Automatic analysis method for binary malicious code function

Abstract

The invention discloses an automatic analysis method for binary malicious code functions, and belongs to the technical field of software security. Comprising the following steps: inputting a malicious binary sample, obtaining sample features through a feature extraction process, identifying a malicious function address by using an unsupervised malicious function identification model, and outputting specific functions of a malicious function in the sample through a semi-supervised malicious function function classification model. The method does not depend on a marked data set. Only a small number of labels are needed in the classification process, the dependence of model training on a large amount of pre-marked data is reduced, the efficiency of function analysis is remarkably improved, safety protection personnel are helped to take defense measures for malicious binary codes in time, and the defense capacity of a safety protection system is continuously enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security, and in particular relates to binary malicious code function analysis. Background Art

[0002] Binary malicious code function analysis is a key link in the field of network security. It not only helps experts identify, understand, and respond to emerging malware threats in a timely manner, but also provides a basis for building an effective security protection system. By deeply analyzing the functions of malicious code, security experts can understand the strategies and methods of attackers and formulate corresponding defense measures. In addition, through in-depth analysis of malicious code, the feature library can be continuously updated to improve the detection capabilities of security products. At the same time, functional analysis can also help and identify malware variants and new attacks, and enhance the defense capabilities of enterprises and organizations against unknown attacks. Overall, binary malicious code function analysis is of great significance in maintaining network security and promoting the advancement of security technology.

[0003] As the number and complexity of malware continue to increase, traditional malicious code analysis methods face many challenges, especially in the identification and classification of malicious code functions. Current binary code analysis methods are often inefficient, overly dependent on manual analysis, and lack automated tools, which not only increases the workload of malicious code analysts, but also easily leads to errors. Take the daily work of binary malicious code analysts as an example. They first query VirusTotal or other anti-virus agencies to confirm whether the malicious code sample has been recorded. If not, analysts usually execute the sample in a sandbox to observe its dynamic behavior, but many malicious samples can identify the sandbox environment and evade dynamic analysis. In this case, analysts can only perform static disassembly. After disassembly, analysts need to identify malicious areas in hundreds or thousands of functions, and often have to check functions one by one, which not only increases the complexity of the work, but also prolongs the time cost.

[0004] This cumbersome workflow leads to inefficient analysis of binary malicious code functions, making it difficult to quickly respond to ever-changing malware, which in turn affects the ability to provide timely and effective defense. Therefore, the use of automated methods based on machine learning can improve the efficiency of binary code analysis. However, commonly used supervised machine learning models require a large number of labeled functions to be input as data sets for training, and there are currently no such public data sets. Manual labeling requires a lot of human resources and time, and cannot guarantee accuracy.

[0005] In summary, binary malicious code function analysis is of great significance in the field of network security. However, current analysis methods have problems such as low efficiency, over-reliance on manual analysis, and lack of automated tools, which makes it difficult to take effective defense measures in a timely manner. Therefore, it is particularly important to use an automated analysis method for binary malicious code functions that does not require a large number of labeled samples. Summary of the invention

[0006] The present invention aims to provide a method for automatic analysis of malicious binary code functions to solve the technical problems of low efficiency, over-reliance on manual analysis and lack of automated analysis tools currently faced by malicious binary code analysis.

[0007] To achieve the above purpose, the specific technical solutions of the present invention are as follows:

[0008] An automated analysis method for binary malicious code function functions comprises the following steps: inputting a malicious binary sample, obtaining sample features through a feature extraction process, identifying malicious function addresses using an unsupervised malicious function recognition model, and outputting specific functions of the malicious functions in the sample through a semi-supervised malicious function classification model.

[0009] Furthermore, the method extracts features from multiple dimensions of the binary code, including but not limited to structural features, arithmetic instruction features, transfer instruction features, and API call categories.

[0010] Furthermore, the method uses benign samples to train an unsupervised machine learning model to locate malicious functions in malicious binary codes and output the addresses of malicious functions.

[0011] Furthermore, the method uses a semi-supervised machine learning model to functionally classify the identified malicious binary functions, and finally outputs the malicious binary functions existing in the sample and their functional classification.

[0012] Furthermore, the unsupervised machine learning model for benign sample training is a feature reconstruction model. After the benign sample features used for training are extracted, the feature reconstruction model needs to be trained. The model consists of two parts: an encoder and a decoder. The encoder is responsible for reducing the high-dimensional features of the input to a low-dimensional representation, and the decoder reconstructs the low-dimensional features into high-dimensional features of the same dimension as the input.

[0013] Furthermore, the feature reconstruction model extracts features in units of basic blocks, and quantifies anomalies by comparing the differences between the reconstructed and original feature vectors. Basic blocks exceeding a threshold are marked as anomalies, wherein a basic block is the basic building block of a function, and its execution order and control flow determine the behavior of the function.

[0014] Furthermore, the basic block is marked as abnormal by accumulating the differences of the abnormal basic blocks in each function to obtain an overall feature value. If the value exceeds a preset threshold, the function is determined to be a malicious function.

[0015] Furthermore, the malicious function classification based on semi-supervised learning adopts a clustering model to classify the functions of the identified malicious functions. Before clustering analysis, the function features are reduced in dimension, the most representative features are extracted, and noise is removed so that the data can be processed in a low-dimensional space.

[0016] The present invention has the following advantages: The present invention can automatically identify and classify malicious functions in malicious binary files without relying on labeled data sets. The classification process only requires a small number of labels, which reduces the reliance of model training on a large amount of pre-labeled data, provides an automated method for binary code analysis, and solves technical problems such as inefficiency, over-reliance on manual analysis, and lack of automated tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the overall structure of the present invention;

[0018] Figure 2 This is the feature extraction result of some samples of the present invention;

[0019] Figure 3 This is the unsupervised malicious function identification result of the present invention;

[0020] Figure 4 This is the semi-supervised malicious function clustering result of the present invention. DETAILED DESCRIPTION

[0021] In order to better understand the purpose, technical solution and function of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings, but the present invention can be implemented in a variety of different ways as defined and covered by the claims. The accompanying drawings constituting a part of this application are used to provide a further understanding of the present invention, and the exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention.

[0022] 1. Overview of the overall principle of the present invention

[0023] The basic process of the present invention is as follows Figure 1 As shown: The invention inputs a malicious binary sample and extracts the features of the sample as a classification basis. First, the malicious binary functions in the malicious sample are identified through an unsupervised machine learning model. Then, the identified malicious binary function codes are classified using a semi-supervised machine learning model, and finally the malicious binary functions existing in the sample and their functional classifications are output.

[0024] The present invention can automatically identify and classify malicious functions in malicious binary files without relying on labeled data sets. The classification process only requires a small number of labels, which reduces the reliance of model training on a large amount of pre-labeled data, provides an automated method for binary code analysis, solves technical problems such as inefficiency, over-reliance on manual analysis, and lack of automated tools, improves the efficiency of analysts in analyzing malicious binary samples, and enhances the rapid defense capabilities of enterprises and organizations against unknown attacks.

[0025] 2. Construction of Binary Code Sample Information Library

[0026] The binary code sample library of the present invention contains malicious binary code and benign binary code. Malicious binary code samples come from open source malicious code platforms such as VirusTotal, covering samples of different families and years; benign binary code samples come from official application download platforms such as Microsoft Store and CNET, covering various types of applications such as games, office, and social networking. All samples are scanned by antivirus software and their label types are clearly marked.

[0027] 3. Specific implementation of malicious function identification based on unsupervised learning

[0028] 1. Feature extraction

[0029] Before training a feature reconstruction model for identifying malicious functions in malicious binary code, it is necessary to extract features from the sample. The present invention extracts features from multiple dimensions of binary code, including but not limited to structural features, arithmetic instruction features, transfer instruction features, and API call categories. By analyzing the structural features, the control flow and execution path of the code can be understood; the arithmetic instruction features reveal the specific way of data processing; the transfer instruction features help the model understand the flow of data within the code; and the API call category is directly related to the interaction between the code and the operating system or other resources.

[0030] The specific features of the present invention are classified as shown in Table 1:

[0031] Table 1

[0032]

[0033]

[0034] This paper selects 10,000 benign binary files covering different application scenarios such as games, office, and social networking as training data, all from the binary sample library. Feature extraction is based on basic blocks. The first 20k basic blocks of each input file are extracted, and 18-dimensional features are extracted from each basic block, such as Figure 2 As shown. The features cover the following 4 dimensions:

[0035] Structural features:

[0036] Count the association value (Betweenness) and the number of offspring (Offspring) of each basic block. The association value is a weighted calculation of the association degree of the basic block with other basic blocks in the control flow graph, and the number of offspring indicates the number of sub-blocks owned by the basic block. These structural features are usually used to detect network communication functions, such as: connect, send, recv, and file operation functions, such as: findfile, open, read, encrypt, write, close, etc. These operations frequently appear in malicious code, so they need special attention.

[0037] Arithmetic instructions:

[0038] Count the number of basic mathematical operations, logical operations, and displacement instructions in each basic block. By observing the number of arithmetic instructions, encryption functions and obfuscation functions containing a large number of XOR instructions or logical displacement operations can be effectively detected. This analysis helps identify common encryption and obfuscation techniques in malicious code.

[0039] Transfer instructions:

[0040] Count the number of instructions for stack operations, register operations, and port operations in each basic block. These instruction parameter passing operations can be used to identify complex logic and data operations in malicious functions. These features illustrate how parameters are provided to functions and the interaction between the return value of a function call and the rest of the data within the function.

[0041] API call:

[0042] Count the number of API calls in multiple dimensions. These functions can be used to represent high-level library operations required to perform malicious activities, such as network communication and file system, registry, and process operations. By studying the sequence of API calls, we can know which special functions are used by the malware. Since these directly represent the high-level behavior of the malware, they are crucial to understanding the overall behavior of the function.

[0043] 2. Malicious function identification model training based on unsupervised learning

[0044] The present invention uses benign samples to train an unsupervised machine learning model for locating malicious functions in malicious binary codes, and defines the model as a feature reconstruction model. After the feature extraction of the benign samples used for training is completed, the feature reconstruction model needs to be trained. The feature reconstruction model is divided into two parts: an encoder and a decoder. The encoder is essentially a feature extraction network that reduces the features of the input samples from high dimensions to low dimensions; the decoder is essentially a feature fusion network that reconstructs the features back to high-dimensional features equal to the input dimension.

[0045] The innovation of this model lies in its unsupervised learning, which uses only benign samples for training and focuses on learning benign code features and patterns. The uniqueness of malicious functions makes it difficult to accurately complete feature reconstruction, so there is no need to mark functions as benign or malicious, which solves the problem of insufficient labeled samples in function-level binary code classification, which is also the key point of the unsupervised implementation of the feature reconstruction model of the present invention.

[0046] The feature reconstruction model uses the local mean square error (LMSE) as an indicator to calculate the difference before and after reconstruction. The formula is as follows:

[0047] LMSE(x,x')=(x (i) -x' (i) ) 2

[0048] where x (i) represents the feature vector of the i-th basic block of the sample, x ’(i) Represents the vector representation of the feature reconstructed using the feature reconstruction model. In the present invention, the basic block is the basic building block of the function, and its execution order and control flow determine the behavior of the function. The feature reconstruction model extracts features in units of basic blocks, and quantifies anomalies by comparing the differences between the reconstructed and original feature vectors. Basic blocks that exceed the threshold are marked as abnormal. Given a threshold φ, if the value of the LMSE of a basic block exceeds φ, it is marked as an abnormal basic block. The LMSE of all abnormal basic blocks in the function is summed to obtain the MSE value of the function. Given a threshold α, marks that exceed the threshold α are considered malicious functions.

[0049] 4. Specific implementation of malicious function classification based on semi-supervised learning

[0050] The present invention identifies malicious binary functions present in the input malicious binary code through a feature reconstruction model, and then confirms the functions of the malicious functions in the identified malicious binary samples through a semi-supervised clustering machine learning method, and defines the model as a function function classifier. The function function classifier model of the present invention is intended to perform specific functional classification on the malicious functions identified by the feature reconstruction model. Therefore, the features used in model training need to be organized and processed according to the function dimension. When constructing the model, for each function, the mean of all the basic block feature vectors marked as abnormal by the feature reconstruction model is calculated as the feature representation of the function.

[0051] 1. Feature confirmation

[0052] Through the unsupervised learning part of the feature reconstruction model, we have been able to locate the malicious functions in a given malicious binary code. Next, we will perform cluster analysis on the identified functions to confirm their specific functions. First, we need to clarify the input of the cluster analysis, that is, the description of the malicious function behavior in the sample, as shown below:

[0053]

[0054] The denominator represents the number of abnormal basic blocks in the function, and the numerator represents the sum of the feature vectors of all abnormal basic blocks in the function. Before cluster analysis, the principal program analysis method (PCA) is used to reduce the dimension of the features from 15 dimensions to 8 dimensions, so that the model can handle more functions.

[0055] 2. Training of malicious function classification model based on semi-supervised learning

[0056] Next, the present invention will apply a clustering algorithm to perform cluster analysis on the function features after dimensionality reduction. This process belongs to semi-supervised machine learning, and only a small number of labeled function samples with different functional behaviors need to be introduced. The functions to be classified will cluster functions with similar features into the same category, and then the specific behavior of the function to be classified will be confirmed by the function with the largest number of labeled samples in the category. This method improves the accuracy and efficiency of classification.

[0057] The clustering model of the present invention is characterized by a low demand for labeled samples, and only a small number of labeled samples are required for each type of malicious function. This reduces the workload of analysts when labeling functions. By automatically clustering functions into categories with the most labeled samples, the model can identify their functions. In addition, the labeled functions can be continuously input into the model for updating and optimization, thereby improving the accuracy and efficiency of clustering. With the addition of new samples, the model gradually adapts to changes in malicious code features and enhances the ability to identify new malicious functions. Before clustering analysis, the most representative features are extracted and noise is removed by reducing the dimensionality of function features, making the data easier to process in a low-dimensional space.

[0058] V. Verification of the Invention

[0059] 1. Experimental environment:

[0060] The experimental environment is: Ubuntu 18.04.6 system, processor Intel (R) Xeon (R) CPU E5-26500@2.00GHz, memory 16GB, Python 3.10.7.

[0061] We select 50 malicious binary samples from the sample code library as the test set and observe how the model clusters the malicious functions in these samples.

[0062] 2. Sample feature extraction results

[0063] The feature extraction of the feature reconstruction model of the present invention is based on basic blocks. The first 20k basic blocks of each input malicious binary file are extracted, and 18-dimensional features are extracted from each basic block, as follows: Figure 2 As shown, each row of data in the figure represents the 18-dimensional feature value of a basic block:

[0064] 3. Unsupervised model locates malicious function results

[0065] The unsupervised feature reconstruction model in the present invention can identify the relative offset address of the malicious function in the input malicious binary sample. The result is as follows: Figure 3 As shown in the figure. The first column indicates the path where the malicious sample is located, which reflects that the sample is named after the SHA256 hash value. The second column is the relative offset address of the malicious function in the sample identified by the feature reconstruction model. The third column is the MSE value of the function calculated by the model. The output of the model not only provides the sample where the malicious function is located and the relative offset address of the function, but also provides the basis for classification, which is explainable.

[0066] 4. Results of clustering function of semi-supervised model

[0067] Next, the semi-supervised clustering model can be used to confirm the specific behavior of the malicious function identified by the unsupervised feature reconstruction network. The results are as follows: Figure 4 As shown, the first column indicates the path where the sample is located, the second column indicates the address of the malicious function identified by the sample, and the last column indicates the category of the behavior after the malicious function is clustered.

[0068] At this point, the category of the malicious function has been confirmed. Based on the behavioral labels of most samples in this category, the behavior of the function can be concretized into the description of the standardized behavior in MITRE ATT&CK. For example: Assuming that there are 100 labeled samples in category 255, 80 of which are labeled as keyboard logging behavior, then the analyst can believe that the samples in this set are very likely to show malicious keyboard logging behavior, and then the samples can be analyzed in a targeted and detailed manner, which greatly improves the efficiency of binary malicious sample analysis.

[0069] 6. Overall advantages of the present invention.

[0070] The present invention can automatically identify and classify malicious functions in malicious binary files without relying on labeled data sets. The classification process only requires a small number of labels, which reduces the reliance of model training on a large amount of pre-labeled data, provides an automated method for binary code analysis, solves technical problems such as inefficiency, over-reliance on manual analysis, and lack of automated tools, improves the efficiency of analysts in analyzing malicious binary samples, and enhances the rapid defense capabilities of enterprises and organizations against unknown attacks.

[0071] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An automated analysis method for binary malicious code functions, characterized by: Input a malicious binary sample, obtain the sample features through the feature extraction process, use the unsupervised malicious function recognition model to identify the malicious function address, and output the specific function of the malicious function in the sample through the semi-supervised malicious function classification model.

2. The automated analysis method for binary malicious code functions according to claim 1, characterized in that: The method extracts features from multiple dimensions of binary code, including but not limited to structural features, arithmetic instruction features, transfer instruction features and API call categories.

3. The automated analysis method for binary malicious code functions according to claim 1, characterized in that: This method uses benign samples to train an unsupervised machine learning model to locate malicious functions in malicious binary codes and output the addresses of malicious functions.

4. The automated analysis method for binary malicious code functions according to claim 1, characterized in that: This method uses a semi-supervised machine learning model to functionally classify the identified malicious binary functions, and finally outputs the malicious binary functions existing in the sample and their functional classification.

5. The automated analysis method for binary malicious code functions according to claim 3, characterized in that: The unsupervised machine learning model for benign sample training is a feature reconstruction model. After the benign sample features used for training are extracted, the feature reconstruction model needs to be trained. The model consists of two parts: an encoder and a decoder. The encoder is responsible for reducing the high-dimensional features of the input to a low-dimensional representation, and the decoder reconstructs the low-dimensional features into high-dimensional features of the same dimension as the input.

6. The automated analysis method for binary malicious code functions according to claim 5, characterized in that: The feature reconstruction model extracts features in basic blocks and quantifies anomalies by comparing the differences between the reconstructed and original feature vectors. Basic blocks that exceed the threshold are marked as anomalies. Basic blocks are the basic building blocks of functions, and their execution order and control flow determine the behavior of the function.

7. The automated analysis method for binary malicious code functions according to claim 6, characterized in that: The method by which a basic block is marked as abnormal is to accumulate the differences of the abnormal basic blocks in each function to obtain an overall feature value. If the value exceeds a preset threshold, the function is judged to be a malicious function.

8. The automated analysis method for binary malicious code functions according to claim 1, characterized in that: Malicious function classification based on semi-supervised learning uses a clustering model to classify the functions of identified malicious functions. Before clustering analysis, the function features are reduced in dimension, the most representative features are extracted, and noise is removed so that the data can be processed in a low-dimensional space.

Images