Malicious binary program identification method and device, equipment and storage medium

Abstract

The invention relates to a malicious binary program identification method and device, equipment and a storage medium. When the malicious binary program is identified, for the obtained target binary program, the target features in the target binary program need to be extracted, and the malicious features in the target features are identified by using the malicious feature library; wherein the malicious features are malicious functions and malicious character strings which are determined through different recognition modes and related to the malicious behaviors; and determining an identification result of the target binary program according to the malicious features. It can be seen that when the malicious binary program is identified, the malicious function and the malicious character string related to the malicious behavior in the target binary program can be identified through multiple methods, and the identification result of the target binary program can be effectively determined through the malicious function and the malicious character string; and the identification speed and the identification accuracy of the malicious binary program are improved.

Description

Technical Field

[0001] The present application relates to the field of program detection, and in particular to a method, apparatus, device and storage medium for identifying malicious binary programs. Background Art

[0002] With the development of the Internet, network security issues have become increasingly prominent. Among them, malicious binary programs, as one of the main means of attack and propagation, pose a serious threat to host security. Traditional solutions often rely on single-feature analysis methods when detecting malicious binary programs, which are easily bypassed by obfuscated, compressed or encrypted malware. In addition, with the rapid changes of new malicious binary programs and the evasion techniques used by malicious program publishers to process malicious binary programs through replacement or hiding of key functions, traditional solutions are unable to detect malicious binary programs in a timely manner, resulting in the inability to effectively identify new malicious binary programs.

[0003] Therefore, how to accurately identify malicious binary programs is a problem that technical personnel in this field need to solve. Summary of the invention

[0004] The present application provides a method, apparatus, device and storage medium for identifying malicious binary programs to accurately identify malicious binary programs.

[0005] In a first aspect, the present application provides a method for identifying a malicious binary program, comprising:

[0006] Get the target binary program;

[0007] Extracting target features from the target binary program, and identifying malicious features in the target features using a malicious feature library; wherein the malicious features are malicious functions and malicious character strings related to malicious behaviors determined by different identification methods;

[0008] An identification result of the target binary program is determined according to the malicious feature.

[0009] Optionally, extracting target features from the target binary program and identifying malicious functions in the target features using a malicious feature library includes:

[0010] Extracting the signature of each pre-selected function in the target binary program;

[0011] According to the malicious function signature feature library and the signature of each preliminary selected function, a first malicious function is identified from the preliminary selected functions.

[0012] Optionally, extracting the signature of each primary selected function in the target binary program includes:

[0013] A signature of each preliminarily selected function in the target binary program is extracted, wherein the signature includes any one of a function entry point, a calling relationship, a parameter type, and a return value type.

[0014] Optionally, the identifying a first malicious function from the preliminary selected functions according to the malicious function signature feature library and the signature of each preliminary selected function includes:

[0015] Calculate the similarity value between the signature of each primary selected function and the signature of each known malicious function in the malicious function signature feature library;

[0016] The initially selected function whose similarity value is greater than the similarity threshold is determined as the first malicious function.

[0017] Optionally, extracting target features from the target binary program and identifying malicious functions in the target features using a malicious feature library includes:

[0018] Extracting a symbol table of the target binary program;

[0019] A second malicious function in the symbol table is identified according to the malicious function feature library.

[0020] Optionally, extracting target features from the target binary program and identifying malicious character strings in the target features using a malicious feature library includes:

[0021] Extracting a preliminary string of the target binary program;

[0022] Identify a target string in the preliminary selected string according to a malicious string feature library;

[0023] A context analysis is performed on the target character string to determine malicious character strings in the target character string that are related to malicious behavior.

[0024] Optionally, determining the identification result of the target binary program according to the malicious feature includes:

[0025] Determine a risk score for each malicious signature;

[0026] The identification results are determined based on the risk scores of all malicious features.

[0027] In a second aspect, the present application provides a device for identifying a malicious binary program, comprising:

[0028] An acquisition module is used to acquire the target binary program;

[0029] An identification module, used to extract target features from the target binary program, and identify malicious features in the target features using a malicious feature library; wherein the malicious features are malicious functions and malicious character strings related to malicious behaviors determined by different identification methods;

[0030] A determination module is used to determine the identification result of the target binary program according to the malicious feature.

[0031] In a third aspect, the present application provides an electronic device, including:

[0032] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the above-mentioned malicious binary program identification method through the computer program.

[0033] In a fourth aspect, the present application provides a computer storage medium, which stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned malicious binary program identification method of the present application.

[0034] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: when identifying malicious binary programs, the present application needs to extract target features in the target binary program for the acquired target binary program, and use the malicious feature library to identify malicious features in the target features; wherein the malicious features are malicious functions and malicious strings related to malicious behaviors determined by different identification methods; the identification result of the target binary program is determined according to the malicious features. It can be seen that when the present application identifies malicious binary programs, malicious functions and malicious strings related to malicious behaviors in the target binary program can be identified by a variety of methods. Through the malicious functions and malicious strings, the identification result of the target binary program can be effectively determined, thereby improving the identification speed and accuracy of the malicious binary program. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0036] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0037] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0038] Figure 1 A schematic diagram of a flow chart of a method for identifying a malicious binary program provided in an embodiment of the present application;

[0039] Figure 2 A flowchart of another method for identifying malicious binary programs provided in an embodiment of the present application;

[0040] Figure 3 A flowchart of another method for identifying malicious binary programs provided in an embodiment of the present application;

[0041] Figure 4 A schematic diagram of the structure of a malicious binary program identification device provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0044] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0045] This embodiment provides a method, apparatus, device, and storage medium for identifying malicious binary programs to accurately identify malicious binary programs.

[0046] See also Figure 1 , Figure 1 A schematic diagram of a method for identifying a malicious binary program provided in an embodiment of the present application, the method comprising the following steps:

[0047] S101, obtaining a target binary program;

[0048] In this embodiment, the target binary program is an executable binary program that needs to be identified as malicious. The target binary program may contain malicious code. Therefore, this application identifies the target binary program to determine the risk level of the target binary program being a malicious binary program.

[0049] S102, extracting target features from the target binary program, and identifying malicious features in the target features using a malicious feature library; wherein the malicious features are malicious functions and malicious character strings related to malicious behaviors determined by different identification methods;

[0050] After obtaining the target binary program, this embodiment needs to extract target features from the target binary program. The target features are features that need to be maliciously identified, including: functions, strings, function signatures, etc. The malicious feature library includes already identified malicious features, malicious feature signatures, malicious strings, etc. When identifying malicious features from target features, this embodiment can determine malicious functions and malicious strings related to malicious behavior based on the malicious feature library through different identification methods, such as: identifying malicious functions through feature matching, identifying malicious strings through string matching, and identifying similar malicious functions through function signature matching.

[0051] S103: Determine the identification result of the target binary program according to the malicious features.

[0052] It should be noted that after the malicious features are determined through the above steps, the recognition result of the target binary program can be comprehensively determined based on the maliciousness level, quantity, and other information of each malicious feature. For example, the maliciousness level of the identified malicious function is high risk, and the maliciousness level of the identified malicious string is also high risk. Therefore, after comprehensively considering the maliciousness levels of the malicious function and the malicious string, the recognition result is high risk, that is, the probability that the target binary program is a malicious binary program is very high.

[0053] From the above, it can be seen that when identifying malicious binary programs, the present application needs to extract target features from the acquired target binary program, and use the malicious feature library to identify malicious features in the target features; the malicious features are malicious functions and malicious strings related to malicious behaviors determined by different identification methods; the identification result of the target binary program is determined based on the malicious features. It can be seen that when identifying malicious binary programs, the present application can identify malicious functions and malicious strings related to malicious behaviors in the target binary program through a variety of methods. Through the malicious functions and malicious strings, the identification result of the target binary program can be effectively determined, and the identification speed and accuracy of the malicious binary program can be improved.

[0054] See also Figure 2 , Figure 2 A flowchart of another method for identifying a malicious binary program provided in an embodiment of the present application, the method comprising the following steps:

[0055] S201, obtaining a target binary program;

[0056] S202, extracting the signature of each primary selected function in the target binary program;

[0057] S203, identifying a first malicious function from the preliminary selected functions according to the malicious function signature feature library and the signature of each preliminary selected function;

[0058] S204, extracting the symbol table of the target binary program;

[0059] S205, identifying a second malicious function in the symbol table according to the malicious function feature library;

[0060] S206, extracting the primary character string of the target binary program;

[0061] S207, identifying a target string in the preliminary selected strings according to a malicious string feature library;

[0062] S208, performing context analysis on the target character string to determine malicious character strings in the target character string that are related to malicious behavior;

[0063] S209: Determine the identification result of the target binary program according to the malicious features.

[0064] In this embodiment, the user inputs the target binary program to be detected into the system, and the system can automatically extract the function signature, symbol table and string and match them to determine the first malicious function. Here, the matching process of the function signature, symbol table and string is described respectively.

[0065] 1. When determining the first malicious function, the present application needs to parse the target binary program to be analyzed and extract the signatures of all functions. In this embodiment, the extracted function is called a preliminary function, and the signature can be a unique identifier based on the function entry point, call relationship, parameter type, return value type, etc. The malicious function signature feature library is a pre-built feature library, which includes function signatures of known malware, and then the extracted signature of the preliminary function is matched with the signature in the malicious function signature feature library to identify the first malicious function from the preliminary function. The malicious function signature feature library needs to be updated regularly to ensure that the feature library contains the latest known malware function signatures and the accuracy of signature recognition.

[0066] Specifically, when the present application identifies the first malicious function from the preliminary functions, it can calculate the similarity value between the signature of each preliminary function and the signature of each known malicious function in the malicious function signature feature library; the preliminary function with a similarity value greater than a similarity threshold is determined to be the first malicious function. Among them, when calculating the similarity, the present application can use a hash algorithm or fingerprint matching technology to calculate the similarity value, thereby determining the similarity between the two functions. The similarity threshold is a pre-set similarity critical value, such as: the similarity threshold can be set to 80%, that is: if the similarity threshold between the signature of the preliminary function and the signature of the known malicious function is greater than 80%, then the preliminary function is determined to be the first malicious function.

[0067] It should be noted that if a first malicious function is found in the matching process that is highly similar to a malware function signature in the feature library, the system will generate a detection report, and point out in the detection report that the target binary program may contain a variant of known malware, and provide relevant detailed information. The user can conduct further analysis or take corresponding security measures based on the information in the report. It can be seen that this embodiment can associate the key behavior of the malware with its specific function implementation through this method, so that even if the malware is obfuscated or reconstructed, traces of its key functions can still be detected, thereby effectively identifying variants of known malware. The specific execution process of S202-S203 is explained here:

[0068] If the user inputs a binary file: example.bin, the binary file includes the target binary program to be detected, and the program includes the function Func_X. At the same time, the malicious function signature feature library includes the signature of MaliciousFunc_Y. In addition, it is necessary to pre-set the signature extraction rule, which is used to determine which type of signature to extract, or the signature extraction rule, etc., such as extracting the instruction opcode of the function entry point in this embodiment.

[0069] The primary function extracted in this embodiment is Func_X, and the signature type of the selected primary function is the instruction opcode of the function entry point. Therefore, it is necessary to analyze the assembly code in the binary file example.bin to find the entry point and return instruction of the primary function Func_X. For example, assuming that Func_X is located between the file offset 0x1000 and 0x1020, the entry point is 0x1000, and the return instruction is at 0x1020. Then extract the instruction sequence of the primary function Func_X, remove the operands, and only retain the opcode to obtain the signature. For example, the assembly code is:

[0070]

[0071] The extraction results are:

[0072] 55 (push)

[0073] 89 (mov)

[0074] 83 (sub)

[0075] c7(mov)

[0076] 8b(mov)

[0077] 83(add)

[0078] 89 (mov)

[0079] 8b(mov)

[0080] c9(leave)

[0081] c3(ret)

[0082] The instruction sequence is: 55 89 83c7 8b 83 89 8b c9 c3. Use SHA (Secure Hash Algorithm)-256 to perform hash operation on the extracted instruction sequence and generate the signature of Func_X:

[0083] d0a1f3c084e6f8c3f0c8914f3c84f89e84f38c7e6e9a3c7d8b7e3f09f79f7e8; the signature of MaliciousFunc_Y in the malicious function signature feature library is:

[0084] d0a1f3c084e6f8c3f0c8914f3c84f89e84f38c7e6e9a3c7d8b7e3f09f79f7e8. The signature of the primary function Func_X is matched with the signature in the malicious function signature feature library. It can be seen that the similarity of the two signatures is 100%. Therefore, the primary function Func_X is identified as a function that is the same as or very similar to the known malicious function MaliciousFunc_Y. At this time, the primary function Func_X can be determined as the first malicious function.

[0085] After detecting the first malicious function, a detection report can be generated, indicating that Func_X completely matches the signature of the known malware MaliciousFunc_Y, and it is speculated that example.bin may contain MaliciousFunc_Y or its variants. It is recommended to further analyze example.bin and take protective measures such as isolating or deleting the file.

[0086] Through the above analysis method, this application can accurately identify whether Func_X is a malicious function. Even if the function may be obfuscated or modified, as long as its core instruction sequence has not changed substantially, it can be effectively detected through signature matching. This method provides an efficient and accurate solution for detecting malware variants.

[0087] Second, this embodiment can also extract the second malicious function through the symbol table of the binary program. Through the symbol table analysis method, functions related to network communication, file operation, etc. can be identified and analyzed to determine whether they have potential malicious behavior.

[0088] If the binary file entered by the user is: malware_sample.bin, the program recorded in the binary file is the target binary program to be detected, and the malicious function feature library records functions related to network communication, file operations and process management, such as send, recv, fopen, fwrite, fork, exec, etc.

[0089] During analysis, first extract the symbol table in the binary file malware_sample.bin. If the extracted symbol table contains the following entries:

[0090]

[0091] Then, according to the functions recorded in the malicious function signature library, the symbols extracted from the symbol table are parsed, focusing on identifying the second malicious functions related to network communication, file operations, and process management. The final parsing results are as follows:

[0092]

[0093] Here, a preliminary risk assessment can be performed on the identified suspicious second malicious functions. In this embodiment, each second malicious function is associated with a common malicious behavior and is given a certain risk weight. An example of the assessment rule is:

[0094] send / recv: High risk (may involve data transmission)

[0095] fopen / fwrite: Medium risk (may involve file tampering)

[0096] fork: medium risk (may involve process hiding or creation of zombie processes)

[0097] In this embodiment, the risk assessment result generated by matching the second malicious function is:

[0098]

[0099] Finally, this solution can also generate an analysis report based on the risk assessment results, highlighting high-risk functions and describing suspicious program behaviors. An example of the output report is:

[0100]

[0101] Preliminary conclusion: This binary file contains multiple high-risk and medium-risk functions related to malicious behavior. Further in-depth analysis or defensive measures are recommended.

[0102] Through the above analysis method, this application can quickly screen out binary files containing potential malicious behaviors and generate a detailed risk analysis report after efficient evaluation. This method greatly improves the analysis efficiency while ensuring accuracy, and is suitable for large-scale binary file screening and preliminary malware detection.

[0103] 3. This embodiment can also identify malicious strings in binary programs. Specifically, after loading the target binary program, this solution can extract all readable strings in it through static analysis tools. This embodiment calls the extracted strings preliminary strings; the extracted preliminary strings need to be matched with a malicious string feature library, which contains known malicious strings. After the system completes the match, it can perform further context analysis on the matched strings to determine whether they are indeed related to the verification activity.

[0104] For example, the binary file to be detected is malicious_program.bin, and the user wants to detect whether the file contains malicious behaviors related to the verification Trojan. The system uses a static analysis tool to extract and analyze the readable preliminary strings in the file. The static analysis tool can be a strings tool, which can correctly identify and extract all readable strings from the binary file to avoid omissions; the extracted preliminary strings may include text information, URLs, command line parameters, etc. For example:

[0105] Plain Text

[0106] stratum+tcp: / / miningpool.example.com

[0107] cgminer -o stratum+tcp: / / anotherpool.com -u user -p pass

[0108] "Invalid input,please try again."

[0109] The strings in the malicious string feature library include: common verification pool addresses, protocol identifiers (such as "stratum"), verification commands (such as "cgminer"), etc. The malicious string feature library should be kept up to date and contain known verification pool address formats, common verification commands, etc. to ensure the accuracy of the match. Then the extracted preliminary strings are matched one by one with the strings in the malicious string feature library to obtain the following matching results:

[0110] Matches the verification pool address: "stratum+tcp: / / miningpool.example.com"

[0111] Matched verification command: "cgminer"

[0112] Furthermore, the matched target string is contextually analyzed to identify malicious strings in the target string that are related to malicious behavior. For example, confirm whether "stratum+tcp: / / " appears in the command line parameters, and whether there are other commands or parameters related to the verification behavior. If so, the target string is determined to be a malicious string. After the malicious string is identified, a report can be generated, which lists in detail the strings found that are related to the verification behavior and their context information. An example of the report content is as follows:

[0113] Plain Text

[0114] Detection Report - Static Analysis of Malicious Binary Programs

[0115] Analyzed file: malicious_program.bin

[0116] Analysis time: 2024-08-29

[0117] The following strings were found to be related to validation activities:

[0118] 1.URL:stratum+tcp: / / miningpool.example.com

[0119] Context: Appears in command line arguments

[0120] 2. Command: cgminer

[0121] Context: Appears together with the verification pool URL, suspected to be used for verification activities

[0122] Preliminary conclusion: This binary file may contain a verification Trojan. Further analysis or preventive measures are recommended.

[0123] It can be seen that this solution can effectively identify potential verification Trojan behaviors in malicious_program.bin, and give detailed analysis results in the report to help users take timely protective measures. Moreover, this method can quickly and accurately detect potential verification Trojans without executing binary files, reducing the complexity and resource consumption of dynamic analysis methods, and significantly improving the detection efficiency and security of malicious programs.

[0124] In summary, the present application determines malicious functions by matching function signatures, which can effectively identify variants of malware and reduce its threat to system security; and is superior to traditional static or dynamic analysis methods in terms of detection speed and accuracy. The present application uses a symbol table analysis method to focus on identifying functions related to network communications and file operations to determine whether the target binary program has potential malicious behavior. The present application uses string analysis technology to effectively detect string features related to malicious behavior in malicious binary programs through static analysis, thereby identifying potential malicious behavior. This method systematically extracts and analyzes all readable strings in binary files, and combines them with a pre-defined malicious string feature library for screening, so that potential malicious behavior can be detected in advance without executing the program. This method solves the limitation of existing dynamic analysis technology that it is difficult to effectively detect and verify Trojans when faced with highly obfuscated and anti-debugging methods, while reducing the occupation of system resources.

[0125] Furthermore, compared with dynamic analysis or other complex static analysis methods, the present application can reduce the potential risk of malicious code execution without running suspicious programs, and quickly and accurately assess their maliciousness, thereby reducing resource consumption and improving detection speed.

[0126] See also Figure 3 , Figure 3 A flowchart of another method for identifying a malicious binary program provided in an embodiment of the present application, the method comprising the following steps:

[0127] S301, obtaining a target binary program;

[0128] S302, extracting the signature of each primary selected function in the target binary program;

[0129] S303, identifying a first malicious function from the preliminary selected functions according to the malicious function signature feature library and the signature of each preliminary selected function;

[0130] S304, extracting the symbol table of the target binary program;

[0131] S305, identifying a second malicious function in the symbol table according to the malicious function feature library;

[0132] S306, extracting the primary character string of the target binary program;

[0133] S307, identifying a target string in the preliminary selected strings according to a malicious string feature library;

[0134] S308, performing context analysis on the target character string to determine malicious character strings in the target character string that are related to malicious behavior;

[0135] S309, determining a risk score for each malicious feature;

[0136] S310: Determine the identification result according to the risk score of the malicious feature.

[0137] In this embodiment, after determining the first malicious function, the second malicious function and the malicious string of the target binary program, the risk scores of the first malicious function, the second malicious function and the malicious string can be comprehensively analyzed to obtain the final identification result. When determining the risk score, the corresponding score weight can be set according to the degree of relevance between the function call and the malicious behavior; different risk scores can be assigned to different strings according to the matching pattern of the string.

[0138] Here, we take the analysis of whether the target binary program is a malicious verification program as an example to illustrate.

[0139] Assume that the binary file to be analyzed is suspicious_miner.exe.

[0140] 1. Extract the preliminarily selected function from the binary file and match it with the known malware function signature feature library to obtain the first malicious function. The matching results are as follows:

[0141] Matches the function init_miner() of a known malware verification

[0142] Matching the function start_mining() of a known malware

[0143] Among them, the score of the first malicious function is:

[0144] init_miner(): 6 points (confirmation of verification behavior)

[0145] start_mining(): 7 points (confirmation of verification behavior)

[0146] Therefore, the total score of the first malicious function is: 6+7=13 points

[0147] 2. Parse the symbol table of the binary file and extract the second malicious function: socket(), connect(): related to network communication

[0148] fopen(), fwrite(): related to file operations

[0149] CreateProcess(): related to process management

[0150] Among them, the scores of each second malicious function are:

[0151] socket(): 3 points (may be related to network communication)

[0152] connect(): 3 points (may communicate with remote server)

[0153] fopen(): 2 points (involving file operations)

[0154] fwrite(): 2 points (may be written to a file)

[0155] CreateProcess(): 4 points (may create a child process for malicious operations)

[0156] Therefore, the total score obtained according to the second malicious function is: 3+3+2+2+4=14 points 3. Extract the readable strings in the binary file and search for specific malicious strings: stratum+tcp: / / miningpool.com: a common verification protocol URL config.json: configuration file name

[0157] Username, password: Possible verification pool login information

[0158] Among them, the scores of each malicious string are:

[0159] stratum+tcp: / / miningpool.com: 5 points (strongly indicates verification behavior) config.json: 2 points (may contain verification configuration)

[0160] Username, password: 3 points (may be the verification pool login credentials)

[0161] Therefore, the total score of the malicious string is: 5+2+3=10 points

[0162] 4. Combination of comprehensive scoring and decision tree

[0163] See Table 1 for a comprehensive scoring table of various analysis methods provided in the embodiments of the present invention:

[0164] Table 1

[0165]

[0166]

[0167] It can be seen from the above that after determining the risk score of each analysis method, the comprehensive total score can be calculated by weighted method, and the final recognition result can be determined based on the comprehensive total score. In this embodiment, the various score intervals and judgment criteria in the decision tree can be optimized according to actual detection experience to reduce the false alarm rate and missed alarm rate. The decision tree in this embodiment is designed as follows:

[0168] If the total score is >15, it is considered a high-risk malicious program.

[0169] If the overall score is between 10 and 15, it is considered a medium-risk malicious program.

[0170] If the combined total score is <10, the procedure is judged to be low-risk or no-risk.

[0171] In this embodiment, the comprehensive total score is 12.4, which is between 10 and 15, so the target binary program is judged to be a medium-risk malicious program. It can be seen that through the combination of this multi-level analysis and scoring table and decision tree, suspicious_miner.exe is accurately identified as a medium-risk verification malicious program, thereby reminding security analysts to conduct further in-depth investigations or take appropriate protective measures.

[0172] From the above, it can be seen that when detecting whether the target binary program is a malicious program, the present application can analyze the target binary program through symbol table analysis, string analysis, function signature matching, etc. This multi-level detection mechanism can complement each other. While maintaining a high detection rate, the system can effectively reduce the false alarm rate and improve the ability to identify hidden and obfuscated malicious behaviors, thereby improving the overall security defense capabilities.

[0173] See also Figure 4 , Figure 4 A schematic diagram of a malicious binary program identification device provided in an embodiment of the present application, the device specifically includes:

[0174] An acquisition module 11 is used to acquire a target binary program;

[0175] The identification module 12 is used to extract the target features in the target binary program and identify the malicious features in the target features using a malicious feature library; wherein the malicious features are malicious functions and malicious strings related to malicious behaviors determined by different identification methods;

[0176] The determination module 13 is used to determine the identification result of the target binary program according to the malicious feature.

[0177] As an optional embodiment, the identification module includes:

[0178] A first extraction unit, configured to extract a signature of each primary selected function in the target binary program;

[0179] The first identification unit is used to identify a first malicious function from the preliminary selected functions according to the malicious function signature feature library and the signature of each preliminary selected function.

[0180] As an optional embodiment, the first extraction unit is specifically used to extract the signature of each preliminary selected function in the target binary program, and the signature includes any one of a function entry point, a calling relationship, a parameter type, and a return value type.

[0181] As an optional embodiment, the first identification unit includes:

[0182] A calculation subunit, used to calculate the similarity value between the signature of each primary selected function and the signature of each known malicious function in the malicious function signature feature library;

[0183] The determination subunit is used to determine the preliminary selected function whose similarity value is greater than the similarity threshold as a first malicious function.

[0184] As an optional embodiment, the identification module includes:

[0185] A second extraction unit, used for extracting a symbol table of the target binary program;

[0186] The second identification unit is used to identify the second malicious function in the symbol table according to the malicious function feature library.

[0187] As an optional embodiment, the identification module includes:

[0188] A third extraction unit, used to extract a preliminary selected character string of the target binary program;

[0189] A third identification unit, configured to identify a target character string in the preliminary selected character string according to a malicious character string feature library;

[0190] The analyzing unit is used to perform context analysis on the target character string to determine malicious character strings related to malicious behaviors in the target character string.

[0191] As an optional embodiment, the determining module includes:

[0192] A first determination unit, used to determine a risk score for each malicious feature;

[0193] The second determination unit is used to determine the identification result according to the risk scores of all malicious features.

[0194] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0195] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0196] A processor 21, a memory 22, and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 executes the steps of the malicious binary program identification method described in any of the above method embodiments through the computer program.

[0197] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0198] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the method for identifying malicious binary programs disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0199] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0200] certainly, Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0201] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by the processor, the steps of the method for identifying malicious binary programs described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0202] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0203] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0204] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for identifying malicious binary programs, characterized in that: include: Get the target binary program; Extracting target features from the target binary program, and identifying malicious features in the target features using a malicious feature library; wherein the malicious features are malicious functions and malicious character strings related to malicious behaviors determined by different identification methods; An identification result of the target binary program is determined according to the malicious feature.

2. The identification method according to claim 1, characterized in that: Extracting target features from the target binary program and identifying malicious functions in the target features using a malicious feature library, including: Extracting the signature of each pre-selected function in the target binary program; According to the malicious function signature feature library and the signature of each preliminary selected function, a first malicious function is identified from the preliminary selected functions.

3. The identification method according to claim 2, characterized in that: The extracting the signature of each primary selected function in the target binary program comprises: A signature of each preliminarily selected function in the target binary program is extracted, wherein the signature includes any one of a function entry point, a calling relationship, a parameter type, and a return value type.

4. The identification method according to claim 2, characterized in that: The step of identifying a first malicious function from the preliminarily selected functions according to the malicious function signature feature library and the signature of each preliminarily selected function includes: Calculate the similarity value between the signature of each primary selected function and the signature of each known malicious function in the malicious function signature feature library; The initially selected function whose similarity value is greater than the similarity threshold is determined as the first malicious function.

5. The identification method according to claim 1, characterized in that: Extracting target features from the target binary program and identifying malicious functions in the target features using a malicious feature library, including: Extracting a symbol table of the target binary program; A second malicious function in the symbol table is identified according to the malicious function feature library.

6. The identification method according to claim 1, characterized in that: Extracting target features from the target binary program and identifying malicious character strings in the target features using a malicious feature library, including: Extracting a preliminary string of the target binary program; Identify a target string in the preliminary selected string according to a malicious string feature library; A context analysis is performed on the target character string to determine malicious character strings in the target character string that are related to malicious behavior.

7. The identification method according to any one of claims 1 to 6, characterized in that: Determining the identification result of the target binary program according to the malicious feature includes: Determine a risk score for each malicious signature; The identification results are determined based on the risk scores of all malicious features.

8. A device for identifying malicious binary programs, characterized in that: include: An acquisition module is used to acquire the target binary program; An identification module, used to extract target features in the target binary program, and identify malicious features in the target features using a malicious feature library; wherein the malicious features are malicious functions and malicious character strings related to malicious behaviors determined by different identification methods; A determination module is used to determine the identification result of the target binary program according to the malicious feature.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the method for identifying malicious binary programs as described in any one of claims 1 to 7 through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the malicious binary program identification method described in any one of claims 1 to 7 of the present application.

Images