Malicious code detection model security evaluation method based on API sequence feature reconstruction

Abstract

The invention discloses a malicious code detection model security assessment method based on API sequence feature reconstruction, and belongs to the technical field of software security. The method focuses on the defect of a malicious code detection model, constructs a large-scale sample set for the malicious code detection model using an API sequence as a feature, extracts the API sequence from the sample set, and constructs a fitting model of a to-be-detected model by using the API sequence as an input of the model after feature engineering processing. The features are explained through a model explaining algorithm, the influence of all the features on a model classification result is analyzed, the black features are beneficial for the model to classify samples as malicious, and the white features are beneficial for the model to classify the samples as benign. On the premise that original functions of samples are not changed, black features are tried to be destroyed by using a binary rewriting method in which new nodes are inserted, and test samples are generated and used for evaluating the safety of the model. According to the method, the security of the malicious code detection model can be effectively verified, and reinforcement and repair of the malicious code detection model are assisted.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security, and in particular relates to security evaluation of malicious code detection models. Background Art

[0002] Malware is an important factor threatening network security. Traditional detection methods rely on manual analysis or rule matching. However, tens of thousands of new malware are added every day, and variants are frequent. Traditional methods can no longer effectively cope with the detection needs of malicious code. In this context, the introduction of machine learning models provides an automated solution for malware detection, greatly improving detection efficiency. However, since the malicious code detection model only relies on input features for judgment and lacks experience judgment in manual analysis, it is easily affected by disguised or obfuscated data, resulting in certain challenges to its security. This method proposes a security assessment method for API feature machine learning models based on binary rewriting. For the malicious code detection model using the dynamic feature of API sequence, a method combining feature interpretation and binary rewriting is used to confuse the specified features and generate a new binary file that retains the original function. By comparing the classification results of the target malicious code detection model before and after the binary file is modified, it is evaluated whether the model has security issues. Summary of the invention

[0003] The purpose of the present invention is to provide a malicious code detection model security assessment method based on API sequence feature reconstruction to verify whether the target malicious code detection model has security issues, so as to solve the problem that the malicious code detection model has poor robustness but is difficult to assess security.

[0004] To achieve the above purpose, the specific technical solutions of the present invention are as follows:

[0005] A malicious code detection model security assessment method based on API sequence feature reconstruction includes the following steps:

[0006] Step 1: Collect malicious and benign samples, build a large-scale data set, and perform feature extraction. Run the samples in a sandbox and extract the sample's API sequence from the result report. After API sequence segmentation and feature engineering, generate data that can be directly used as input for the malicious code detection model.

[0007] Step 2: Use the data generated in the previous step as the input of the malicious code detection model, train the fitting model of the model to be detected, and use the model to simulate the model to be detected.

[0008] Step 3: Based on the feature interpretation algorithm, analyze the features of the machine learning model to be verified in the previous step, evaluate the importance of each feature, and determine the white features and black features. White features help the model classify samples as benign, while black features tend to classify samples as malicious.

[0009] Step 4: Reconstruct features based on the binary rewriting method. Without changing the original function of the sample, destroy the black features analyzed in the previous step in the malicious sample to generate a detection sample. The detection sample is used to prove whether there is a security problem in the malicious code detection model.

[0010] Furthermore, in step 1, the API sequence segmentation: uses the N-gram algorithm to separate the continuous API sequence into subsequences of fixed size. The feature engineering: uses the API subsequences segmented from the API sequence as the column names of the feature matrix, calculates the TF-IDF value of each API subsequence, and TF-IDF represents the importance of a single API subsequence in the entire report set, directly as the input of the malicious code detection model, uses the feature matrix as the input of the model, trains the fitting model of the malicious code detection model to be detected, and performs optimization.

[0011] Furthermore, the feature interpretation described in step three determines the impact of each feature on the classification results of the machine learning model, locates the black features that cause the model to classify the samples as malicious, and generates samples to test the security of the malicious code detection model by accurately destroying the black features. The test samples are used to verify the security of the malicious code detection model.

[0012] Furthermore, the feature reconstruction based on the binary rewriting method described in step 4 can modify the sample without the sample source code and will not destroy the original function of the sample. Through the binary rewriting method, the white feature API is inserted in the middle of the located black feature API sequence to achieve the effect of destroying the black feature. The sample generated by the binary rewriting contains the original malicious function, and the black feature is accurately destroyed to generate a test sample for evaluating the security of the model.

[0013] Furthermore, the binary rewriting method of the present invention comprises the following steps:

[0014] (1) Modify the import table

[0015] Analyze the import table of the malicious file to understand its existing API calls. The import table records the dynamic link library (DLL) and its export functions that the binary file needs to load at runtime. Insert white features into the malicious file, modify the import table of the binary file, select the appropriate white feature API based on the feature interpretation results and add it to the import table.

[0016] Modifying the import table involves three steps: first, add a new DLL entry. If the white feature API to be called is located in the new DLL, add the corresponding DLL entry in the import table; second, under the existing or newly added DLL entry, add the call entry of the white feature API. These entries should contain the name of the API and the corresponding address; finally, after modifying the import table, the header information and other related structures of the binary file need to be updated to ensure the integrity and executableness of the file.

[0017] (2) Positioning black features

[0018] According to the result of feature interpretation, the black feature API sequence that needs to be accurately located is selected and located in the malicious binary file. The control flow graph (CFG) of the malicious binary file is deeply analyzed using the control flow analysis method to identify the specific instructions that call the black feature API sequence. The identified and located instructions that call the black feature API sequence and their context information are recorded, including but not limited to the address of the instruction and the name of the API called;

[0019] (3) Add a new section and fill in the new section content

[0020] Add a new section at the end of the malicious binary file. The new section contains a jump table, an inserted white feature API, and the black feature API originally included in the file. The jump table contains the original address of the instruction and the target address to jump to. Replace the located black feature API call instruction with a Call instruction. The target address to which the Call instruction jumps is the starting address of the new section. After jumping to the starting point of the new section, the jump table is queried to match the jump target address, and further jumps to the specific instruction of the new section for execution.

[0021] After jumping to the specific instructions of the new section, the inserted white feature API is executed first, and then the replaced original API call instructions are called, which effectively realizes special reconstruction.

[0022] The present invention has the following advantages:

[0023] (1) Constructing a large-scale sample set and feature matrix: The large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples, wherein the malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from the official software market, and the samples are confirmed to have no malicious behavior through detection by antivirus software. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples, from which the API sequence can be extracted as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated.

[0024] (2) Model interpretation and feature analysis: A series of model interpretation algorithms are used to conduct in-depth analysis of the malicious code detection model. These interpretation algorithms can reveal the specific impact of each feature on the classification results. By analyzing the results of the interpretation algorithm, black features and white features can be accurately located.

[0025] (3) Feature reconstruction based on binary rewriting method: Rewrite the malicious binary file without destroying the original function of the malicious file. Locate the black features in the file, insert the white feature API in the middle of the black feature API sequence, destroy the black features, and achieve feature reconstruction. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of the scheme of the present invention;

[0027] Figure 2 It is a feature extraction flow chart of the present invention;

[0028] Figure 3 It is a flow chart of the binary rewriting method of the present invention;

[0029] Figure 4 It is a schematic diagram of instruction replacement and modification of the present invention;

[0030] Figure 5 It is a schematic diagram of instruction reconstruction of the present invention;

[0031] Figure 6 The API call information in the JSON report of the present invention;

[0032] Figure 7 It is the Shapley value distribution diagram of the present invention;

[0033] Figure 8 Add the white feature API function to the import table of the present invention;

[0034] Fig. 9 This is the binary rewriting method of the present invention. DETAILED DESCRIPTION

[0035] In order to better understand the purpose, technical solution and function of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings, but the present invention can be implemented in a variety of different ways as defined and covered by the claims. The accompanying drawings constituting a part of this application are used to provide a further understanding of the present invention, and the exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention.

[0036] like Figure 1 As shown, the method flow chart of the present invention.

[0037] The method of the present invention comprises the following steps:

[0038] (I) Collect malicious and benign samples, build large-scale datasets, and perform feature extraction

[0039] The large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples, wherein the malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from the official software market, and the samples are confirmed to have no malicious behavior through detection by antivirus software. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples, from which the API sequence can be extracted as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated. The feature matrix is ​​used as the input of the model to train the fitting model of the malicious code detection model to be detected.

[0040] (II) Training the malicious code detection model and fitting the target model to be verified

[0041] The malicious code detection model of the present invention uses the API sequence called by the sample during execution as a feature, and by analyzing these API sequences, potential malicious behaviors can be accurately identified. The model uses a common machine learning model algorithm, including but not limited to decision trees, random forests, gradient boosting trees (such as XGBoost and LightGBM), support vector machines (SVMs), and deep neural networks (such as convolutional neural networks CNN and recurrent neural networks RNN). Through cross-validation and hyperparameter tuning, the trained malicious code detection model has a high classification accuracy and can fit the target model.

[0042] (III) Interpret the features of the model and locate black and white features

[0043] Based on the feature interpretation algorithm, the features of the fitted malicious code detection model are analyzed, the importance of each feature is evaluated, and white features and black features are determined. Among them, white features help the model classify samples as benign, while black features are more inclined to classify samples as malicious.

[0044] (IV) Reconstructing features based on binary rewriting method

[0045] Using the binary rewriting method, by locating the black feature API sequence in the feature interpretation result, the white feature API is inserted in the middle of the black feature API sequence to destroy the black features in the malicious sample, realize feature reconstruction, generate test samples, and complete the security assessment of the malicious code detection model.

[0046] The technical solution of the present invention is further described below:

[0047] In step (a), the large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples, wherein the malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from the official software market, and the samples are confirmed to have no malicious behavior through detection by antivirus software. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples, from which the API sequence can be extracted as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated. The details of API sequence segmentation and feature engineering are as follows:

[0048] A. API sequence segmentation: Use the N-gram algorithm to separate continuous API sequences into subsequences of fixed size;

[0049] B. Feature Engineering: Use the API subsequences obtained by segmenting the API sequence as the column names of the feature matrix, and calculate the TF-IDF value of each API subsequence. TF-IDF is a statistical method commonly used in information retrieval and natural language processing, which can indicate the importance of a single API subsequence in the entire report set. TF-IDF is in numerical form and can be directly used as the input of the malicious code detection model. Use the feature matrix as the input of the model, train the fitting model of the malicious code detection model to be detected, and perform optimization.

[0050] The API feature extraction process is as follows: Figure 2 shown.

[0051] In step (ii), the advantage of the model is automation and intelligence. Traditional malicious code detection methods often rely on signature matching and rule engines, which are vulnerable to attacks by variant malicious codes. The model of the present invention can identify the characteristics of new malicious codes by learning a large amount of historical data, thereby greatly improving the coverage and accuracy of detection. The present invention uses the trained malicious code detection model as the target of security assessment.

[0052] In step (iii), the present invention uses explanation techniques such as SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations). These techniques quantify the impact of features on the final classification results by calculating the contribution value of each feature. In this way, features can be divided into two categories: white features and black features.

[0053] A. White features: These features help the model classify samples as benign. They usually represent normal, harmless behavior patterns, such as common file operations, network requests, etc. The presence of white features can enhance the model's confidence in benign samples and reduce the false positive rate.

[0054] B. Black features: These features tend to classify samples as malicious. They usually indicate abnormal and potentially harmful behavior patterns, such as abuse of system permissions, read and write operations on sensitive files, etc. The presence of black features can significantly increase the probability that the model will classify samples as malicious.

[0055] By interpreting and analyzing the features of malicious code detection models, we can understand which features play a key role in the model's decision-making, discover potential feature reconstructions and other attack methods, accurately make security assessments of the model, and provide a basis for formulating more effective defense strategies.

[0056] In step (iv), the binary rewriting method locates the black feature API sequence in the feature interpretation result, and uses the method of inserting the white feature API in the middle of the black feature API sequence to destroy the black features in the malicious sample, realize feature reconstruction, and generate test samples. The test samples can evaluate the security of the model. The binary rewriting method can be divided into three steps: modifying the import table, locating the black features, and adding new sections and filling in the new section content. The overall process of binary rewriting is as follows: Figure 3 shown.

[0057] The binary rewriting method of the present invention is mainly divided into the following steps:

[0058] (1) Modify the import table

[0059] Analyze the import table of the malicious file to understand its existing API calls. The import table records the dynamic link library (DLL) and its export functions that the binary file needs to load at runtime. In order to insert white features into the malicious file, it is necessary to modify the import table of the binary file, select the appropriate white feature API based on the feature interpretation results and add it to the import table. The selected white feature API should not conflict with the existing functions of the malicious file to ensure that the inserted file can still run normally.

[0060] Modifying the import table involves three steps. First, add a new DLL entry. If the white feature API to be called is located in the new DLL, add the corresponding DLL entry in the import table. Second, add the call entry of the white feature API under the existing or newly added DLL entry. These entries should contain the name of the API and the corresponding address. Finally, after modifying the import table, the header information and other related structures of the binary file need to be updated to ensure the integrity and executableness of the file, which includes adjusting the file size, correcting the offset, etc.

[0061] (2) Positioning black features

[0062] According to the results of feature interpretation, the black feature API sequence that needs to be accurately located is selected and located in the malicious binary file. The control flow graph (CFG) of the malicious binary file is deeply analyzed using the control flow analysis method. The control flow graph shows the execution path and branch structure of the program. By analyzing the control flow graph, the instructions that specifically call the black feature API sequence can be identified. The identified and located instructions that call the black feature API sequence and their context information are recorded, including the address of the instruction, the name of the called API, etc., for subsequent feature reconstruction and processing.

[0063] (3) Add a new section and fill in the new section content

[0064] Add a new section at the end of the malicious binary file. The new section contains a jump table, the inserted white feature API, and the black feature API originally included in the file. The jump table contains the original address of the instruction and the target address to jump to. Replace the located black feature API call instruction with a Call instruction. The target address that the Call instruction jumps to is the starting address of the new section. After jumping to the beginning of the new section, the jump table is queried to match the jump target address, and then further jumps to the specific instruction of the new section for execution. The replacement and modification of instructions are as follows: Figure 4 shown.

[0065] After jumping to the specific instructions of the new section, the inserted white feature API is executed first, and then the replaced original API call instruction is called. This operation inserts the white feature API in the middle of the black feature API sequence while ensuring that the original API execution, that is, the original function, is not changed, thereby destroying the original black feature and effectively realizing special reconstruction. After the original API call instruction is executed, the instruction address pushed into the stack is popped out through the ret instruction. This address is the address of the next instruction of the replaced call instruction, and the control flow returns to the code section of the program to continue executing the subsequent original functions to ensure the integrity of the function. The process of instruction reconstruction is as follows: Figure 5 shown.

[0066] Core invention principle:

[0067] (1) Dataset construction and feature extraction principles

[0068] Collect a large number of malicious and benign samples to form a data set. Execute the samples in a sandbox to obtain a sandbox report containing static and dynamic execution information of the samples. From the sandbox report, you can extract the APIs called during sample execution as features of the malicious code detection model. Feature engineering can split the textual API sequence and express it in numerical form. The generated feature matrix can be used as the input of the malicious code detection model.

[0069] (2) Principles of feature interpretation

[0070] Feature interpretation is a technique used to understand the decision-making process of machine learning models, which can reveal the specific impact of each feature on the model's prediction results. Model interpretation algorithms can quantify the contribution of each feature to the model's prediction results through different methods. Features can be divided into white features and black features according to their impact on the model's prediction results. White features help the model classify samples as benign. They usually represent normal, harmless behavior patterns, such as common file operations, network requests, etc. Black features are more likely to classify samples as malicious. They usually represent abnormal, potentially harmful behavior patterns, such as abuse of system permissions, read and write operations of sensitive files, etc. The presence of black features can significantly increase the probability that the model will classify samples as malicious samples. By analyzing the black features of the model, it is possible to accurately locate the black features to implement damage, and observe the classification accuracy of the model before and after the damage to evaluate the security of the model.

[0071] (3) Principle of binary rewriting method

[0072] The binary rewriting method can reconstruct the features of malicious files without destroying their original functions, thus avoiding detection by malicious code detection models. A new section is inserted at the end of the file, and the inserted white features and the original API call instructions are executed in the new section. After the execution is completed, the execution will jump to the next instruction of the original instruction, thus achieving instruction reconstruction while retaining the original functions of the malicious file.

[0073] Based on the above description, compared with the prior art, the present invention improves the detection efficiency of malicious code and can better perform security assessment on the malicious code detection model.

[0074] Example 1

[0075] Taking the sample e5aaaad4bbf22ea5c732a638fb16050497ab6d90c759eca2c05759e2cc482404 as an example, the security assessment process of the malicious code detection model is introduced.

[0076] 1. Dataset construction and feature preprocessing

[0077] Malicious samples were collected from the official VirusShare website, and benign samples were collected from the official software market. The samples were filtered by antivirus software to further confirm that the collected benign samples had no malicious behavior. The final dataset contains 20,000 malicious samples and 20,000 benign samples.

[0078] Use Cuckoo sandbox to run the sample and collect the JSON report generated by the sandbox about the sample running results. The JSON report generated by Cuckoo sandbox records in detail the running behavior of the sample in a controlled environment. The report includes basic information of the task (such as task ID, sample file name, hash value, file size and type, analysis time), behavior analysis (such as process information, API calls, registry operations, file operations, network activities, memory operations), static analysis (such as PE file information, printable strings), signature analysis (such as malicious behavior signatures, threat classification), and additional information (such as log information, screenshots, network traffic data). This information helps security analysts fully understand the running behavior of the sample, identify potential malicious activities, and take corresponding protective measures. Extract the API called by the sample during operation from the JSON report. The API call information recorded in the JSON report is as follows: Figure 6 shown.

[0079] After extracting the API call information, use the N-gram algorithm to separate the continuous API sequence into subsequences of fixed size. In this example, N is set to 1 or 2, that is, each API subsequence after segmentation contains 1 or 2 APIs. Then, the API subsequences segmented from the API sequence are used as the column names of the feature matrix, and the TF-IDF value of each API subsequence is calculated. In the generated feature matrix, each row represents a sample file, each column represents a segmented API subsequence, and the value of the matrix is ​​the calculated TF-IDF value.

[0080] 2. Model training

[0081] The feature matrix generated by preprocessing is used as the input of the model, and the general XGBoost machine learning algorithm is selected to train the malicious code detection model. XGBoost is a machine learning algorithm based on gradient boosting decision trees. It has a variety of optimization techniques and flexible configuration options, and is particularly suitable for processing large-scale data sets and complex prediction tasks. Adjust the parameters of the model, such as the depth of the tree and the minimum number of samples contained in the leaf nodes, to improve the classification accuracy of the model.

[0082] 3. Feature explanation

[0083] The SHAP algorithm is used to calculate the Shapley value for each feature in XGBoost. At the same time, the Shapley value distribution of the entire sample is plotted by combining its label and using the overall distribution graph tool in the SHAP interpretation model. The Shapley value generated by the SHAP algorithm is a method based on game theory that reflects the average impact of a feature on the model's prediction results in all possible scenarios, helping users understand the specific contribution of each feature to the model's decision. The Shapley value can be used to intuitively show which features have the greatest impact on the model's prediction results, thereby improving the transparency and interpretability of the model. The Shapley value distribution graph generated by the SHAP algorithm is shown below: Figure 7 shown.

[0084] Determine black features and white features according to the SHAP algorithm. Figure 7 The distribution of each sample can be seen in the figure. Each point in the figure represents a sample. The vertical axis represents each API N-gram. The total number of samples in each row is consistent. The horizontal axis represents the Shapley value of the sample. A positive Shapley value represents a positive effect on the prediction result, and a negative Shapley value represents a negative effect on the prediction result. The color of each point in the figure represents the sample feature value. The more red the color, the larger the feature value, and the more blue the color, the smaller the feature value. By observing the distribution diagram, it can be found that the 2-gram feature "CoUninitialize NtClose" in the figure will significantly affect the prediction result. All blue sample points are concentrated in the area where the Shapley value is greater than zero, while all red sample points are in the area where the SHAP value is less than zero, so it is a typical white feature.

[0085] 4. Binary rewriting method to achieve feature reconstruction

[0086] Perform black feature location and binary rewrite on sample e5aaaad4bbf22ea5c732a638fb16050497ab6d90c759eca2c05759e2cc482404.

[0087] Modify the sample's import table and add the white feature API function to the import table. After the modification is completed, use LoadPE to open the file generated after modifying the import table, such as Figure 8 As shown, you can see that a section named @.import is added to the file, and the import table inserts the white feature API function.

[0088] Implement the binary rewriting method, identify the black feature API sequence in the original attack sample, insert the white feature API sequence call instructions before and after the black feature API sequence call, and generate the rewritten binary file. The binary rewriting process is as follows: Fig. 9 shown.

[0089] 5. Model security assessment

[0090] The malicious code detection model is used to classify the original sample and the sample reconstructed by binary rewriting features. The malicious code detection model classifies the original sample as a malicious sample, and classifies the test sample reconstructed by binary rewriting features as a benign sample. This shows that feature reconstruction can effectively affect the classification results of the model, revealing the major security problems of the malicious code detection model. The security of the model can be effectively improved by weakening the influence of the white feature list, adding the generated test samples to the training set and retraining the malicious code detection model.

[0091] Advantages of the present invention:

[0092] (1) Constructing a large-scale sample set and feature matrix: The large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples, wherein the malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from the official software market, and the samples are confirmed to have no malicious behavior through detection by antivirus software. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples, from which the API sequence can be extracted as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated.

[0093] (2) Model interpretation and feature analysis: A series of model interpretation algorithms are used to conduct in-depth analysis of the malicious code detection model. These interpretation algorithms can reveal the specific impact of each feature on the classification results. By analyzing the results of the interpretation algorithm, black features and white features can be accurately located.

[0094] (3) Feature reconstruction based on binary rewriting method: Rewrite the malicious binary file without destroying the original function of the malicious file. Locate the black features in the file, insert the white feature API in the middle of the black feature API sequence, destroy the black features, and achieve feature reconstruction.

[0095] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A malicious code detection model security assessment method based on API sequence feature reconstruction, characterized in that The following steps are involved: Step 1: Collect malicious and benign samples, build a large-scale data set, and perform feature extraction. Run the samples in a sandbox and extract the sample's API sequence from the result report. After API sequence segmentation and feature engineering, generate data that can be directly used as input for the malicious code detection model. Step 2: Use the data generated in the previous step as the input of the malicious code detection model, train the fitting model of the model to be detected, and use the model to simulate the model to be detected. Step 3: Based on the feature interpretation algorithm, analyze the features of the machine learning model to be verified in the previous step, evaluate the importance of each feature, and determine the white features and black features. White features help the model classify samples as benign, while black features tend to classify samples as malicious. Step 4: Reconstruct features based on the binary rewriting method. Without changing the original function of the sample, destroy the black features analyzed in the previous step in the malicious sample to generate a detection sample. The detection sample is used to prove whether there is a security problem in the malicious code detection model.

2. According to claim 1, the malicious code detection model security assessment method based on API sequence feature reconstruction is characterized in that: In step 1, the API sequence segmentation is to use the N-gram algorithm to separate the continuous API sequence into subsequences of fixed size.

3. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: In step 1, the feature engineering described is as follows: the API subsequences obtained by segmenting the API sequence are used as column names of the feature matrix, and the TF-IDF value of each API subsequence is calculated. TF-IDF represents the importance of a single API subsequence in the entire report set, and is directly used as the input of the malicious code detection model. The feature matrix is ​​used as the input of the model, and the fitting model of the malicious code detection model to be detected is trained and optimized.

4. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: The feature interpretation described in step 3 determines the impact of each feature on the classification results of the machine learning model, locates the black features that cause the model to classify the sample as malicious, and generates samples to test the security of the malicious code detection model by accurately destroying the black features. The test samples are used to verify the security of the malicious code detection model.

5. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: The feature reconstruction based on the binary rewriting method described in step 4 can modify the sample without the sample source code and will not destroy the original function of the sample. Through the binary rewriting method, the white feature API is inserted in the middle of the located black feature API sequence to achieve the effect of destroying the black feature. The sample generated by the binary rewriting contains the original malicious function, and the black feature is accurately destroyed to generate a test sample for evaluating the security of the model.

6. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 5 is characterized in that: The binary rewriting method includes the following steps: (1) Modify the import table Analyze the import table of the malicious file to understand its existing API calls. The import table records the dynamic link library (DLL) and its export functions that the binary file needs to load at runtime. Insert white features into the malicious file, modify the import table of the binary file, select the appropriate white feature API based on the feature interpretation results and add it to the import table. (2) Positioning black features According to the result of feature interpretation, the black feature API sequence that needs to be accurately located is selected and located in the malicious binary file. The control flow graph (CFG) of the malicious binary file is deeply analyzed using the control flow analysis method to identify the specific instructions that call the black feature API sequence. The identified and located instructions that call the black feature API sequence and their context information are recorded, including but not limited to the address of the instruction and the name of the API called; (3) Add a new section and fill in the new section content Add a new section at the end of the malicious binary file. The new section contains a jump table, an inserted white feature API, and the black feature API originally included in the file. The jump table contains the original address of the instruction and the target address to jump to. Replace the located black feature API call instruction with a Call instruction. The target address to which the Call instruction jumps is the starting address of the new section. After jumping to the starting point of the new section, the jump table is queried to match the jump target address, and further jumps to the specific instruction of the new section for execution. After jumping to the specific instructions of the new section, the inserted white feature API is executed first, and then the replaced original API call instructions are called, which effectively realizes special reconstruction.

7. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 6 is characterized in that: Modifying the import table involves three steps: first, add a new DLL entry. If the white feature API to be called is located in the new DLL, add the corresponding DLL entry in the import table; second, under the existing or newly added DLL entry, add the call entry of the white feature API. These entries should contain the name of the API and the corresponding address; finally, after modifying the import table, the header information and other related structures of the binary file need to be updated to ensure the integrity and executableness of the file.

Images