Explanatable high-value malicious code classification method based on thinking chain technology

Abstract

The invention belongs to the technical field of network security, and discloses an interpretable high-value malicious code classification method based on a thinking chain technology, which comprises the following steps of: 1, generating high-value API (Application Program Interface) calling sequence information of a malicious code family; step 2, constructing a corpus based on a thinking chain technology: identifying a high-value API calling sequence and non-aggressive API calling sequence information in the APT family through the thinking chain technology, and performing feasibility description analysis on the high-value API calling sequence so as to construct the corpus; and 3, performing fine adjustment on the large model, training the corpus constructed in the step 2, and generating a final classification result. According to the method, by generating the high-value API abstract of the malicious code family and combining the thinking chain technology and the fine adjustment strategy, efficient classification of malicious software codes is achieved, and therefore the problems that existing malicious codes are complex in structure and large in manual analysis difficulty are effectively solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically relates to an explainable high-value malicious code classification method based on thought chain technology. Background Art

[0002] In the process of network security development, malicious code has always been one of the most threatening factors, which can cause devastating damage to network systems and data information. Malicious code usually refers to computer programs designed to perform malicious behaviors, including viruses, worms, Trojans, ransomware and other forms. Today, the analysis of malicious code has become an important part of network security defense, threat response and tracing. However, with the surge in the number of malicious codes and the increase in their complexity, manual analysis has become a highly specialized, extremely difficult and time-consuming task. Common problems in manual analysis of malicious code include: many malicious codes have complex code structures, containing a large number of branches and difficult-to-understand logic; manual analysis of malicious code is usually very time-consuming, especially complex and advanced malware may require days or even weeks of analysis; the risk of false positives and false negatives in manual analysis of malicious code still exists, especially in the judgment of certain boundary behaviors; malware developers often use obfuscation techniques such as code reordering, junk code insertion, variable and function renaming, and encryption to hide their intentions.

[0003] Therefore, in the process of analyzing malicious code, it is particularly important to identify and extract high-value information fragments that play a key role in malicious behavior. The so-called high-value API of malicious code refers to application program interface calls that play an important role in realizing the core functions of malicious code such as data theft, system destruction, and privilege escalation. These API calls are important clues to understanding the code structure and potential intentions.

[0004] There are also some studies on malicious code classification in the prior art, such as the malware classification method based on improved CNN (Xuan Bona, Li Jin. Journal of Electronics, 2023, 51(05): 1187-1197.) which discloses the technical key points of malware RGB (Red Green Blue) visualization based on improved CNN, the malicious code classification method based on Transformer and CNN (Mu Yumeng, Liu Liang, Zhang Lei, et al. Journal of Sichuan University (Natural Science Edition), 2024, 61(04): 133-139.) which discloses the technical key points of MobileVit model based on cost sensitivity, API2Vec++: Boosting API Sequence Representation for Malware Detection and Classification (Cui L, Yin J, Cui J, et al. IEEE Transactions on Software Engineering, 2024, 50(8): 2142-2162.) which discloses the technical key points of graph-based API embedding, and Research on APT Malware Detection Based on BERT-Transformer-TextCNN. Modeling (Zhang J, Liu S, Liu Z. Proceedings of the 2024 International Conference on Generative Artificial Intelligence and Information Security. 2024: 235-242.) discloses the key technical points of the BERT-Transformer TextNN model for attack detection.

[0005] Although these public technologies have made some progress in malicious code classification, they still have some limitations in fully mining the core information in malicious code, and there is still much room for improvement. Summary of the invention

[0006] In order to solve the above technical problems, the present invention provides an explainable high-value malicious code classification method based on mind chain technology. The method generates a high-value API summary of the malicious code family, combines the mind chain technology with the fine-tuning strategy, and realizes efficient classification of malicious software code, thereby effectively addressing the problems of complex structure of existing malicious code and difficulty of manual analysis.

[0007] In order to achieve the above object, the present invention is achieved through the following technical solutions:

[0008] The present invention is an explainable high-value malicious code classification method based on thought chain technology, and the classification method specifically comprises the following steps:

[0009] Step 1, generate high-value API call sequence information of malicious code families: extract API call sequence information from samples of the APT (Advanced Persistent Threats) family, screen out key API call sequence information that is highly related to target behaviors such as malicious behaviors, attack activities or system functions, namely 3-gram API call sequence information, connect the screened API call sequence information, namely 3-gram API call sequence information, together to form high-value API call sequence information, and at the same time screen out non-aggressive API call sequence information, namely 3-gram API call sequence information, from different APT families;

[0010] Step 2: Construct a corpus based on the mind chain technology: Use the mind chain technology to identify high-value API call sequences and non-aggressive API call sequence information in the APT family, conduct a feasibility analysis on the high-value API call sequences, and thus construct a corpus;

[0011] Step 3: Fine-tune the large model, train the corpus constructed in step 2, and generate the final classification results.

[0012] A further improvement of the present invention is that step 1 generates high-value API call sequence information of malicious code, specifically comprising the following steps:

[0013] Step 1.1: Start the sandbox analysis environment, capture the dynamic behavior of malicious code from the samples of the APT family, such as file operations, network activities, registry operations, etc., and extract various API call sequence information related to the dynamic behavior of malicious code;

[0014] Step 1.2, using the 3-gram model to integrate and analyze the API call sequence information extracted in step 1.1, to obtain the 3-gram API call sequence information after the integration and analysis, and retain the context information of the 3-gram API call sequence information;

[0015] Step 1.3: There are some identical 3-gram API call sequence information that are not directly offensive in different APT families. The identical 3-gram API call sequence information of different APT families is extracted to construct a common non-aggressive API call sequence information, and identify which parts of the malicious code are non-aggressive 3-gram API call sequence information;

[0016] Step 1.4: Count the overall occurrence frequency of the 3-gram API call sequence information of each APT family, sort the overall occurrence frequency, retain the 3-gram API call sequence information whose occurrence times exceed the set threshold, and connect the retained 3-gram API call sequence information to form the high-value API call sequence information of the malware sample.

[0017] A further improvement of the present invention is that in step 1.4, the statistical calculation method of the overall occurrence frequency of the 3-gram API call sequence information of each APT family is:

[0018]

[0019] Among them, TF i,j represents the probability of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of sample j; n i,j represents the number of 3-gram API call sequence information i in sample j; ∑ k n k,j Indicates the number of sample j3-gram API call sequence information;

[0020] The probability IDF of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of malicious code family h i,h for:

[0021]

[0022] Among them, m i Indicates the total number of 3-gram API call sequence information i in the family, N h Indicates the total number of samples in the family;

[0023] Calculate the weight TF-IDF of 3-gram API call sequence information i in malicious code family h sample j i,j,h , and use this as the basis for screening high-value APIs:

[0024] TF-IDF i,j,h =TF i,j ×IDF i,h .

[0025] A further improvement of the present invention is that in step 1.2, the use of a 3-gram model to integrate and analyze the API call sequence information extracted in step 1.1 means that the 3-gram model divides the API call sequence information into triplets, i.e., three consecutive API call sequence information, to capture the relationships and patterns between the API call sequence information.

[0026] A further improvement of the present invention is that a corpus is constructed based on the thought chain technology, which specifically includes the following steps:

[0027] Step 2.1: Split the API call sequence information extracted from each APT family sample, specifically: identify a section of API call sequence information, and mark the high-value API call sequence information and non-aggressive API call sequence information;

[0028] Step 2.2, interpreting the split high-value API call sequence information to form the input and output of the corpus, and inferring that the high-value API call sequence information belongs to the name of a specific malicious code family;

[0029] The input of the corpus is the high-value API call sequence information and the non-aggressive API call sequence information separated in step 2.1, the high-value API call sequence information extracted from the APT family samples and the common non-aggressive API call sequence, i.e., the user instruction part;

[0030] The output of the corpus is the explanation of high-value API call sequence information and the name of the malicious code family;

[0031] Step 2.3: Repeat step 2.2 for each piece of API call sequence information data extracted from the APT family sample to build a corpus with clear structure and coherent content.

[0032] A further improvement of the present invention is that the step 3 specifically includes the following steps:

[0033] Step 3.1: Convert the corpus constructed in step 2 into a new form and divide the converted corpus into a training set and a test set.

[0034] Step 3.2: Input the training set into the large model for preliminary training. That is, input the training set into the large model to configure the training parameters and train the model. After the preliminary training is completed, fine-tune it through LoRA technology.

[0035] Step 3.3: After training is completed, the test set is input into the large model. The large model performs a comprehensive performance evaluation on the test set to test whether the large model can accurately provide explanations of high-value API call sequence information and family classification results.

[0036] A further improvement of the present invention is that in step 3.3, the large model is subjected to a comprehensive performance evaluation by a testing machine, specifically:

[0037] Evaluation accuracy:

[0038]

[0039] Among them, a represents the number of correctly predicted samples, and A represents the total number of samples involved in the prediction;

[0040] Evaluation of Recall g (Multi-classification problem):

[0041]

[0042] TP g Indicates the number of samples correctly predicted in family g, FN g Indicates the number of samples of family g that are incorrectly predicted

[0043]

[0044] Take the average of the recall rates of k families as the final recall rate

[0045] Precision (multi-classification problem):

[0046]

[0047] TP g Indicates the number of samples correctly predicted by family g, FP g Indicates the number of samples that are incorrectly predicted to be in the g family

[0048]

[0049] Take the average of the precision rates of k families as the final precision rate,

[0050] F1 score:

[0051]

[0052] Precision means precision, and Recall means recall.

[0053] The beneficial effects of the present invention are as follows: the present invention proposes a more targeted and effective solution to the complexity of malicious code evading detection through code obfuscation, encryption and polymorphic technology. The method not only significantly improves the accuracy of malicious code classification and detection, but also provides more comprehensive and accurate support in threat warning and coping with the complex and changeable behavior of malicious code; based on the extraction of high-value API features of malicious code, high-value API calls are the key path for the execution of malicious behavior. Extracting these APIs can effectively bypass protection mechanisms such as code obfuscation and encryption, capture the dynamic behavior of malicious code, and significantly improve the effectiveness of detection; at the same time, the method can more accurately identify the core behavioral characteristics of malicious code, thereby improving the accuracy of detection and effectively reducing the false alarm rate;

[0054] By introducing the chain of thought, the model can gradually generate intermediate reasoning steps, which gradually decomposes the problem into multiple manageable sub-problems. The generation of each step of reasoning can not only help the model better understand the current task, but also provide a more solid foundation for subsequent steps. This step-by-step reasoning method is similar to the process of human thinking, which enables the model to derive complex conclusions from simple conditions;

[0055] The large model of the present invention is trained by a corpus built based on the thought chain to learn the reasoning logic therein, so that the large model can provide an explainable description of high-value APIs on the test set and accurately classify malicious code families.

[0056] In summary, the extraction of high-value API features from malicious code has greatly improved the accuracy and efficiency of the security detection system in malicious code analysis, and has become a core element in identifying potential threats. The corpus generated by Thinking Chain further enhances the reasoning ability and interpretability of the model, enabling it to cope with more complex reasoning tasks. Through large-scale model training and fine-tuning, the model can accurately adapt to task requirements, and demonstrate excellent language processing and reasoning performance in malicious code classification, thereby achieving more efficient analysis and threat identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a schematic diagram of the method of the present invention.

[0058] Figure 2 It is a schematic diagram of guiding the thinking chain of the present invention.

[0059] Figure 3 It is a schematic diagram of the summary result of high-value API of malicious code of the present invention.

[0060] Figure 4 It is a schematic diagram of the summary of common non-aggressive APIs of the present invention.

[0061] Figure 5 This is a loss function diagram of the large model training effect after the present invention combines the fine-tuning technology. DETAILED DESCRIPTION

[0062] The following will disclose the embodiments of the present invention with drawings. For the purpose of clear description, many practical details will be described together in the following description. However, it should be understood that these practical details should not be used to limit the present invention. That is to say, in some embodiments of the present invention, these practical details are not necessary.

[0063] like Figure 1As shown in the figure, the malicious code sample is first preliminarily parsed through the cape sandbox to extract high-value malicious code API summaries and common non-offensive API summaries. Then, the thinking chain is used to guide the construction of an interpretable corpus, and the LLaMA large model is trained in combination with the LoRA fine-tuning technology to achieve the classification of malicious code.

[0064] like Figure 2-Figure 5 As shown, the explainable high-value malicious code classification based on the thinking chain technology described in the present invention includes a malicious code high-value API summary generation part, a thinking chain corpus construction part, and a large model training and fine-tuning part;

[0065] Malicious code high-value API summary generation part: By converting the samples of the malicious code family into JSON format files, the API information involved in the samples can be extracted. Then, the key high-value parts are screened out from these APIs and a concise API summary is generated;

[0066] Thinking chain corpus construction part: through the thinking chain technology, the high-value API call sequence and non-aggressive API call sequence information in the APT family are identified, and the feasibility analysis of the high-value API call sequence is performed to construct the corpus. Specifically, the API call sequence information extracted from each APT family sample is split, specifically: a section of API call sequence information is identified, and the high-value API call sequence information and non-aggressive API call sequence information are marked; the split high-value API call sequence information is explained to form the input and output of the corpus, and the high-value API call sequence information belongs to the name of a specific malicious code family; wherein, for the input part of the corpus, i.e. the user instruction part, each sample data adopts the following template: "This is a section of API call sequence information, in which the high-value part of the call sequence information is: (the high-value API call sequence information of the sample is given); the common non-aggressive part is: (the common non-aggressive API call sequence information is given)."

[0067] For the output part of the corpus, that is, the large model answer part, each sample data uses the following template: "The specific meaning of this high-value API call sequence information is: (give the specific meaning of each 3-gram of the API call sequence information summarized in the high-value API call sequence information); it is inferred that it belongs to: (give the name of the malicious code family to which this sample belongs)." Each API call sequence information data extracted from the APT family sample repeats the input and output of the corpus to construct a corpus with clear structure and coherent content.

[0068] The constructed corpus is converted into a form, and the converted corpus is divided into a training set and a test set; the training set is input into the large model for preliminary training, that is, the training set is input into the large model to configure the training parameters, train the model, and after the preliminary training is completed, fine-tune it through the LoRA technology; after the overall training is completed, the test set is input into the large model, and the large model performs a comprehensive performance evaluation through the test set to test whether the large model can accurately provide explanations of high-value API call sequence information and family classification results. The core of this stage is to analyze the performance of the model in actual tasks, focusing on key indicators such as classification accuracy, recall rate, and F1 score. Through the evaluation of these indicators, the overall performance of the model can be accurately judged, and it is determined whether further optimization and tuning are needed. During the entire training process, it is often necessary to adjust the hyperparameter configuration multiple times, including learning rate, batch size, regularization strength, etc., to ensure the best performance of the model. Through this series of highly refined steps, the LLaMA large model combined with the LoRA fine-tuning technology fully utilizes the data advantages of the corpus, achieves efficient learning and performance optimization, and finally shows good reasoning and processing capabilities in the complex task of malicious code classification.

[0069] The present invention is introduced below by taking the malicious code family Appin, extracting the high-value API summary of the Appin family, and completing the interpretable high-value malicious code classification through the guidance of the thinking chain combined with the fine-tuning technology as an example, which specifically includes the following steps:

[0070] Step 1. Generate high-value API call sequence information of malicious code families: Extract API call sequence information from samples of the APT (Advanced Persistent Threats) family, screen out key API call sequence information that is highly related to target behaviors such as malicious behaviors, attack activities or system functions, namely 3-gram API call sequence information, connect the screened API call sequence information, namely 3-gram API call sequence information, together to form high-value API call sequence information, and at the same time screen out non-aggressive API call sequence information, namely 3-gram API call sequence information, from different APT families.

[0071] High-value API call sequence information that generates malicious code such as Figure 3-4 As shown, specifically:

[0072] Start the cape sandbox analysis environment, use the cape sandbox to parse the prepared Appin malicious family samples using the jsonsearch package, and generate detailed results including sample behaviors through dynamic analysis of the cape sandbox. Then, extract the generated json and html files from the parsed results, and further extract the API call sequence information related to the sample. At this stage, the main task of the cape sandbox is to capture the dynamic behavior of the malicious code and extract various API call sequence information related to the malicious activities.

[0073] After extracting the API call sequence information of all samples of the Appin malicious family, the API call sequence information is divided into triplets, that is, every three consecutive API call sequence information is combined into a 3-gram API call sequence information. This grouping method helps to capture the dependencies between API call sequence information. Subsequently, these 3-gram API call sequence information of the Appin family are compared with the API call sequence information of other malware families to identify the same parts. These same 3-gram API call sequence information can be regarded as general API call sequence information without attack characteristics, thereby constructing a relatively general and non-aggressive API call sequence information, such as Figure 3 Finally, the API call sequence information extracted from the family is statistically analyzed, the frequency of occurrence of the overall API call sequence information is calculated, and each sample data is sorted based on the overall frequency, retaining the top 20-40 API call sequence information with the highest frequency, preferably the top 20. These high-frequency API call sequence information are usually the most representative operations in the malware execution process, forming the high-value API call sequence information of the sample, as shown in Figure 1. Figure 4 shown.

[0074] The statistical calculation method for the overall occurrence frequency of the 3-gram API call sequence information of each APT family is:

[0075]

[0076] Among them, TF i,j represents the probability of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of sample j; n i,j represents the number of 3-gram API call sequence information i in sample j; ∑ k n k,j Indicates the number of sample j3-gram API call sequence information;

[0077] The probability IDF of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of malicious code family h i,h for:

[0078]

[0079] Among them, m i Indicates the total number of 3-gram API call sequence information i in the family, N h Indicates the total number of samples in the family;

[0080] Calculate the weight TF-IDF of 3-gram API call sequence information i in malicious code family h sample j i,j,h , and use this as the basis for screening high-value APIs:

[0081] TF-IDF i,j,h =TF i,j ×IDF i,h .

[0082] Step 2: Construct a corpus based on the thinking chain technology: The Appin malicious code family is input as follows: "This is a section of API call sequence information, among which the high-value API call sequence information is, and the common non-aggressive API call sequence information is." The output is: "This section of high-value API call sequence information behavior meanings are respectively, and it is inferred that it belongs to which family." Construct a corpus. For example, the input is: There is an API sequence where the summary of high-valueAPIs is:(NtSetTimer,NtQuerySystemInformation,FindResourceExW),(NtQuerySystemInformation,FindResourceExW,RegQueryValueExW),(FindResourceExW,RegQueryValueExW,HeapCreate),(RegQueryValueExW,HeapCreate,GetVolum eNameForVolumeMountPointW),(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose),(NtQueryFullAttributesFile,NtCl ose,LdrGetDllHandle),(NtClose,LdrGetDllHandle,CreateWindowExA),(LdrGetDllHandle,CreateWindowExA,NtAddAtom),(CreateWindowExA,NtAddAtom,NtCreateThreadEx),(NtAddAtom,NtCreateThreadEx,RegQueryInfoKeyW),(Nt CreateThreadEx,RegQueryInfoKeyW,FindFirstFileExW),(RegQueryInfoKeyW,FindFirstFileExW,ChangeWindowMessageFilter),(FindFirstFileExW,ChangeWindowMessageFilter,GetSystemMetrics),(ChangeWindowMessageFilter,GetSystemMetrics,NtFreeVirtualMemory),(GetSystemMetrics,NtFreeVirtualMemory,StrCmpNICW),(NtFreeVirtualMemory,StrCmpNICW,NtDelayExecution),(StrCmpNICW,NtDelayExecution,LdrGetProcedureAddress),(NtDelayExecution,LdrGetProcedureAddress,LsaOpenPolicy),(LdrGetProcedureAddress,LsaOpenPolicy,ScriptIsComplex);The common non aggressive APIs are:(CreateWindowExW,GetSystemInfo,RegQueryValueExA),(GetSystemTimeAsFileTime,NtAllocateVirtualMemory,GetSystemTime),(LdrLoadDll,GetSystemInfo,RegQueryValueExA),(RegCloseKey,LdrLoadDll,CoCreateInstance),(NtCreateFile,memcpy,NtReleaseMutant),(OpenSCManagerA,NtDeviceIoControlFile,InternetOpenA),(NtCreateFile,GetSystemTime,HeapCreate),(GetSystemInfo,RegQueryValueExA,NtCreateFile),(NtWaitForSingleObject,LdrGetProcedureAddress,LdrLoadDll),(NtCreateFile,LdrLoadDll,LdrGetProcedureAddress),(NtQueryAttributesFile,NtDelayExecution,NtClose),(GetSystemInfo,NtQueryValueKey,GetComputerNameA),(NtCreateFile,RegQueryValueExA,ChangeWindowMessageFilter),(LdrGetProcedureAddress,(NtCreateSection, NtQueryValueKey), (NtQueryValueKey, NtFreeVirtualMemory, NtReleaseMutant), (NtUnmapViewOfSection, NtAllocateVirtualMemory, NtClose), (NtOpenKey, NtQueryValueKey, GetSystemTimeAsFileTime), (NtQuerySystemTime, RegOpenKeyExW, GetSystemInfo), (CreateProcessInternalW, NtOpenKey, RegCloseKey), (CreateWindowExW, NtDelayExecution, NtMapViewOfSection), (NtReadFile, NtQuerySystemTime, RegOpenKeyExW), (LdrLoadDll, NtDelayExecution, NtAllocateVirtualMemory), (memcpy, NtSetInformationFile, NtFindAtom), (NtAllocateVirtualMemory, RegQueryValueExA, RegOpenKeyExW), (NtQueryInformationFile, SetUnhandledExceptionFilter, LdrGetProcedureAddress). The meanings of this high - value API behavior are as follows: (NtSetTimer, NtQuerySystemInformation, FindResourceExW): Sets a timer object; Retrieves system information, such as system performance or process list; Finds a resource in a specified module, supports Unicode, (NtQuerySystemInformation, FindResourceExW, RegQueryValueExW): Retrieves system information,such as system performance or process list;Finds a resourcein a specified module,supports Unicode;Retrieves a value from a specified keyin the registry,supports Unicode,(FindResourceExW,RegQueryValueExW,HeapCreate):Finds aresource in a specified module,supports Unicode;Retrievesa value from a specified keyin the registry,supports Unicode;Creates a heapobject for dynamic memory allocation,(RegQueryValueExW,HeapCreate,GetVolumeNameForVolumeMountPointW):Retrieves a value from a specified key in theregistry,supports Unicode;Creates a heap object for dynamic memoryallocation;Gets the volume name for a volume mount point,supports Unicode,(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile):Createsa heap object for dynamic memory allocation;Gets the volume name for avolume mountpoint,supports Unicode;Queries the full attributes of a file(e.g.,size,timestamps,etc.),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose):Gets the volume name for a volume mountpoint,supports Unicode;Queries the full attributes of a file(e.g.,size,timestamps,etc.);Closes a kernel object handle,releasing resources,(NtQueryFullAttributesFile,NtClose,LdrGetDllHandle):Queries the fullattributes of a file(e.g.,size,timestamps,etc.);Closes a kernel objecthandle,releasing resources;Gets the handle of a loaded DLL,(NtClose,LdrGetDllHandle,CreateWindowExA):Closes a kernel object handle,releasingresources;Gets the handle of a loaded DLL;Creates a window with extendedstyles,supports ANSI,(LdrGetDllHandle,CreateWindowExA,NtAddAtom):Gets thehandle of a loaded DLL;Creates a window with extended styles,supports ANSI;Adds a string to the global atom table and returns its atom identifier,(CreateWindowExA,NtAddAtom,NtCreateThreadEx):Creates a window with extendedstyles,supports ANSI;Adds a string to the global atom table and returns itsatom identifier;Creates a new thread in a specified process,(NtAddAtom,NtCreateThreadEx,RegQueryInfoKeyW):Adds a string to the global atom table andreturns its atom identifier;Creates a new thread in a specified process;Retrieves information about a registry key,supports Unicode,(NtCreateThreadEx,RegQueryInfoKeyW,FindFirstFileExW):Creates a new thread ina specified process;Retrieves information about aregistry key,supportsUnicode;Searches for files or directories,supports Unicode,(RegQueryInfoKeyW,FindFirstFileExW,ChangeWindowMessageFilter):Retrieves information aboutaregistry key,supports Unicode;Searches for files or directories,supportsUnicode;Changes the filter for window messages received by an application,(FindFirstFileExW,ChangeWindowMessageFilter,GetSystemMetrics):Searches forfiles or directories,supports Unicode;Changes the filter for window messagesreceived by an application;Retrieves system metricsand configurationinformation,(ChangeWindowMessageFilter,GetSystemMetrics,NtFreeVirtualMemory):Changes the filter for window messages received by an application;Retrievessystem metrics and configuration information;Frees a region of virtualmemory,(GetSystemMetrics,NtFreeVirtualMemory,StrCmpNICW):Retrieves systemmetrics and configuration information;Frees a region of virtual memory;Compares two strings case-insensitively,supports Unicode,(NtFreeVirtualMemory,StrCmpNICW,NtDelayExecution):Frees a region of virtualmemory;Compares two strings case-insensitively,supports Unicode;Delays theexecution of a thread,often used for sleep operations,(StrCmpNICW,NtDelayExecution,LdrGetProcedureAddress):Compares two strings case-insensitively,supports Unicode;Delays the execution of a thread,often usedfor sleep operations;Retrieves the address of a function from a loaded DLL,(NtDelayExecution,LdrGetProcedureAddress,LsaOpenPolicy):Delays the executionof a thread,often used for sleep operations;Retrieves the address of a function from a loaded DLL;Opens the security policy object of a local orremote system,(LdrGetProcedureAddress,LsaOpenPolicy,ScriptIsComplex): ,

[0083] Step 3: Fine-tune the large model, train the corpus constructed in step 2, and generate the final classification results.

[0084] For the large model training and fine-tuning part: convert the constructed corpus into a json file suitable for model input, use the LLaMA large model to train the corpus, and after the model is initially trained, fine-tune it through LoRA to further improve the adaptability of the model. This process can optimize the performance of the model in different tasks, allowing it to learn and capture complex features more efficiently, thereby improving the accuracy and effect of processing specific tasks. During the training process, use the logging tool to track the training progress of the model in real time, especially the changing trend of the loss function, such as Figure 5As shown in the figure, the convergence and training status of the model are evaluated. After training, the model will be evaluated by the test set. For example, for the LLaMA large model input: There is an API sequence where the summary of high-value APIs is: (NtSetTimer,WriteConsoleW,gethostname), (WriteConsoleW,gethostname,NtQuerySystemInformation), (gethostname,NtQuerySystemInformation,ReadProcessMemory), (NtQuerySystemInformation,ReadProcessMemory,FindResourceExW), (ReadProcessMemory,FindResourceExW,RegQueryValueExW), (FindResourceExW,RegQueryValueExW,StartServiceW), (RegQueryValueExW,StartServiceW,HttpOpenRequestA), (StartServiceW,HttpOpenRequestA,HeapCreate), (HttpOpenRequestA,HeapCreate,Ge tVolumeNameForVolumeMountPointW),(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose),(NtQueryFullAttributesFile,NtClose,LdrGetDll Handle),(NtClose,LdrGetDllHandle,CreateWindowExA),(LdrGetDllHandle,CreateWindowExA,SetUnhandledExceptionFilter),(CreateWindowExA,SetUnhandledExceptionFilter,GetComputerNameA),(SetUnhandledExceptionFilter,GetComputerNameA,NtCreateUserProcess),(GetComputerNameA,NtCreateUserProcess,NtWriteFile),(NtCreateUserProcess,NtWriteFile,NtAddAtom),(NtWriteFile,NtAddAtom,NtCreateEvent),(NtAddAtom,NtCreateEvent,GetLocalTime),The common nonaggressive APIs are:(CreateWindowExW,GetSystemInfo,RegQueryValueExA),(GetSystemTimeAsFileTime,NtAllocateVirtualMemory,GetSystemTime),(LdrLoadDll,GetSystemInfo,RegQueryValueExA),(RegCloseKey,LdrLoadDll,CoCreateInstance),(NtCreateFile,memcpy,NtReleaseMutant),(OpenSCManagerA,NtDeviceIoControlFile,InternetOpenA),(NtCreateFile,GetSystemTime,HeapCreate),(GetSystemInfo,RegQueryValueExA,NtCreateFile),(NtWaitForSingleObject,LdrGetProcedureAddress,LdrLoadDll),(NtCreateFile,LdrLoadDll,LdrGetProcedureAddress),(NtQueryAttributesFile,NtDelayExecution,NtClose),(GetSystemInfo,NtQueryValueKey,GetComputerNameA),(NtCreateFile,RegQueryValueExA,ChangeWindowMessageFilter),(LdrGetProcedureAddress,NtCreateSection,NtQueryValueKey),(NtQueryValueKey,NtFreeVirtualMemory,NtReleaseMutant),(NtUnmapViewOfSection,NtAllocateVirtualMemory, NtClose), (NtOpenKey, NtQueryValueKey, GetSystemTimeAsFileTime), (NtQuerySystemTime, RegOpenKeyExW, GetSystemInfo), (CreateProcessInternalW, NtOpenKey, RegCloseKey), (CreateWindowExW, NtDelayExecution, NtMapViewOfSection), (NtReadFile, NtQuerySystemTime, RegOpenKeyExW), (LdrLoadDll, NtDelayExecution, NtAllocateVirtualMemory), (memcpy, NtSetInformationFile, NtFindAtom), (NtAllocateVirtualMemory, RegQueryValueExA, RegOpenKeyExW), (NtQueryInformationFile, SetUnhandledExceptionFilter, LdrGetProcedureAddress) The final large model will give the answer: The meanings of this high-value API behavior are as follows: (NtSetTimer, WriteConsoleW, gethostname): Sets a timer object; Writes data to the console, supports Unicode; Retrieves the host name, (WriteConsoleW, gethostname, NtQuerySystemInformation): Writes data to the console, supports Unicode; Retrieves the host name; Retrieves system information, such as system performance or process list, (gethostname, NtQuerySystemInformation, ReadProcessMemory): Retrieves the host name; Retrieves system information,suchas system performance or process list;Reads the memory of a process,(NtQuerySystemInformation,ReadProcessMemory,FindResourceExW):Retrievessysteminformation,such a s system performance or process list;Reads thememory of a process;Finds a resource ina specified module,supports Unicode,(ReadProcessMemory,FindResourceExW,RegQueryValueExW):Reads the memory of aprocess;Finds a resource in a specified module,supportsUnicode;Retrieves avalue from a specified key in the registry,supports Unicode,(FindResourceExW,RegQueryValueExW,StartServiceW):Finds a resource in a specified module,supports Unicode;Retrieves a value from a specified key in the registry,supports Unicode;Starts a specified service,supports Unicode,(RegQueryValueExW,StartServiceW,HttpOpenRequestA):Retrieves a value from aspecified key in the registry,supports Unicode;Starts a specified service,supports Unicode;Opens an HTTP request handle,supports ANSI,(StartServiceW,HttpOpenRequestA,HeapCreate):Starts a specified service,supports Unicode;Opens an HTTP request handle,supports ANSI;Creates a heap object for dynamicmemory allocation,(HttpOpenRequestA,HeapCreate,GetVolumeNameForVolumeMountPointW):Opens anHTTP request handle,supports ANSI;Creates a heap object fordynamic memory allocation;Gets the volume name for a volume mount point,supports Unicode,(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile):Creates a heap object for dynamic memoryallocation;Gets the volume name for a volume mount point,supports Unicode;Queries the full attributes of a file(e.g.,size,timestamps,etc.),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose):Gets the volumename for a volume mount point,supports Unicode;Queries the full attributes ofa file(e.g.,size,timestamps,etc.);Closes a kernel object handle,releasingresources,(NtQueryFullAttributesFile,NtClose,LdrGetDllHandle):Queries thefull attributes of a file(e.g.,size,timestamps,etc.);Closes a kernel objecthandle,releasing resources;Gets the handle of a loaded DLL,(NtClose,LdrGetDllHandle,CreateWindowExA):Closes a kernel object handle,releasingresources;Gets the handle of a loaded DLL;Creates a window with extendedstyles,supports ANSI,(LdrGetDllHandle,CreateWindowExA,SetUnhandledExceptionFilter):Gets the handle of a loaded DLL;Creates a windowwith extended styles,supports ANSI;Sets a handler for unhandled exceptions,(CreateWindowExA,SetUnhandledExceptionFilter,GetComputerNameA):Createsawindow with extended styles,supports ANSI;Sets a handler for unhandledexceptions;Retrieves the name of the computer,supports ANSI,(SetUnhandledExceptionFilter,GetComputerNameA,NtCreateUserProcess):Sets ahandler for unhandled exceptions;Retrieves the name of the computer,supportsANSI;Creates a new user process,(GetComputerNameA,NtCreateUserProcess,NtWriteFile):Retrieves the name of the computer,supports ANSI;Creates a newuser process;Writes data to a file or device,(NtCreateUserProcess,NtWriteFile,NtAddAtom):Creates a new user process; Writes data to a file or device; Adds a string to the global atom table and returns its atom identifier, (NtWriteFile,NtAddAtom,NtCreateEvent): Writes data to a file or device; object,(NtAddAtom,NtCreateEvent,GetLocalTime):Adds a string to the global atom table and returns its atom identifier;Creates or opens anevent object;Retrieves the local system time.This API sequence may be:Appin. ,

[0085] The large model undergoes a comprehensive performance evaluation on the test machine, specifically:

[0086] Evaluation accuracy:

[0087]

[0088] Among them, a represents the number of correctly predicted samples, and A represents the total number of samples involved in the prediction;

[0089] Recall (multi-classification problem):

[0090]

[0091] TP g Indicates the number of samples correctly predicted in family g, FN g Indicates the number of samples of family g that are incorrectly predicted

[0092]

[0093] Take the average of the recall rates of k families as the final recall rate

[0094] Precision (multi-classification problem):

[0095]

[0096] TP g Indicates the number of samples correctly predicted by family g, FP g Indicates the number of samples that are incorrectly predicted to be in the g family

[0097]

[0098] Take the average of the precision rates of k families as the final precision rate,

[0099] F1 score:

[0100]

[0101] Precision means precision, and Recall means recall.

[0102] The method of the present invention generates a high-value API summary of the malicious code family, combines the thinking chain technology with the fine-tuning strategy, and realizes efficient classification of malicious software codes, thereby effectively coping with the problem that the existing malicious code has a complex structure and is difficult to analyze manually.

[0103] The above description is only an embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. An explainable high-value malicious code classification method based on thought chain technology, characterized by: The explainable high-value malicious code classification method specifically includes the following steps: Step 1: Generate high-value API call sequence information of the malicious code family: Extract API call sequence information from samples of the APT (Advanced Persistent Threats) family, filter out key API call sequence information related to the target behavior, connect the filtered API call sequence information together to form high-value API call sequence information, and filter out non-aggressive API call sequence information from different APT families; Step 2: Construct a corpus based on the mind chain technology: Use the mind chain technology to identify high-value API call sequences and non-aggressive API call sequence information in the APT family, conduct a feasibility analysis on the high-value API call sequences, and thus construct a corpus; Step 3: Fine-tune the large model, train the corpus constructed in step 2, and generate the final classification results.

2. According to claim 1, the explainable high-value malicious code classification method based on thought chain technology is characterized by: Step 1 generates high-value API call sequence information of malicious code, which specifically includes the following steps: Step 1.1: Start the sandbox analysis environment, capture the dynamic behavior of malicious code from the samples of the APT family, and extract the API call sequence information related to the dynamic behavior of malicious code; Step 1.2, using the 3-gram model to integrate and analyze the API call sequence information extracted in step 1.1, to obtain the 3-gram API call sequence information after the integration and analysis, and retain the context information of the 3-gram API call sequence information; Step 1.3: There are some identical 3-gram API call sequence information that are not directly offensive in different APT families. The identical 3-gram API call sequence information of different APT families is extracted to construct a non-aggressive API call sequence information, and identify which parts of the malicious code are non-aggressive 3-gram API call sequence information; Step 1.4: Count the overall occurrence frequency of the 3-gram API call sequence information of each APT family, sort the overall occurrence frequency, retain the 3-gram API call sequence information whose occurrence times exceed the set threshold, and connect the retained 3-gram API call sequence information to form the high-value API call sequence information of the malware sample.

3. According to claim 1, the explainable high-value malicious code classification method based on thought chain technology is characterized by: In step 1.4, the statistical calculation method for the overall occurrence frequency of the 3-gram API call sequence information of each APT family is: Among them, TF i,j represents the probability of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of sample j; n i,j represents the number of 3-gram API call sequence information i in sample j; ∑ k n k,j Indicates the number of sample j3-gramAPI call sequence information; The probability IDF of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of malicious code family h i,h for: Among them, m i Indicates the total number of 3-gram API call sequence information i in the family, N h Indicates the total number of samples in the family; Calculate the weight TF-IDF of 3-gram API call sequence information i in malicious code family h sample j i,j,h , and use this as the basis for screening high-value APIs: TF-IDF i,j,h =TF i,j ×IDF i,h 。 4. According to claim 1, the explainable high-value malicious code classification method based on thought chain technology is characterized by: In step 1.2, the 3-gram model is used to integrate and analyze the API call sequence information extracted in step 1.

1. The 3-gram model divides the API call sequence information into triplets, i.e., three consecutive API call sequence information, to capture the relationship and pattern between the API call sequence information.

5. According to claim 1, the explainable high-value malicious code classification method based on thought chain technology is characterized by: The construction of the corpus based on the thought chain technology includes the following steps: Step 2.1: Split the API call sequence information extracted from each APT family sample, specifically: identify a section of API call sequence information, and mark the high-value API call sequence information and non-aggressive API call sequence information; Step 2.2, interpreting the split high-value API call sequence information to form the input and output of the corpus, and inferring that the high-value API call sequence information belongs to the name of a specific malicious code family; The input of the corpus is the high-value API call sequence information and the non-offensive API call sequence information separated in step 2.1, and the high-value API call sequence information and non-offensive API call sequence extracted from the APT family sample, that is, the user instruction part; The output of the corpus is the explanation of high-value API call sequence information and the name of the malicious code family; Step 2.3: Repeat step 2.2 for each piece of API call sequence information data extracted from the APT family sample to build a corpus with clear structure and coherent content.

6. The explainable high-value malicious code classification method based on thought chain technology according to claim 1 is characterized by: The step 3 specifically comprises the following steps: Step 3.1: Convert the corpus constructed in step 2 into a new form and divide the converted corpus into a training set and a test set. Step 3.2: Input the training set into the large model for preliminary training. That is, input the training set into the large model to configure the training parameters and train the model. After the preliminary training is completed, fine-tune it through LoRA technology; Step 3.3: After training is completed, the test set is input into the large model. The large model performs a comprehensive performance evaluation on the test set to test whether the large model can accurately provide explanations of high-value API call sequence information and family classification results.

7. The explainable high-value malicious code classification method based on thought chain technology according to claim 6 is characterized by: In step 3.3, the large model is comprehensively evaluated on the test machine, specifically: Evaluation accuracy: Among them, a represents the number of correctly predicted samples, and A represents the total number of samples involved in the prediction; Evaluate recall g : Among them, TP g Indicates the number of samples correctly predicted in family g, FN g Indicates the number of samples of family g that are incorrectly predicted, The average of the recall rates of k families is taken as the final recall rate; Evaluation precision g : Among them, TP g Indicates the number of samples correctly predicted by family g, FP g represents the number of samples that are incorrectly predicted to be of family g, Take the average of the precision rates of k families as the final precision rate, F1 score: Precision means precision, and Recall means recall.

Images