Security assessment method of malicious code detection model based on API sequence feature reconstruction

Abstract

A method for security assessment of a malicious code detection model based on reconstruction of API sequence features belongs to the field of software security technology. The present invention focuses on this defect of the malicious code detection model. For the malicious code detection model that uses API sequence as a feature, a large-scale sample set is constructed, and the API sequence is extracted from the sample set. After being processed by feature engineering, it is used as the input of the model to construct a fitting model of the model to be detected. The features are interpreted by the model interpretation algorithm, and the influence of each feature on the model classification result is analyzed, wherein black features are conducive to the model classifying the sample as malicious, and white features are conducive to the model classifying the sample as benign. Without changing the original function of the sample, the binary rewriting method of inserting new sections is used to try to destroy the black features, and a test sample is generated to evaluate the security of the model. The present invention can effectively verify the security of the malicious code detection model and assist in the reinforcement and repair of the malicious code detection model.

Description

Technical Field

[0001] The present invention belongs to the field of software security technology, and in particular relates to security evaluation of malicious code detection models. Background Art

[0002] Malware is a major threat to network security, and traditional detection methods rely on manual analysis or rule matching. However, with tens of thousands of new malware added every day and frequent variants, traditional methods can no longer effectively meet the detection needs of malicious code. In this context, the introduction of machine learning models provides an automated solution for malware detection, greatly improving detection efficiency. However, since malicious code detection models only rely on input features for judgment and lack the experience judgment of manual analysis, they are easily affected by disguised or obfuscated data, resulting in certain challenges to their security. This method proposes a security assessment method for API feature machine learning models based on binary rewriting. For malicious code detection models that use the dynamic feature of API sequence, a method combining feature interpretation and binary rewriting is used to obfuscate the specified features and generate new binary files that retain the original functions. By comparing the classification results of the target malicious code detection model before and after the binary file is modified, the model is evaluated to see if there are security issues. Summary of the Invention

[0003] The present invention aims to provide a malicious code detection model security assessment method based on API sequence feature reconstruction to verify whether the target malicious code detection model has security issues. This solves the problem that the malicious code detection model has poor robustness but is difficult to assess security.

[0004] To achieve the above object, the specific technical solutions of the present invention are as follows:

[0005] A malicious code detection model security assessment method based on API sequence feature reconstruction includes the following steps:

[0006] Step 1: Collect malicious and benign samples, build a large-scale dataset, and perform feature extraction. Run the samples in a sandbox and extract the sample's API sequence from the result report. After API sequence segmentation and feature engineering, generate data that can be directly used as input for the malicious code detection model.

[0007] Step 2: Use the data generated in the previous step as the input of the malicious code detection model, train the fitting model of the model to be detected, and use the model to simulate the model to be detected.

[0008] Step 3: Using the feature interpretation algorithm, analyze the features of the machine learning model generated in the previous step to evaluate its importance and determine whether it is a white feature or a black feature. White features help the model classify samples as benign, while black features tend to classify samples as malicious.

[0009] Step 4: Reconstruct features based on the binary rewriting method. Without changing the original function of the sample, destroy the black features analyzed in the previous step in the malicious sample to generate a detection sample. The detection sample is used to prove whether there are security issues in the malicious code detection model.

[0010] Furthermore, in step 1, the API sequence segmentation involves using the N-gram algorithm to separate the continuous API sequence into subsequences of fixed size. The feature engineering involves using the API subsequences obtained by segmenting the API sequence as column names in the feature matrix, calculating the TF-IDF value of each API subsequence. TF-IDF represents the importance of a single API subsequence in the entire report set, and directly using it as input to the malicious code detection model. The feature matrix is ​​used as input to the model to train and optimize the fitting model of the malicious code detection model to be detected.

[0011] Furthermore, the feature interpretation described in step three determines the impact of each feature on the classification results of the machine learning model, locates the black features that cause the model to classify the sample as malicious, and generates samples to test the security of the malicious code detection model by accurately destroying the black features. The test samples are used to verify the security of the malicious code detection model.

[0012] Furthermore, the feature reconstruction based on the binary rewriting method described in step 4 can modify the sample without the sample source code and will not destroy the original function of the sample. Through the binary rewriting method, the white feature API is inserted in the middle of the located black feature API sequence to achieve the effect of destroying the black feature. The sample generated by the binary rewriting contains the original malicious function, and the black feature is accurately destroyed to generate a test sample for evaluating the security of the model.

[0013] Furthermore, the binary rewriting method of the present invention includes the following steps:

[0014] (1) Modify the import table

[0015] Analyze the malicious file's import table to understand its existing API calls. The import table records the dynamic link libraries (DLLs) and their exported functions that the binary file needs to load at runtime. White signatures are inserted into the malicious file, and the binary file's import table is modified. Based on the signature interpretation results, the appropriate white signature API is selected and added to the import table.

[0016] Modifying the import table involves three steps: first, adding a new DLL entry. If the white feature API to be called is located in the new DLL, the corresponding DLL entry must be added to the import table. Second, under the existing or newly added DLL entry, add call entries for the white feature API. These entries should contain the name of the API and the corresponding address. Finally, after modifying the import table, the header information and other related structures of the binary file need to be updated to ensure the integrity and executableness of the file.

[0017] (2) Positioning black features

[0018] Based on the results of feature interpretation, the black signature API sequences that need to be precisely located are selected and located in the malicious binary file. Using control flow analysis methods, the control flow graph (CFG) of the malicious binary file is deeply analyzed to identify the instructions that specifically call the black signature API sequences. The identified and located instructions that call the black signature API sequences and their context information are recorded, including but not limited to the instruction address and the called API name.

[0019] (3) Add a new section and fill in the new section content

[0020] A new section is added to the end of the malicious binary file. The new section contains a jump table, the inserted white feature API, and the black feature API originally included in the file. The jump table contains the original address of the instruction and the target address to jump to. The located black feature API call instruction is replaced with a Call instruction. The target address to which the Call instruction jumps is the starting address of the new section. After jumping to the starting address of the new section, the jump table is searched to match the jump target address, and then the specific instruction in the new section is further jumped to for execution.

[0021] After jumping to the specific instructions of the new section, the inserted white feature API is executed first, and then the replaced original API call instructions are called, effectively achieving special reconstruction.

[0022] The present invention has the following advantages:

[0023] (1) Constructing a large-scale sample set and feature matrix: The large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples. The malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from official software markets. The samples are tested by antivirus software to confirm that they have no malicious behavior. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples. The API sequence can be extracted from the report as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated.

[0024] (2) Model interpretation and feature analysis: A series of model interpretation algorithms are used to conduct in-depth analysis of the malicious code detection model. These interpretation algorithms can reveal the specific impact of each feature on the classification results. By analyzing the results of the interpretation algorithms, black features and white features can be accurately located.

[0025] (3) Feature reconstruction based on binary rewriting method: Rewrite the malicious binary file without destroying the original function of the malicious file. Locate the black features in the file, insert the white feature API in the middle of the black feature API sequence, destroy the black features, and achieve feature reconstruction. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flow chart of the solution of the present invention;

[0027] Figure 2 This is a feature extraction flow chart of the present invention;

[0028] Figure 3 This is a flow chart of the binary rewriting method of the present invention;

[0029] Figure 4 This is a schematic diagram of instruction replacement and modification of the present invention;

[0030] Figure 5 It is a schematic diagram of instruction reconstruction of the present invention;

[0031] Figure 6 The API call information in the JSON report of the present invention;

[0032] Figure 7 This is the Shapley value distribution diagram of the present invention;

[0033] Figure 8 Add the white feature API function to the import table of the present invention;

[0034] Figure 9 This is the binary rewriting method of the present invention. DETAILED DESCRIPTION

[0035] To better understand the objectives, technical solutions, and functions of the present invention, the present invention is described in further detail below with reference to the accompanying drawings. However, the present invention may be implemented in a variety of different ways as defined and covered by the claims. The accompanying drawings, which constitute a part of this application, are intended to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are intended to explain the present invention and do not constitute undue limitations of the present invention.

[0036] like Figure 1 As shown, the method flow chart of the present invention.

[0037] The method of the present invention comprises the following steps:

[0038] (1) Collect malicious and benign samples, build large-scale datasets, and perform feature extraction

[0039] The large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples, wherein the malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from official software markets, and the samples are confirmed to have no malicious behavior through detection by antivirus software. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples. The API sequence can be extracted from the report as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated. The feature matrix is ​​used as the input of the model to train the fitting model of the malicious code detection model to be detected.

[0040] (2) Training the malicious code detection model and fitting the target model to be verified

[0041] The malicious code detection model of the present invention uses the API sequences called by the sample during execution as features. By analyzing these API sequences, potential malicious behaviors can be accurately identified. The model uses common machine learning model algorithms, including but not limited to decision trees, random forests, gradient boosting trees (such as XGBoost and LightGBM), support vector machines (SVMs), and deep neural networks (such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs). Through cross-validation and hyperparameter tuning, the trained malicious code detection model has high classification accuracy and can fit the target model.

[0042] (3) Interpret the features of the model and locate black features and white features

[0043] Based on the feature interpretation algorithm, the features fitted to the malicious code detection model are analyzed, the importance of each feature is evaluated, and white features and black features are determined. White features help the model classify samples as benign, while black features are more likely to classify samples as malicious.

[0044] (4) Reconstructing features based on binary rewriting method

[0045] Using the binary rewriting method, by locating the black feature API sequence in the feature interpretation results, the white feature API is inserted in the middle of the black feature API sequence to destroy the black features in the malicious sample, realize feature reconstruction, and generate test samples, thereby completing the security assessment of the malicious code detection model.

[0046] The technical solution of the present invention is further described below:

[0047] In step (1), the large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples, wherein the malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from the official software market, and the samples are confirmed to have no malicious behavior through detection by antivirus software. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples. The API sequence can be extracted from the report as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated. The details of the API sequence segmentation and feature engineering are as follows:

[0048] A. API sequence segmentation: Use the N-gram algorithm to separate continuous API sequences into subsequences of fixed size;

[0049] B. Feature Engineering: Use the API subsequences generated from the API sequence as column names in the feature matrix and calculate the TF-IDF value for each API subsequence. TF-IDF is a statistical method commonly used in information retrieval and natural language processing. It indicates the importance of a single API subsequence within the entire report set. TF-IDF is a numerical value that can be directly used as input for the malicious code detection model. Using the feature matrix as input, the model is trained and optimized for the malicious code detection model to be detected.

[0050] The API feature extraction process is as follows Figure 2 shown.

[0051] In step (2), the model's advantages lie in its automation and intelligence. Traditional malicious code detection methods often rely on signature matching and rule engines, making them vulnerable to attacks from variant malicious code. However, the model of the present invention, by learning from a large amount of historical data, can identify the characteristics of new malicious code, thereby greatly improving the coverage and accuracy of detection. The present invention uses the trained malicious code detection model as the target of security assessment.

[0052] In step (3), the present invention uses interpretation techniques such as SHAP (SHapley Additive Explanations) and LIME (Local Interpretable Model-agnostic Explanations). These techniques calculate the contribution of each feature to quantify its impact on the final classification result. This method can be used to classify features into two categories: white features and black features.

[0053] A. White features: These features help the model classify samples as benign. They typically indicate normal, harmless behavior patterns, such as common file operations and network requests. The presence of white features can increase the model's confidence in benign samples and reduce the false positive rate.

[0054] B. Dark features: These features are more likely to classify a sample as malicious. They typically indicate unusual, potentially harmful behavior patterns, such as abuse of system permissions or reading and writing sensitive files. The presence of dark features can significantly increase the probability that the model will classify a sample as malicious.

[0055] By interpreting and analyzing the features of malicious code detection models, we can understand which features play a key role in the model's decision-making, discover potential feature reconstructions and other attack methods, accurately assess the model's security, and provide a basis for formulating more effective defense strategies.

[0056] In step (4), the binary rewriting method locates the black feature API sequence in the feature interpretation result, and uses the method of inserting the white feature API in the middle of the black feature API sequence to destroy the black features in the malicious sample, realize feature reconstruction, and generate test samples. The test samples can evaluate the security of the model. The binary rewriting method can be divided into three steps: modifying the import table, locating the black features, adding a new section and filling the new section content. The overall process of binary rewriting is as follows: Figure 3 shown.

[0057] The binary rewriting method of the present invention is mainly divided into the following steps:

[0058] (1) Modify the import table

[0059] Analyze the malicious file's import table to understand its existing API calls. The import table records the dynamic link libraries (DLLs) and their exported functions that the binary file needs to load at runtime. To insert white signatures into the malicious file, modify the binary's import table. Based on the signature interpretation results, select the appropriate white signature API and add it to the import table. The selected white signature API should not conflict with the existing functionality of the malicious file to ensure that the inserted file continues to function properly.

[0060] Modifying the import table involves three steps. First, add a new DLL entry. If the white feature API to be called is located in the new DLL, add the corresponding DLL entry to the import table. Second, add call entries for the white feature API under the existing or newly added DLL entry. These entries should contain the API name and corresponding address. Finally, after modifying the import table, update the binary file header information and other related structures to ensure file integrity and executableness. This includes adjusting the file size and correcting offsets.

[0061] (2) Positioning black features

[0062] Based on the results of feature interpretation, the black signature API sequences that require precise location are selected and located within the malicious binary. Using control flow analysis, the malicious binary's control flow graph (CFG) is thoroughly analyzed. The CFG displays the program's execution path and branch structure. By analyzing the CFG, the instructions that specifically call the black signature API sequences can be identified. The identified and located instructions that call the black signature API sequences, along with their contextual information, are recorded. This information, including the instruction address and the API name being called, facilitates subsequent feature reconstruction and processing.

[0063] (3) Add a new section and fill in the new section content

[0064] Add a new section at the end of the malicious binary file. The new section contains the jump table, the inserted white feature API, and the black feature API originally included in the file. The jump table contains the original address of the instruction and the target address to jump to. Replace the located black feature API call instruction with the Call instruction. The target address to which the Call instruction jumps is the starting address of the new section. After jumping to the starting address of the new section, the jump table is searched to match the jump target address, and further jumps to the specific instruction of the new section for execution. The replacement and modification of instructions are as follows: Figure 4 shown.

[0065] After jumping to the specific instructions of the new section, the inserted white feature API is executed first, and then the replaced original API call instruction is called. This operation ensures that the original API execution, that is, the original function is not changed, while inserting the white feature API in the middle of the black feature API sequence, destroying the original black feature, and effectively realizing special reconstruction. After the original API call instruction is executed, the instruction address pushed into the stack is popped out through the ret instruction. This address is the address of the next instruction of the replaced call instruction. The control flow returns to the code section of the program and continues to execute the subsequent original functions to ensure the integrity of the function. The process of instruction reconstruction is as follows Figure 5 shown.

[0066] Core invention principle:

[0067] (1) Dataset construction and feature extraction principles

[0068] A large number of malicious and benign samples are collected to form a dataset. These samples are then executed in a sandbox to generate a sandbox report containing both static and dynamic information about the samples. From this sandbox report, the APIs called during sample execution are extracted as features for the malicious code detection model. Feature engineering can be used to decompose textual API sequences and represent them in numerical form. The resulting feature matrix can then be used as input for the malicious code detection model.

[0069] (2) Principles of Feature Interpretation

[0070] Feature interpretation is a technique used to understand the decision-making process of machine learning models, revealing the specific impact of each feature on the model's predictions. Model interpretation algorithms can quantify the contribution of each feature to the model's predictions using various methods. Features can be categorized as either white features or black features based on their impact on the model's predictions. White features help the model classify samples as benign. They typically represent normal, harmless behavior patterns, such as common file operations and network requests. Black features, on the other hand, tend to classify samples as malicious. They typically represent abnormal, potentially harmful behavior patterns, such as the abuse of system permissions and the reading and writing of sensitive files. The presence of black features can significantly increase the probability that the model will classify a sample as malicious. By analyzing the model's black features, it is possible to precisely locate where black features are being used to sabotage the model and assess the model's security by observing the model's classification accuracy before and after the sabotage.

[0071] (3) Principle of binary rewriting method

[0072] The binary rewriting method reconstructs the features of malicious files without destroying their original functionality, thus evading detection by malicious code detection models. A new section is inserted at the end of the file, where the inserted whitespace features and the original API call instructions are executed. After execution, the code jumps to the next instruction after the original instruction, achieving instruction reconstruction while preserving the original functionality of the malicious file.

[0073] Based on the above description, compared with the prior art, the present invention improves the detection efficiency of malicious code and can better perform security assessment on malicious code detection models.

[0074] Example 1

[0075] Taking the sample e5aaaad4bbf22ea5c732a638fb16050497ab6d90c759eca2c05759e2cc482404 as an example, this article introduces the security assessment process of the malicious code detection model.

[0076] 1. Dataset construction and feature preprocessing

[0077] Malicious samples were collected from the official VirusShare website, and benign samples were collected from official software marketplaces. These samples were then filtered through antivirus software to confirm that the collected benign samples were free of malicious activity. The resulting dataset contained 20,000 malicious samples and 20,000 benign samples.

[0078] Use the Cuckoo sandbox to run the sample and collect the JSON report generated by the sandbox about the sample running results. The JSON report generated by the Cuckoo sandbox records in detail the running behavior of the sample in a controlled environment. The report includes basic information of the task (such as task ID, sample file name, hash value, file size and type, analysis time), behavioral analysis (such as process information, API calls, registry operations, file operations, network activities, memory operations), static analysis (such as PE file information, printable strings), signature analysis (such as malicious behavior signatures, threat classification), and additional information (such as log information, screenshots, network traffic data). This information helps security analysts fully understand the running behavior of the sample, identify potential malicious activities, and take corresponding protective measures. Extract the API called by the sample during operation from the JSON report. The API call information recorded in the JSON report is as follows: Figure 6 shown.

[0079] After extracting API call information, we use the N-gram algorithm to segment the continuous API sequence into fixed-size subsequences. In this example, N is set to 1 or 2, meaning each API subsequence contains one or two APIs. We then use the resulting API subsequences as columns in the feature matrix, and calculate the TF-IDF value for each API subsequence. In the resulting feature matrix, each row represents a sample file, and each column represents a segmented API subsequence. The matrix values ​​are the calculated TF-IDF values.

[0080] 2. Model training

[0081] The feature matrix generated by preprocessing is used as the model input, and the popular XGBoost machine learning algorithm is selected to train the malicious code detection model. XGBoost is a machine learning algorithm based on gradient boosting decision trees. It has multiple optimization techniques and flexible configuration options, making it particularly suitable for processing large datasets and complex prediction tasks. Model parameters such as the tree depth and the minimum number of samples required for leaf nodes can be adjusted to improve the model's classification accuracy.

[0082] 3. Feature Explanation

[0083] The SHAP algorithm is used to calculate the Shapley value for each feature in XGBoost. At the same time, the Shapley value distribution of the entire sample is plotted by combining its label and using the overall distribution graph tool in the SHAP interpretation model. The Shapley value generated by the SHAP algorithm is a method based on game theory that reflects the average impact of a feature on the model's prediction results under all possible scenarios, helping users understand the specific contribution of each feature to the model's decision. Through the Shapley value, you can intuitively show which features have the greatest impact on the model's prediction results, thereby improving the model's transparency and interpretability. The Shapley value distribution graph generated by the SHAP algorithm is shown below. Figure 7 shown.

[0084] Determine the black features and white features according to the SHAP algorithm. Figure 7 The distribution of each sample can be seen in the figure. Each dot in the figure represents a sample, the vertical axis represents each API N-gram, and the total number of samples in each row is consistent. The horizontal axis represents the sample's Shapley value. A positive Shapley value indicates a positive effect on the prediction result, while a negative Shapley value indicates a negative effect. The color of each dot in the figure represents the sample's feature value. Redder colors represent larger feature values, while bluer colors represent smaller feature values. By observing the distribution graph, we can see that the 2-gram feature "CoUninitialize NtClose" in the figure significantly affects the prediction results. The blue sample points are all concentrated in the area with a Shapley value greater than zero, while the red sample points are all in the area with a Shapley value less than zero, making it a typical white feature.

[0085] 4. Binary rewriting method to achieve feature reconstruction

[0086] Perform black feature location and binary rewriting on the sample e5aaaad4bbf22ea5c732a638fb16050497ab6d90c759eca2c05759e2cc482404.

[0087] Modify the sample's import table and add the white feature API function to the import table. After the modification is completed, use LoadPE to open the file generated after modifying the import table, such as Figure 8 As shown, you can see that a section named @.import is added to the file, and the import table inserts the white feature API function.

[0088] Implement the binary rewriting method to identify the black feature API sequence in the original attack sample, insert the white feature API sequence call instructions before and after the black feature API sequence call, and generate the rewritten binary file. The binary rewriting process is as follows: Figure 9 shown.

[0089] 5. Model Security Assessment

[0090] The malicious code detection model was used to classify the original sample and the sample reconstructed using the binary rewriting feature. The malicious code detection model classified the original sample as malicious, while the test sample reconstructed using the binary rewriting feature was classified as benign. This demonstrates that feature reconstruction can effectively influence the model's classification results, revealing a significant security issue with the malicious code detection model. By mitigating the impact of the whitelist and retraining the malicious code detection model by adding the generated test samples to the training set, the model's security can be effectively improved.

[0091] Advantages of the present invention:

[0092] (1) Constructing a large-scale sample set and feature matrix: The large-scale data set constructed by the present invention contains a large number of malicious samples and benign samples. The malicious samples are downloaded from public websites such as VirusShare and Androzoo, and the benign samples are collected from official software markets. The samples are tested by antivirus software to confirm that they have no malicious behavior. After the data set is collected, the samples are run in a sandbox to obtain a report on the dynamic execution of the samples. The API sequence can be extracted from the report as a feature of the malicious code detection model. After the API sequence is processed by API sequence segmentation and feature engineering, a feature matrix that can be used as a malicious code detection model is generated.

[0093] (2) Model interpretation and feature analysis: A series of model interpretation algorithms are used to conduct in-depth analysis of the malicious code detection model. These interpretation algorithms can reveal the specific impact of each feature on the classification results. By analyzing the results of the interpretation algorithms, black features and white features can be accurately located.

[0094] (3) Feature reconstruction based on binary rewriting method: Rewrite the malicious binary file without destroying the original function of the malicious file. Locate the black features in the file, insert the white feature API in the middle of the black feature API sequence, destroy the black features, and achieve feature reconstruction.

[0095] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A malicious code detection model security assessment method based on API sequence feature reconstruction, characterized by The following steps are involved: Step 1: Collect malicious and benign samples, build a large-scale dataset, and perform feature extraction. Run the samples in a sandbox and extract the sample's API sequence from the result report. After API sequence segmentation and feature engineering, generate data that can be directly used as input for the malicious code detection model. Step 2: Use the data generated in the previous step as the input of the malicious code detection model to train a fitting model for the model to be detected, and use this model to simulate the model to be detected; Step 3: Using the feature interpretation algorithm, analyze the features of the machine learning model generated in the previous step to evaluate its importance and determine whether it is a white feature or a black feature. White features help the model classify samples as benign, while black features tend to classify samples as malicious. Step 4: Reconstruct features based on the binary rewriting method. Without changing the original function of the sample, the black features analyzed in the previous step are destroyed in the malicious sample to generate a detection sample. This detection sample is used to prove whether there are security issues in the malicious code detection model. The binary rewriting method includes the following steps: (1) Modify the import table Analyze the import table of the malicious file to understand its existing API calls. The import table records the dynamic link libraries (DLLs) and their exported functions that the binary file needs to load at runtime. Insert white features into the malicious file, modify the binary file's import table, select the appropriate white feature API based on the feature interpretation results, and add it to the import table. (2) Positioning black features Based on the results of feature interpretation, the black signature API sequences that need to be precisely located are selected and located in the malicious binary file. Using control flow analysis, the control flow graph (CFG) of the malicious binary file is deeply analyzed to identify the instructions that specifically call the black signature API sequences. The identified and located instructions that call the black signature API sequences and their context information are recorded, including the instruction address and the called API name. (3) Add a new section and fill in the new section content A new section is added to the end of the malicious binary file. The new section contains a jump table, the inserted white feature API, and the black feature API originally included in the file. The jump table contains the original address of the instruction and the target address to jump to. The located black feature API call instruction is replaced with a Call instruction. The target address to which the Call instruction jumps is the starting address of the new section. After jumping to the starting address of the new section, the jump table is searched to match the jump target address, and then the specific instruction in the new section is further jumped to for execution. After jumping to the specific instructions of the new section, the inserted white feature API is executed first, and then the replaced original API call instructions are called, effectively realizing feature reconstruction.

2. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: In step 1, the API sequence segmentation is to use the N-gram algorithm to separate the continuous API sequence into subsequences of fixed size.

3. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: In step 1, the feature engineering is as follows: the API subsequences obtained by segmenting the API sequence are used as column names of the feature matrix, and the TF-IDF value of each API subsequence is calculated. TF-IDF represents the importance of a single API subsequence in the entire report set, and is directly used as the input of the malicious code detection model. The feature matrix is ​​used as the input of the model to train the fitting model of the malicious code detection model to be detected and perform optimization.

4. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: The feature interpretation described in step 3 determines the impact of each feature on the classification results of the machine learning model, locates the black features that cause the model to classify samples as malicious, and generates samples to test the security of the malicious code detection model by accurately destroying the black features. The test samples are used to verify the security of the malicious code detection model.

5. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: The feature reconstruction based on the binary rewriting method described in step 4 can modify the sample without the sample source code and will not destroy the original function of the sample. Through the binary rewriting method, the white feature API is inserted in the middle of the located black feature API sequence to achieve the effect of destroying the black feature. The sample generated by binary rewriting contains the original malicious function, and the black feature is accurately destroyed to generate a test sample for evaluating the security of the model.

6. The malicious code detection model security assessment method based on API sequence feature reconstruction according to claim 1 is characterized in that: Modifying the import table involves three steps: first, adding a new DLL entry. If the white feature API to be called is located in the new DLL, the corresponding DLL entry must be added to the import table. Second, under the existing or newly added DLL entry, add call entries for the white feature API. These entries should contain the name of the API and the corresponding address. Finally, after modifying the import table, the header information and other related structures of the binary file need to be updated to ensure the integrity and executableness of the file.

Images