Assembly code-oriented malicious software intelligent classification detection method and system

Abstract

The invention discloses an assembly code-oriented malicious software intelligent classification detection method and system. A malicious code sample is obtained from the malicious code data set, an assembly code is obtained through reverse analysis, an API calling sequence is extracted from the assembly code of the assembly file through a regular expression, and a type label is added and stored in a CSV file; carrying out feature vectorization on the API calling sequence by using a Doc2vec algorithm; constructing a GRU attention classification model based on the vectorized API calling sequence, verifying the model by using a verification set, and compiling the GRU attention classification model; and training the training data by using the compiled GRU attention classification model to realize the classification of malicious software behaviors, and evaluating the model performance by using the test set. According to the scheme, the accuracy and robustness of malicious code analysis are enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of malicious code detection and artificial intelligence, and in particular relates to an intelligent classification detection method and system for malicious software facing assembly code. Background Art

[0002] As the number and complexity of malicious code continue to increase, traditional manual analysis methods can no longer meet the needs. Therefore, it is an inevitable trend to develop automated malicious code detection technology to improve the accuracy and efficiency of malicious code detection, reduce the burden of manual analysis, and better protect network security.

[0003] In automated malicious code detection technology, existing detection methods include signature scanning, static analysis, dynamic analysis, machine learning and other means. Signature scanning is a method of detection based on the characteristics of known malicious code. Static analysis is to detect malicious behavior by analyzing the code itself without executing the malicious code. It can detect some common malicious code patterns, such as specific function calls, string encryption, code obfuscation, etc. Dynamic analysis is to detect malicious behavior by executing malicious code in an infected environment, monitoring its behavior and collecting relevant data. Although there are many means for malicious code detection now, the malicious code mutates very quickly. For new malicious code, the detection model needs to be retrained. For specific data sets or malicious code variants, customized detection models are required for detection. Summary of the invention

[0004] In order to solve the deficiencies in the prior art, the present invention provides a method and system for intelligent classification and detection of malware for assembly code, so as to enhance the accuracy and robustness of the judgment of the malicious code analysis model.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0006] The present invention first discloses a malware intelligent classification detection method for assembly code, which comprises the following steps:

[0007] Step 1: Obtain malicious code samples from the malicious code dataset and perform preprocessing, reverse analyze the malicious code samples to obtain the assembled malicious code, use regular expressions to extract API call sequences from the assembled malicious code, add type tags according to the file names and save them in CSV files;

[0008] Step 2: Use the Doc2vec algorithm to vectorize the API call sequence extracted from the assembly-style malicious code;

[0009] Step 3: Building a GRU attention classification model based on the vectorized API call sequence, validating the model using a validation set, and compiling the GRU attention classification model, wherein the GRU attention classification model includes three GRU layers, a fully connected layer, and an attention layer;

[0010] Step 4: Use the compiled GRU attention classification model to train the training data to classify malware behaviors, and use the test set to evaluate the model performance.

[0011] The present invention further includes the following preferred embodiments:

[0012] The method of obtaining a malicious code sample from a malicious code data set and preprocessing it, reverse-analyzing the malicious code sample to obtain an assembled malicious code, extracting an API call sequence from the assembled malicious code using a regular expression, adding a type tag according to the file name and saving it in a CSV file, further includes:

[0013] After obtaining malicious code samples, data sets with the same behavior and code features are merged based on the same labels;

[0014] Convert the binary malicious code into an ASM assembly file through reverse analysis;

[0015] Extracting an API call sequence from the assembly code of the assembly file using a regular expression;

[0016] Save the extracted API call sequence into a CSV file according to the file's hash value and label;

[0017] The malicious code dataset is divided into a training set and a test set, and the divided datasets are saved locally.

[0018] The regular expression is:

[0019] pattern=r"\s+call\s+ds:(?P<api_name>[_a-zA-Z0-9]+)"

[0020] Among them, \s means matching one or more space characters, call matches call, ds: matches character ds, (?P<api_name> [_a-zA-Z0-9]+) is a named capture group. This pattern matches any space characters before and after the statement, capturing the API name from the assembly statement.

[0021] The API call sequence is extracted by using this regular expression pattern to read each line of the assembly code in each assembly file of the dataset.

[0022] The method of using the Doc2vec algorithm to vectorize the API call sequence extracted from the assembled malicious code further includes:

[0023] Read the API call sequence of the CSV file and segment the API call sequence; initialize the Doc2Vec model, the Doc2Vec model parameters include the dimension of the word vector, the context window size, the minimum number of times a word appears in the document, the number of training rounds, and the number of parallel training processes; use the Doc2Vec class to create a model object and represent each API call sequence as a vector; load training data; create a training corpus and convert the training data into a labeled document sequence; use the training data to build a vocabulary of the Doc2Vec model, including words and their corresponding word vectors; build a vocabulary and train the model, scan the training data and build a vocabulary of the model, in which each word is assigned a unique integer index; use the training data to perform multiple rounds of iterative training on the model; during the training process, update the word vector and model parameters according to the context relationship, and build a Doc2Vec model representing the API call sequence; train the Doc2Vec model using the training data; save the trained Doc2Vec model to a local file.

[0024] The constructing of the GRU attention classification model further includes:

[0025] Initialize an empty sequence model and add GRU layers one by one. The first GRU layer specifies the shape of the input sequence, the number of time steps in the sequence, and the dimension is 1. Add a dropout layer to each GRU layer to randomly discard 20% of the neurons. The first and second GRU layers use L1 regularizers to add penalty terms to the loss function for all output sequences.

[0026] The output of the GRU layer is fed into an attention layer, which computes attention weights and then multiplies them by the GRU output. The resulting tensor is summed along the time axis, resulting in a single vector representing the entire time series. A dense output layer with a softmax activation function is added to predict the output class.

[0027] The input data is passed through a fully connected layer to obtain a vector, the vector is processed, the last dimension is removed, the exponential function is applied to the vector to increase the weight difference, each element is divided by the sum of all elements to obtain the attention weight, the attention weight vector is processed and the new dimension is added; finally, the function returns a tensor with the attention weights, which is multiplied by the input data.

[0028] The compiling of the GRU attention classification model further includes:

[0029] The GRU attention classification model is compiled using the Adam optimizer and categorical cross entropy as the loss function, and the accuracy is calculated as the evaluation metric.

[0030] The method further includes: implementing the classification of malware behaviors and using a test set to evaluate model performance.

[0031] Returns the loss function and accuracy of each epoch in the training process, the loss function and accuracy of the validation set, performs predictions on the test set to obtain the prediction results, calculates the weighted F1 value using the true label and the predicted label, calculates the F1 value on the test data after each training cycle, and uses the F1 value to evaluate the classification results of the model.

[0032] The present invention also discloses an assembly code-oriented malware intelligent classification detection system using the above-mentioned assembly code-oriented malware intelligent classification detection method, comprising:

[0033] An assembly code generation module is used to obtain malicious code samples from a malicious code data set and perform preprocessing, reverse analyze the malicious code samples to obtain the malicious code in assembly form, extract the API call sequence from the malicious code in assembly form using regular expressions, add a type tag according to the file name and save it in a CSV file;

[0034] A feature vectorization module, which is used to perform feature vectorization on the API call sequence extracted from the assembled malicious code using the Doc2vec algorithm;

[0035] A classification model building module, used to build a GRU attention classification model based on the vectorized API call sequence, verify the model using a validation set, and compile the GRU attention classification model, wherein the GRU attention classification model includes three GRU layers, a fully connected layer, and an attention layer;

[0036] The malware classification detection module is used to train the training data using the compiled GRU attention classification model to achieve the classification of malware behaviors, and use the test set to evaluate the model performance.

[0037] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0038] The storage medium is used to store instructions;

[0039] The processor is used to operate according to the instructions to execute the steps of the aforementioned intelligent classification detection method for malware oriented to assembly code.

[0040] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the aforementioned intelligent classification detection method for malware for assembly code are implemented.

[0041] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides an intelligent classification detection method and system for malware for assembly code, which classifies the behavior of malicious code and can be used for malicious code behavior analysis; analyzes the malicious code behavior characteristics from the underlying assembly code, analyzes the malicious code by static analysis, and obtains the assembly code of its underlying machine instructions by disassembling the malicious code, thereby deeply analyzing the implementation principle and function of the malicious code. Extract API call sequences from assembly code using regular expressions; pass the API call sequence extracted from the assembly code into the Doc2vec model for vectorization as the input of the next classification model; construct a model including three GRU layers, a fully connected layer and an attention layer, and Doc2vec vectorizes the API call sequence as the input of the classification model, which improves the accuracy and efficiency of malicious code behavior classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of the intelligent classification detection method for malware in assembly code in the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0044] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0045] In view of the shortcomings of the prior art, the present invention proposes an intelligent classification detection method and system for malware for assembly code, which uses a classification model based on GRU (Gate Recurrent Unit) and a Doc2vec algorithm based on word vectors to form a malicious code analysis model, uses regular expressions to extract API call sequences from the assembly code of the malicious code data set, adds type labels to the extracted API call sequences according to the types, and then sends the extracted API call sequences to the Doc2vec algorithm, and uses Doc2vec to vectorize the input API call sequences, and outputs them as the input of the classification model. In order to solve the problem of overfitting in the model training process, 20% Dropout is used after each GRU layer in the model, and L1 regularization is added to the Dense layer before the output layer, so that the model can rely on high-dimensional feature input to classify malicious behaviors, thereby enhancing the accuracy and robustness of model judgment.

[0046] See also Figure 1 As shown, the intelligent classification detection method for malware in assembly code disclosed in the present invention comprises the following steps:

[0047] Step 1: Obtain malicious code samples from a malicious code dataset and perform preprocessing, reverse analyze the malicious code samples to obtain assembled malicious codes, extract API call sequences from assembled malicious codes using regular expressions, add type tags according to file names, and save them in CSV files.

[0048] Step 1.1: Obtain malicious code samples by capturing or downloading, and merge datasets with the same behavior and code features based on the same labels.

[0049] For example, you can download the dataset provided by Microsoft in the malware classification competition held by Kaggle in 2015 from Kaggle. The dataset contains labeled data for training and unlabeled data for testing, totaling about 500GB. The dataset contains malware from 9 different families, including Ramnit, Vundo, Tracur, and Obfuscator.ACY, which are worm types, Gatak, which is a Trojan type, Kelihos_ver3 and Kelihos_ver1, which are Botnet types, and Simda, which is a backdoor type. The total number of malware files in the dataset is 10,868, which are divided into byte files and ASM files. As shown in Table 1, malicious code samples from families 1, 2, 3, 6, 8, and 9 with a large number of samples in the dataset are used as training data for training;

[0050] Table 1

[0051]

[0052] Step 1.2: Convert the binary malicious code into an ASM assembly file through reverse analysis.

[0053] Step 1.3: Extracting the API call sequence from the assembly code of the assembly file using regular expressions.

[0054] According to the API call statements in the assembly code, use regular expressions to extract API regular expressions from the ASM assembly code. For example, the regular expression is as follows:

[0055] pattern=r"\s+call\s+ds:(?P<api_name>[_a-zA-Z0-9]+)"

[0056] The prefix r indicates that this is a "raw string", that is, "\s+call\s+ds:(?P<api_name> [_a-zA-Z0-9]+)" is treated as a raw string, otherwise \s will be interpreted as an escape sequence in a normal string. \s means matching one or more space characters (such as spaces, character line breaks, etc.), call matches calls, ds: matches character ds, (? P<api_name> [_a-zA-Z0-9]+) is a named capture group. This pattern matches any space characters before and after the statement, capturing the API name (which can only contain letters, numbers, and underscores) from the assembly statement. By using this regular expression pattern for each line of assembly code in each assembly file in the dataset, the API call sequence can be extracted.

[0057] Step 1.4: Save the extracted API call sequence into a CSV file according to the file’s hash value and label;

[0058] Traverse the ASM files in the training set, use regular expressions to extract the API call sequence from each assembled ASM file, and save it to a CSV file according to the file hash value and the extracted API name. Add a type label according to the file name. The dataset contains a CSV file that contains the hash value and type label of each ASM file in the dataset. Merge the results of the previous step according to the hash value of the file. The new CSV file contains three columns of data: Id, class, and API Calls.

[0059] Step 1.5: After the above preprocessing of the data set is completed, the malicious code data set is divided into a training set and a test set, and the divided data sets are saved locally.

[0060] Step 2: Use the Doc2vec algorithm to vectorize the API call sequence extracted from the assembly-style malicious code.

[0061] The step 2 further comprises:

[0062] Step 2.1: Define the TaggedDocumentsSequence class; read the API call sequence of the CSV file and convert it into a TaggedDocument object. The TaggedDocumentsSequence class contains three methods: '_init_', '_iter_', and '_len_'. '_init_' is a method that initializes an instance of the class and saves the input file to self.filename. The '_iter_' method is a generator that iterates through each line of data in the CSV file, tokenizes the API call sequence, and uses it as the words attribute of the TaggedDocument object, marking it with a TaggedDocuments object, whose tags attribute consists of the index number of the current sequence. The '_len_' method returns the number of API calls in the CSV file.

[0063] Step 2.2: Initialize Doc2Vec model:

[0064] Doc2Vec(vector_size=50,window=2,min_count=1,epochs=5,workers=1)vector_size specifies the dimension of the word vector,window specifies the context window size,min_count specifies the minimum number of times a word appears in a document,epochs specifies the number of training rounds,workers specifies the number of parallel training processes. Use the Doc2Vec class to create a model object and set the vector size to 50. Each API call sequence will be represented as a vector with 50 dimensions. The window size is set to 2, indicating that the model will consider the context information of the two words around the current word. The minimum word frequency is set to 1, that is, as long as an API name appears in the dataset, it will be included in the vocabulary. The model will be trained for 5 rounds, that is, the data in the training corpus is passed to the model 5 times. The number of workers is set to 1, indicating that the model will be trained using a single worker process.

[0065] Step 2.3: Load the training data: that is, the list of TaggedDocument objects generated by the TaggedDocumentsSequence class.

[0066] train_corpus=TaggedDocumentsSequence('new_csv_file.csv')

[0067] To create a training corpus, instantiate the TaggedDocumentsSequence class and pass in a parameter, new_csv_file.csv, which points to the file name or path of the CSV file of the training data.

[0068] The file name is passed as a parameter to obtain a training corpus object train_corpus.

[0069] The TaggedDocumentsSequence class is used to convert the training data into a document sequence with labels by passing in the file name of the training data. The training corpus object will be used in the subsequent model training process.

[0070] Step 2.4: Use the training data to build the vocabulary of the Doc2Vec model, including words and their corresponding word vectors.

[0071] Build the vocabulary and train the model. Call the model.build_vocab(train_corpus) method to scan the training data and build the model's vocabulary, where each word is assigned a unique integer index. Call model.train(train_corpus, total_examples = model.corpus_count,

[0072] epochs = model.epochs) method, using the training data to train the model for multiple rounds of iterations. During the training process, the word vectors and model parameters are updated according to the context relationship to improve the semantic representation ability of the vectors.

[0073] Through these two steps, a Doc2Vec model for representing API call sequences is built and trained.

[0074] model.build_vocab(train_corpus)

[0075] Step 2.5: Train the Doc2Vec model using the training data:

[0076] model.train(train_corpus,total_examples=model.corpus_count,epochs=model.epochs) where total_examples specifies the total number of samples of training data, and epochs specifies the number of training rounds.

[0077] Step 2.6: Save the trained Doc2Vec model to a local file named

[0078] Sixclass.model, reload the model and use it directly in the next classification step.

[0079] model.save("Sixclass.model")

[0080] Step 3: Build a GRU attention classification model based on the vectorized API call sequence, verify the model using the validation set, and compile the GRU attention classification model.

[0081] The attention classification model contains three GRU layers, a fully connected layer and an attention layer.

[0082] Step 3.1: Load the dataset and select the three columns of Id, Class, and API Calls as data. The read data is stored in a Pandas DataFrame named data. test_size=0.2 means that the dataset is split in an 8:2 ratio, that is, 20% of the data is divided into the test set and the remaining 80% of the data is divided into the training set. To ensure that the data distribution in the test set and the training set is consistent, the stratify parameter is set to data['Class'];

[0083] Step 3.2: Load the pre-trained Doc2vec model. Load the trained model into memory by calling the Doc2Vec.load() method. Use Doc2Vec to vectorize API calls in the subsequent code. The vectorize_api_calls() function is called to convert the API call sequences in the training and test sets into Doc2Vec vectors. The function takes two parameters: api_calls, which is a Pandas series containing the API call sequences to be vectorized, and model, which is a pre-trained Doc2Vec model. A NumPy array X is created inside the function to hold the Doc2Vec vectors. The infer_vector() method of the object is called for each API call sequence to calculate its corresponding Doc2Vec vector, and the resulting vector is stored in 'model', 'api_calls', X'. Finally, the generated Doc2Vec vectors for the training and test sets are stored in variables X_train and X_test, respectively, and used as input features for the machine learning model.

[0084] Step 3.3: Load the type labels and perform one-hot encoding. Use the get_dummies() function in the Pandas library to train the type labels in the training set and test set, and convert the 'Class' column in the training set and test set into multiple binary dummy variables. For each different type label, a corresponding dummy variable will be generated, and the value of the variable is 0 or 1, indicating whether the text sample belongs to the type label; the results are stored in the y_train and y_test variables as the labels of the training set and test set, respectively.

[0085] Step 3.4: Construct a GRU classification model, which includes three GRU layers, a fully connected layer, and an attention layer.

[0086] Specifically, an empty sequence model is initialized, and GRU layers are added to it one by one. The first GRU layer specifies the shape of the input sequence, the number of time steps in the sequence, and the dimension is 1; a dropout layer is added to each GRU layer, and the first and second GRU layers use an L1 regularizer to add a penalty term to the loss function for all output sequences. The penalty term is proportional to the sum of the absolute values ​​of the model weights.

[0087] The Sequential() function in the Keras library is used to define the sequence model object model_gru, and then the model_gru.add() method is used to add three GRU layers to the model. Each GRU layer has 32 units, and a dropout layer with a parameter of 0.2 is added after each GRU layer, indicating that this layer randomly discards 20% of the neurons. The role of the dropout layer is to randomly discard a certain proportion of neurons during training, thereby reducing the complexity of the model and the risk of overfitting.

[0088] The first GRU layer uses 32 neurons and its input shape is (X_train.shape[1], 1), which means that this layer will receive samples of the X_train sequence, the time step of each sample is X_train.shape[1], and the input dimension of each time step is 1. Use the return_sequences=True parameter to indicate that this layer outputs a sequence with the same shape as the input. To avoid overfitting, this GRU layer uses the L1 regularizer with a parameter of 0.001. The role of the regularizer is to constrain the model parameters to reduce the risk of overfitting the model. Add two GRU layers with the same parameters as the first layer in sequence. Keras can automatically infer the output shape of the previous layer and use it as the input shape of the next layer, returning the created GRU classification model object model_gru.

[0089] Step 3.5: Pass the input data through a fully connected layer to get a vector. The Lambda layer processes the vector of the API call sequence and removes the last dimension. The Lambda layer applies an exponential function to the vector to increase the weight difference and processes the vector of the API call sequence, that is, divides each element by the sum of all elements to get the attention weight. Finally, the Lambda layer processes the attention weight vector and adds a new dimension (None). Finally, the function returns a tensor (attention) with attention weights, which can be multiplied with the input data to strengthen the model's attention to important features;

[0090] Step 3.6: Create a GRU Attention Classification Model. Add the attention mechanism to the GRU classification model. Enter the function "create(X_train.shape[1], 1) and apply a GRU layer with an unspecified number of units. The output of the GRU layer is fed into the attention layer, which calculates the attention weights and then multiplies them by the GRU output. The resulting tensor is then summed along the time axis to produce a single vector representing the entire time series. Finally, a dense output layer with a softmax activation function is added to predict the output class. The resulting Keras model can be compiled and trained using standard methods.

[0091] where (X_train.shape[1], 1) matches the dimension of the input data. Create the GRU classification model gru_model by calling the function create_gru_model(). This function returns the GRU classification model and passes the input layer inputs as a parameter to the function to build the input part of the GRU classification model. Call the function create_attention_layer() to create the attention layer attention. Receive gru_model as input and return the calculated attention tensor. Perform element-wise multiplication of the GRU model gru_model and the attention tensor attention through Lambda and x[0]*x[1] to obtain the weighted GRU output tensor attention_mul, and then sum the weighted GRU output tensor attention_mul through Lambda and K.sum to obtain the combined output tensor output. Add a fully connected layer with y_train.shape[1] neurons and a softmax activation function to map the combined output tensor output to the final output of the model. Use the Model function to construct the input layer inputs and the output layer output into a model object model. Finally, the model object model with GRU and attention mechanism is returned.

[0092] Step 3.7: Compile the GRU attention classification model using the Adam optimizer and categorical cross entropy as the loss function, and calculate the accuracy as the evaluation metric.

[0093] The formula of the loss function is as follows:

[0094] H(p,q)=-Σp(x)logq(x)

[0095] Among them, p(x) is the probability distribution of the true label, and q(x) is the probability distribution of the predicted label.

[0096] Specifically, call the function create_gru_attention_model() to create the model model_gru_attention with GRU and attention mechanism. Use the compile method to compile the model, the optimizer is Adam, the loss function is specified as categorical_crossentropy, and the evaluation indicator is accuracy, which is used to measure the classification accuracy of the model during training and evaluation.

[0097] Step 4: Use the compiled GRU attention classification model to train the training data to classify malware behaviors, and use the test set to evaluate the model performance.

[0098] Specifically, train the GRU attention classification model and record the training process. After each epoch, calculate the loss function and accuracy of the training set and validation set. Specifically, specify the num_epoch parameter to determine the number of training rounds, and use the training data x_train and label y_train as input for training. During the training process, the model is trained with 32 samples each time, and the validation_data parameter is used to monitor the performance of the model on the test set. After the training is completed, the function will return the history variable history, which contains the loss function, accuracy of each epoch in the training process, the loss function and accuracy of the validation set, and other information. Predictions are made on the test set X_test to obtain the prediction results, and the weighted F1 value is calculated using the true label and the predicted label. The F1 value on the test data is calculated after each training cycle, and the classification results of the model are evaluated using the F1 value.

[0099] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides an intelligent classification detection method and system for malware for assembly code, which classifies the behavior of malicious code and can be used for malicious code behavior analysis; analyzes the malicious code behavior characteristics from the underlying assembly code, analyzes the malicious code by static analysis, and obtains the assembly code of its underlying machine instructions by disassembling the malicious code, thereby deeply analyzing the implementation principle and function of the malicious code. Extract API call sequences from assembly code using regular expressions; pass the API call sequence extracted from the assembly code into the Doc2vec model for vectorization as the input of the next classification model; construct a model including three GRU layers, a fully connected layer and an attention layer, and Doc2vec vectorizes the API call sequence as the input of the classification model, which improves the accuracy and efficiency of malicious code behavior classification.

[0100] The present invention may be a system, a method and / or a computer program product. The present invention also discloses an assembly code-oriented malware intelligent classification detection system based on the aforementioned assembly code-oriented malware intelligent classification detection method, comprising:

[0101] An assembly code generation module is used to obtain malicious code samples from a malicious code data set and perform preprocessing, reverse analyze the malicious code samples to obtain the malicious code in assembly form, extract the API call sequence from the malicious code in assembly form using regular expressions, add a type tag according to the file name and save it in a CSV file;

[0102] A feature vectorization module, which is used to perform feature vectorization on the API call sequence extracted from the assembled malicious code using the Doc2vec algorithm;

[0103] A classification model building module, used to build a GRU attention classification model based on the vectorized API call sequence, verify the model using a validation set, and compile the GRU attention classification model, wherein the GRU attention classification model includes three GRU layers, a fully connected layer, and an attention layer;

[0104] The malware classification detection module is used to train the training data using the compiled GRU attention classification model to achieve the classification of malware behaviors, and use the test set to evaluate the model performance.

[0105] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned intelligent classification detection method for malware oriented to assembly code. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned intelligent classification detection method for malware oriented to assembly code.

[0106] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0107] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0108] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A malware intelligent classification detection method for assembly code, characterized in that: The following steps are involved: Step 1: Obtain malicious code samples from the malicious code dataset and perform preprocessing, reverse analyze the malicious code samples to obtain the assembled malicious code, use regular expressions to extract API call sequences from the assembled malicious code, add type tags according to the file names and save them in CSV files; Step 2: Use the Doc2vec algorithm to vectorize the API call sequence extracted from the assembly-style malicious code; Step 3: Building a GRU attention classification model based on the vectorized API call sequence, validating the model using a validation set, and compiling the GRU attention classification model, wherein the GRU attention classification model includes three GRU layers, a fully connected layer, and an attention layer; Step 4: Use the compiled GRU attention classification model to train the training data to classify malware behaviors, and use the test set to evaluate the model performance.

2. The method for intelligent classification and detection of malware for assembly code according to claim 1, characterized in that: The method of obtaining a malicious code sample from a malicious code data set and preprocessing it, reverse-analyzing the malicious code sample to obtain an assembled malicious code, extracting an API call sequence from the assembled malicious code using a regular expression, adding a type tag according to the file name and saving it in a CSV file, further includes: After obtaining malicious code samples, data sets with the same behavior and code features are merged based on the same labels; Convert the malicious code in binary form into an assembly file in ASM form through reverse analysis; Extracting an API call sequence from the assembly code of the assembly file using a regular expression; Save the extracted API call sequence into a CSV file according to the file's hash value and label; The malicious code dataset is divided into a training set and a test set, and the divided datasets are saved locally.

3. The method for intelligent classification and detection of malware for assembly code according to claim 2, characterized in that: The regular expression is: pattern=r"\s+call\s+ds:(?P<api_name>[_a-zA-Z0-9]+)" Among them, \s means matching one or more space characters, call matches call, ds: matches character ds, (?P<api_name> [_a-zA-Z0-9]+) is a named capture group. This pattern matches any space characters before and after the statement, capturing the API name from the assembly statement. The API call sequence is extracted by using this regular expression pattern to read each line of the assembly code in each assembly file of the dataset.

4. The method for intelligent classification and detection of malware for assembly code according to claim 3, characterized in that: The method of using the Doc2vec algorithm to vectorize the API call sequence extracted from the assembled malicious code further includes: Read the API call sequence of the CSV file and segment the API call sequence; initialize the Doc2Vec model, the Doc2Vec model parameters include the dimension of the word vector, the context window size, the minimum number of times a word appears in the document, the number of training rounds, and the number of parallel training processes; use the Doc2Vec class to create a model object and represent each API call sequence as a vector; load training data; create a training corpus and convert the training data into a labeled document sequence; use the training data to build a vocabulary of the Doc2Vec model, including words and their corresponding word vectors; build a vocabulary and train the model, scan the training data and build a vocabulary of the model, in which each word is assigned a unique integer index; use the training data to perform multiple rounds of iterative training on the model; during the training process, update the word vector and model parameters according to the context relationship, and build a Doc2Vec model representing the API call sequence; train the Doc2Vec model using the training data; save the trained Doc2Vec model to a local file.

5. The method for intelligent classification and detection of malware for assembly code according to claim 4, characterized in that: The constructing of the GRU attention classification model further includes: Initialize an empty sequence model and add GRU layers one by one. The first GRU layer specifies the shape of the input sequence, the number of time steps in the sequence, and the dimension is 1. Add a dropout layer to each GRU layer to randomly discard 20% of the neurons. The first and second GRU layers use L1 regularizers to add penalty terms to the loss function for all output sequences. The output of the GRU layer is fed into an attention layer, which computes attention weights and then multiplies them by the GRU output. The resulting tensor is summed along the time axis, resulting in a single vector representing the entire time series. A dense output layer with a softmax activation function is added to predict the output class. The input data is passed through a fully connected layer to obtain a vector, the vector is processed, the last dimension is removed, the exponential function is applied to the vector to increase the weight difference, each element is divided by the sum of all elements to obtain the attention weight, the attention weight vector is processed and the new dimension is added; finally, the function returns a tensor with the attention weights, which is multiplied by the input data.

6. The intelligent classification detection system for malware based on assembly code according to claim 5, characterized in that: The compiling of the GRU attention classification model further includes: The GRU attention classification model is compiled using the Adam optimizer and categorical cross entropy as the loss function, and the accuracy is calculated as the evaluation metric.

7. The intelligent classification detection system for malware based on assembly code according to claim 6, characterized in that: The method further includes: implementing the classification of malware behaviors and using a test set to evaluate model performance. Returns the loss function and accuracy of each epoch in the training process, the loss function and accuracy of the validation set, performs predictions on the test set to obtain the prediction results, calculates the weighted F1 value using the true label and the predicted label, calculates the F1 value on the test data after each training cycle, and uses the F1 value to evaluate the classification results of the model.

8. An intelligent malware classification detection system for assembly code, characterized in that: include: An assembly code generation module is used to obtain malicious code samples from a malicious code data set and perform preprocessing, reverse analyze the malicious code samples to obtain the malicious code in assembly form, extract the API call sequence from the malicious code in assembly form using regular expressions, add a type tag according to the file name and save it in a CSV file; A feature vectorization module, which is used to perform feature vectorization on the API call sequence extracted from the assembled malicious code using the Doc2vec algorithm; A classification model building module, used to build a GRU attention classification model based on the vectorized API call sequence, verify the model using a validation set, and compile the GRU attention classification model, wherein the GRU attention classification model includes three GRU layers, a fully connected layer, and an attention layer; The malware classification detection module is used to train the training data using the compiled GRU attention classification model to achieve the classification of malware behaviors, and use the test set to evaluate the model performance.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the intelligent classification detection method for assembly code malware according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the intelligent classification detection method for assembly code-oriented malware described in any one of claims 1 to 7 are implemented.

Images