High-value malicious code classification method with high explainability based on thought chain technology

Abstract

This invention belongs to the field of network security technology and discloses an interpretable high-value malware classification method based on the thinking chain technology. The method comprises three steps: Step 1, generating high-value API call sequence information for malware families; Step 2, constructing a corpus based on the thinking chain technology: identifying high-value and non-invasive API call sequences within APT families using the thinking chain technology, performing feasibility analysis on the high-value API call sequences, and thus constructing the corpus; Step 3, fine-tuning a large model to train the corpus constructed in Step 2, and generating the final classification result. This invention, by generating high-value API summaries for malware families and combining thinking chain technology with fine-tuning strategies, achieves efficient classification of malware code, effectively addressing the problems of complex malware structures and high difficulty in manual analysis.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an interpretable high-value malicious code classification method based on thought chain technology. Background Technology

[0002] In the development of cybersecurity, malicious code has always been one of the most threatening factors, capable of causing devastating damage to network systems and data. Malicious code generally refers to computer programs designed to perform malicious acts, including viruses, worms, Trojans, ransomware, and many other forms. Today, malicious code analysis has become a crucial part of cybersecurity defense, threat response, and attribution. However, with the surge in the number and increasing complexity of malicious code, relying on manual analysis has become a highly specialized, extremely challenging, and time-consuming task. Common problems with manual malicious code analysis include: many malicious codes have complex structures, containing numerous branches and difficult-to-understand logic; manual analysis of malicious code is often very time-consuming, especially for complex and advanced malware, which may require days or even weeks of analysis; the risk of false positives and false negatives in manual analysis of malicious code remains, particularly in judging certain boundary behaviors; malware developers often use obfuscation techniques such as code rearrangement, spam code insertion, variable and function renaming, and encryption to conceal their intentions.

[0003] Therefore, in the process of analyzing malware, identifying and extracting high-value information fragments that play a key role in malicious behavior is particularly important. So-called high-value APIs in malware refer to application interface calls that play a crucial role in implementing the core functions of malware, such as data theft, system destruction, and privilege escalation. These API calls are important clues for understanding the code structure and underlying intent.

[0004] There are also some studies on malware classification in the existing technology. The malware classification method based on improved CNN (Xuan Bona, Li Jin. Journal of Electronics, 2023, 51(05): 1187-1197.) discloses the key technical points of malware RGB (Red Green Blue) visualization based on improved CNN. The malware classification method based on Transformer and CNN (Mou Yumeng, Liu Liang, Zhang Lei, et al. Journal of Sichuan University (Natural Science Edition), 2024, 61(04): 133-139.) discloses the key technical points of cost-sensitive MobileVit model. API2Vec++: Boosting API Sequence Representation for Malware Detection and Classification (Cui L, Yin J, Cui J, et al. IEEE Transactions on Software Engineering, 2024, 50(8): 2142-2162.) discloses the key technical points of graph-based API embedding. Research on APT Malware Detection Based on BERT-Transformer-TextCNN Modeling (Zhang J, Liu S, Liu Z. Proceedings of the 2024 International Conference on Genetic Artificial Intelligence and Information Security. 2024: 235-242.) discloses the key technical points of the BERT-Transformer TextNN model for attack detection.

[0005] While these publicly available techniques have made some progress in classifying malware, they still have limitations in fully extracting core information from malware and there is still considerable room for improvement. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides an interpretable high-value malware classification method based on mind chain technology. This method generates high-value API summaries of malware families and combines mind chain technology with fine-tuning strategies to achieve efficient classification of malware code, thereby effectively addressing the problems of complex malware structures and high difficulty in manual analysis.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0008] This invention is an interpretable high-value malware classification method based on thought chain technology. The classification method specifically includes the following steps:

[0009] Step 1: Generate high-value API call sequence information for malicious code families: Extract API call sequence information from samples of APT (Advanced Persistent Threats) families, filter out key API call sequence information that is highly related to target behaviors such as malicious behavior, attack activities, or system functions, i.e., 3-gram API call sequence information, and connect the filtered API call sequence information, i.e., 3-gram API call sequence information, together to form high-value API call sequence information. At the same time, filter out non-aggressive API call sequence information, i.e., 3-gram API call sequence information, from different APT families.

[0010] Step 2: Construct a corpus based on the MindChain technology: Identify high-value API call sequences and non-aggressive API call sequences in the APT family using the MindChain technology, perform a feasibility analysis on the high-value API call sequences, and thus construct a corpus.

[0011] Step 3: Fine-tune the large model, train the corpus constructed in Step 2, and generate the final classification results.

[0012] A further improvement of the present invention is that step 1 generates high-value API call sequence information of malicious code, specifically including the following steps:

[0013] Step 1.1: Start the sandbox analysis environment to capture the dynamic behavior of malicious code from samples of the APT family, such as file operations, network activities, registry operations, etc., and extract various API call sequence information related to the dynamic behavior of malicious code.

[0014] Step 1.2: Use the 3-gram model to integrate and analyze the API call sequence information extracted in Step 1.1. After integration and analysis, 3-gram API call sequence information is obtained, while retaining the context information of the 3-gram API call sequence information.

[0015] Step 1.3: Different APT families contain some identical 3-gram API call sequence information that does not have direct attack capabilities. Extract the identical 3-gram API call sequences from different APT families, construct a list of common non-attack API call sequence information, and identify which parts of the malicious code are non-attack 3-gram API call sequence information.

[0016] Step 1.4: Calculate the overall frequency of occurrence of 3-gram API call sequence information for each APT family, sort the overall frequency of occurrence, retain the 3-gram API call sequence information whose occurrence frequency exceeds a set threshold, and connect the retained 3-gram API call sequence information to form high-value API call sequence information of malware samples.

[0017] A further improvement of the present invention is that: in step 1.4, the statistical calculation method for the overall occurrence frequency of 3-gram API call sequence information for each APT family is as follows:

[0018]

[0019] Among them, TF i,j n represents the probability that 3-gram API call sequence information i appears in all 3-gram API call sequence information of sample j; i,j This represents the number of 3-gram API call sequence information i in sample j; ∑ k n k,j This indicates the number of API call sequence information entries for the sample j3-gram;

[0020] The probability (IDF) of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of malware family h. i,h for:

[0021]

[0022] Where, m i N represents the total number of 3-gram API call sequence information i in this family. h This indicates the total number of samples in the family;

[0023] Calculate the TF-IDF weight of 3-gram API call sequence information i in malware family h sample j. i,j,h This is used as a criterion for selecting high-value APIs.

[0024] TF-IDF i,j,h =TF i,j ×IDF i,h .

[0025] A further improvement of the present invention is that: in step 1.2, the integration and analysis of the API call sequence information extracted in step 1.1 using the 3-gram model means that the 3-gram model divides the API call sequence information into triplets, that is, three consecutive API call sequence information, and captures the relationship and pattern between the API call sequence information.

[0026] A further improvement of this invention lies in: constructing a corpus based on thought chain technology, specifically including the following steps:

[0027] Step 2.1: Segment the API call sequence information extracted from each APT family sample. Specifically, identify a segment of API call sequence information and label the high-value API call sequence information and the non-invasive API call sequence information within it.

[0028] Step 2.2: Explain the split high-value API call sequence information to form the input and output of the corpus, and infer the name of the specific malicious code family to which the high-value API call sequence information belongs;

[0029] The input to the corpus consists of the high-value API call sequence information and the non-aggressive API call sequence information split in step 2.1, as well as the high-value API call sequence information and common non-aggressive API call sequences extracted from APT family samples, which are the user instruction parts.

[0030] The corpus outputs explanations of high-value API call sequence information and names of malware families;

[0031] Step 2.3: Repeat step 2.2 for each API call sequence information extracted from the APT family sample to build a well-structured and coherent corpus.

[0032] A further improvement of the present invention is that step 3 specifically includes the following steps:

[0033] Step 3.1: Convert the corpus constructed in Step 2 into a different format, and divide the converted corpus into a training set and a test set;

[0034] Step 3.2: Input the training set into the large model for preliminary training. This involves inputting the training set into the large model, configuring the training parameters, and training the model. After the preliminary training is completed, fine-tuning is performed using LoRA technology.

[0035] Step 3.3: After training is complete, the test set is input into the large model. The large model performs a comprehensive performance evaluation using the test set to verify whether it can accurately provide explanations of high-value API call sequence information and family classification results.

[0036] A further improvement of this invention is that, in step 3.3, the large model undergoes a comprehensive performance evaluation using a testing machine, specifically as follows:

[0037] Assessment accuracy:

[0038]

[0039] Where a represents the number of correctly predicted samples, and A represents the total number of samples participating in the prediction;

[0040] Evaluate recall g (Multi-class classification problem):

[0041]

[0042] TP g FN represents the number of samples in the g family that were correctly predicted. g This represents the number of samples in the g family that were incorrectly predicted.

[0043]

[0044] The final recall rate is the average of the recall rates of k families.

[0045] Precision (for multi-class classification problems):

[0046]

[0047] TP g FP represents the number of samples in the g family that were correctly predicted. g This represents the number of samples that were incorrectly predicted as belonging to the g family.

[0048]

[0049] The average of the precision rates of k families is taken as the final precision rate.

[0050] F1 score:

[0051]

[0052] Precision refers to accuracy, and recall refers to recall.

[0053] The beneficial effects of this invention are as follows: This invention addresses the complexity of malicious code evading detection through code obfuscation, encryption, and polymorphism techniques, proposing a more targeted and effective solution. This method not only significantly improves the accuracy of malicious code classification and detection but also provides more comprehensive and accurate support for threat warning and responding to the complex and ever-changing behavior of malicious code. Based on the extraction of high-value API features from malicious code, high-value API calls are the key path for malicious behavior execution. Extracting these APIs can effectively bypass protection mechanisms such as code obfuscation and encryption, capture the dynamic behavior of malicious code, and significantly improve the effectiveness of detection. Simultaneously, this method can more accurately identify the core behavioral characteristics of malicious code, thereby improving detection accuracy and effectively reducing the false positive rate.

[0054] This invention introduces a thought chain, enabling the model to progressively generate intermediate reasoning steps. This process breaks down the problem into multiple manageable sub-problems. Each step of reasoning not only helps the model better understand the current task but also provides a more solid foundation for subsequent steps. This step-by-step reasoning approach is similar to the human thought process, allowing the model to deduce complex conclusions from simple conditions.

[0055] The large model of this invention is trained on a corpus built on a thought chain, learning the reasoning logic therein, so that the large model can provide interpretable descriptions of high-value APIs on the test set and accurately classify malicious code families.

[0056] In summary, high-value API feature extraction from malicious code significantly improves the accuracy and efficiency of security detection systems in malware analysis, becoming a core element in identifying potential threats. The corpus generated by the thought chain further enhances the model's reasoning ability and interpretability, enabling it to handle more complex reasoning tasks. Through large-scale model training and fine-tuning, the model can accurately adapt to task requirements, demonstrating superior language processing and reasoning performance in malware classification, thereby achieving more efficient analysis and threat identification. Attached Figure Description

[0057] Figure 1 This is a schematic diagram of the method of the present invention.

[0058] Figure 2 This is a schematic diagram illustrating the thought process of this invention.

[0059] Figure 3 This is a schematic diagram of the high-value API digest results of the malicious code in this invention.

[0060] Figure 4 This is a schematic diagram of a common non-aggressive API summary of the present invention.

[0061] Figure 5 This is a graph showing the loss function of the large model training effect after combining fine-tuning technology according to the present invention. Detailed Implementation

[0062] The embodiments of the present invention will be disclosed below with reference to the drawings. For clarity, many practical details will be described in the following description. However, it should be understood that these practical details are not intended to limit the invention. That is, in some embodiments of the invention, these practical details are not essential.

[0063] like Figure 1As shown, the malicious code samples are first preliminarily analyzed using the Cape sandbox to extract high-value malicious code API summaries and common non-aggressive API summaries. Then, an interpretable corpus is built using the mind chain guidance, and the LLaMA large model is trained using LoRA fine-tuning technology to achieve the classification of malicious code.

[0064] like Figures 2-5 As shown, the interpretable high-value malicious code classification based on the thinking chain technology of the present invention includes a high-value API summary generation part of malicious code, a corpus construction part of thinking chain, and a large model training and fine-tuning part.

[0065] The high-value API summary generation section for malware involves converting malware family samples into JSON format files to extract API information. Subsequently, key high-value portions are selected from these APIs, and a concise API summary is generated.

[0066] The corpus construction part of the MindChain technique involves identifying high-value and non-aggressive API call sequences within APT families, performing feasibility analysis on the high-value API call sequences, and thus constructing a corpus. Specifically, the API call sequence information extracted from each APT family sample is split: a segment of API call sequence information is identified, and the high-value and non-aggressive API call sequence information within it is labeled; the split high-value API call sequence information is explained, forming the input and output of the corpus, and the name of the specific malware family to which the high-value API call sequence information belongs is inferred. For the input part of the corpus, i.e., the user command part, each sample data uses the following template: "This is an API call sequence information, where the high-value part of the call sequence information is: (give the high-value API call sequence information of this sample); the common non-aggressive part is: (give the common non-aggressive API call sequence information)."

[0067] For the output part of the corpus, i.e. the large model response part, each sample data uses the following template: "The specific meaning of this high-value API call sequence information is: (give the specific meaning of each 3-gram API call sequence information in the high-value API call sequence information summarized by yourself); from this, it is inferred that it belongs to: (give the name of the malicious code family to which this sample belongs)." Each data point extracting API call sequence information from APT family samples repeats the input and output of the corpus to build a corpus with a clear structure and coherent content.

[0068] The constructed corpus is transformed and divided into training and test sets. The training set is input into a large model for initial training, configuring training parameters and training the model. After initial training, LoRA technology is used for fine-tuning. After overall training, the test set is input into the large model for comprehensive performance evaluation, verifying its ability to accurately explain high-value API call sequence information and classify family results. The core of this stage is analyzing the model's performance in real-world tasks, focusing on key metrics such as classification accuracy, recall, and F1 score. These metrics allow for precise assessment of the model's overall performance and determine if further optimization and tuning are needed. Throughout the training process, multiple adjustments to hyperparameters, including learning rate, batch size, and regularization strength, are often required to ensure optimal model performance. Through this series of highly refined steps, the LLaMA large model, combined with LoRA fine-tuning technology, fully leverages the data advantages of the corpus, achieving efficient learning and performance optimization, ultimately demonstrating good inference and processing capabilities in the complex task of malware classification.

[0069] The following section uses the Appin malware family as an example to illustrate this invention. It extracts high-value API summaries from the Appin family and uses a mind-chain guided approach combined with fine-tuning techniques to complete the interpretable classification of high-value malware. The specific steps include:

[0070] Step 1: Generate high-value API call sequence information for malicious code families: Extract API call sequence information from samples of APT (Advanced Persistent Threats) families, filter out key API call sequence information that is highly related to target behaviors such as malicious behavior, attack activities, or system functions, i.e., 3-gram API call sequence information, and connect the filtered API call sequence information (i.e., 3-gram API call sequence information) together to form high-value API call sequence information. At the same time, filter out non-aggressive API call sequence information (i.e., 3-gram API call sequence information) from different APT families.

[0071] High-value API call sequence information that generates malicious code, such as Figure 3-4 As shown, specifically:

[0072] The Cape sandbox analysis environment is launched, and the prepared Appin malware family sample is parsed using the jsonsearch package. Through dynamic analysis by the Cape sandbox, detailed results containing sample behavior are generated. Next, the generated JSON and HTML files are extracted from the parsing results, and further API call sequence information related to the sample is extracted. At this stage, the main task of the Cape sandbox is to capture the dynamic behavior of the malware and extract various API call sequence information related to malicious activities.

[0073] After extracting API call sequence information from all samples of the Appin malware family, this information was divided into triplets, meaning every three consecutive API call sequences were combined into a 3-gram API call sequence. This grouping method helps to capture the dependencies between API call sequences. Subsequently, these 3-gram API call sequences from the Appin family were compared with those from other malware families to identify commonalities. These identical 3-gram API call sequences can be considered generic API call sequences without attack characteristics, thus constructing a relatively general and non-attack-prone API call sequence profile, such as... Figure 3 As shown. Finally, statistical analysis was performed on the API call sequence information extracted from this family, calculating the overall frequency of API call sequence information, and sorting each sample data according to the overall frequency. The top 20-40 API call sequence information with the highest frequency were retained, preferably the top 20. These high-frequency API call sequence information are usually the most representative operations in the execution of malware, forming the high-value API call sequence information of this sample, such as... Figure 4 As shown.

[0074] The statistical calculation method for the overall frequency of occurrence of 3-gram API call sequence information for each APT family is as follows:

[0075]

[0076] Among them, TF i,j n represents the probability that 3-gram API call sequence information i appears in all 3-gram API call sequence information of sample j; i,j This represents the number of 3-gram API call sequence information i in sample j; ∑ k n k,j This indicates the number of API call sequence information entries for the sample j3-gram;

[0077] The probability (IDF) of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of malware family h. i,h for:

[0078]

[0079] Where, m i N represents the total number of 3-gram API call sequence information i in this family. h This indicates the total number of samples in the family;

[0080] Calculate the TF-IDF weight of 3-gram API call sequence information i in malware family h sample j. i,j,h This is used as a criterion for selecting high-value APIs.

[0081] TF-IDF i,j,h =TF i,j ×IDF i,h .

[0082] Step 2: Construct a corpus based on the MindChain technique: The Appin malware family is constructed according to the following input: "This is an API call sequence information, where the high-value API call sequence information is [list of high-value APIs], and the common non-invasive API call sequence information is [list of non-invasive APIs]." The output is: "The behavioral meanings of this high-value API call sequence information are [list of behaviors], thus inferring which family it belongs to." For example, the input is: There is an API sequence where the summary of high-value APIs [list of behaviors] is [list of behaviors]. is:(NtSetTimer,NtQuerySystemInformation,FindResourceExW),(NtQuerySystemInformation,FindResourceExW,RegQueryValueExW),(FindResourceExW,RegQueryValueExW,HeapCreate),(RegQueryValueExW,HeapCreate,GetVolum eNameForVolumeMountPointW),(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose),(NtQueryFullAttributesFile,NtCl ose,LdrGetDllHandle),(NtClose,LdrGetDllHandle,CreateWindowExA),(LdrGetDllHandle,CreateWindowExA,NtAddAtom),(CreateWindowExA,NtAddAtom,NtCreateThreadEx),(NtAddAtom,NtCreateThreadEx,RegQueryInfoKeyW),(Nt CreateThreadEx,RegQueryInfoKeyW,FindFirstFileExW),(RegQueryInfoKeyW,FindFirstFileExW,ChangeWindowMessageFilter),(FindFirstFileExW,ChangeWindowMessageFilter,GetSystemMetrics),(ChangeWindowMessageFilter,GetSystemMetrics,NtFreeVirtualMemory),(GetSystemMetrics,NtFreeVirtualMemory,StrCmpNICW),(NtFreeVirtualMemory,StrCmpNICW,NtDelayExecution),(StrCmpNICW,NtDelayExecution,LdrGetProcedureAddress),(NtDelayExecution,LdrGetProcedureAddress,LsaOpenPolicy),(LdrGetProcedureAddress,LsaOpenPolicy,ScriptIsComplex);The common non aggressive APIs are:(CreateWindowExW,GetSystemInfo,RegQueryValueExA),(GetSystemTimeAsFileTime,NtAllocateVirtualMemory,GetSystemTime),(LdrLoadDll,GetSystemInfo,RegQueryValueExA),(RegCloseKey,LdrLoadDll,CoCreateInstance),(NtCreateFile,memcpy,NtReleaseMutant),(OpenSCManagerA,NtDeviceIoControlFile,InternetOpenA),(NtCreateFile,GetSystemTime,HeapCreate),(GetSystemInfo,RegQueryValueExA,NtCreateFile),(NtWaitForSingleObject,LdrGetProcedureAddress,LdrLoadDll),(NtCreateFile,LdrLoadDll,LdrGetProcedureAddress),(NtQueryAttributesFile,NtDelayExecution,NtClose),(GetSystemInfo,NtQueryValueKey,GetComputerNameA),(NtCreateFile,RegQueryValueExA,ChangeWindowMessageFilter),(LdrGetProcedureAddress,(NtCreateSection, NtQueryValueKey), (NtQueryValueKey, NtFreeVirtualMemory, NtReleaseMutant), (NtUnmapViewOfSection, NtAllocateVirtualMemory, NtClose), (NtOpenKey, NtQueryValueKey, GetSystemTimeAsFileTime), (NtQuerySystemTime, RegOpenKeyExW, GetSystemInfo), (CreateProcessInternalW, NtOpenKey, RegCloseKey), (CreateWindowExW, NtDelayExecution, NtMapViewOfSection), (NtReadFile, NtQuerySystemTime, RegOpenKeyExW), (LdrLoadDll, NtDelayExecution, NtAllocateVirtualMemory), (memcpy, NtSetInformationFile, NtFindAtom), (NtAllocateVirtualMemory, RegQueryValueExA, RegOpenKeyExW), (NtQueryInformationFile, SetUnhandledExceptionFilter, LdrGetProcedureAddress). The meanings of this high - value API behavior are as follows: (NtSetTimer, NtQuerySystemInformation, FindResourceExW): Sets a timer object; Retrieves system information, such as system performance or process list; Finds a resource in a specified module, supports Unicode, (NtQuerySystemInformation, FindResourceExW, RegQueryValueExW): Retrieves system information,such as system performance or process list;Finds a resourcein a specified module,supports Unicode;Retrieves a value from a specified keyin the registry,supports Unicode,(FindResourceExW,RegQueryValueExW,HeapCreate):Finds aresource in a specified module,supports Unicode;Retrievesa value from a specified keyin the registry,supports Unicode;Creates a heapobject for dynamic memory allocation,(RegQueryValueExW,HeapCreate,GetVolumeNameForVolumeMountPointW):Retrieves a value from a specified key in theregistry,supports Unicode;Creates a heap object for dynamic memoryallocation;Gets the volume name for a volume mount point,supports Unicode,(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile):Createsa heap object for dynamic memory allocation;Gets the volume name for avolume mountpoint,supports Unicode;Queries the full attributes of a file(e.g.,size,timestamps,etc.),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose):Gets the volume name for a volume mountpoint,supports Unicode;Queries the full attributes of a file(e.g.,size,timestamps,etc.);Closes a kernel object handle,releasing resources,(NtQueryFullAttributesFile,NtClose,LdrGetDllHandle):Queries the fullattributes of a file(e.g.,size,timestamps,etc.);Closes a kernel objecthandle,releasing resources;Gets the handle of a loaded DLL,(NtClose,LdrGetDllHandle,CreateWindowExA):Closes a kernel object handle,releasingresources;Gets the handle of a loaded DLL;Creates a window with extendedstyles,supports ANSI,(LdrGetDllHandle,CreateWindowExA,NtAddAtom):Gets thehandle of a loaded DLL;Creates a window with extended styles,supports ANSI;Adds a string to the global atom table and returns its atom identifier,(CreateWindowExA,NtAddAtom,NtCreateThreadEx):Creates a window with extendedstyles,supports ANSI;Adds a string to the global atom table and returns itsatom identifier;Creates a new thread in a specified process,(NtAddAtom,NtCreateThreadEx,RegQueryInfoKeyW):Adds a string to the global atom table andreturns its atom identifier;Creates a new thread in a specified process;Retrieves information about a registry key,supports Unicode,(NtCreateThreadEx,RegQueryInfoKeyW,FindFirstFileExW):Creates a new thread ina specified process;Retrieves information about aregistry key,supportsUnicode;Searches for files or directories,supports Unicode,(RegQueryInfoKeyW,FindFirstFileExW,ChangeWindowMessageFilter):Retrieves information aboutaregistry key,supports Unicode;Searches for files or directories,supportsUnicode;Changes the filter for window messages received by an application,(FindFirstFileExW,ChangeWindowMessageFilter,GetSystemMetrics):Searches forfiles or directories,supports Unicode;Changes the filter for window messagesreceived by an application;Retrieves system metricsand configurationinformation,(ChangeWindowMessageFilter,GetSystemMetrics,NtFreeVirtualMemory):Changes the filter for window messages received by an application;Retrievessystem metrics and configuration information;Frees a region of virtualmemory,(GetSystemMetrics,NtFreeVirtualMemory,StrCmpNICW):Retrieves systemmetrics and configuration information;Frees a region of virtual memory;Compares two strings case-insensitively,supports Unicode,(NtFreeVirtualMemory,StrCmpNICW,NtDelayExecution):Frees a region of virtualmemory;Compares two strings case-insensitively,supports Unicode;Delays theexecution of a thread,often used for sleep operations,(StrCmpNICW,NtDelayExecution,LdrGetProcedureAddress):Compares two strings case-insensitively,supports Unicode;Delays the execution of a thread,often usedfor sleep operations;Retrieves the address of a function from a loaded DLL,(NtDelayExecution,LdrGetProcedureAddress,LsaOpenPolicy):Delays the executionof a thread,often used for sleep operations;Retrieves the address of a function from a loaded DLL;Opens the security policy object of a local orremote system,(LdrGetProcedureAddress,LsaOpenPolicy,ScriptIsComplex): ,

[0083] Step 3: Fine-tune the large model, train the corpus constructed in Step 2, and generate the final classification results.

[0084] For the large-scale model training and fine-tuning: the constructed corpus is converted into a JSON file suitable for model input. The LLaMA large-scale model is then used to train the corpus. After initial training, LoRA is used for fine-tuning to further improve the model's adaptability. This process optimizes the model's performance across different tasks, enabling it to learn and capture complex features more efficiently, thereby improving accuracy and performance when handling specific tasks. During training, logging tools are used to track the model's training progress in real time, especially the trend of changes in the loss function, such as... Figure 5As shown, this is to evaluate the model's convergence and training status. After training, the model will be evaluated for performance using a test set, for example, for a large LLaMA model input: There is an API sequence where the summary of high-value APIs is: (NtSetTimer,WriteConsoleW,gethostname),(WriteConsoleW,gethostname,NtQuerySystemInformation),(gethostname,NtQuerySystemInformation,ReadProcessMemory),(NtQuerySystemInformation,ReadProcessMemory,FindResourceExW),(ReadProcessMemory,FindResourceExW,RegQueryValueExW),(FindResourceExW,RegQueryValueExW,StartServiceW),(RegQueryValueExW,StartServiceW,HttpOpenRequestA),(StartServiceW,HttpOpenRequestA,HeapCreate),(HttpOpenRequestA,HeapCreate,Ge tVolumeNameForVolumeMountPointW),(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose),(NtQueryFullAttributesFile,NtClose,LdrGetDll Handle),(NtClose,LdrGetDllHandle,CreateWindowExA),(LdrGetDllHandle,CreateWindowExA,SetUnhandledExceptionFilter),(CreateWindowExA,SetUnhandledExceptionFilter,GetComputerNameA),(SetUnhandledExceptionFilter,GetComputerNameA,NtCreateUserProcess),(GetComputerNameA,NtCreateUserProcess,NtWriteFile),(NtCreateUserProcess,NtWriteFile,NtAddAtom),(NtWriteFile,NtAddAtom,NtCreateEvent),(NtAddAtom,NtCreateEvent,GetLocalTime),The common nonaggressive APIs are:(CreateWindowExW,GetSystemInfo,RegQueryValueExA),(GetSystemTimeAsFileTime,NtAllocateVirtualMemory,GetSystemTime),(LdrLoadDll,GetSystemInfo,RegQueryValueExA),(RegCloseKey,LdrLoadDll,CoCreateInstance),(NtCreateFile,memcpy,NtReleaseMutant),(OpenSCManagerA,NtDeviceIoControlFile,InternetOpenA),(NtCreateFile,GetSystemTime,HeapCreate),(GetSystemInfo,RegQueryValueExA,NtCreateFile),(NtWaitForSingleObject,LdrGetProcedureAddress,LdrLoadDll),(NtCreateFile,LdrLoadDll,LdrGetProcedureAddress),(NtQueryAttributesFile,NtDelayExecution,NtClose),(GetSystemInfo,NtQueryValueKey,GetComputerNameA),(NtCreateFile,RegQueryValueExA,ChangeWindowMessageFilter),(LdrGetProcedureAddress,NtCreateSection,NtQueryValueKey),(NtQueryValueKey,NtFreeVirtualMemory,NtReleaseMutant),(NtUnmapViewOfSection,NtAllocateVirtualMemory, NtClose), (NtOpenKey, NtQueryValueKey, GetSystemTimeAsFileTime), (NtQuerySystemTime, RegOpenKeyExW, GetSystemInfo), (CreateProcessInternalW, NtOpenKey, RegCloseKey), (CreateWindowExW, NtDelayExecution, NtMapViewOfSection), (NtReadFile, NtQuerySystemTime, RegOpenKeyExW), (LdrLoadDll, NtDelayExecution, NtAllocateVirtualMemory), (memcpy, NtSetInformationFile, NtFindAtom), (NtAllocateVirtualMemory, RegQueryValueExA, RegOpenKeyExW), (NtQueryInformationFile, SetUnhandledExceptionFilter, LdrGetProcedureAddress) The final large model will give the answer: The meanings of this high-value API behavior are as follows: (NtSetTimer, WriteConsoleW, gethostname): Sets a timer object; Writes data to the console, supports Unicode; Retrieves the host name, (WriteConsoleW, gethostname, NtQuerySystemInformation): Writes data to the console, supports Unicode; Retrieves the host name; Retrieves system information, such as system performance or process list, (gethostname, NtQuerySystemInformation, ReadProcessMemory): Retrieves the host name; Retrieves system information,suchas system performance or process list;Reads the memory of a process,(NtQuerySystemInformation,ReadProcessMemory,FindResourceExW):Retrievessysteminformation,such a s system performance or process list;Reads thememory of a process;Finds a resource ina specified module,supports Unicode,(ReadProcessMemory,FindResourceExW,RegQueryValueExW):Reads the memory of aprocess;Finds a resource in a specified module,supportsUnicode;Retrieves avalue from a specified key in the registry,supports Unicode,(FindResourceExW,RegQueryValueExW,StartServiceW):Finds a resource in a specified module,supports Unicode;Retrieves a value from a specified key in the registry,supports Unicode;Starts a specified service,supports Unicode,(RegQueryValueExW,StartServiceW,HttpOpenRequestA):Retrieves a value from aspecified key in the registry,supports Unicode;Starts a specified service,supports Unicode;Opens an HTTP request handle,supports ANSI,(StartServiceW,HttpOpenRequestA,HeapCreate):Starts a specified service,supports Unicode;Opens an HTTP request handle,supports ANSI;Creates a heap object for dynamicmemory allocation,(HttpOpenRequestA,HeapCreate,GetVolumeNameForVolumeMountPointW):Opens anHTTP request handle,supports ANSI;Creates a heap object fordynamic memory allocation;Gets the volume name for a volume mount point,supports Unicode,(HeapCreate,GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile):Creates a heap object for dynamic memoryallocation;Gets the volume name for a volume mount point,supports Unicode;Queries the full attributes of a file(e.g.,size,timestamps,etc.),(GetVolumeNameForVolumeMountPointW,NtQueryFullAttributesFile,NtClose):Gets the volumename for a volume mount point,supports Unicode;Queries the full attributes ofa file(e.g.,size,timestamps,etc.);Closes a kernel object handle,releasingresources,(NtQueryFullAttributesFile,NtClose,LdrGetDllHandle):Queries thefull attributes of a file(e.g.,size,timestamps,etc.);Closes a kernel objecthandle,releasing resources;Gets the handle of a loaded DLL,(NtClose,LdrGetDllHandle,CreateWindowExA):Closes a kernel object handle,releasingresources;Gets the handle of a loaded DLL;Creates a window with extendedstyles,supports ANSI,(LdrGetDllHandle,CreateWindowExA,SetUnhandledExceptionFilter):Gets the handle of a loaded DLL;Creates a windowwith extended styles,supports ANSI;Sets a handler for unhandled exceptions,(CreateWindowExA,SetUnhandledExceptionFilter,GetComputerNameA):Createsawindow with extended styles,supports ANSI;Sets a handler for unhandledexceptions;Retrieves the name of the computer,supports ANSI,(SetUnhandledExceptionFilter,GetComputerNameA,NtCreateUserProcess):Sets ahandler for unhandled exceptions;Retrieves the name of the computer,supportsANSI;Creates a new user process,(GetComputerNameA,NtCreateUserProcess,NtWriteFile):Retrieves the name of the computer,supports ANSI;Creates a newuser process;Writes data to a file or device,(NtCreateUserProcess,NtWriteFile,NtAddAtom):Creates a new user process; Writes data to a file ordevice; Adds a string to the global atom table and returns its atom identifier, (NtWriteFile,NtAddAtom,NtCreateEvent):Writes data to a file or device; object,(NtAddAtom,NtCreateEvent,GetLocalTime):Adds a string to the global atom table and returns its atom identifier;Creates or opens anevent object;Retrieves the local system time.This API sequence may be:Appin. ,

[0085] The large model undergoes a comprehensive performance evaluation using a test machine, specifically as follows:

[0086] Assessment accuracy:

[0087]

[0088] Where a represents the number of correctly predicted samples, and A represents the total number of samples participating in the prediction;

[0089] Recall rate (for multi-class classification problems):

[0090]

[0091] TP g FN represents the number of samples in the g family that were correctly predicted. g This represents the number of samples in the g family that were incorrectly predicted.

[0092]

[0093] The final recall rate is the average of the recall rates of k families.

[0094] Precision (for multi-class classification problems):

[0095]

[0096] TP g FP represents the number of samples in the g family that were correctly predicted. g This represents the number of samples that were incorrectly predicted as belonging to the g family.

[0097]

[0098] The average of the precision rates of k families is taken as the final precision rate.

[0099] F1 score:

[0100]

[0101] Precision refers to accuracy, and recall refers to recall.

[0102] The method of this invention generates high-value API summaries of malicious code families, and combines thought chain technology with fine-tuning strategies to achieve efficient classification of malicious code, thereby effectively addressing the problems of complex structure and high difficulty of manual analysis of existing malicious code.

[0103] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for classifying interpretable high-value malicious code based on thought chain technology, characterized in that: The explainable high-value malicious code classification method specifically includes the following steps: Step 1: Generate high-value API call sequence information of malicious code families: Extract API call sequence information from samples of APT (Advanced Persistent Threats) families, filter out key API call sequence information related to the target behavior, connect the filtered API call sequence information together to form high-value API call sequence information, and at the same time filter out non-aggressive API call sequence information from different APT families. Step 2: Construct a corpus based on the MindChain technology: Identify high-value API call sequences and non-aggressive API call sequences in the APT family using the MindChain technology, perform a feasibility analysis on the high-value API call sequences, and thus construct a corpus. Step 3: Fine-tune the large model, train the corpus constructed in Step 2, and generate the final classification result, where: Step 1 generates high-value API call sequence information for malicious code, specifically including the following steps: Step 1.1: Start the sandbox analysis environment to capture the dynamic behavior of malicious code from samples of the APT family and extract API call sequence information related to the dynamic behavior of malicious code; Step 1.2: Use the 3-gram model to integrate and analyze the API call sequence information extracted in Step 1.

1. After integration and analysis, 3-gram API call sequence information is obtained, while retaining the context information of the 3-gram API call sequence information. Step 1.3: Different APT families contain some identical 3-gram API call sequence information that does not have direct attack capabilities. Extract the identical 3-gram API call sequences from different APT families, construct a set of non-attack API call sequence information, and identify which parts of the malicious code are non-attack 3-gram API call sequence information. Step 1.4: Calculate the overall frequency of occurrence of 3-gram API call sequence information for each APT family, sort the overall frequency of occurrence, retain the 3-gram API call sequence information whose occurrence frequency exceeds a set threshold, and connect the retained 3-gram API call sequence information to form high-value API call sequence information of malware samples. The process of building a corpus based on the MindChain technology includes the following steps: Step 2.1: Segment the API call sequence information extracted from each APT family sample. Specifically, identify a segment of API call sequence information and label the high-value API call sequence information and the non-invasive API call sequence information within it. Step 2.2: Explain the split high-value API call sequence information to form the input and output of the corpus, and infer the name of the specific malicious code family to which the high-value API call sequence information belongs; The input to the corpus consists of the high-value API call sequence information and the non-aggressive API call sequence information that were split in step 2.

1. The high-value API call sequence information and the non-aggressive API call sequence information extracted from the APT family samples are the user instruction parts. The corpus outputs explanations of high-value API call sequence information and names of malware families; Step 2.3: Repeat step 2.2 for each API call sequence information extracted from the APT family sample to build a well-structured and coherent corpus. Step 3 specifically includes the following steps: Step 3.1: Convert the corpus constructed in Step 2 into a different format, and divide the converted corpus into a training set and a test set; Step 3.2: Input the training set into the large model for preliminary training. This involves inputting the training set into the large model, configuring the training parameters, training the model, and then fine-tuning it using LoRA technology after the preliminary training is completed. Step 3.3: After training is complete, the test set is input into the large model. The large model performs a comprehensive performance evaluation using the test set to verify whether it can accurately provide explanations of high-value API call sequence information and family classification results.

2. The interpretable high-value malicious code classification method based on mind chain technology according to claim 1, characterized in that: In step 1.4, the statistical calculation method for the overall frequency of occurrence of 3-gram API call sequence information for each APT family is as follows: Among them, TF i,j n represents the probability that 3-gram API call sequence information i appears in all 3-gram API call sequence information of sample j; i,j This represents the number of 3-gram API call sequence information i in sample j; ∑ k n k,j This indicates the number of sample j3-gram API call sequence information; The probability (IDF) of 3-gram API call sequence information i appearing in all 3-gram API call sequence information of malware family h. i,h for: Where, m i N represents the total number of 3-gram API call sequence information i in this family. h This indicates the total number of samples in the family; Calculate the TF-IDF weight of 3-gram API call sequence information i in malware family h sample j. i,j,h This is used as a criterion for selecting high-value APIs. TF-IDF i,j,h =TF i,j ×IDF i,h 。 3. The interpretable high-value malicious code classification method based on mind chain technology according to claim 1, characterized in that: In step 1.2, the integration and analysis of the API call sequence information extracted in step 1.1 using the 3-gram model means that the 3-gram model divides the API call sequence information into triplets, i.e., three consecutive API call sequence information, and captures the relationships and patterns between the API call sequence information.

4. The interpretable high-value malicious code classification method based on mind chain technology according to claim 1, characterized in that: In step 3.3, the large model undergoes a comprehensive performance evaluation using a test machine, specifically as follows: Assessment accuracy: Where a represents the number of correctly predicted samples, and A represents the total number of samples participating in the prediction; Evaluate recall g : Among them, TP g FN represents the number of samples in the g family that were correctly predicted. g This represents the number of samples in the g family that were incorrectly predicted. The average recall rate of k families is taken as the final recall rate; Precision assessment g : Among them, TP g FP represents the number of samples in the g family that were correctly predicted. g This represents the number of samples that were incorrectly predicted as belonging to the g family. The average of the precision rates of k families is taken as the final precision rate. F1 score: Precision refers to accuracy, and recall refers to recall.

Images