Full-life-cycle malicious software detection method and device in system resource competition environment

Abstract

The invention provides a full-life-cycle malicious software detection method and device in a system resource competition environment, and relates to the technical field of network space security. The method comprises the following steps: running to-be-tested software in different resource competition environments, and acquiring a hardware event result during running of the to-be-tested software by utilizing at least one hardware performance counter; inputting the hardware event result into a current expression network to obtain an expression result; inputting the expression result into a current malicious software detection model to obtain a malicious software detection result; judging whether the distribution of the hardware event results deviates or not, wherein the number of the deviated hardware events is higher than a preset first threshold value; and if yes, updating the expression network and the malicious software detection model by using an incremental learning method. The invention provides a method for efficiently detecting malicious software in a full life cycle in a system resource competition environment, so that the method is not interfered by system resource competition when a hardware performance counter is used for detecting the malicious software, and a detection model can be automatically updated.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a method and device for detecting malware throughout its life cycle in a system resource competition environment. Background Art

[0002] At present, social development has entered the era of the Internet of Everything. The Internet of Things, artificial intelligence, and big data technologies are widely used in industrial applications and social life. Systems, as the basic support for various applications, are inseparable from the use of various technologies. The widespread deployment of various applications in the system has made system resource competition a normal phenomenon. At the same time, the vulnerabilities in various applications have led to a rapid increase in the types and number of malware. The existing static malware detection methods based on feature matching are applicable to a single type and have low detection accuracy; the dynamic detection methods based on control flow graphs or data flow graphs have high overhead and are difficult to be effective in actual systems.

[0003] Hardware performance counters are gradually being used for malware detection because they have low data acquisition process overhead and are difficult to be circumvented by malware. Hardware performance counters are registers inside the central processing unit. They exist in various processors and are often used to monitor hardware events that occur inside the processor during software execution, such as the number of instructions executed, the number of cache misses, branch prediction errors, etc. However, the count values ​​of hardware performance counters are easily affected by the operating system. The count values ​​of hardware events obtained by running the same program twice in the system will be different. This difference is closely related to the hardware resources available to the system, so when using hardware performance counters to detect malware, it is necessary to pay special attention to the system resource environment and whether the system environment when the classifier is established is consistent with the system environment when it is used.

[0004] Existing research pays little attention to the impact of system resource environment, which makes the performance of malware detection models significantly degraded when detecting malware under different system resource environments. If there is no need to consider system resource competition when using hardware performance counters to detect malware, it will be more practical to use malware classifiers to determine whether the software under test is malware based on the results of hardware performance counters. In addition, if the classifier itself can determine the deviation between the distribution of the software under test and existing samples, it can efficiently detect malware in the entire life cycle under the system resource competition environment. Therefore, it is extremely important to design a method for efficiently detecting malware in the entire life cycle under the system resource competition environment. Summary of the invention

[0005] In order to solve the technical problem of how to design a method for efficiently detecting malware in the whole life cycle under a system resource competition environment in the prior art, an embodiment of the present invention provides a method and device for detecting malware in the whole life cycle under a system resource competition environment. The technical solution is as follows:

[0006] On the one hand, a full life cycle malware detection method under a system resource competition environment is provided, the method is implemented by a full life cycle malware detection device, and the method includes:

[0007] S1. Run the software under test in different resource competition environments, and use at least one hardware performance counter to obtain hardware event results during the running of the software under test.

[0008] S2. Input the hardware event result into the current expression network to obtain the expression result.

[0009] S3. Input the expression result into the current malware detection model to obtain the malware detection result.

[0010] S4. Determine whether the distribution of hardware event results deviates and whether the number of deviated hardware events is higher than a preset first threshold.

[0011] If so, the expression network and malware detection model are updated using an incremental learning method, and the updated expression network and malware detection model are used as the current expression network and malware detection model, and the process goes to step S2.

[0012] If not, output the malware detection result.

[0013] Optionally, the training process of the expression network in S2 includes:

[0014] S21. Create different resource competition environments by running various benchmark programs, run software samples in different resource competition environments, and use at least one hardware performance counter to obtain sample hardware event results during the running of the software samples.

[0015] Among them, software samples include benign software samples and malware samples.

[0016] S22. Train the expression network according to the sample hardware event results to obtain a trained expression network.

[0017] Optionally, the training process of the malware detection model in S3 includes:

[0018] S31. Use the trained expression network to express software samples in different resource competition environments to obtain expression results of the training samples.

[0019] S32. Train a classifier according to the expression results of the training samples to obtain a trained malware detection model.

[0020] Optionally, the number of hardware performance counters is determined according to the number of hardware events.

[0021] The method for determining the number of hardware events includes:

[0022] Possible hardware events are obtained based on analysis by security experts, correlation calculation is performed on possible hardware events to obtain simplified hardware events, the simplified hardware events are combined to obtain a variety of simplified hardware event combination results, malware detection models are trained based on the various simplified hardware event combination results, and simplified hardware event combinations corresponding to the optimal malware detection model are obtained, and hardware events that need to be counted are determined based on the simplified hardware event combinations corresponding to the optimal malware detection model.

[0023] Optionally, the expression result includes a label of each software sample and / or a name of each software sample.

[0024] The labels of the software samples include whether the software samples are benign software or malicious software.

[0025] Optionally, determining in S4 whether the distribution of the hardware event results deviates includes:

[0026] A MAD value between the statistic of the hardware event result that has deviated and the statistic of the existing hardware event results is calculated, and whether the distribution of the hardware event results has deviated is determined based on a ratio of the MAD value to a preset second threshold.

[0027] On the other hand, a full life cycle malware detection device in a system resource competition environment is provided, and the device is applied to a full life cycle malware detection method in a system resource competition environment. The device includes:

[0028] The acquisition module is used to run the software under test in different resource competition environments and use at least one hardware performance counter to obtain hardware event results during the running of the software under test.

[0029] The expression module is used to input the hardware event results into the current expression network to obtain the expression results.

[0030] The malware detection module is used to input the expression result into the current malware detection model to obtain the malware detection result.

[0031] The output module is used to determine whether the distribution of hardware event results deviates and whether the number of deviated hardware events is higher than a preset threshold.

[0032] If so, the expression network and malware detection model are updated using the incremental learning method, and the updated expression network and malware detection model are used as the current expression network and malware detection model and transferred to the expression module.

[0033] If not, output the malware detection result.

[0034] Optionally, the expression module is further used to:

[0035] S21. Create different resource competition environments by running various benchmark programs, run software samples in different resource competition environments, and use at least one hardware performance counter to obtain sample hardware event results during the running of the software samples.

[0036] Among them, software samples include benign software samples and malware samples.

[0037] S22. Train the expression network according to the sample hardware event results to obtain a trained expression network.

[0038] Optionally, the malware detection module is further configured to:

[0039] S31. Use the trained expression network to express software samples in different resource competition environments to obtain expression results of the training samples.

[0040] S32. Train a classifier according to the expression results of the training samples to obtain a trained malware detection model.

[0041] Optionally, the number of hardware performance counters is determined according to the number of hardware events.

[0042] The method for determining the number of hardware events includes:

[0043] Possible hardware events are obtained based on analysis by security experts, correlation calculation is performed on possible hardware events to obtain simplified hardware events, the simplified hardware events are combined to obtain a variety of simplified hardware event combination results, malware detection models are trained based on the various simplified hardware event combination results, and simplified hardware event combinations corresponding to the optimal malware detection model are obtained, and hardware events that need to be counted are determined based on the simplified hardware event combinations corresponding to the optimal malware detection model.

[0044] Optionally, the expression result includes a label of each software sample and / or a name of each software sample.

[0045] The labels of the software samples include whether the software samples are benign software or malicious software.

[0046] Optionally, the output module is further configured to:

[0047] A MAD value between the statistic of the hardware event result that has deviated and the statistic of the existing hardware event results is calculated, and whether the distribution of the hardware event results has deviated is determined based on a ratio of the MAD value to a preset second threshold.

[0048] On the other hand, a full life cycle malware detection device is provided, the full life cycle malware detection device comprising: a processor; a memory, the memory storing computer-readable instructions, the computer-readable instructions, when executed by the processor, implement any one of the full life cycle malware detection methods under the system resource competition environment described above.

[0049] On the other hand, a computer-readable storage medium is provided, in which at least one instruction is stored. The at least one instruction is loaded and executed by a processor to implement any one of the above-mentioned full-life cycle malware detection methods under a system resource competition environment.

[0050] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0051] By adopting the present invention, when using hardware performance counters to detect malware, the detection model can be automatically updated according to changes in environmental samples and will not be affected by system resource competition. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0053] Figure 1 This is a flow chart of a method for detecting malware throughout its life cycle in a system resource competition environment provided by an embodiment of the present invention;

[0054] Figure 2 is a flow chart of a method for efficiently detecting malware in the entire life cycle under a system resource competition environment provided by an embodiment of the present invention;

[0055] Figure 3 It is a block diagram of a full life cycle malware detection device under a system resource competition environment provided by an embodiment of the present invention;

[0056] Figure 4 It is a structural schematic diagram of a full life cycle malware detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0058] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0059] In the embodiments of the present invention, the terms “of”, “corresponding”, “relevant” and “corresponding” may sometimes be used interchangeably. It should be noted that when the distinction between them is not emphasized, the meanings they intend to express are consistent.

[0060] In the embodiments of the present invention, sometimes a subscript such as W1 may be written as a non-subscript such as W1. When the difference is not emphasized, the meanings to be expressed are the same.

[0061] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0062] The embodiment of the present invention provides a full life cycle malware detection method under a system resource competition environment, which can be implemented by a full life cycle malware detection device, which can be a terminal or a server. Figure 2 The flowchart of the method for detecting malware in the whole life cycle under the system resource competition environment is shown. The processing flow of the method may include the following steps:

[0063] S1. Run the software under test in different resource competition environments, and use at least one hardware performance counter to obtain hardware event results during the running of the software under test.

[0064] The count of the Hardware Performance Counter (HPC) is easily affected by the system operation status, so that the count results of the same software using HPC twice are different.

[0065] There are usually two types of HPC-based malware detection models: one is a threshold-based detection method, which uses the total number of HPC events after the program ends as the threshold for detection; the other is to use an intelligent learning algorithm to establish a detection model based on the sampled data sequence monitored by HPC during the program running.

[0066] Existing studies rarely consider the impact of inaccurate HPC counts on HPC-based malware detection. Prior to the work of this invention, only two works discussed how HPC-based malware detection models (the first type of detection model and the second type of detection model) would be affected by HPC count fluctuations, but they did not provide a good solution, either in terms of correcting HPC data or in terms of detection model performance.

[0067] The present invention considers the impact of inaccurate HPC counting on the performance of HPC-based malware detection. Specifically, the present invention first conducts experiments to verify the impact of inaccurate counting on HPC-based malware detection. The experiment shows that when the HPC-based malware detection model detects the same batch of samples under different system resource competition environments, its detection performance decreases by about 20%. Because different types of resource competition are typical manifestations of different system operating states, it is more representative to verify the model effect in a resource competition environment.

[0068] Furthermore, the present invention provides how to establish a detection model with better performance when the HPC count value is affected by the system state, so that the detection performance is still good even when the system state changes.

[0069] The present invention uses a benchmark program to simulate the possible forms of system status. Specifically, the present invention first explores the possible system status and divides the possible system status into ten types, such as CPU resource competition, memory competition, etc.; considering that the benchmark program can also be divided into CPU intensive, memory intensive, etc., it is considered to use the benchmark program to simulate the system status. On this basis, tools such as Perf are used to obtain HPC data of program samples under various resource competitions, and the program HPC data is first expressed using a convolutional neural network, and then an HPC-based malware detection model is established based on the expression results. The modeling process is slightly different. Using the method of the present invention, the detection model continues to be effective in a resource competition interference environment (more in line with the real system environment).

[0070] The resource pressure simulator module of the present invention obtains the operating environment required for collecting the HPC-level behavior of typical programs by running benchmark programs. The present invention selects to run benchmark programs based on the following considerations. First, according to the type of resource competition (such as cache IO), the competition environment can be divided into different categories. Second, the characteristics of the resource competition environment can be characterized by running corresponding resource-intensive programs. Third, most of the programs in the benchmark test are resource-intensive programs. The main task of this module is to generate a controllable operating environment.

[0071] Further, the present invention designs a resource stress simulator based on a benchmark program, and the resource stress simulator based on the benchmark program is intended to generate a controllable resource competition environment, in which only benchmark programs of different types or load levels and programs to be monitored run together. The present invention uses stress-ng as a benchmark for generating a resource competition environment, because it provides specific operations on program execution required to change resource pressure, which is conducive to generating system environments with different load levels. Next, according to the source of resource competition, the present invention first divides background processes (such as programs running together with monitoring programs) into ten types: CPU intensive, cache intensive, VM intensive, memory intensive, I0 intensive, file intensive, device intensive, scheduler intensive, and interrupt intensive and operating system intensive. Then, the present invention reclassifies the benchmark programs according to the description of strss-ng to meet each type of resource intensive application. In this way, all benchmark programs that meet each type of resource intensive application form a type list. Note that even if a program is a combined consumption of several resources, it may not be obviously resource intensive, and the present invention can still represent this program by using a combination of several benchmark programs. There are also cases where some benchmark programs are classified into multiple categories of resource-intensive applications.

[0072] To generate a resource competition environment, the present invention runs a benchmark program of a certain type (such as iomix) from the type list as a background process. To avoid the impact of randomness of resource competition time on the HPC-level behavior of the program, the present invention first runs the benchmark program for a period of time and then starts running the program sample to be tested.

[0073] Here, a certain number of benign and malware samples need to be determined in advance. In the environment after running the benchmark program, all samples of benign and malware need to be run. Before running the benign and malware samples, the benchmark program must be running stably. To ensure that the running of malicious programs does not affect the subsequent system operation and scheduling, you can choose to run the malware in a container; a container is an upper-layer application isolated from the system. The purpose of this step is to use the benchmark program to create various resource competition environments to obtain hardware data for the software samples running in the resource competition environment.

[0074] In this setting, the present invention automatically collects the typical HPC-level behavior of each program sample. Similarly, the present invention increases the number of background processes (such as command -iomix 2, where 2 is the number of runs) and continues to collect the behavior of program samples. If insufficient memory is encountered, the benchmark program is skipped and the next benchmark program is continued to run as a background process. Further repeat the above steps, and run the next benchmark program of the current type in the type list (such as ioprio or aio) until all other types (such as cpu or crypt), and repeat the collection of HPC-level behavior of each program sample to be tested.

[0075] formal, , , …, , …, Represents each program sample, where is the number of program samples involved in training, It is Program sample. The present invention uses to represent the HPC-level behavior of a program sample under a resource competition environment, where It is the feature vector presented by the program sample at the mth moment, and M is the number of sampling times. ,in, represents the value of HPC event k at time m, K is the dimension of the feature vector (i.e., the number of HPC events). With the help of the resource pressure generator, the present invention obtains The HPC value is express.

[0076] Optionally, different resource competition environments can be implemented as follows: first run one or more of a certain type of benchmark programs, and if the benchmark program ends, continue to run in a loop, that is, first classify the benchmark programs according to the requirements for resource types, start at least one type of benchmark program, and use at least one benchmark program to create at least one type of resource competition environment; wherein, the benchmark programs should be resource-intensive applications, that is, each benchmark program should consume a lot of resources such as CPU or memory, and the benchmark programs can be SPEC2006, StressNG, etc.

[0077] Optionally, the hardware performance counters may be read using existing tools such as Perf and PAPI, or registers may be configured by the user.

[0078] Optionally, various benchmark programs are run to create different resource competition environments, software samples are run in different resource competition environments, and sample hardware event results during the running of the software samples are obtained using at least one hardware performance counter.

[0079] Among them, software samples may include benign software samples and malware samples.

[0080] Optionally, the number of hardware performance counters is determined according to the number of hardware events, and the method for determining the number of hardware events includes:

[0081] Possible hardware events are obtained based on analysis by security experts, correlation calculation is performed on possible hardware events to obtain simplified hardware events, the simplified hardware events are combined to obtain a variety of simplified hardware event combination results, malware detection models are trained based on the various simplified hardware event combination results, and simplified hardware event combinations corresponding to the optimal malware detection model are obtained, and hardware events that need to be counted are determined based on the simplified hardware event combinations corresponding to the optimal malware detection model.

[0082] In a feasible implementation, since the number of hardware performance counters is constrained by the CPU type, the number of hardware events selected should be smaller than the number of hardware counters configured in the CPU; the reading method of the hardware performance counters should take into account the existence of containers, and the readings should not be incorrect due to the existence of containers.

[0083] Furthermore, the way to obtain the count value of the hardware performance counter each time is based on a specific tool such as perf, and the sampling period δt is determined according to the running time of the software. The number of sampling times should not be too many, so that malware can be quickly detected based on a small number of sampling times. Because the malware has been effective due to long running, the detection loses its meaning.

[0084] The purpose of this step is to read the HPC data of each program sample running in different system environments monitored by the hardware performance counter in a certain way.

[0085] S2. Input the hardware event result into the current expression network to obtain the expression result.

[0086] Optionally, the training process of the expression network in S2 may include the following steps S21-S22:

[0087] S21. Construct a suitable expression network. Considering that the fluctuation of HPC counts is only reflected in the time dimension and the HPC behavior data of malware is sparse, a convolutional neural network can be selected to construct the expression network. The convolution kernel can be used to convolve in the time dimension to compress the relatively large HPC data and find the relationship between events at each time point.

[0088] S22. Train the expression network according to the sample hardware event results to obtain a trained expression network.

[0089] Furthermore, the hardware event results refer to the hardware event results of software samples under all different system resource competition environments, and serve as the input of the expression network; the output of the expression network can be the label of each sample or the name of each sample; the label can be both benign software and malicious software.

[0090] According to the hardware event results of the monitored software samples, the expression network such as convolutional neural network is trained. The loss in the training process can be reflected in two aspects: one is the loss between benign, malicious labels and real labels, and the other is the loss of the same software sample being misclassified in different resource competition environments.

[0091] The purpose of this step is to express the hardware performance counter data of the sample so that the sample data is least affected by resource competition, which is similar to the effect of filtering.

[0092] S3. Input the expression result into the current malware detection model to obtain the malware detection result.

[0093] Optionally, the training process of the malware detection model in S3 includes:

[0094] S31. Use the trained expression network to express software samples in different resource competition environments to obtain expression results of the training samples.

[0095] S32. Train a classifier according to the expression results of the training samples to obtain a trained malware detection model.

[0096] In a feasible implementation, when training the classifier, a commonly used machine learning algorithm may be used, such as support vector machine, random forest, logistic regression, etc. The model obtained after training is the malware detection model.

[0097] The purpose of this step is to obtain a malware detection model with higher accuracy.

[0098] S4. Determine whether the distribution of hardware event results deviates and whether the number of deviated hardware events is higher than a preset first threshold.

[0099] If so, the expression network and malware detection model are updated using an incremental learning method, and the updated expression network and malware detection model are used as the current expression network and malware detection model, and the process goes to step S2.

[0100] If not, output the malware detection result.

[0101] In a feasible implementation, at least one hardware performance counter is used to obtain the hardware event results during the operation of the software to be tested, and the results are judged to deviate from the result distribution of the hardware events of the existing software samples; there are many ways to judge the deviation of the distribution, such as calculating the (MedianAbsolute Deviation) MAD value between the result of the sample to be tested and the statistics of the existing results, and determining whether the sample to be tested deviates from the existing distribution based on the ratio of the MAD value and the threshold τ.

[0102] Specifically, the result distribution of hardware events of existing software samples refers to the result distribution of samples used to train the expression network, and the criterion for judging whether the result deviates from the result distribution of existing software samples is judged by using a statistic based on MAD. MAD is a distance The median absolute deviation from its median, where Describes the class in the latent space The distance between each sample in and its class center.

[0103] The core idea of ​​the MAD-based statistical judgment criterion is to estimate the data distribution of each class by calculating the MAD of the class. ( is the category subscript), and then calculate the distance from the sample to be tested to the center of a certain category ( Is the sample to be tested to the category The distance between the centroids, is the subscript of the sample to be tested), and the distance Subtract the median distance from each sample in the class to the class center , according to the distance difference ( )and If the ratio exceeds a certain threshold, it is considered that the distribution of the sample to be tested has changed relative to other samples of the same type; otherwise, it is considered that there has been no change.

[0104] The purpose of this step is to timely determine the deviation between the sample to be tested and the existing distribution, and to judge the applicability of the model in order to determine the update timing of each model in the step.

[0105] Furthermore, if no deviation occurs, continue to use the trained classifier to give the test result; if deviation occurs and the total number of samples deviating from the distribution is higher than the threshold τ d When the expression network and malware detection model are updated, the incremental learning method is used to update the expression network and malware detection model. After the update is completed, the previous step is repeated.

[0106] Incremental learning refers to a method in which the model only uses deviated samples to update the model. The main idea is to make the performance of the model not change significantly on the existing samples after the model parameters are updated. To this end, a penalty term can be added on the basis of the original loss. When the parameter changes greatly, a larger penalty is given.

[0107] Specifically, the incremental learning method is used to update the expression network and malware detection model. It should be ensured that after updating the parameters ( )’s performance on the original data remains almost unchanged; here, the incremental learning process is as follows: , where For the original loss, is the original parameter vector, is the parameter vector after incremental update, is the penalty term so that after updating the parameters ( )’s performance on the original data remains almost unchanged.

[0108] The purpose of this step is to update the various models in the entire step in a timely manner to keep the malware detection model running efficiently.

[0109] Through the above steps, the embodiment of the present invention can achieve the goal of efficiently detecting malware throughout its life cycle under a system resource competition environment.

[0110] The present invention focuses on two concepts, namely, system resource competition interference environment and full life cycle.

[0111] The system resource competition interference environment refers to the feature that the method described in this patent can resist the interference of the resource competition environment, and can still detect malware efficiently and accurately under the interference of the resource competition environment. The idea of ​​implementing the anti-interference method is to obtain the HPC data of software samples in various typical resource competition environments, and learn the characteristics of the data in various typical environments. Since the system environment is uncertain and the typical resource competition environment is difficult to control, the competition type is first classified according to the possible system resource competition, and then the method of running the benchmark program is selected to simulate the resource competition environment, thereby solving the problem of system resource competition interference. The specific details have been introduced in the first part of the specific implementation method.

[0112] The concept of the entire life cycle is to clarify the timing of model updates. For the selection of the update timing, the present invention provides a criterion based on the MAD statistic, that is, first determine whether the software sample to be tested deviates from the model sample. When the number of deviations is higher than the threshold, the model needs to be updated. It should be noted here that the selection of the update timing cannot be determined by whether the model performance has dropped by more than a certain threshold, because doing so implies an assumption: the distribution of the samples to be tested is consistent with the distribution when the model was established. However, due to changes in the samples to be tested, it is very likely that the current model is no longer applicable to detect the samples to be tested. Therefore, the present invention selects a method of determining whether the sample deviates from the distribution before using the model. Using this strategy, the model can be automatically updated to avoid the difficulty of manually determining the update time.

[0113] Furthermore, the concept of the entire life cycle requires not only the specific update moment, but also a specific description of the update plan. The conventional solution is to integrate the original samples and new samples, and retrain the model to maintain the applicability of the model. This undoubtedly increases the time cost and indirectly reduces the efficiency of malware detection. The present invention requires that the performance of the updated model should not be reduced when detecting the original samples. Accordingly, the model adopts the principle of incremental update. This update method requires that the change in its parameters after the model is updated (i.e., the model parameter update) should not be too large to avoid model performance loss when detecting the original samples. Therefore, the present invention adds a penalty term on the basis of the original loss for constraint. This has the advantage of avoiding the need to retrain the model using the original data set, shortening the model update time, and facilitating the model to quickly detect malware.

[0114] By adopting the present invention, when using hardware performance counters to detect malware, the detection model can be automatically updated according to changes in environmental samples and will not be affected by system resource competition.

[0115] Figure 3 This is a block diagram of a device for detecting malware throughout its life cycle in a system resource competition environment according to an exemplary embodiment. The device is used in a method for detecting malware throughout its life cycle in a system resource competition environment. Figure 3 The device includes an acquisition module 310, an expression module 320, a malware detection module 330 and an output module 340. Among them:

[0116] The acquisition module 310 is used to run the software under test in different resource competition environments, and use at least one hardware performance counter to obtain hardware event results during the running of the software under test.

[0117] The expression module 320 is used to input the hardware event result into the current expression network to obtain the expression result.

[0118] The malware detection module 330 is used to input the expression result into the current malware detection model to obtain the malware detection result.

[0119] The output module 340 is used to determine whether the distribution of the hardware event results deviates and whether the number of deviated hardware events is higher than a preset threshold.

[0120] If so, the expression network and malware detection model are updated using the incremental learning method, and the updated expression network and malware detection model are used as the current expression network and malware detection model and transferred to the expression module.

[0121] If not, output the malware detection result.

[0122] Optionally, the expression module 320 is further configured to:

[0123] S21. Create different resource competition environments by running various benchmark programs, run software samples in different resource competition environments, and use at least one hardware performance counter to obtain sample hardware event results during the running of the software samples.

[0124] Among them, software samples include benign software samples and malware samples.

[0125] S22. Train the expression network according to the sample hardware event results to obtain a trained expression network.

[0126] Optionally, the malware detection module 330 is further configured to:

[0127] S31. Use the trained expression network to express software samples in different resource competition environments to obtain expression results of the training samples.

[0128] S32. Train a classifier according to the expression results of the training samples to obtain a trained malware detection model.

[0129] Optionally, the number of hardware performance counters is determined according to the number of hardware events.

[0130] The method for determining the number of hardware events includes:

[0131] Possible hardware events are obtained based on analysis by security experts, correlation calculation is performed on possible hardware events to obtain simplified hardware events, the simplified hardware events are combined to obtain a variety of simplified hardware event combination results, malware detection models are trained based on the various simplified hardware event combination results, and simplified hardware event combinations corresponding to the optimal malware detection model are obtained, and hardware events that need to be counted are determined based on the simplified hardware event combinations corresponding to the optimal malware detection model.

[0132] Optionally, the expression result includes a label of each software sample and / or a name of each software sample.

[0133] The labels of the software samples include whether the software samples are benign software or malicious software.

[0134] Optionally, the output module 340 is further configured to:

[0135] A MAD value between the statistic of the hardware event result that has deviated and the statistic of the existing hardware event results is calculated, and whether the distribution of the hardware event results has deviated is determined based on a ratio of the MAD value to a preset second threshold.

[0136] By adopting the present invention, when using hardware performance counters to detect malware, the detection model can be automatically updated according to changes in environmental samples and will not be affected by system resource competition.

[0137] Figure 4 is a schematic diagram of the structure of a full life cycle malware detection device provided by an embodiment of the present invention, such as Figure 4 As shown, the full life cycle malware detection equipment may include the above Figure 3 The full life cycle malware detection device in a system resource competition environment is shown. Optionally, the full life cycle malware detection device 410 may include a first processor 2001 .

[0138] Optionally, the full life cycle malware detection device 410 may also include a memory 2002 and a transceiver 2003 .

[0139] The first processor 2001, the memory 2002 and the transceiver 2003 may be connected via a communication bus.

[0140] Combine the following Figure 4 The components of the full life cycle malware detection device 410 are described in detail:

[0141] The first processor 2001 is the control center of the full life cycle malware detection device 410, which can be a processor or a general term for multiple processing elements. For example, the first processor 2001 is one or more central processing units (CPUs), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more microprocessors (digital signal processors, DSPs), or one or more field programmable gate arrays (field programmable gate arrays, FPGAs).

[0142] Optionally, the first processor 2001 can perform various functions of the full life cycle malware detection device 410 by running or executing a software program stored in the memory 2002 and calling data stored in the memory 2002.

[0143] In a specific implementation, as an embodiment, the first processor 2001 may include one or more CPUs, such as Figure 4 CPU0 and CPU1 are shown in FIG.

[0144] In a specific implementation, as an embodiment, the full life cycle malware detection device 410 may also include multiple processors, such as Figure 4 The first processor 2001 and the second processor 2004 are shown in FIG. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0145] The memory 2002 is used to store the software program for executing the solution of the present invention, and is controlled to be executed by the first processor 2001. The specific implementation method can refer to the above method embodiment, which will not be repeated here.

[0146] Optionally, the memory 2002 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 2002 may be integrated with the first processor 2001, or may exist independently, and may be accessed through the interface circuit ( Figure 4 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0147] The transceiver 2003 is used to communicate with a network device or a terminal device.

[0148] Optionally, the transceiver 2003 may include a receiver and a transmitter ( Figure 4 The receiver is used to implement a receiving function, and the transmitter is used to implement a sending function.

[0149] Optionally, the transceiver 2003 may be integrated with the first processor 2001, or may exist independently and be connected to the first processor 2001 through the interface circuit ( Figure 4 (not shown) is coupled to the first processor 2001, which is not specifically limited in this embodiment of the present invention.

[0150] It should be noted that Figure 4 The structure of the full life cycle malware detection device 410 shown in the figure does not constitute a limitation on the router. The actual knowledge structure identification device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0151] In addition, the technical effects of the full-life cycle malware detection device 410 can refer to the technical effects of the full-life cycle malware detection method under the system resource competition environment described in the above method embodiment, and will not be repeated here.

[0152] It should be understood that the first processor 2001 in the embodiment of the present invention may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0153] It should also be understood that the memory in the embodiments of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0154] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0155] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0156] In the present invention, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0157] It should be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0158] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0159] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described equipment, devices and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0160] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0161] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0162] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0163] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0164] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A method for detecting malware throughout its life cycle under a system resource competition environment, characterized in that: The method comprises: S1. Run the software under test in different resource competition environments, and use at least one hardware performance counter to obtain hardware event results during the running of the software under test; S2, inputting the hardware event result into the current expression network to obtain an expression result; S3, inputting the expression result into the current malware detection model to obtain a malware detection result; S4, determining whether the distribution of the hardware event results deviates and whether the number of hardware events that deviate is higher than a preset first threshold; If yes, then use the incremental learning method to update the expression network and malware detection model, use the updated expression network and malware detection model as the current expression network and malware detection model, and proceed to step S2; If not, output the malware detection result.

2. The method for detecting malware throughout its life cycle under a system resource competition environment according to claim 1, characterized in that: The training process of the expression network in S2 includes: S21, running various benchmark programs to create different resource competition environments, running software samples in different resource competition environments, and using at least one hardware performance counter to obtain sample hardware event results during the running of the software samples; Wherein, the software samples include benign software samples and malicious software samples; S22: Train an expression network according to the sample hardware event results to obtain a trained expression network.

3. The method for detecting malware throughout its life cycle under a system resource competition environment according to claim 1, characterized in that: The training process of the malware detection model in S3 includes: S31. Using the trained expression network to express software samples in different resource competition environments, obtain expression results of the training samples; S32. Train a classifier according to the expression results of the training samples to obtain a trained malware detection model.

4. The method for detecting malware throughout its life cycle under a system resource competition environment according to claim 1, characterized in that: The number of the hardware performance counters is determined according to the number of hardware events; The method for determining the number of hardware events includes: Possible hardware events are obtained based on analysis by security experts, correlation calculation is performed on the possible hardware events to obtain simplified hardware events, the simplified hardware events are combined to obtain a plurality of simplified hardware event combination results, malware detection models are trained respectively according to the plurality of simplified hardware event combination results to obtain a simplified hardware event combination corresponding to an optimal malware detection model, and hardware events that need to be counted are determined according to the simplified hardware event combination corresponding to the optimal malware detection model.

5. The method for detecting malware throughout its life cycle under a system resource competition environment according to claim 1, characterized in that: The expression result includes a label of each software sample and / or a name of each software sample; The labels of the software samples include whether the software samples are benign software or malicious software.

6. The method for detecting malware throughout its life cycle in a system resource competition environment according to claim 1, characterized in that: The step of determining whether the distribution of the hardware event results deviates in S4 includes: A MAD value between the statistic of the hardware event result that has deviated and the statistic of the existing hardware event results is calculated, and whether the distribution of the hardware event result has deviated is determined based on a ratio of the MAD value to a preset second threshold.

7. A full life cycle malware detection device under a system resource competition environment, the full life cycle malware detection device under a system resource competition environment is used to implement the full life cycle malware detection method under a system resource competition environment as claimed in any one of claims 1 to 6, characterized in that: The device comprises: An acquisition module, used to run the software under test in different resource competition environments, and use at least one hardware performance counter to obtain hardware event results during the running of the software under test; An expression module, used for inputting the hardware event result into the current expression network to obtain an expression result; A malware detection module, used for inputting the expression result into a current malware detection model to obtain a malware detection result; An output module, used to determine whether the distribution of the hardware event results deviates and whether the number of hardware events that deviate is higher than a preset threshold; If yes, the expression network and malware detection model are updated using the incremental learning method, and the updated expression network and malware detection model are used as the current expression network and malware detection model and transferred to the expression module; If not, output the malware detection result.

8. The full life cycle malware detection device under system resource competition environment according to claim 7, characterized in that: The training process of the expression network includes: S21, running various benchmark programs to create different resource competition environments, running software samples in different resource competition environments, and using at least one hardware performance counter to obtain sample hardware event results during the running of the software samples; Wherein, the software samples include benign software samples and malicious software samples; S22: Train an expression network according to the sample hardware event results to obtain a trained expression network.

9. A full life cycle malware detection device, characterized in that: The full life cycle malware detection device includes: processor; A memory having computer-readable instructions stored thereon, wherein when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 6.

Images