Program detection method and device based on mixed features

Abstract

The invention provides a program detection method and device based on mixed features. The method comprises the steps of obtaining static features and dynamic features of a to-be-detected program; fusing the static features and the dynamic features to obtain mixed features; and inputting the mixed features into a preset detection model to perform program detection so as to obtain a program type used for indicating that the to-be-detected program is a malicious program or a benign program. According to the scheme, the static feature and the dynamic feature of the to-be-detected program are fused to obtain the mixed feature; then the mixed features are input into the detection model for program detection, so that the program type used for indicating that the to-be-detected program is a malicious program or a benign program is obtained, the malicious program is detected through the multi-dimensional program features, and the detection accuracy of the malicious program is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a program detection method and device based on hybrid features. Background Art

[0002] With the development of the Internet, various programs are presented to users. In order to ensure the safety of users when using programs, it is necessary to detect malicious programs.

[0003] The current method of detecting malicious programs is to use single-dimensional features such as the program's data flow graph, control flow graph, or abstract syntax tree to detect whether a program is a malicious program. However, single-dimensional features cannot fully reflect the specific situation of the program. It is difficult to accurately detect malicious programs from single-dimensional features, and the detection accuracy of malicious programs is low. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a program detection method and device based on hybrid features to solve the problem of low accuracy in detecting malicious programs based on features from a single dimension.

[0005] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0006] A first aspect of an embodiment of the present invention discloses a program detection method based on hybrid features, the method comprising:

[0007] Obtaining static features and dynamic features of the program to be detected, wherein the static features at least include a function call graph, a system call, the number of basic blocks, and the number of instruction types, and the dynamic features at least include a function execution sequence;

[0008] The static feature and the dynamic feature are combined to obtain a mixed feature;

[0009] The mixed features are input into a preset detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program, and the detection model is obtained based on a graph neural network model trained based on sample data.

[0010] Preferably, the process of obtaining the static features of the program to be detected includes:

[0011] Decompiling the program to be detected to obtain a function call graph of the program to be detected;

[0012] Identify the system call instruction in the assembly code obtained by decompiling the program to be detected to obtain the system call in the function of the program to be detected;

[0013] The number of basic blocks and the number of instructions of each type in the function of the program to be detected are counted to obtain the number of basic blocks and the number of instruction types.

[0014] Preferably, the process of obtaining the dynamic characteristics of the program to be detected includes:

[0015] Perform program instrumentation at each function entry in the program to be tested;

[0016] The program to be detected that has completed program instrumentation is placed in a sandbox for fuzz testing to obtain multiple function execution sequences of the program to be detected under different inputs.

[0017] Preferably, the static feature and the dynamic feature are fused to obtain a mixed feature, including:

[0018] Determining the weight of each edge in the function call graph according to the function execution sequence;

[0019] determining a feature embedding feature of the system call;

[0020] The number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph are input into a node embedding model to obtain a mixed feature, where the mixed feature is a feature vector of each node in the function call graph.

[0021] Preferably, determining the weight of each edge in the function call graph according to the function execution sequence includes:

[0022] Parsing the function execution sequence to obtain multiple function call paths;

[0023] The number of times each edge in the function call graph appears in the function call path is counted to obtain the weight of each edge in the function call graph.

[0024] Preferably, determining the feature embedding feature of the system call includes:

[0025] One-hot encoding the system call;

[0026] Counting the number of occurrences of the system call in each function of the function call graph to obtain a weight of the system call;

[0027] The weight of the system call is multiplied by the one-hot encoding of the system call to obtain a feature embedding feature of the system call.

[0028] A second aspect of an embodiment of the present invention discloses a program detection device based on hybrid features, the device comprising:

[0029] An acquisition unit, used to acquire static features and dynamic features of the program to be detected, wherein the static features at least include a function call graph, a system call, the number of basic blocks and the number of instruction types, and the dynamic features at least include a function execution sequence;

[0030] A fusion unit, used for fusing the static feature and the dynamic feature to obtain a mixed feature;

[0031] A detection unit is used to input the mixed features into a preset detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program, and the detection model is obtained by training a graph neural network model based on sample data.

[0032] Preferably, the acquisition unit for acquiring the static features of the program to be detected includes:

[0033] A decompiling subunit, used for decompiling the program to be detected to obtain a function call graph of the program to be detected;

[0034] An identification subunit, used for identifying a system call instruction in an assembly code obtained by decompiling the program to be detected, so as to obtain a system call in a function of the program to be detected;

[0035] The counting subunit is used to count the number of basic blocks and the number of instructions of each type in the function of the program to be detected to obtain the number of basic blocks and the number of instruction types.

[0036] Preferably, the acquisition unit for acquiring the dynamic features of the program to be detected includes:

[0037] The stub subunit is used to perform program stubs at each function entry in the program to be detected;

[0038] The testing subunit is used to put the program to be tested that has completed program instrumentation into a sandbox for fuzzy testing to obtain multiple function execution sequences of the program to be tested under different inputs.

[0039] Preferably, the fusion unit comprises:

[0040] A first determining subunit, configured to determine a weight of each edge in the function call graph according to the function execution sequence;

[0041] A second determination subunit is used to determine a feature embedding feature of the system call;

[0042] A fusion subunit is used to input the number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph into a node embedding model to obtain a mixed feature, wherein the mixed feature is a feature vector of each node in the function call graph.

[0043] Based on the above-mentioned embodiment of the present invention, a program detection method and device based on hybrid features are provided. The method is as follows: obtaining static features and dynamic features of the program to be detected; fusing the static features and dynamic features to obtain hybrid features; inputting the hybrid features into a preset detection model for program detection to obtain a program type indicating that the program to be detected is a malicious program or a benign program. This solution fuses the static features and dynamic features of the program to be detected to obtain hybrid features; then inputting the hybrid features into a detection model for program detection to obtain a program type indicating that the program to be detected is a malicious program or a benign program, and utilizes multi-dimensional program features to detect malicious programs, thereby improving the detection accuracy of malicious programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flowchart of a program detection method based on hybrid features provided by an embodiment of the present invention;

[0046] Figure 2 An example workflow diagram of a program detection method based on hybrid features provided by an embodiment of the present invention;

[0047] Figure 3 A structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention;

[0048] Figure 4 Another structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention;

[0049] Figure 5 Another structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention;

[0050] Figure 6 Another structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0053] Graph features such as data flow graph (DFG), control flow graph (CFG), API dependency graph, etc. are one of the important features of programs, and these graph features are usually used to detect malicious programs.

[0054] The inventor has found through research that the current methods of detecting malicious programs are either to detect malicious programs only by using features such as the program's data flow graph, control flow graph, or abstract syntax tree, or to detect malicious programs only by using memory images or sandbox logs. These methods all use features of a single dimension to detect programs. However, features of a single dimension cannot fully reflect the specific situation of the program, and it is difficult to accurately detect malicious programs from features of a single dimension, and the detection accuracy of malicious programs is low.

[0055] To solve the above problems, an embodiment of the present invention proposes a program detection method and device based on hybrid features, which fuses the static features and dynamic features of the program to be detected to obtain hybrid features; then the hybrid features are input into a detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program, thereby utilizing multi-dimensional program features to detect malicious programs and improving the detection accuracy of malicious programs.

[0056] It should be noted that the subsequent explanation of this solution will involve graph neural network models, static features, dynamic features, program instrumentation and decompilation. In order to better understand the subsequent explanation of this solution, the graph neural network model, static features, dynamic features, program instrumentation and decompilation are explained in advance here.

[0057] Graph Neural Network (GNN): GNN is a deep learning model specially designed to process graph-structured data; graph-structured data consists of nodes and edges, nodes represent entities, and edges represent the relationships between these entities; GNN captures the complex relationships between nodes and their neighbors by passing messages on the graph structure, thereby achieving effective representation and processing of graph data.

[0058] Static features: The static features of a program refer to the features that can be determined and analyzed before the program runs. These features are usually related to the code structure, syntax, and semantics of the program, without the need to actually execute the program. The static features of this solution are: function call graph (FCG, used to show the calling relationship between various functions in the program), system call (System Call, the interface for user programs to request the operating system kernel to provide services), the number of basic blocks, and the number of instruction types.

[0059] Dynamic features: The dynamic features of a program refer to the features that can only be observed when the program is running. These features are related to the actual execution process, runtime data, and behavior of the program. They need to be obtained by actually executing the program or using specific tools. The dynamic features of this solution are: function execution sequence.

[0060] Program instrumentation: This solution can obtain the function execution sequence through program instrumentation by inserting additional code or instructions into the source code, binary code or runtime environment of the program to collect various information when the program is running.

[0061] Decompilation (also known as disassembly): A process of converting machine code into assembly language code (assembly code). Decompilation can convert machine instructions in binary files into human-readable assembly language form, thereby helping developers understand the internal structure and execution logic of the program.

[0062] See also Figure 1 , shows a flow chart of a program detection method based on hybrid features provided by an embodiment of the present invention, the program detection method comprising:

[0063] Step S101: Obtain static features and dynamic features of the program to be detected.

[0064] In the process of implementing step S101, a program to be detected of a program type that needs to be detected (characterizing a malicious program or a benign program) is obtained, and static features and dynamic features of the program to be detected are obtained; wherein the static features include at least a function call graph, system calls, the number of basic blocks and the number of instruction types, and the dynamic features include at least a function execution sequence.

[0065] In some specific embodiments, the specific method of obtaining the static characteristics of the program to be detected is: decompiling the program to be detected to obtain the function call graph of the program to be detected; identifying the system call instructions in the assembly code obtained by decompiling the program to be detected to obtain the system calls in the functions of the program to be detected; counting the number of basic blocks and the number of instructions of each type in the functions of the program to be detected to obtain the number of basic blocks and the number of instruction types.

[0066] Specifically, the program to be detected is decompiled using a disassembly tool to obtain a function call graph of the program to be detected; the system call instructions in the decompiled assembly code are identified to identify the system calls in the functions of the program to be detected; the number of basic blocks and the number of instructions of each type in the function of the program to be detected are counted to obtain the number of basic blocks and the number of instruction types;

[0067] The function call graph, system call, number of basic blocks and number of instruction types obtained above are the static features of the program to be detected.

[0068] In some other specific embodiments, the specific method of obtaining the dynamic characteristics of the program to be detected is: perform program stubbing at each function entry in the program to be detected; place the program to be detected with completed program stubbing into a sandbox for fuzzy testing to obtain multiple function execution sequences of the program to be detected under different inputs.

[0069] Specifically, a binary instrumentation tool is used to instrument the program at each function entry in the program to be tested, and then the program to be tested after the instrumentation is placed in a sandbox for fuzz testing; during the fuzz testing process, different inputs are provided to the program to be tested so that the program to be tested executes different functions, and finally the instrumentation tool is used to obtain multiple function execution sequences of the program to be tested under different inputs.

[0070] It should be noted that the "input" in "providing different inputs for the program to be detected" specifically refers to: the input parameters for the execution of the program to be detected.

[0071] In practical applications, symbolic execution can also be used to obtain multiple function execution sequences of the program to be tested.

[0072] Step S102: Fusing the static features and the dynamic features to obtain mixed features.

[0073] In the specific implementation of step S102, after the static features and fused features of the program to be detected are obtained, the static features and dynamic features of the program to be detected are fused (or combined) to obtain the mixed features of the program to be detected.

[0074] In some specific embodiments, the specific method of obtaining the mixed features of the program to be detected is: according to the function execution sequence (i.e., the dynamic features obtained in step S101), determine the weight of each edge in the function call graph; determine the feature embedding features of the system call; input the number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph into the node embedding model to obtain the mixed features, which are the feature vectors of each node in the function call graph.

[0075] The following is a detailed explanation of “how to determine the weight of each edge in the function call graph” and “how to determine the feature embedding characteristics of system calls” respectively.

[0076] 1. The specific method to determine the weight of each edge in the function call graph:

[0077] Analyze the function execution sequence to obtain multiple function call paths; count the number of times each edge in the function call graph appears in the function call path to obtain the weight of each edge in the function call graph, that is, "the number of times each edge in the function call graph appears in the function call path" is used as the "weight of each edge in the function call graph".

[0078] That is to say, the dynamic feature of the function execution sequence of the program to be tested is analyzed to obtain multiple actual function call paths, and then the number of times each edge in the function call graph of the program to be tested appears in the function call path is counted, and the "number of times each edge in the function call graph appears in the function call path" is used as the "weight of each edge in the function call graph".

[0079] Among them, the weight of each edge in the function call graph is recorded as W(a,b) is the weight of the edge "a->b" in the function call graph, a and b are the two nodes (function nodes) of the edge "a->b", N is the total number of function call paths, L i (a,b) is the edge "a->b" in the function call path L i The number of times it appears in .

[0080] 2. The specific method of determining the feature embedding features of the system call is:

[0081] One-hot encodes the system call; counts the number of occurrences of the system call in each function of the function call graph to obtain the weight of the system call; multiplies the weight of the system call by the one-hot encoding of the system call to obtain the feature embedding feature of the system call.

[0082] That is to say, one-hot encode the system call, count the number of occurrences of the system call in each function in the function call graph, and use the "number of occurrences of the system call in each function in the function call graph" as the "weight of the system call".

[0083] Multiplying the "weight of the system call" by the "one-hot encoding of the system call" can obtain the feature embedding features of the system call, thus completing the feature embedding of the system call.

[0084] After obtaining the weight of each edge in the function call graph and the feature embedding features of the system call in the above manner, the number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph are input into the node embedding model together, so that the node embedding model can learn the number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph, and obtain the feature vector of each node in the function call graph output by the node embedding model. The "feature vector of each node in the function call graph" is the mixed feature of the program to be detected.

[0085] It should be noted that the node embedding model can be a node2vec model.

[0086] Step S103: inputting the mixed features into a preset detection model to perform program detection, so as to obtain a program type indicating whether the program to be detected is a malicious program or a benign program.

[0087] It should be noted that the detection model is obtained by training a graph neural network model based on sample data, and the sample data includes malicious sample programs and benign sample programs, and the malicious sample programs and the benign sample programs are pre-labeled with real labels; therefore, the specific method of training the detection model is: according to the above-mentioned steps S101 and S102, the malicious sample programs and the benign sample programs are processed respectively, so as to obtain the mixed features of the malicious sample programs and the mixed features of the benign sample programs, and the mixed features of the malicious sample programs and the mixed features of the benign sample programs are input into the graph neural network model for training, so as to train the detection model.

[0088] In the process of implementing step S103, after obtaining the mixed features of the program to be detected, the mixed features of the program to be detected are input into a pre-trained detection model for program detection (or program classification), and the program category of the program to be detected output by the detection model is obtained. The program category of the program to be detected indicates whether the program to be detected is a malicious program or a benign program.

[0089] In an embodiment of the present invention, the static features and dynamic features of the program to be detected are fused to obtain a hybrid feature that better characterizes the behavior of the program. The hybrid feature is input into the detection model to provide the detection model with more comprehensive program information, so that the detection model accurately outputs the program type indicating whether the program to be detected is a malicious program or a benign program, thereby improving the detection accuracy of malicious programs.

[0090] To further understand the above embodiments of the present invention Figure 1 The process of detecting the program category of the program to be detected is as follows: Figure 2 The following is an example of a workflow diagram of a program detection method based on hybrid features.

[0091] from Figure 2 As can be seen from the workflow shown, the overall workflow of this solution is divided into several parts: "static feature extraction", "dynamic feature extraction", "hybrid feature combination" and "malicious program detection". These parts are explained below.

[0092] Static feature extraction: Decompilation technology is used to obtain the function call graph and system call of the program to be detected, and the number of basic blocks and instruction types is counted.

[0093] Dynamic feature extraction: The program to be detected is instrumented and sandboxed in sequence to extract the function execution sequence.

[0094] Hybrid feature combination: determine the weight of each edge in the function call graph, so as to assign weights to the edges of the function call graph; count the number of occurrences of system calls in each function of the function call graph, and then obtain the feature embedding features of the system calls based on the "one-hot encoding of the system calls" and the "number of occurrences in each function of the function call graph"; input the number of basic blocks, the number of instruction types, the feature embedding features of the system calls, and the weight of each edge in the function call graph into the node embedding model to obtain the feature vector of each node in the function call graph. The feature vector of each node in the function call graph is the hybrid feature of the program to be detected. The process of obtaining the "feature vector of each node in the function call graph" is called "function call graph node embedding".

[0095] Malicious program detection: The mixed features of the program to be detected are input into the detection model to obtain the program type used to indicate whether the program to be detected is a malicious program or a benign program.

[0096] Corresponding to the program detection method based on mixed features provided in the above embodiment of the present invention, see Figure 3 , the embodiment of the present invention also provides a structural block diagram of a program detection device based on hybrid features, the program detection device includes: an acquisition unit 100, a fusion unit 200 and a detection unit 300;

[0097] The acquisition unit 100 is used to acquire static features and dynamic features of the program to be detected, wherein the static features at least include function call graph, system call, number of basic blocks and number of instruction types, and the dynamic features at least include function execution sequence.

[0098] The fusion unit 200 is used to fuse the static features and the dynamic features to obtain mixed features.

[0099] The detection unit 300 is used to input the mixed features into a preset detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program. The detection model is obtained by training a graph neural network model based on sample data.

[0100] In an embodiment of the present invention, the static features and dynamic features of the program to be detected are fused to obtain a hybrid feature that better characterizes the behavior of the program. The hybrid feature is input into the detection model to provide the detection model with more comprehensive program information, so that the detection model accurately outputs the program type indicating whether the program to be detected is a malicious program or a benign program, thereby improving the detection accuracy of malicious programs.

[0101] Preferably, combined Figure 3 , see Figure 4 , shows another structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention, wherein an acquisition unit 100 for acquiring static features of a program to be detected includes a decompilation subunit 101, an identification subunit 102 and a statistics subunit 103;

[0102] The decompiling subunit 101 is used to decompile the program to be detected to obtain a function call graph of the program to be detected.

[0103] The identification subunit 102 is used to identify the system call instruction in the assembly code obtained by decompiling the program to be detected, so as to obtain the system call in the function of the program to be detected.

[0104] The counting subunit 103 is used to count the number of basic blocks and the number of instructions of each type in the function of the program to be detected, so as to obtain the number of basic blocks and the number of instruction types.

[0105] Preferably, combined Figure 3 , see Figure 5 , shows another structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention, wherein an acquisition unit 100 for acquiring dynamic features of a program to be detected includes an instrumentation subunit 104 and a testing subunit 105;

[0106] The instrumentation subunit 104 is used to perform program instrumentation at each function entry in the program to be detected.

[0107] The testing subunit 105 is used to put the program to be tested that has completed program instrumentation into a sandbox for fuzz testing, so as to obtain multiple function execution sequences of the program to be tested under different inputs.

[0108] Preferably, combined Figure 3 , see Figure 6 , shows another structural block diagram of a program detection device based on hybrid features provided by an embodiment of the present invention, wherein the fusion unit 200 includes a first determination subunit 201, a second determination subunit 202 and a fusion subunit 203;

[0109] The first determining subunit 201 is used to determine the weight of each edge in the function call graph according to the function execution sequence.

[0110] In a specific implementation, the first determining subunit 201 is specifically used for: parsing the function execution sequence to obtain multiple function call paths; counting the number of times each edge in the function call graph appears in the function call path to obtain the weight of each edge in the function call graph.

[0111] The second determining subunit 202 is used to determine the feature embedding feature of the system call.

[0112] In a specific implementation, the second determination subunit 202 is specifically used to: one-hot encode the system call; count the number of occurrences of the system call in each function of the function call graph to obtain the weight of the system call; multiply the weight of the system call by the one-hot encoding of the system call to obtain the feature embedding feature of the system call.

[0113] The fusion subunit 203 is used to input the number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph into the node embedding model to obtain a hybrid feature, which is a feature vector of each node in the function call graph.

[0114] In summary, the embodiments of the present invention provide a program detection method and device based on hybrid features, which fuse the static features and dynamic features of the program to be detected to obtain hybrid features; the hybrid features are then input into a detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program, and multi-dimensional program features are used to detect malicious programs, thereby improving the detection accuracy of malicious programs.

[0115] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0116] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0117] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A program detection method based on hybrid features, characterized in that: The method comprises: Obtaining static features and dynamic features of the program to be detected, wherein the static features at least include a function call graph, a system call, the number of basic blocks, and the number of instruction types, and the dynamic features at least include a function execution sequence; The static feature and the dynamic feature are combined to obtain a mixed feature; The mixed features are input into a preset detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program, and the detection model is obtained based on a graph neural network model trained based on sample data.

2. The method according to claim 1, characterized in that The process of obtaining the static features of the program to be detected includes: Decompiling the program to be detected to obtain a function call graph of the program to be detected; Identify the system call instruction in the assembly code obtained by decompiling the program to be detected to obtain the system call in the function of the program to be detected; The number of basic blocks and the number of instructions of each type in the function of the program to be detected are counted to obtain the number of basic blocks and the number of instruction types.

3. The method according to claim 1, characterized in that The process of obtaining the dynamic features of the program to be detected includes: Perform program instrumentation at each function entry in the program to be tested; The program to be detected that has completed program instrumentation is placed in a sandbox for fuzz testing to obtain multiple function execution sequences of the program to be detected under different inputs.

4. The method according to any one of claims 1 to 3, characterized in that: The static features and the dynamic features are fused to obtain mixed features, including: Determining the weight of each edge in the function call graph according to the function execution sequence; determining a feature embedding feature of the system call; The number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph are input into a node embedding model to obtain a mixed feature, where the mixed feature is a feature vector of each node in the function call graph.

5. The method according to claim 4, characterized in that Determining the weight of each edge in the function call graph according to the function execution sequence includes: Parsing the function execution sequence to obtain multiple function call paths; The number of times each edge in the function call graph appears in the function call path is counted to obtain the weight of each edge in the function call graph.

6. The method according to claim 4, characterized in that Determining a feature embedding feature of the system call includes: One-hot encoding the system call; Counting the number of occurrences of the system call in each function of the function call graph to obtain a weight of the system call; The weight of the system call is multiplied by the one-hot encoding of the system call to obtain a feature embedding feature of the system call.

7. A program detection device based on mixed features, characterized in that: The device comprises: An acquisition unit, used to acquire static features and dynamic features of the program to be detected, wherein the static features at least include a function call graph, a system call, the number of basic blocks and the number of instruction types, and the dynamic features at least include a function execution sequence; A fusion unit, used for fusing the static feature and the dynamic feature to obtain a mixed feature; A detection unit is used to input the mixed features into a preset detection model for program detection to obtain a program type indicating whether the program to be detected is a malicious program or a benign program, and the detection model is obtained by training a graph neural network model based on sample data.

8. The device according to claim 7, characterized in that The acquisition unit for acquiring the static features of the program to be detected includes: A decompiling subunit, used for decompiling the program to be detected to obtain a function call graph of the program to be detected; An identification subunit, used for identifying a system call instruction in an assembly code obtained by decompiling the program to be detected, so as to obtain a system call in a function of the program to be detected; The counting subunit is used to count the number of basic blocks and the number of instructions of each type in the function of the program to be detected to obtain the number of basic blocks and the number of instruction types.

9. The device according to claim 7, characterized in that The acquisition unit for acquiring the dynamic features of the program to be detected includes: The stub subunit is used to perform program stubs at each function entry in the program to be detected; The testing subunit is used to put the program to be tested that has completed program instrumentation into a sandbox for fuzzy testing to obtain multiple function execution sequences of the program to be tested under different inputs.

10. The device according to any one of claims 7 to 9, characterized in that: The fusion unit comprises: A first determining subunit, configured to determine a weight of each edge in the function call graph according to the function execution sequence; A second determination subunit is used to determine a feature embedding feature of the system call; A fusion subunit is used to input the number of basic blocks, the number of instruction types, the feature embedding features of the system call, and the weight of each edge in the function call graph into a node embedding model to obtain a mixed feature, wherein the mixed feature is a feature vector of each node in the function call graph.

Images