Malicious software detection model training and detection method and device and storage medium
By generating and adjusting data sets and adjusting parameters of pre-trained models, the problems of low intelligence level and high hardware resource consumption in existing malware detection technologies are solved, and efficient and intelligent malware detection is achieved.
Patent Information
- Application Number
- CN202311114286.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-30
- Publication Date
- 2025-03-07
AI Technical Summary
Existing malware detection technologies have problems with low intelligence and high hardware resources, especially rule-based detection requires continuous update of rules, while machine learning-based detection requires a large number of samples and hardware resources.
By obtaining the behavior report data of historical malware and normal software, generating and adjusting the data set, parameter adjustment of the pre-trained generative model based on self-attention mechanism, and obtaining the malware detection model. The model runs in a virtual execution environment, generates behavior report data, and formats the API execution sequence and behavior data to obtain sample data.
It effectively shortens the model training time and hardware resource consumption, improves the intelligence level and efficiency of malware detection, and can dynamically update the model to identify new malware.
Smart Images
Figure CN119577745A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of software detection, and in particular to a training and detection method, device and storage medium for a malware detection model. Background Art
[0002] With the rapid development of communication and Internet technologies, information exchange has become more frequent, and various types of malware have also increased. In related technologies, malware detection can be achieved based on dynamic behavior, mainly including the following two methods:
[0003] Method 1: Based on rules, the dynamic behavior of the software is scored, where the higher the score, the higher the maliciousness;
[0004] Method 2: Based on machine learning, first use a large number of malware and normal software to train the model, then send the unknown file into the model for prediction. The model will output the probability that the unknown file is malware.
[0005] However, the above rule-based method 1 relies on security experts to write rules. As malware is constantly updated and iterated, it is necessary to continuously write rules to detect newly emerging malware, which has the defect of low intelligence level; the above machine learning-based method 2 requires a large amount of malware and normal software during training, and model training consumes a lot of hardware resources; in addition, it is necessary to continuously update training data and retrain the model to ensure the detection effect of the model. The training and updating of the model will affect the detection efficiency of malware and consume too many hardware resources. Summary of the invention
[0006] In view of this, the embodiments of the present application provide a malware detection model training and detection method, device and storage medium, aiming to effectively improve the efficiency and intelligence level of malware detection.
[0007] The technical solution of the embodiment of the present application is implemented as follows:
[0008] In a first aspect, an embodiment of the present application provides a method for training a malware detection model, comprising:
[0009] Acquire an adjustment data set for model adjustment, wherein the adjustment data set is generated based on historical behavior report data of malware samples and behavior report data of normal software samples;
[0010] Based on the adjustment data set, parameters of the pre-trained first detection model are adjusted to obtain a malware detection model; wherein the first detection model is a generative pre-trained model based on a self-attention mechanism.
[0011] In the above solution, the step of obtaining an adjustment data set for model adjustment includes:
[0012] Obtain historical malware samples and normal software samples within a set period of time;
[0013] Execute each sample based on the virtual execution environment to obtain behavior report data of each sample;
[0014] Generate sample data of each sample based on the behavior report data of each sample;
[0015] Based on the sample data of each sample, an adjustment data set for model adjustment is obtained.
[0016] In the above solution, the virtual execution environment includes: at least two different virtual execution sub-environments, and the behavior report data of each sample corresponds to the virtual execution sub-environment one by one; the sample data of each sample is generated based on the behavior report data of each sample, including:
[0017] Obtaining behavior report data generated by the sample running in each of the virtual execution sub-environments, the behavior report data including: behavior data and API (Application Programming Interface) execution sequence;
[0018] For at least two behavior report data of each sample, determine target behavior report data of the sample based on the length of the API execution sequence and / or the number of behaviors in the behavior data;
[0019] The target behavior report data is formatted to obtain sample data of the sample.
[0020] In the above solution, the at least two behavior report data for each sample, based on the length of the API execution sequence and the number of behaviors in the behavior data, determine the target behavior report data of the sample, including:
[0021] From at least two behavior report data of each sample, select the behavior report data whose length of the API execution sequence is greater than a set value;
[0022] From the selected behavior report data, the behavior report data with the largest number of behaviors in the behavior data is used as the target behavior report data of the corresponding sample.
[0023] In the above scheme, the method further includes:
[0024] Obtain unsupervised pre-training sample set;
[0025] Based on the unsupervised pre-training sample set, unsupervised pre-training is performed on the neural network structure model to generate the pre-trained first detection model.
[0026] In the above solution, the step of adjusting the parameters of the pre-trained first detection model based on the adjustment data set to obtain a malware detection model includes:
[0027] Dividing the adjustment data set into a training data set and a validation data set;
[0028] Based on the preset detection task and the training data set, adjusting parameters of the first detection model;
[0029] Verifying the adjusted first detection model based on the verification data set to generate a verification result;
[0030] Based on the verification result, the malware detection model is generated.
[0031] In the above solution, after obtaining the malware detection model, the method further includes:
[0032] Obtaining a tuning dataset for model tuning;
[0033] Parameters of the malware detection model are adjusted based on the adjustment data set to obtain an updated malware detection model.
[0034] In a second aspect, an embodiment of the present application provides a method for detecting malware, including:
[0035] Obtain sample data of the software to be tested;
[0036] The sample data of the software to be detected is input into the malware detection model trained by the method described in the first aspect of the embodiment of the present application to obtain the detection result of the software to be detected.
[0037] In the above solution, the step of obtaining sample data of the software to be tested includes:
[0038] Obtaining behavior report data generated by running the software to be detected in at least two different virtual execution sub-environments, wherein the behavior report data includes: behavior data and API execution sequence;
[0039] For at least two behavior report data, based on the length of the API execution sequence and the number of behaviors in the behavior data, determine the target behavior report data of the software to be detected;
[0040] The target behavior report data is formatted to obtain sample data of the software to be detected.
[0041] In a third aspect, an embodiment of the present application provides a training device for a malware detection model, comprising:
[0042] A first acquisition module, configured to acquire an adjustment data set for model adjustment, wherein the adjustment data set is generated based on historical behavior report data of malware samples and behavior report data of normal software samples;
[0043] An adjustment module is used to adjust parameters of a pre-trained first detection model based on the adjustment data set to obtain a malware detection model; wherein the first detection model is a generative pre-trained model based on a self-attention mechanism.
[0044] In a fourth aspect, an embodiment of the present application provides a malware detection device, including:
[0045] The second acquisition module is used to acquire sample data of the software to be tested;
[0046] The detection module is used to input the sample data of the software to be detected into the malware detection model trained by the training device as described in the third aspect of the embodiment of the present application to obtain the detection result of the software to be detected.
[0047] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein when the processor is used to run the computer program, the steps of the method described in any aspect of the embodiment of the present application are executed.
[0048] In a sixth aspect, an embodiment of the present application provides a computer storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any aspect of the embodiment of the present application are implemented.
[0049] The technical solution provided in the embodiment of the present application obtains an adjustment data set for model adjustment, the adjustment data set is generated based on the behavior report data of historical malware samples and the behavior report data of normal software samples; based on the adjustment data set, the parameters of the pre-trained first detection model are adjusted to obtain a malware detection model; wherein the first detection model is a generative pre-trained model based on the self-attention mechanism. In the embodiment of the present application, the parameters of the first detection model can be adjusted based on the adjustment data set to obtain a malware detection model, which effectively shortens the time and hardware resources required for traditional machine learning-based model training, thereby improving the detection efficiency on the basis of improving the intelligence level of malware detection and saving hardware resource overhead. BRIEF DESCRIPTION OF THE DRAWINGS
[0050] Figure 1 A flowchart of a method for training a malware detection model according to an embodiment of the present application;
[0051] Figure 2A schematic diagram of a flow chart of a method for detecting malware according to an embodiment of the present application;
[0052] Figure 3 A schematic diagram of the workflow of malware detection in an application example of this application;
[0053] Figure 4 A schematic diagram of the principle of constructing a fine-tuning dataset in an application example of this application;
[0054] Figure 5 This is a schematic diagram of the principles of pre-training and fine-tuning of a secure GPT model in an application example of this application;
[0055] Figure 6 This is a schematic diagram of the principle of model reasoning in an application example of this application;
[0056] Figure 7 A schematic diagram of the structure of a training device for a malware detection model according to an embodiment of the present application;
[0057] Figure 8 This is a schematic diagram of the structure of a malware detection device according to an embodiment of the present application;
[0058] Fig. 9 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION
[0059] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments.
[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.
[0061] In related technologies, malware detection either relies on security experts to write rules, resulting in low rule iteration efficiency and intelligence level, or is based on machine learning, resulting in a large number of samples required for model training, affecting detection efficiency and consuming too many hardware resources.
[0062] Based on this, in various embodiments of the present application, a training method for a malware detection model and a detection method based on the malware detection model are provided, which can effectively improve the efficiency and intelligence level of malware detection.
[0063] Exemplarily, the present application embodiment provides a method for training a malware detection model, such as Figure 1 As shown, the training method includes:
[0064] Step 101 : obtaining an adjustment data set for model adjustment, wherein the adjustment data set is generated based on historical behavior report data of malware samples and behavior report data of normal software samples.
[0065] Here, the adjustment data set is used for model adjustment (also known as model fine-tuning). Exemplarily, the adjustment data set can be generated based on the behavior report data of malware samples and the behavior report data of normal software samples within a recent set time period (for example, a week or a month). Among them, malware samples and normal software samples can be selected based on activity. For example, the software on the network can be sorted based on an activity index that characterizes activity, and the top M normal software are selected as normal software samples, and the top N malware are selected as malware samples, where M and N are natural numbers greater than 1.
[0066] Here, the behavior report data may include: behavior data and API execution sequence obtained by running the software based on the virtual environment. For example, the behavior data may include: file behavior, registry behavior, network behavior and other behaviors of the sample. The API execution sequence may include the record of the API corresponding to the above corresponding behaviors, wherein the API is a set of predefined functions, the purpose of which is to provide application programs and developers with the ability to access a set of routines based on certain software or hardware without accessing the source code or understanding the details of the internal working mechanism.
[0067] Step 102: Adjust parameters of a pre-trained first detection model based on the adjustment data set to obtain a malware detection model; wherein the first detection model is a generative pre-trained model based on a self-attention mechanism.
[0068] Here, generative pre-trained models refer to self-supervised learning on large-scale unlabeled text data through pre-trained models, which achieves powerful natural language processing capabilities. The core idea of these models is to obtain a deep understanding and generative ability of language by learning the statistical patterns of large amounts of text data. The self-attention mechanism refers to the attention mechanism that occurs between elements within the input sentence or between elements within the output sentence.
[0069] It can be understood that the embodiments of the present application can obtain a pre-trained generative pre-trained model based on the self-attention mechanism, that is, obtain a first detection model, which has a certain malware detection capability, and then adjust the parameters of the first detection model based on the adjustment data set to obtain a malware detection model, which effectively shortens the time and hardware resources required for traditional machine learning-based model training, and thus can improve the detection efficiency on the basis of improving the intelligence level of malware detection and save hardware resource overhead.
[0070] Exemplarily, the first detection model can be a generative pre-trained model based on Transformer, also known as GPT (Generative pre-trained transformers). Among them, Transformer is a deep learning algorithm based on the self-attention mechanism, which is inspired by the fact that humans only focus on important things and only learns important information in the input sequence. The GPT in the embodiment of the present application can adopt a self-supervised learning method, first pre-training on a large amount of unlabeled text data, and then fine-tuning on the data of a specific task (i.e., the adjustment data set of the embodiment of the present application), which can perform hyperparameter fine-tuning to complete various natural language processing tasks, such as text generation, code generation, video generation, text question and answer, image generation, paper writing, film and television creation, scientific experiment design, etc.
[0071] It is understandable that in order to adjust the parameters of the first detection model, it is necessary to first obtain the aforementioned adjustment data set. Exemplarily, the acquisition of the adjustment data set for model adjustment includes:
[0072] Obtain historical malware samples and normal software samples within a set period of time;
[0073] Execute each sample based on the virtual execution environment to obtain behavior report data of each sample;
[0074] Generate sample data of each sample based on the behavior report data of each sample;
[0075] Based on the sample data of each sample, an adjustment data set for model adjustment is obtained.
[0076] In an application example, active malware samples and normal software samples in the last month may be obtained, wherein the active malware samples or normal software samples refer to a set number of software that are ranked top after being sorted based on an activity index.
[0077] Here, considering that in different virtual execution environments, samples may exhibit different behaviors. For example, some malware will identify the current operating environment and then decide whether to execute malicious behavior. Based on this, the virtual execution environment includes: at least two different virtual execution sub-environments, and the behavior report data of each sample corresponds one-to-one to the virtual execution sub-environment. Exemplarily, corresponding sandboxes can be constructed for different virtual execution sub-environments to form a sandbox cluster. For example, the sandbox cluster can include but is not limited to: Win7 32-bit / 64-bit, win10, IOS, LINUX and other operating environments. In this way, the complete behavior report data corresponding to the sample can be obtained.
[0078] Exemplarily, the generating of sample data of each sample based on the behavior report data of each sample includes:
[0079] Obtaining behavior report data generated by running the sample in each of the virtual execution sub-environments, the behavior report data including: behavior data and API execution sequence;
[0080] For at least two behavior report data of each sample, determine target behavior report data of the sample based on the length of the API execution sequence and / or the number of behaviors in the behavior data;
[0081] The target behavior report data is formatted to obtain sample data of the sample.
[0082] It is understandable that the behavior report data generated by each sample in different virtual execution sub-environments may be different. Based on this, it is necessary to select target behavior report data from multiple behavior report data, and then obtain sample data that characterizes the sample, which is conducive to subsequent model adjustment and model-based malicious detection.
[0083] Exemplarily, the at least two behavior report data for each sample, based on the length of the API execution sequence and the number of behaviors in the behavior data, determine the target behavior report data of the sample, including:
[0084] From at least two behavior report data of each sample, select the behavior report data whose length of the API execution sequence is greater than a set value;
[0085] From the selected behavior report data, the behavior report data with the largest number of behaviors in the behavior data is used as the target behavior report data of the corresponding sample.
[0086] In an application example, the set value can be 7, that is, behavior report data with an API execution sequence length greater than 7 is selected from multiple behavior report data of the sample, that is, behavior report data with an API execution sequence length greater than 7 is used as valid behavior report data, and behavior report data with the largest number of behaviors is selected from the valid behavior report data as the target behavior report data of the sample.
[0087] It is understandable that in other application examples, target behavior report data representing the sample can also be selected from multiple behavior report data of the sample based on the length of the API execution sequence or the number of behaviors in the behavior data. For example, the behavior report data with the longest API execution sequence is selected as the target behavior report data, or the behavior report data with the largest number of behaviors in the behavior data is selected as the target behavior report data.
[0088] It should be noted that selecting target behavior report data based on the length of the API execution sequence and / or the number of behaviors in the behavior data can make the behavior information of the sample most complete and rich, and then be able to select target behavior report data that can represent the sample from the behavior report data generated in different virtual execution sub-environments, which is conducive to model fine-tuning and subsequent reasoning applications.
[0089] In an application example, the target behavior report data is formatted and the sample data of the sample obtained may include:
[0090] The API execution sequence in the target behavior report data is obtained, and based on the execution time sequence, the name of the API in the API execution sequence is extracted to obtain the sample data of the sample.
[0091] It can be understood that by extracting the name of the API in the API execution sequence and generating sample data based on the API name of the API execution sequence, the amount of sample data can be effectively reduced, which is conducive to improving the efficiency of model adjustment.
[0092] It is understandable that before adjusting the parameters of the first detection model, it is necessary to construct the first detection model. Based on this, the training method further includes:
[0093] Obtain unsupervised pre-training sample set;
[0094] Based on the unsupervised pre-training sample set, unsupervised pre-training is performed on the neural network structure model to generate the pre-trained first detection model.
[0095] Exemplarily, a large amount of security knowledge, security data, etc. can be obtained, and the aforementioned unsupervised pre-training sample set can be constructed based on the pre-processed security knowledge and security data.
[0096] Here, security knowledge refers to the knowledge that experts in the information security industry need to know, which may include but is not limited to: concepts and definitions of special terms in the field of information security, laws, regulations and industry standards related to the information security industry, and methods and processes for actual operation of specific technical positions; security data refers to data output or used by information security products, which may include but is not limited to: alarms and detailed logs of security products, and threat intelligence. The above preprocessing may include but is not limited to: word segmentation, tokenization, removal of stop words and special symbols, etc., to facilitate subsequent model pre-training.
[0097] Exemplarily, the embodiment of the present application adopts a generative pre-training model based on Transformer, which includes a multi-layer self-attention mechanism and a feedforward neural network. Before pre-training, hyperparameters such as the number of layers, the number of hidden units, and the number of attention heads of the model can be defined and randomly initialized. Pre-training is carried out by means of unsupervised learning (also known as self-supervised learning), that is, the model has no training labels or manual annotation guidance in the pre-training stage. During the pre-training process, the model, according to the self-attention mechanism of Transformer, covers some words or fragments in the text, and then predicts the content of these covered parts. The model learns the contextual information, grammatical structure and semantic representation in the text by predicting the covered parts.
[0098] After the pre-training phase is completed, the parameters of the first detection model will be saved as the initial parameters of the pre-trained model. These pre-trained parameters will contain the knowledge and semantic representation learned by the model on large-scale network security text data.
[0099] It is understandable that since the first detection model has learned the semantic representation and knowledge in the field of network security on large-scale network security text data, in order to better meet the needs of malware detection, it is necessary to fine-tune the pre-trained first detection model to make it more suitable for specific malware detection tasks and improve the accuracy of detection.
[0100] Exemplarily, the adjusting parameters of the pre-trained first detection model based on the adjustment data set to obtain a malware detection model includes:
[0101] Dividing the adjustment data set into a training data set and a validation data set;
[0102] Based on the preset detection task and the training data set, adjusting parameters of the first detection model;
[0103] Verifying the adjusted first detection model based on the verification data set to generate a verification result;
[0104] Based on the verification result, the malware detection model is generated.
[0105] Here, the preset detection tasks are tasks related to malware detection, for example, including but not limited to: the type of threat, the level of threat, possible affected systems, etc.
[0106] Exemplarily, the aforementioned constructed adjustment data set can be divided into a training data set and a validation data set, and the parameters of the first detection model are adjusted based on the preset detection task and the training data set. For example, during the parameter adjustment process, the parameters of the model will be optimized according to the training data and the task objectives. The fine-tuning process uses optimization algorithms such as gradient descent to update the parameters of the model. After the above-mentioned fine-tuning is completed, the model can be evaluated using the validation data set to ensure the performance of the model on the malware detection task. Based on the evaluation results, hyperparameter tuning is performed to achieve the best performance. In this way, by fine-tuning the pre-trained first detection model, it is made more suitable for the task of malware detection, thereby improving the accuracy and effect of malware detection.
[0107] It should be noted that since the pre-trained model has learned a lot of relevant knowledge in the field of information security, relatively less data can be used to achieve better results during the fine-tuning process, thereby shortening the adjustment time and reducing the consumption of hardware resources.
[0108] It is understandable that in practical applications, the malware detection model can also be updated based on the latest adjustment data set. Based on this, after obtaining the malware detection model, the training method further includes:
[0109] Obtaining a tuning dataset for model tuning;
[0110] Parameters of the malware detection model are adjusted based on the adjustment data set to obtain an updated malware detection model.
[0111] It is understandable that the update process of the malware detection model can refer to the aforementioned process of adjusting the parameters of the first detection model, which will not be repeated here. In this way, the dynamic update of the malware detection model can be achieved, and new malware can be effectively identified, effectively ensuring network security.
[0112] Exemplarily, the present application also provides a method for detecting malware, such as Figure 2 As shown, the detection method includes:
[0113] Step 201, obtaining sample data of the software to be tested.
[0114] Step 202: input the sample data of the software to be detected into a malware detection model trained by a training method of a malicious detection model to obtain a detection result of the software to be detected.
[0115] Here, a malware detection model is obtained by training the malware detection model training method described above in the embodiment of the present application. The malware detection model uses sample data of the software to be detected as input data, and performs reasoning based on the sample data to obtain a detection result of whether the software to be detected is malware. Since the malware detection model training method of the embodiment of the present application is different from the traditional machine learning-based model, the detection method can improve the detection efficiency on the basis of improving the intelligence level of malware detection and save hardware resource overhead.
[0116] Exemplarily, the obtaining of sample data of the software to be tested includes:
[0117] Obtaining behavior report data generated by running the software to be detected in at least two different virtual execution sub-environments, wherein the behavior report data includes: behavior data and API execution sequence;
[0118] For at least two behavior report data, determine target behavior report data of the software to be detected based on the length of the API execution sequence and / or the number of behaviors in the behavior data;
[0119] The target behavior report data is formatted to obtain sample data of the software to be detected.
[0120] Exemplarily, for at least two behavior report data, determining the target behavior report data of the software to be detected based on the length of the API execution sequence and the number of behaviors in the behavior data includes:
[0121] From the at least two behavior report data, select the behavior report data whose length of the API execution sequence is greater than a set value;
[0122] From the selected behavior report data, the behavior report data having the largest number of behaviors in the behavior data is used as the target behavior report data of the software to be detected.
[0123] It is understandable that since the behavior report data generated by the software to be tested in different virtual execution sub-environments may be different, by selecting the behavior report data whose length of the API execution sequence is greater than the set value, and from the selected behavior report data, taking the behavior report data with the largest number of behaviors in the behavior data as the target behavior report data of the software to be tested, the behavior information of the target behavior report data can be made the most complete and rich, which is conducive to improving the accuracy of model reasoning.
[0124] In an application example, the set value can be 7, that is, behavior report data with an API execution sequence length greater than 7 is selected from multiple behavior report data of the software to be detected. In other words, behavior report data with an API execution sequence length greater than 7 is used as valid behavior report data, and behavior report data with the largest number of behaviors is selected from the valid behavior report data as the target behavior report data of the software to be detected.
[0125] In an application example, converting the target behavior report data into a format to obtain sample data of the software to be detected may include:
[0126] The API execution sequence in the target behavior report data is obtained, and based on the execution time sequence, the name of the API in the API execution sequence is extracted to obtain the sample data of the software to be detected.
[0127] It can be understood that by extracting the name of the API in the API execution sequence and generating sample data based on the API name of the API execution sequence, the amount of sample data can be effectively reduced, which is conducive to improving the efficiency of model detection.
[0128] The present application is described in further detail below in conjunction with application examples.
[0129] like Figure 3 As shown in the figure, malware detection in this application example mainly involves the construction of fine-tuning datasets, pre-training and fine-tuning of secure GPT models, model reasoning, and model updates. The following is an exemplary description of each link.
[0130] 1. Construction of fine-tuning dataset
[0131] like Figure 4 As shown, in this application example, the construction of the fine-tuning dataset (i.e., the aforementioned adjustment dataset) specifically includes:
[0132] 1) Obtain the behavior report data of malware samples and normal software samples that have been active within the recent set period of time.
[0133] Here, each sample can be executed through the sandbox cluster, and the file behavior, registry behavior, network behavior and API execution sequence of each sample can be recorded to generate the sample's behavior report data. Since a sample can be executed in multiple sandbox operating environments, and the sample may have different behaviors in different operating environments, it is necessary to let the sample execute in multiple operating environments in order to obtain more complete behavior report data, that is, a sample can obtain the behavior report data corresponding to each sandbox in the sandbox cluster.
[0134] 2) Filter the target behavior report data of malware samples and normal software samples.
[0135] It is understandable that some samples are not executed and there is no data in the behavior report data. Only the recorded parts in the behavior report data are filtered. In addition, there are certain differences in the behavior report data generated by a single software in different operating environments. Based on this, it is necessary to select the behavior report data with the most recorded sample behaviors and an API execution sequence length greater than 7 from the multiple behavior report data of each of the above samples, and use this behavior report data as the target behavior report data of the sample.
[0136] 3) Organize the data into a fine-tuning dataset in a unified format.
[0137] The target behavior report data of the sample will contain the API execution sequences of multiple processes, which are organized into an API execution sequence according to the time of API execution. Then, the API execution sequence only retains the API name without retaining the parameters, and then the sample data of the sample is obtained and constitutes a fine-tuning dataset. Among them, the API execution sequence with the API name retained is used as the question of the secure GPT, and the label of the sample is used as the answer of the secure GPT.
[0138] 2. Secure GPT model pre-training and fine-tuning
[0139] like Figure 5 As shown, a large amount of security knowledge, security data, etc. can be obtained, and an unsupervised pre-training sample set can be constructed based on the pre-processed security knowledge and security data. The general GPT model is pre-trained based on the unsupervised pre-training sample set to obtain a secure GPT model. Then, the secure GPT model is fine-tuned using the fine-tuning data set constructed above to obtain a fine-tuned secure GPT model, that is, the malware detection model of the embodiment of the present application is obtained.
[0140] 3. Model Reasoning
[0141] like Figure 6 As shown, the process of model reasoning using the fine-tuned secure GPT model may include:
[0142] 1) Obtain the behavior report data of the unknown file (i.e. the software to be detected).
[0143] Here, the unknown file can be executed through the sandbox cluster, and the file behavior, registry behavior, network behavior and API execution sequence of the unknown file can be recorded to generate behavior report data.
[0144] 2) Filter target behavior report data of unknown files.
[0145] For multiple behavior report data generated by unknown files in different operating environments, the behavior report data with the most recorded sample behaviors and an API execution sequence length greater than 7 is selected, and the behavior report data is used as the target behavior report data of the unknown file, which can be used for model reasoning.
[0146] 3) Organize the target behavior report data into an API sequence.
[0147] According to the API execution time, the API sequences of multiple processes are sorted into one API execution sequence. The API execution sequence only retains the API name.
[0148] 4) Input the API execution sequence of the unknown file into the fine-tuned secure GPT model in the form of questions. The model performs reasoning based on the input content. The answer of the secure GPT is the result of the model reasoning. There are two results of reasoning: the unknown file is malware or normal software.
[0149] 4. Model Update
[0150] It is understandable that the secure GPT model in this application example does not require training of the entire model. It only needs to use the latest samples to build a fine-tuning dataset and then fine-tune the model to complete the model update.
[0151] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a training device for a malware detection model. The training device for the malware detection model corresponds to the training method for the above-mentioned malware detection model, and each step in the embodiment of the training method for the above-mentioned malware detection model is also fully applicable to the embodiment of the training device for the malware detection model.
[0152] like Figure 7 As shown, the training device of the malware detection model includes: a first acquisition module 701 and an adjustment module 702. The first acquisition module 701 is used to obtain an adjustment data set for model adjustment, and the adjustment data set is generated based on the behavior report data of historical malware samples and the behavior report data of normal software samples; the adjustment module 702 is used to adjust the parameters of the pre-trained first detection model based on the adjustment data set to obtain the malware detection model; wherein the first detection model is a generative pre-trained model based on the self-attention mechanism.
[0153] Exemplarily, the first acquisition module 701 acquires an adjustment data set for model adjustment, including:
[0154] Obtain historical malware samples and normal software samples within a set period of time;
[0155] Execute each sample based on the virtual execution environment to obtain behavior report data of each sample;
[0156] Generate sample data of each sample based on the behavior report data of each sample;
[0157] Based on the sample data of each sample, an adjustment data set for model adjustment is obtained.
[0158] Exemplarily, the virtual execution environment includes: at least two different virtual execution sub-environments, and the behavior report data of each sample corresponds to the virtual execution sub-environment one by one; and generating the sample data of each sample based on the behavior report data of each sample includes:
[0159] Obtaining behavior report data generated by running the sample in each of the virtual execution sub-environments, the behavior report data including: behavior data and API execution sequence;
[0160] For at least two behavior report data of each sample, determine target behavior report data of the sample based on the length of the API execution sequence and / or the number of behaviors in the behavior data;
[0161] The target behavior report data is formatted to obtain sample data of the sample.
[0162] Exemplarily, the at least two behavior report data for each sample, based on the length of the API execution sequence and the number of behaviors in the behavior data, determine the target behavior report data of the sample, including:
[0163] From at least two behavior report data of each sample, select the behavior report data whose length of the API execution sequence is greater than a set value;
[0164] From the selected behavior report data, the behavior report data with the largest number of behaviors in the behavior data is used as the target behavior report data of the corresponding sample.
[0165] Exemplarily, the first acquisition module 701 is also used to obtain an unsupervised pre-training sample set; the training device of the malware detection model also includes: a pre-training module 703, which is used to perform unsupervised pre-training on the neural network structure model based on the unsupervised pre-training sample set to generate the pre-trained first detection model.
[0166] Exemplarily, the adjustment module 702 is specifically configured to:
[0167] Dividing the adjustment data set into a training data set and a validation data set;
[0168] Based on the preset detection task and the training data set, adjusting parameters of the first detection model;
[0169] Verifying the adjusted first detection model based on the verification data set to generate a verification result;
[0170] Based on the verification result, the malware detection model is generated.
[0171] Exemplarily, the training device for the malware detection model also includes: an update module 704, and the first acquisition module 701 is also used to obtain an adjustment data set for model adjustment after obtaining the malware detection model; the update module 704 is used to adjust the parameters of the malware detection model based on the adjustment data set to obtain an updated malware detection model.
[0172] In actual application, the first acquisition module 701, the adjustment module 702, the pre-training module 703 and the update module 704 can be implemented by a processor in the training device of the malware detection model. Of course, the processor needs to run the computer program in the memory to implement its function.
[0173] In order to implement the method of the embodiment of the present application, the embodiment of the present application also provides a malware detection device, which corresponds to the above-mentioned malware detection method, and each step in the above-mentioned malware detection method embodiment is also fully applicable to the malware detection device embodiment.
[0174] like Figure 8 As shown, the malware detection device includes: a second acquisition module 801 and a detection module 802. The second acquisition module 801 is used to obtain sample data of the software to be detected; the detection module 802 is used to input the sample data of the software to be detected into the malware detection model trained by the training device as described in the third aspect of the embodiment of the present application, and obtain the detection result of the software to be detected.
[0175] Exemplarily, the second acquisition module 801 is specifically used for:
[0176] Obtaining behavior report data generated by running the software to be detected in at least two different virtual execution sub-environments, wherein the behavior report data includes: behavior data and API execution sequence;
[0177] For at least two behavior report data, determine target behavior report data of the software to be detected based on the length of the API execution sequence and / or the number of behaviors in the behavior data;
[0178] The target behavior report data is formatted to obtain sample data of the software to be detected.
[0179] In actual application, the second acquisition module 801 and the detection module 802 can be implemented by a processor in the malware detection device. Of course, the processor needs to run the computer program in the memory to implement its function.
[0180] It should be noted that: the above embodiment only illustrates the division of the above program modules. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above.
[0181] Based on the hardware implementation of the above program modules and in order to implement the method of the embodiment of the present application, the embodiment of the present application also provides an electronic device. Fig. 9 Only an exemplary structure of the electronic device is shown, not all structures, and it can be implemented as needed. Fig. 9 Partial or complete structure shown.
[0182] like Fig. 9 As shown, the electronic device 900 provided in the embodiment of the present application includes: at least one processor 901, a memory 902, a user interface 903 and at least one network interface 904. The various components in the electronic device 900 are coupled together through a bus system 905. It can be understood that the bus system 905 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 905 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, in Fig. 9 Various buses are labeled as bus system 905.
[0183] The user interface 903 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.
[0184] The memory 902 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device. Examples of such data include: any computer program used to operate on the electronic device.
[0185] The method disclosed in the embodiment of the present application can be applied to the processor 901, or implemented by the processor 901. The processor 901 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the method of the embodiment of the present application can be completed by the hardware integrated logic circuit or software instructions in the processor 901. The above-mentioned processor 901 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 901 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiment of the present application. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 902, and the processor 901 reads the information in the memory 902, and completes the steps of the method provided in the embodiment of the present application in combination with its hardware.
[0186] In an exemplary embodiment, the electronic device 900 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.
[0187] It can be understood that the memory 902 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memories described in the embodiments of the present application are intended to include, but are not limited to, these and any other suitable types of memories.
[0188] In an exemplary embodiment, the present application also provides a computer storage medium, which can be a computer-readable storage medium, for example, a memory 902 storing a computer program, and the computer program can be executed by a processor 901 of an electronic device to complete the steps described in the method of the present application embodiment. The computer-readable storage medium can be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.
[0189] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.
[0190] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.
[0191] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.
Claims
1. A method for training a malware detection model, characterized in that: include: Acquire an adjustment data set for model adjustment, wherein the adjustment data set is generated based on historical behavior report data of malware samples and behavior report data of normal software samples; Based on the adjustment data set, parameters of the pre-trained first detection model are adjusted to obtain a malware detection model; wherein the first detection model is a generative pre-trained model based on a self-attention mechanism.
2. The method according to claim 1, characterized in that The step of obtaining an adjustment data set for model adjustment includes: Obtain historical malware samples and normal software samples within a set period of time; Execute each sample based on the virtual execution environment to obtain behavior report data of each sample; Generate sample data of each sample based on the behavior report data of each sample; Based on the sample data of each sample, an adjustment data set for model adjustment is obtained.
3. The method according to claim 2, characterized in that The virtual execution environment includes: at least two different virtual execution sub-environments, and the behavior report data of each sample corresponds to the virtual execution sub-environment one by one; and the sample data of each sample is generated based on the behavior report data of each sample, including: Obtaining behavior report data generated by running the sample in each of the virtual execution sub-environments, the behavior report data including: behavior data and application programming interface API execution sequence; For at least two behavior report data of each sample, determine target behavior report data of the sample based on the length of the API execution sequence and / or the number of behaviors in the behavior data; The target behavior report data is formatted to obtain sample data of the sample.
4. The method according to claim 3, characterized in that The at least two behavior report data for each sample, based on the length of the API execution sequence and / or the number of behaviors in the behavior data, determine the target behavior report data of the sample, including: From at least two behavior report data of each sample, select the behavior report data whose length of the API execution sequence is greater than a set value; From the selected behavior report data, the behavior report data with the largest number of behaviors in the behavior data is used as the target behavior report data of the corresponding sample.
5. The method according to claim 1, characterized in that: The method further comprises: Obtain an unsupervised pre-training sample set; Based on the unsupervised pre-training sample set, unsupervised pre-training is performed on the neural network structure model to generate the pre-trained first detection model.
6. The method according to claim 1, characterized in that The step of adjusting parameters of the pre-trained first detection model based on the adjustment data set to obtain a malware detection model includes: Dividing the adjustment data set into a training data set and a validation data set; Based on the preset detection task and the training data set, adjusting parameters of the first detection model; Verifying the adjusted first detection model based on the verification data set to generate a verification result; Based on the verification result, the malware detection model is generated.
7. The method according to claim 1, characterized in that After obtaining the malware detection model, the method further includes: Obtaining a tuning dataset for model tuning; Parameters of the malware detection model are adjusted based on the adjustment data set to obtain an updated malware detection model.
8. A method for detecting malware, characterized in that: include: Obtain sample data of the software to be tested; The sample data of the software to be detected is input into the malware detection model trained by the method according to any one of claims 1 to 7 to obtain the detection result of the software to be detected.
9. The method according to claim 8, characterized in that The step of obtaining sample data of the software to be detected includes: Obtaining behavior report data generated by running the software to be detected in at least two different virtual execution sub-environments, wherein the behavior report data includes: behavior data and API execution sequence; For at least two behavior report data, determine target behavior report data of the software to be detected based on the length of the API execution sequence and / or the number of behaviors in the behavior data; The target behavior report data is formatted to obtain sample data of the software to be detected.
10. A training device for a malware detection model, characterized in that: include: A first acquisition module, configured to acquire an adjustment data set for model adjustment, wherein the adjustment data set is generated based on historical behavior report data of malware samples and behavior report data of normal software samples; An adjustment module is used to adjust parameters of a pre-trained first detection model based on the adjustment data set to obtain a malware detection model; wherein the first detection model is a generative pre-trained model based on a self-attention mechanism.
11. A malware detection device, characterized in that: include: The second acquisition module is used to acquire sample data of the software to be tested; The detection module is used to input the sample data of the software to be detected into the malware detection model trained by the training device as described in claim 10 to obtain the detection result of the software to be detected.
12. An electronic device, characterized in that: include: A processor and a memory for storing a computer program that can be executed on the processor, wherein: The processor is used to execute the steps of the method described in any one of claims 1 to 7 or claims 8 to 9 when running a computer program.
13. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 or claims 8 to 9 are implemented.