Malicious document detection method based on multi-feature fusion and related equipment

Abstract

The invention provides a malicious document detection method based on multi-feature fusion and related equipment. The method comprises the following steps: constructing a PDF document data set with known document categories; performing static analysis and dynamic analysis on each PDF document in the PDF document data set to extract conventional features, structural features and API calling sequence features of the PDF document data set; performing multi-feature fusion on the conventional features, the structural features and the API calling sequence features of the PDF document data set to obtain comprehensive feature representation of the PDF document data set; training a preset malicious document detection network by using the comprehensive feature representation of the PDF document data set to obtain a malicious document detection model; and inputting the comprehensive feature representation of the PDF document to be detected into the malicious document detection model to obtain a detection result. The problem that an existing malicious PDF document detection method is limited to single-type feature analysis or cannot deal with code obfuscation well can be solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious document detection method based on multi-feature fusion and related equipment. Background Art

[0002] With the development of network technology, malicious documents have become one of the main threats to the security of cyberspace, causing serious damage to computer systems and user data. PDF files have become the main attack vector of malware due to their flexibility and widespread use. Attackers can use potential vulnerabilities in these files to perform malicious operations on users' computers, thereby stealing sensitive information, destroying system stability, or conducting other illegal activities. Therefore, strengthening the identification and prevention of malicious PDF documents is of vital importance to maintaining the security and stability of cyberspace.

[0003] There are many technologies for detecting malicious documents. Traditional detection methods mainly rely on signatures and heuristic methods, which are good at identifying malicious code in known virus libraries, but are powerless against viruses that have never appeared. With the development of technology, malicious PDF document detection technology is mainly divided into two directions: static analysis, which focuses on checking the content and structure of the document; dynamic analysis, which observes its behavior by executing the document.

[0004] et al. used the differences in the file structure level to determine the maliciousness of the document. They analyzed the differences in the structured paths between malicious and normal PDF files, thereby revealing the malicious characteristics of the document. Falah et al. evaluated multiple static features of PDF documents through feature engineering, but their work failed to cover the dynamic behavior characteristics of the document during execution, which to some extent limited the comprehensiveness and accuracy of its detection. In addition, the above methods cannot effectively deal with technologies such as code obfuscation.

[0005] As neural networks are widely used in the security field, malicious PDF document detection based on deep learning has gradually emerged. Jeong et al. designed a CNN model that directly takes the raw byte sequence of a PDF document as input to identify and detect malicious attack patterns in it. et al. converted PDF documents into barcode images and used CNN to classify and detect them to identify malicious PDF documents. Some researchers also captured system call information during document execution, constructed a system call graph, and applied a graph convolutional network (GCN) to mine the intrinsic connections between these system calls. Although these methods have made some progress, they often only consider a single type of feature when extracting features. Summary of the invention

[0006] In view of the fact that existing malicious PDF document detection methods are limited to a single type of feature analysis or cannot deal with the problem of code obfuscation well, the present invention aims to provide a malicious document detection method based on multi-feature fusion and related equipment.

[0007] In a first aspect, the present invention provides a malicious document detection method based on multi-feature fusion, comprising:

[0008] Step 1: Construct a PDF document dataset with known document categories; the document categories include benign documents and malicious documents;

[0009] Step 2: Perform static analysis on each PDF document in the PDF document dataset to extract the general features and structural features of the PDF document dataset; perform dynamic analysis on each PDF document in the PDF document dataset to extract the API call sequence features of the PDF document dataset;

[0010] Step 3: Perform multi-feature fusion on the conventional features, structural features, and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset;

[0011] Step 4: Use the comprehensive feature representation of the PDF document dataset to train the preset malicious document detection network to obtain a malicious document detection model;

[0012] Step 5: Input the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain the detection result.

[0013] Furthermore, the malicious document detection model includes two layers of CNN, BiLSTM, CBAM, a fully connected layer and a Softmax classifier;

[0014] Correspondingly, the detection process of the malicious document detection model specifically includes:

[0015] The two-layer CNN extracts local features based on the comprehensive feature representation of the input PDF document;

[0016] BiLSTM extracts contextual semantic features based on the local features output by the two-layer CNN;

[0017] CBAM performs channel weighting and spatial position weighting on the contextual semantic features output by BiLSTM to obtain the final feature vector;

[0018] The final feature vector is processed by the fully connected layer and input into the Softmax classifier to obtain the detection result.

[0019] Furthermore, the conventional features refer to extracted features that are irrelevant to the specific content of the PDF document; and the structural features refer to extracted features that are relevant to the specific content of the PDF document.

[0020] Furthermore, in step 2, the API call sequence features of the PDF document dataset are extracted, specifically including:

[0021] Run and analyze each PDF document using Cuckoo sandbox to extract the API call sequence of each PDF document;

[0022] An n-gram method is used to analyze all API call sequences of each PDF document to generate an API call sequence feature set of each PDF document, wherein the API call sequence feature set includes a plurality of n-gram features;

[0023] For the API call sequence feature set of all PDF documents, n-gram features whose global occurrence frequency is greater than a first set threshold are added to a global list; the global occurrence frequency refers to the occurrence frequency in the PDF document dataset;

[0024] For each PDF document, the following process is performed to obtain its feature list: for the API call sequence feature set of the current PDF document, n-gram features whose local occurrence frequency is greater than a second set threshold are added to the feature list of the current PDF document; the local occurrence frequency refers to the occurrence frequency in the current PDF document;

[0025] For each PDF document, determine whether each n-gram feature in its feature list also belongs to the global list, and assign a value to each n-gram feature based on the judgment result to construct the API call sequence feature of the PDF document dataset.

[0026] In a second aspect, the present invention provides a malicious document detection device based on multi-feature fusion, comprising:

[0027] A data set construction module, used to construct a PDF document data set with known document categories; the document categories include benign documents and malicious documents;

[0028] A feature extraction module is used to perform static analysis on each PDF document in the PDF document dataset to extract conventional features and structural features of the PDF document dataset; and to perform dynamic analysis on each PDF document in the PDF document dataset to extract API call sequence features of the PDF document dataset;

[0029] The feature fusion module is used to perform multi-feature fusion on the conventional features, structural features and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset;

[0030] A training module, used to train a preset malicious document detection network using the comprehensive feature representation of the PDF document data set to obtain a malicious document detection model;

[0031] The detection module is used to input the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain the detection result.

[0032] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0033] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in the first aspect.

[0034] Beneficial effects of the present invention:

[0035] (1) Convolutional neural networks are used to extract key local features of general information, structural information, and API sequence information in PDF documents. Bidirectional long short-term memory networks are introduced to deeply explore the interdependence between features and capture contextual semantic relationships. In order to enhance the expressiveness of features, a convolutional block attention module is integrated into the model, which can dynamically assign weights to different features to select the most discriminative key features. Finally, the model classifies and detects documents through a Softmax classifier, achieving efficient identification of malicious PDF documents.

[0036] (2) The model was comprehensively evaluated on the Evasive-PDFMal2022 dataset. The experimental results show that compared with traditional machine learning and deep learning-based methods, the model of the present invention has improved key performance indicators such as accuracy, precision, F1 score, and recall rate, and achieved the lowest false alarm rate. Compared with the existing methods, the model of the present invention has more obvious advantages in performance, which further verifies the effectiveness and superiority of the method of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 One of the flow charts of a malicious document detection method based on multi-feature fusion provided by an embodiment of the present invention;

[0038] Figure 2 A second flow chart of a malicious document detection method based on multi-feature fusion provided by an embodiment of the present invention;

[0039] Figure 3A structural diagram of a BiLSTM network model provided in an embodiment of the present invention;

[0040] Figure 4 The CBAM attention mechanism provided by the embodiment of the present invention;

[0041] Figure 5 A channel attention mechanism provided for an embodiment of the present invention;

[0042] Figure 6 A spatial attention mechanism provided for an embodiment of the present invention;

[0043] Figure 7 A schematic diagram of the structure of a malicious document detection device based on multi-feature fusion provided by an embodiment of the present invention;

[0044] Figure 8 A structural block diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] like Figure 1 As shown, an embodiment of the present invention provides a malicious document detection method based on multi-feature fusion, including:

[0047] S101: Constructing a PDF document dataset with known document categories; the document categories include benign documents and malicious documents;

[0048] S102: performing static analysis on each PDF document in the PDF document dataset to extract conventional features and structural features of the PDF document dataset; performing dynamic analysis on each PDF document in the PDF document dataset to extract API call sequence features of the PDF document dataset;

[0049] Specifically, the PDFMalyzer tool can be used to extract general information and structural information from PDF documents. The PDF document can be executed through the Cuckoo sandbox to obtain a dynamic behavior report of the sample. The dynamic behavior report includes key information such as API calls and registry modifications during the execution process. Therefore, API call sequence information can be extracted from the dynamic behavior report.

[0050] It can be understood that, in this embodiment, conventional features cover the basic information of the PDF document, such as file size, version, number of pages and title, etc., and do not involve the specific content of the document; while structural features pay more attention to the specific content in the file, mainly including the number of stream objects, the number of JavaScript and JS keywords, the number of embedded objects, etc. These features are crucial for identifying and analyzing malicious code, discovering hidden objects or potential malicious operations.

[0051] S103: performing multi-feature fusion on conventional features, structural features, and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset;

[0052] S104: training a preset malicious document detection network using the comprehensive feature representation of the PDF document dataset to obtain a malicious document detection model;

[0053] S105: Input the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain a detection result.

[0054] The malicious document detection method based on multi-feature fusion provided by the embodiment of the present invention not only integrates the general information and structural information extracted from static analysis, but also combines the API sequence information captured by dynamic analysis to construct a comprehensive and multi-dimensional feature set; wherein, the general information has wide applicability, the structural information can reflect the correlation between objects in the PDF document, and the API call sequence information reflects the behavior of the malicious code; by integrating the characteristics of each feature, the interference of code obfuscation and shell technology on the detection process can be reduced, the dependency relationship in the sequence information can be deeply studied, and finally the effective detection of malicious PDF documents can be achieved.

[0055] In one embodiment, 31 features are extracted through static analysis of PDF documents, including 10 conventional features and 21 structural features. Table 1 lists some feature names and security relevance.

[0056] Table 1 Security relevance of general characteristics

[0057]

[0058] Understandably, PDF documents often use object-level obfuscation techniques, using filters to transform object stream data and hide embedded JS code. PDF supports a variety of filters, such as for decoding arbitrary 8-bit data encoded as ASCII text ( / ASCII85DECODE, / ASCIIHEXDECODE), decompressing images ( / CCITTFAXDECODE, / JBIG2DECODE, / DCTDECODE, / JPXDECODE), decompressing arbitrary data ( / LZWDECODE, / FLATEDECODE, / RUNLENGTHDECODE), and document-level security processors ( / CRYPT). Attackers can cleverly combine these filters to cover up the traces of JavaScript code. For example, they may use filter abbreviations ( / Fl instead of / FLATEDECODE), obfuscated code ( / O#70e#6e#41c#74i#6fn instead of / OpenAction, / #52UN#4CE#6E#67T#68DECODE instead of / RUNLENGTHDECODE), and so on. Therefore, in order to better solve the problems of code packing, obfuscation, and difficulty in locating JavaScript code, it is necessary to extract the API call sequence information of the PDF document. The inventor has also found through research that attackers often use the same API set when conducting malicious activities. Therefore, the existence of API call sequence information in the analysis report alone is not enough to determine the maliciousness of a PDF document. Therefore, in order to better solve this problem, this embodiment also designs a method for selecting key API call sequence features, which specifically includes the following steps:

[0059] S201: Run and analyze each PDF document using Cuckoo sandbox to extract the API call sequence of each PDF document;

[0060] S202: Analyze all API call sequences of each PDF document using an n-gram method to generate an API call sequence feature set of each PDF document, wherein the API call sequence feature set includes a plurality of n-gram features;

[0061] S203: for the API call sequence feature set of all PDF documents, adding n-gram features whose global occurrence frequency is greater than a first set threshold to a global list; the global occurrence frequency refers to the occurrence frequency in the PDF document dataset;

[0062] S204: For each PDF document, the following process is performed to obtain its feature list: for the API call sequence feature set of the current PDF document, n-gram features whose local occurrence frequency is greater than a second set threshold are added to the feature list of the current PDF document; the local occurrence frequency refers to the occurrence frequency in the current PDF document;

[0063] S205: For each PDF document, determine whether each n-gram feature in its feature list also belongs to the global list, and assign a value to each n-gram feature according to the determination result to construct an API call sequence feature of the PDF document dataset.

[0064] In this embodiment, corresponding algorithm pseudo code is also provided, as shown in Table 2.

[0065] Table 2 Dynamic feature extraction and selection

[0066]

[0067]

[0068] Given that the similarity of API call sequences between similar files is higher than that between non-similar files, first, the embodiment of the present invention adopts the n-gram method to analyze the API call sequence, generates the API call sequence feature set of each PDF document, recorded as API-Call-grams, and sorts them according to the frequency of occurrence. Next, a global list containing all API-Call-grams is constructed, and sorted again according to the frequency, while deleting the items with lower frequency. Finally, a feature vector is created and assigned a value based on whether the API-Call-gram of a specific PDF document appears in the global list.

[0069] Finally, this embodiment screened 800 n-gram features to construct a feature vector. The features obtained from static analysis were combined with the features obtained from dynamic analysis to generate a feature vector with a length of 831, which combined features from different sources and provided a comprehensive feature representation for the detection of malicious documents.

[0070] In order to better address the problem that existing malicious PDF document detection methods ignore the semantic relationship between features, in one embodiment, Figure 2 As shown, an embodiment of the present invention provides a structure of a malicious document detection network, including two layers of CNN, BiLSTM, CBAM, a fully connected layer and a Softmax classifier.

[0071] Correspondingly, the detection process of the malicious document detection model obtained based on the network training specifically includes: two-layer CNN extracts local features based on the comprehensive feature representation of the input PDF document; BiLSTM extracts contextual semantic features based on the local features output by the two-layer CNN; CBAM performs channel weighting and spatial position weighting on the contextual semantic features output by BiLSTM to obtain the final feature vector; the final feature vector is processed by the fully connected layer and input into the Softmax classifier to obtain the detection result.

[0072] Specifically, in the research and application of deep learning, CNN has become a widely used model. Compared with other deep learning architectures, CNN usually requires fewer parameters, which means that the training process is more efficient and takes less time. CNN is mainly composed of convolutional layers, pooling layers, and fully connected layers. In an embodiment of the present invention, a two-layer CNN model is used to extract local features of the preprocessed input vector, and the feature dimension is further reduced through the maximum pooling layer, while retaining important texture information. This structure not only enhances the expressive power of features, but also helps to reduce the complexity of the model and improve training efficiency.

[0073] As a derivative model of RNN, LSTM can selectively retain key information and forget secondary information through its unique memory unit design. This mechanism effectively solves the common gradient vanishing or gradient exploding problems of traditional RNN during training. In addition, by introducing a gating mechanism, LSTM effectively improves the network's ability to capture long-term dependencies when processing long sequence data. BiLSTM is an extension of LSTM, which consists of two LSTMs: a forward LSTM, from the beginning to the end of the sequence; and a backward LSTM, from the end to the beginning of the sequence. This design enables BiLSTM to simultaneously consider the contextual information of the sequence, thereby more comprehensively extracting the semantic features of the context and effectively capturing long-distance dependencies. Figure 3 The network structure of BiLSTM is shown.

[0074] There is often a certain correlation between the general information and sequence information in malicious documents. This information not only maps the behavior of the document when it is running, but is also closely related to its previous and subsequent states. CNN has significant advantages in extracting local features of general information and sequence information, but it has limitations in identifying and processing long-distance dependencies in sequence data. In contrast, BiLSTM can deeply analyze the interdependence between features and capture rich contextual semantic relationships, effectively solving the long-distance dependency problem that CNN is difficult to handle. Therefore, this embodiment combines CNN and BiLSTM to form a CNN-BiLSTM model, which can give full play to the advantages of their respective neural network models. In the CNN-BiLSTM architecture, feature extraction is first performed through the CNN layer, and then these feature vectors are sent to the BiLSTM layer to capture the contextual information in the sequence. However, not all features are equally important to the final detection task. Therefore, introducing the CBAM (Convolutional Block Attention Module) module after the output of the BiLSTM layer can further enhance the model's ability to identify and utilize key features, and effectively improve the network's attention to important features. CBAM consists of two key components: a channel attention module and a spatial attention module. The CBAM module first weights each channel of the feature through the channel attention module to emphasize the importance of different channels. Then, the spatial attention module weights the spatial position of the feature to highlight or ignore different spatial regions. The combination of these two steps enables CBAM to focus on the key information in the input data comprehensively and meticulously, thereby improving the accuracy and robustness of the model. Compared with the Attention mechanism, the CBAM module has the ability to dynamically adjust the weights of feature maps, which helps the network focus more on key features while reducing the interference of redundant information. The CBAM structure is as follows: Figure 4 shown.

[0075] Channel attention module such as Figure 5 As shown, the formula is as follows:

[0076]

[0077] Where W0 and W1 are the weights of the multi-layer perceptron (MLP), and They represent the average pooling feature and the maximum pooling feature respectively, and σ represents the Sigmoid function.

[0078] The spatial attention module is as follows Figure 6 As shown, the formula is as follows:

[0079]

[0080] where f(7×7) Represents the convolution kernel size.

[0081]

[0082] in, represents element-by-element addition, Stands for element-wise multiplication.

[0083] In this embodiment, a feature vector with a length of 831 is input into a two-layer CNN, the number of convolution kernels is set to 128, and the ReLU activation function is used after the convolution layer; the number of neurons in the forward and backward directions of the BiLSTM model is set to 128. In order to prevent the model from overfitting, a dropout layer is introduced into the network, and the dropout ratio is set to 40% to regularize the model and improve its generalization ability. Finally, the vector obtained by the CBAM attention mechanism is input into the Softmax classifier to obtain the final classification result, thereby completing the malicious PDF document detection task.

[0084] The malicious document detection method provided by the embodiment of the present invention applies the CNN-BiLSTM-CBAM model and multi-feature fusion to malicious PDF document detection, which not only integrates the conventional information and structural information extracted from static analysis, but also combines the API sequence information captured by dynamic analysis to construct a comprehensive and multi-dimensional feature set. The model first uses a convolutional neural network to extract local features in the feature set; secondly, it uses a bidirectional long short-term memory network (BiLSTM) to capture the dependency and contextual semantic relationship features between features, and assigns different weights to different features through a convolutional block attention module (CBAM) to screen out the most discriminative key features; finally, the Softmax classifier is used to calculate the detection results. The experimental results show that compared with the existing methods, the model proposed in this paper shows significant advantages in key performance indicators such as accuracy, recall rate, and F1 score, effectively improving the detection performance of malicious PDF documents, and can well deal with the problems that the existing malicious PDF document detection methods ignore the semantic relationship between features and are often limited to a single type of feature analysis.

[0085] like Figure 7 As shown, an embodiment of the present invention provides a malicious document detection device based on multi-feature fusion, including a data set construction module, a feature extraction module, a feature fusion module, a training module and a detection module.

[0086] Among them, the dataset construction module is used to construct a PDF document dataset with known document categories; the document categories include benign documents and malicious documents; the feature extraction module is used to perform static analysis on each PDF document in the PDF document dataset to extract the general features and structural features of the PDF document dataset; and to perform dynamic analysis on each PDF document in the PDF document dataset to extract the API call sequence features of the PDF document dataset; the feature fusion module is used to perform multi-feature fusion on the general features, structural features and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset; the training module is used to train a preset malicious document detection network using the comprehensive feature representation of the PDF document dataset to obtain a malicious document detection model; the detection module is used to input the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain a detection result.

[0087] It should be noted that the malicious document detection device provided in the embodiment of the present invention is to implement the above method. Its specific functions can be referred to the above method embodiment, which will not be repeated here.

[0088] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802 and the memory 503 communicate with each other through the communication bus 804. The processor 801 may call the logic instructions in the memory 803 to execute the malicious document detection method, which includes: constructing a PDF document data set with known document categories; the document categories include benign documents and malicious documents; statically analyzing each PDF document in the PDF document data set to extract the conventional features and structural features of the PDF document data set; dynamically analyzing each PDF document in the PDF document data set to extract the API call sequence features of the PDF document data set; performing multi-feature fusion on the conventional features, structural features and API call sequence features of the PDF document data set to obtain a comprehensive feature representation of the PDF document data set; training a preset malicious document detection network using the comprehensive feature representation of the PDF document data set to obtain a malicious document detection model; inputting the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain a detection result.

[0089] In addition, when the logic instructions in the above-mentioned memory 803 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0090] An embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: constructing a PDF document dataset with known document categories; the document categories include benign documents and malicious documents; statically analyzing each PDF document in the PDF document dataset to extract conventional features and structural features of the PDF document dataset; dynamically analyzing each PDF document in the PDF document dataset to extract API call sequence features of the PDF document dataset; performing multi-feature fusion on the conventional features, structural features and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset; using the comprehensive feature representation of the PDF document dataset to train a preset malicious document detection network to obtain a malicious document detection model; inputting the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain a detection result.

[0091] An embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method provided by the above-mentioned method embodiments is implemented, for example, including: constructing a PDF document data set with known document categories; the document categories include benign documents and malicious documents; statically analyzing each PDF document in the PDF document data set to extract conventional features and structural features of the PDF document data set; dynamically analyzing each PDF document in the PDF document data set to extract API call sequence features of the PDF document data set; performing multi-feature fusion on the conventional features, structural features and API call sequence features of the PDF document data set to obtain a comprehensive feature representation of the PDF document data set; training a preset malicious document detection network using the comprehensive feature representation of the PDF document data set to obtain a malicious document detection model; inputting the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain a detection result.

[0092] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A malicious document detection method based on multi-feature fusion, characterized in that: include: Step 1: Construct a PDF document dataset with known document categories; the document categories include benign documents and malicious documents; Step 2: Perform static analysis on each PDF document in the PDF document dataset to extract general features and structural features of the PDF document dataset; Dynamically analyze each PDF document in the PDF document dataset to extract the API call sequence features of the PDF document dataset; Step 3: Perform multi-feature fusion on the conventional features, structural features, and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset; Step 4: Use the comprehensive feature representation of the PDF document dataset to train the preset malicious document detection network to obtain a malicious document detection model; Step 5: Input the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain the detection result.

2. According to claim 1, a malicious document detection method based on multi-feature fusion is characterized in that: The malicious document detection model includes two layers of CNN, BiLSTM, CBAM, fully connected layer and Softmax classifier; Correspondingly, the detection process of the malicious document detection model specifically includes: The two-layer CNN extracts local features based on the comprehensive feature representation of the input PDF document; BiLSTM extracts contextual semantic features based on the local features output by the two-layer CNN; CBAM performs channel weighting and spatial position weighting on the contextual semantic features output by BiLSTM to obtain the final feature vector; The final feature vector is processed by the fully connected layer and then input into the Softmax classifier to obtain the detection result.

3. According to claim 1, a malicious document detection method based on multi-feature fusion is characterized in that: The conventional features refer to extracted features that are irrelevant to the specific content of the PDF document; the structural features refer to extracted features that are relevant to the specific content of the PDF document.

4. According to claim 1, a malicious document detection method based on multi-feature fusion is characterized in that: In step 2, the API call sequence features of the PDF document dataset are extracted, including: Run and analyze each PDF document using Cuckoo sandbox to extract the API call sequence of each PDF document; An n-gram method is used to analyze all API call sequences of each PDF document to generate an API call sequence feature set of each PDF document, wherein the API call sequence feature set includes a plurality of n-gram features; For the API call sequence feature set of all PDF documents, n-gram features whose global occurrence frequency is greater than a first set threshold are added to a global list; the global occurrence frequency refers to the occurrence frequency in the PDF document dataset; For each PDF document, the following process is performed to obtain its feature list: for the API call sequence feature set of the current PDF document, n-gram features whose local occurrence frequency is greater than a second set threshold are added to the feature list of the current PDF document; the local occurrence frequency refers to the occurrence frequency in the current PDF document; For each PDF document, determine whether each n-gram feature in its feature list also belongs to the global list, and assign a value to each n-gram feature based on the judgment result to construct the API call sequence feature of the PDF document dataset.

5. A malicious document detection device based on multi-feature fusion, characterized in that: include: A data set construction module, used to construct a PDF document data set with known document categories; the document categories include benign documents and malicious documents; A feature extraction module is used to perform static analysis on each PDF document in the PDF document dataset to extract conventional features and structural features of the PDF document dataset; and dynamically analyzing each PDF document in the PDF document dataset to extract API call sequence features of the PDF document dataset; The feature fusion module is used to perform multi-feature fusion on the conventional features, structural features and API call sequence features of the PDF document dataset to obtain a comprehensive feature representation of the PDF document dataset; A training module, used to train a preset malicious document detection network using the comprehensive feature representation of the PDF document data set to obtain a malicious document detection model; The detection module is used to input the comprehensive feature representation of the PDF document to be tested into the malicious document detection model to obtain the detection result.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 4 is implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images