Malicious control instruction detection method and system based on CNN-LSTM hybrid model

Abstract

The present invention provides a method and system for detecting malicious control instructions based on a CNN-LSTM hybrid model. The method is applied to a distribution network communication network. First, the open source Cuckoo Sandbox is used to extract the API call sequence generated by the execution behavior of malicious control instructions in the distribution network operating software, and a training data set is constructed. A CNN-LSTM hybrid model is established, and a loss function is constructed after extracting a part of the API call sequence as input data. After selecting the binary classification loss function Sigmoid for processing, a classification result is obtained to detect whether the control instruction is malicious. The efficiency of the proposed method under malicious business control instructions is then demonstrated through a confusion matrix, and the performance of the proposed method CNN-LSTM hybrid model is compared with the detection performance of traditional CNN and LSTM models through indicators such as precision, recall rate, accuracy, and F1 score to demonstrate the performance advantage of the proposed method CNN-LSTM hybrid model. Finally, the hyperparameters are adjusted to determine the optimal CNN-LSTM hybrid model. The present invention can detect malicious control instructions more efficiently and accurately.

Description

Technical Field

[0001] The present invention relates to the technical field of detecting malicious control instructions in an active power distribution network communication network, and in particular to a malicious control instruction detection method and system based on a CNN-LSTM hybrid model. Background Art

[0002] In modern society, distribution networks play a vital role. They are critical infrastructure for transmitting electricity from power plants to end users. First, they are the foundation for ensuring power supply. Almost all production and daily life in modern society rely on electricity. Second, they are crucial for ensuring the smooth operation of society and the economy, as they are a key link in power transmission. Any disruption to the distribution network can cause power outages, production halts, and even economic losses. Therefore, the security and stability of the distribution network are crucial for the sustainable development of society and the economy. Furthermore, the distribution network is a vital safeguard for public safety. Overloads, short circuits, or damage to distribution equipment can cause fires, explosions, and other safety incidents, posing serious threats to life and property. Therefore, ensuring the safe and stable operation of the distribution system is crucial for ensuring public safety.

[0003] Power Line Communication (PLC) technologies in distribution networks include both wired and wireless technologies, used to distribute power and transmit data across different frequency ranges. Malicious control commands are a significant issue that can lead to communication slowdowns and unavailability, errors and altered commands, failures, and observed abnormal system behavior. These commands can cause abnormal operation of distribution equipment, paralyze the system, and even pose a serious threat to public safety. Therefore, with the rapid spread of new malicious control commands, distribution network communication networks require effective technical means to detect these commands.

[0004] IDS (Intrusion Detection System) is one of the solutions for dealing with security attacks on distribution networks and protecting systems from unauthorized access to malicious control instructions. However, the existing IDS system's methods for detecting malicious control instructions have the problem that attack samples are scarce and variable, and the distribution of positive and negative samples is extremely unbalanced, making it difficult to learn and train the model. On the one hand, as the number of control instructions increases, they require more and more permissions. In order to avoid being detected by the system's built-in protection and antivirus software, malicious control instructions have also begun to learn how to apply for a series of permissions from benign control instructions. This makes it difficult to judge malicious control instructions. There is an urgent need to design a practical and feasible fast identification and detection algorithm to identify, prevent and respond to the impact of malicious control instructions, so as to ensure the safe and stable operation of the distribution network, ensure the reliability of power supply, and maintain social order and public safety.

[0005] With the development of artificial intelligence, deep learning has also opened up new research directions in the field of distribution network communication network security. The detection and classification of malicious control instructions are essentially classification problems, and deep learning can effectively perform various classification tasks. After the introduction of the CNN (Convolutional Neural Network) model, widely used in image processing, some researchers drew inspiration from NLP (Natural Language Processing) methods and applied related learning methods to malicious control instruction detection. They proposed a multi-layer convolutional neural network model that processes decompiled assembly language code as text data and uses the assembly code's instruction set as a dictionary to train the model. However, this approach requires very expensive program analysis. Some researchers have proposed a malicious control instruction classification method called MCFT-CNN (Malware Classification with Fine-Tune Convolution Neural Networks). This method is based on a fine-tuned convolutional neural network model. Using model parameters trained on the ImageNet dataset, it is used for transfer learning to classify malicious control instructions into their corresponding malicious control instruction families. However, using pre-trained parameters makes the model too large and complex, affecting detection efficiency. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to address the deficiencies of the above-mentioned existing malicious control instruction detection technology, and provide a malicious control instruction detection method and system based on a CNN-LSTM hybrid model. The open source Cuckoo Sandbox is used to extract the API (Application Programming Interface) call sequence generated by the execution behavior of malicious control instructions in the distribution network operation software, and a large data set of API sequences called by malicious and benign control instructions is used to train the model. Then, a CNN-LSTM (Long ShortTerm Memory) model structure is established, and a part of the API call sequence is extracted as input data. After processing with the binary classification loss function Sigmoid, the classification result is obtained to detect whether the control instruction is malicious. Finally, the confusion matrix is ​​used to prove that the proposed method can detect malicious control instructions more efficiently and accurately.

[0007] The present invention adopts the following technical solutions.

[0008] A first aspect of the present invention provides a malicious control instruction detection method based on a CNN-LSTM hybrid model, which is applied to a distribution network communication network, comprising:

[0009] Obtain multiple API call sequences generated when the control instruction to be detected is executed in the distribution network communication network software;

[0010] Use a hash algorithm to encrypt multiple API call sequences into hash values ​​to obtain multiple encrypted API call sequences;

[0011] Multiple encrypted API call sequences are input into a pre-built malicious control instruction detection model, and an output is given as to whether the control instruction to be detected is a malicious control instruction; the malicious control instruction detection model is a hybrid model constructed based on CNN and LSTM, and the malicious control instruction detection model is obtained through machine learning training using multiple sets of data, and the multiple sets of data include a first category of data and a second category of data, each set of data in the first category of data includes an encrypted API call sequence of an API call sequence generated when a malicious control instruction is executed in the distribution network communication network software, and each set of data in the second category of data includes an encrypted API call sequence of an API call sequence generated when a benign control instruction is executed in the distribution network communication network software.

[0012] Optionally, the plurality of API call sequences include first 100 non-repeating consecutive API call sequences associated with a parent process of the called API.

[0013] Optionally, building a hybrid model based on CNN and LSTM includes:

[0014] Select API call sequences from multiple sets of data as input sequences;

[0015] Construct a CNN model, which includes convolutional layers and pooling layers. Input the input sequence into the CNN model and process it through the convolutional layers and pooling layers in turn.

[0016] Build an LSTM model, input the output of the pooling layer into the LSTM model, and input the output of the LSTM model into the fully connected layer;

[0017] Establishing an output layer for outputting characteristic data related to malicious control instructions, including the network communication destination of the control instruction, the target path of the control instruction operation, and the behavior pattern of the control instruction;

[0018] A classification layer is established, and the feature data output by the output layer is input into the classification layer. The classification layer outputs whether the control instruction to be detected is a malicious control instruction, completing the construction of the hybrid model based on CNN and LSTM.

[0019] Optionally, the CNN model also includes:

[0020] Embedding layer, used to reduce the dimensionality of the input sequence;

[0021] Batch normalization is done on one layer, connected to the embedding layer, to normalize the data output by the embedding layer to a preset range, and then the normalized data is input to the convolutional layer.

[0022] Optionally, the convolution layer includes a first convolution layer and a second convolution layer.

[0023] Optionally, the first convolutional layer has 64 filters and the second convolutional layer has 128 filters.

[0024] Optionally, in the classification layer, a Sigmoid function is used to output the probability that the control instruction to be detected is a malicious control instruction according to the feature data.

[0025] Optionally, the method further includes:

[0026] Evaluate the performance of the malicious control instruction detection model and obtain evaluation results;

[0027] Parameters of the malicious control instruction detection model are adjusted according to the loss function and the evaluation results, where the parameters include at least one of the following: pooling rate, number of layers, number of channels, and number of hidden neurons.

[0028] Optionally, evaluating the performance of the malicious control instruction detection model includes:

[0029] A confusion matrix is ​​used to calculate based on the output of the malicious control instruction detection model, where the rows of the confusion matrix represent the actual categories, and the columns represent the categories output by the malicious control instruction detection model. The confusion matrix includes four cells, each cell corresponding to a preset category, and the preset categories include true positive, false positive, false negative, and true negative. The value in each cell represents the number of times the malicious control instruction detection model predicted the actual category as the preset category;

[0030] Calculate the evaluation results based on the confusion matrix.

[0031] Optionally, parameters of the malicious control instruction detection model are adjusted according to the loss function and the evaluation results, including:

[0032] The comprehensive index value is calculated according to the loss function and evaluation results according to the following formula;

[0033] Q = α × e lnL +β×(1-e lnZ )

[0034] Where Q represents the comprehensive index value, L is the loss value of the malicious control instruction monitoring model, which is calculated by the loss function, Z is the evaluation result of the malicious control instruction detection model performance, α and β are weight coefficients, which are non-negative numbers;

[0035] When Q is greater than the tuning threshold, the parameters of the malicious control instruction detection model are tuned.

[0036] A second aspect of the present invention provides a malicious control instruction detection system, comprising:

[0037] An acquisition module, used to acquire multiple API call sequences generated when the control instruction to be detected is executed in the distribution network communication network software;

[0038] An encryption module, used to encrypt multiple API call sequences into hash values ​​using a hash algorithm to obtain multiple encrypted API call sequences;

[0039] A detection module is used to input multiple encrypted API call sequences into a pre-built malicious control instruction detection model, and output whether the control instruction to be detected is a malicious control instruction; the malicious control instruction detection model is a hybrid model constructed based on CNN and LSTM, and the malicious control instruction detection model is obtained through machine learning training using multiple groups of data, and the multiple groups of data include a first category of data and a second category of data. Each group of data in the first category of data includes an encrypted API call sequence of an API call sequence generated when a malicious control instruction is executed in the distribution network communication network software, and each group of data in the second category of data includes an encrypted API call sequence of an API call sequence generated when a benign control instruction is executed in the distribution network communication network software.

[0040] The third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the computer program is loaded into the processor, the malicious control instruction detection method based on the CNN-LSTM hybrid model is implemented.

[0041] A fourth aspect of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned malicious control instruction detection method based on the CNN-LSTM hybrid model.

[0042] Compared with the prior art, the beneficial effects of the present invention include at least:

[0043] Compared with the existing malicious control instruction detection method, the original detection method has the problem that the malicious control instruction samples are scarce and changeable, and the distribution of positive and negative samples is extremely unbalanced, which makes it difficult to learn and train the model, and it is difficult to judge the malicious control instructions. The detection method proposed by the present invention finds the key information API call sequence for identifying malicious control instructions. Since these data are generated by the behavior of the control instructions themselves, it is difficult to confuse them. Therefore, the present invention uses the API call sequence extracted from the Cuckoo Sandbox report as the data set for effective malicious control instruction detection, overcoming the problems of the original method such as small number of samples, difficulty in training and overfitting.

[0044] Compared with existing methods, the present invention proposes a detection method using a CNN-LSTM hybrid model. The CNN-LSTM hybrid model can process different parts of the input data simultaneously, facilitating the simultaneous extraction and integration of data features. It can capture information related to various aspects of the data generated by the execution of control instructions, significantly improving computational efficiency and accelerating the model training and inference process. Specifically, compared with other models, the CNN-LSTM model achieved an improvement in accuracy of 24% and 22%, respectively, and an improvement in F1 score of at least 16% and 14%. These results demonstrate the effectiveness of the model proposed in the embodiments of the present invention in enhancing the ability to detect malicious control instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be derived from these drawings without inventive effort. Among them:

[0046] Figure 1 A schematic diagram of a cuckoo sandbox model provided in an embodiment of the present invention;

[0047] Figure 2 A schematic flow chart of a method for detecting malicious control instructions provided by an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of the structure of a CNN-LSTM hybrid model provided by an embodiment of the present invention;

[0049] Figure 4 A schematic diagram of a process for constructing a CNN-LSTM hybrid model provided in an embodiment of the present invention;

[0050] Figure 5 A schematic diagram of the results of a confusion matrix proof method provided by an embodiment of the present invention;

[0051] Figure 6 A schematic diagram of the results of determining the final optimal model by selecting hyperparameters provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0052] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0053] Combine Figure 1 As shown, the implementation environment of the present invention mainly includes three parts: an analysis virtual machine, a virtual network, and a Cuckoo host. Training samples of malicious control instructions in the distribution network communication network software are extracted on the analysis virtual machine. The analysis virtual machine provides an isolated environment, which can analyze the behavior of the software more safely and accurately without affecting the security of the host system. The virtual network is an isolated virtual network mainly used to run the analysis virtual machine, and each analysis virtual machine and the Cuckoo host are connected in this isolated environment. When running the sample instruction, that is, the control instruction to be detected, the analysis virtual machine creates a new environment and reports the sample instruction behavior to the Cuckoo host. The Cuckoo host is connected to the Internet for management analysis, dumping traffic, and generating reports.

[0054] based on Figure 1 The implementation environment, combined with Figure 2 As shown, embodiment 1 of the present invention provides a malicious control instruction detection method based on a CNN-LSTM hybrid model, which is applied to a distribution network communication network. The method includes the following contents:

[0055] S1. Acquire multiple API call sequences generated when the control instruction to be detected is executed in the distribution network communication network software.

[0056] Optionally, the plurality of API call sequences include first 100 non-repeating consecutive API call sequences associated with a parent process of the called API.

[0057] Specifically, multiple API sequences are extracted by the open source Cuckoo Sandbox from the API call sequences generated by the execution behavior of malicious control instructions in the distribution network software.

[0058] S1 specifically includes:

[0059] S1.1. Use the Cuckoo Sandbox to establish an isolated virtual network mainly used to run analysis virtual machines, connect each analysis virtual machine and the Cuckoo host in this isolated environment, and finally connect the Cuckoo host to the Internet.

[0060] S1.2. Extract the dynamic data API call sequence generated after the control instruction is executed and generate a report, as shown below:

[0061] First, obtain the analysis report from Cuckoo Sandbox or other sandbox environments. Sandbox reports are usually generated in JSON, XML, or HTML format and contain detailed behavioral data of the analyzed software. Then, according to the format of the report, use appropriate parsing tools (such as Python's json module to read and parse the report content. In the parsed report, find the section containing API call information. Usually, this part of the data will be under the "behavior" or "api_calls" field. For example, the report of Cuckoo Sandbox may contain a "calls" list that records all API calls. Then traverse the API call data and extract the required API call sequence. Depending on the needs, you can choose to extract the first 100 non-repeating consecutive API calls. Process the extracted API call sequence (such as mapping to a unique value or encoding) and store it in an appropriate data structure (such as a list or database). Finally, output the extracted API call sequence to a file or database for subsequent analysis or model training.

[0062] Malicious control instructions often exhibit specific behavioral patterns and characteristics, which can be identified by analyzing dynamic data and API call sequences. Dynamic data refers to real-time data generated during the execution of control instructions by software, such as file operations, network communications, and registry access. API call sequences refer to the sequence of API functions called by the software during the execution of control instructions. There is a close relationship between dynamic data and API call sequences. Specifically, API call sequences can reflect the functions and behaviors used by the software during the execution of control instructions, while dynamic data provides more specific details and contextual information.

[0063] Malicious control instructions often use specific API functions to perform malicious activities, such as reading sensitive information, modifying system settings, and self-propagation. By analyzing the API call sequences of malicious control instructions, we can identify the patterns and characteristics of these malicious behaviors. Dynamic data can also provide more detailed information, such as the network communication destination of the malicious control instructions and the target path of the control instruction operation, which can help further analyze and determine the malicious nature of the control instructions executed by the software.

[0064] The virtual machine is analyzed to extract the API call sequences of control instructions. A new environment is created each time a sample is run, and the sample's behavior is reported back to the Cuckoo host. The Cuckoo host then analyzes and manages the data, dumps the traffic, and generates a report. The data used in this embodiment of the present invention includes 42,797 malicious control instruction API call sequences and 1,079 benign control instruction API call sequences. Each API call sequence consists of the first 100 non-repeating, consecutive API calls associated with the parent process. The sequence is extracted from the call elements of the Cuckoo Sandbox report and generated from a real sandbox environment.

[0065] S2. Use a hash algorithm to encrypt multiple API call sequences into hash values ​​to obtain multiple encrypted API call sequences.

[0066] In S2, a hash algorithm is used to encrypt the API call sequence of malicious or benign control instructions into a 32-byte hash value. The specific steps are as follows:

[0067] ① Input data: First, the API call sequence of malicious or benign control instructions is used as the input data for hash calculation.

[0068] ② Data Blocking: This embodiment of the present invention needs to process the API call sequence generated by the execution of 43,876 control instructions, so the data needs to be processed in blocks. First, the data is divided into blocks of fixed size. This can improve processing efficiency and is suitable for hash algorithms that cannot process the entire data at once.

[0069] ③ Initialize the hash value: Before starting the calculation, a hash value needs to be initialized. The length of this hash value is generally determined by the design of the hash algorithm. This embodiment of the present invention uses the SHA-3-256 hash algorithm, whose hash value length is 256 bits, or 32 bytes. This is because the hash value length directly affects the security of the hash algorithm and the possibility of hash collisions. Generally speaking, the longer the hash value length, the lower the probability of hash collisions, making it more difficult to forge.

[0070] ④ Processing the data block: The data block is processed by first performing data conversion to convert the data block into a specific format. In the embodiment of the present invention, the hexadecimal format is used. Then, a hash operation is performed on the converted data block.

[0071] ⑤Update hash value: Merge the hash operation result of each data block with the previous hash value to update the hash value.

[0072] ⑥ Repeat processing of data blocks: Repeat the above steps until all data blocks are processed.

[0073] ⑦ Output hash value: After all data blocks are processed, the hash value obtained is the hash calculation result of the input data. Table 1 shows the API call sequence dataset, which shows the results of the encrypted hash value of the API call sequence of malicious or benign control instructions.

[0074] Table 1

[0075] Hash value t_0 t_1 t_2 *** t_99 07le8c3f8922e186e57548cd4c703a5d 112 274 158 *** 71 70b78f7bdf9c484913d10365348ed2ba 286 172 117 *** 135 b68abd064e975elc6d5f25e748663076 16 110 240 *** 112 72049be7bd30ea61297ea624ae198067 82 208 187 *** 302 164b56522eb24164184460f8523ed7e2 82 240 117 *** 35 56ae1459ba6lal4eb119982d6ec793d7 82 240 117 *** 117 654139d715abcf7ecdddbef5a84f224b 82 240 117 *** 141 078c964e7be4819a06974c6f292a4857 112 274 158 *** 71

[0076] Table 1 shows the top 100 non-repeated API calls from t_0 to t_99 related to a specific parent process during dynamic analysis. Each API call represents a specific operation during program execution, such as file reading and writing, network requests, and memory allocation.

[0077] S3. Input multiple encrypted API call sequences into a pre-built malicious control instruction detection model, and output whether the control instruction to be detected is a malicious control instruction; the malicious control instruction detection model is a hybrid model constructed based on CNN and LSTM, and the malicious control instruction detection model is obtained through machine learning training using multiple groups of data. The multiple groups of data include a first category of data and a second category of data. Each group of data in the first category of data includes an API call sequence generated when a malicious control instruction is executed in the distribution network communication network software, and each group of data in the second category of data includes an API call sequence generated when a benign control instruction is executed in the distribution network communication network software.

[0078] In S3, a malicious control instruction detection model is trained through machine learning using multiple sets of data obtained from a dataset. Specifically, an automated malware analysis system extracts training samples of malicious control instructions in the distribution network communication network software.

[0079] Cuckoo Sandbox is an open-source automated malware analysis system and a classic sandbox analysis tool. It provides detailed analysis results within seconds, summarizing the behavior of files executed in an isolated environment. The aforementioned malicious control instructions were simulated in the Cuckoo Sandbox distribution network malware control software to obtain the original malicious sample, which was then placed in the dataset.

[0080] S3 divides the samples used for model training into two categories: malicious and benign. Malicious samples are commands or instructions used by hackers or malicious attackers to manipulate, interfere with, or disrupt the operation of the distribution network. These samples are often harmful and may pose a threat to the security of the distribution network's communication network and its stable operation. Benign samples are samples without malicious control commands or behaviors. They are benign operational instructions issued by the distribution network to maintain optimal distribution strategies and ensure accurate and rapid recovery after failures. These samples are safe and reliable and will not harm the system.

[0081] Specifically, malicious control instructions include but are not limited to the following:

[0082] Remote power-off instructions: Hackers may send instructions to remotely control power distribution equipment, cutting off the power supply, causing power outages or partial power outages, affecting users' normal electricity use.

[0083] Power equipment overload instructions: Attackers may send instructions to overload power equipment, causing it to overheat, short-circuit, or be damaged, leading to safety accidents such as fire or explosion.

[0084] Malicious data tampering instructions: Hackers may send instructions to tamper with data in the power distribution system, such as electricity meter readings or power load information, to cause inaccurate data records or mislead operations and maintenance personnel to make incorrect decisions.

[0085] Remote control commands: Attackers may use malicious commands to remotely control the control equipment of the power distribution system, such as circuit breakers and switches, causing abnormal operation of the equipment and paralyzing or damaging the power distribution system.

[0086] Denial of service commands: Hackers may send commands that cause the distribution system to fail to operate normally, such as by sending a large amount of malicious traffic or attacking the distribution system's communication network, making its services unavailable or severely damaged.

[0087] Transformer damage commands: An attacker could send commands that cause transformer overload or damage, thereby affecting power supply stability or causing power outages.

[0088] Security protocol attack instructions: Hackers may send instructions to attack the communication protocols or security mechanisms of the distribution system, such as by intercepting, tampering with, or forging communication data, to gain control of the system or manipulate system behavior to cause system paralysis, which may even pose a serious threat to public safety.

[0089] The hybrid model based on CNN and LSTM in S3 includes:

[0090] S3.1. Select an API call sequence from multiple sets of data as an input sequence.

[0091] Specifically, an API call sequence is selected from multiple sets of data as an input sequence to establish an input layer. The sample of the parent process of the called API sequence is encrypted into a hash value based on its behavior through a hash algorithm. The call sequence consists of the first 100 non-repeated continuous API calls associated with the parent process. These non-repeated continuous API calls reflect the behavioral characteristics of the control instructions. The hash value generated by the hash algorithm can be regarded as the "fingerprint" or "identification" of the parent process when it is executed in the sandbox. This hash value is generated based on the specific behavior of the process and can uniquely identify the API call pattern of the process. Specifically, these non-repeated continuous API calls are mapped to corresponding values ​​(each API has a unique value) and are placed in the t_0 to t_99 indexes.

[0092] By mapping API call sequences to unique values, these calls can be converted into a numerical format for subsequent machine learning processing. Each value corresponds to a specific API, effectively representing the characteristics of that API. Furthermore, by limiting the API call sequence to the first 100 calls, the input data maintains consistent dimensionality, which is crucial for training deep learning models. CNN models require fixed-size inputs, so using indices from t_0 to t_99 ensures that the input data has the correct shape for the model.

[0093] S3.2. Construct a CNN model, which includes an embedding layer, a batch normalization layer, a convolutional layer, and a pooling layer. Input the input sequence to the CNN model and process it sequentially through the embedding layer, batch normalization layer, convolutional layer, and pooling layer. The embedding layer performs dimensionality reduction on the API call sequence, and the batch normalization layer normalizes the data output by the embedding layer to the same range.

[0094] S3.3. Build an LSTM model, input the output of the pooling layer into the LSTM model, and input the output of the LSTM model into the fully connected layer.

[0095] Optionally, the convolution layer includes a first convolution layer and a second convolution layer.

[0096] Optionally, the first convolutional layer has 64 filters and the second convolutional layer has 128 filters.

[0097] The CNN model can process unstructured information and extract features from input sequences, thus improving the efficiency of problem solving.

[0098] combination Figure 3 and Figure 4 As shown in the figure, the parameter settings of each layer of the CNN model are as follows:

[0099] The first layer is the embedding layer, with a vocabulary size of 307. The vocabulary here is a mapping that converts API call sequences into corresponding unique values. The dimension of the output word vector is then set to 8, indicating that the embedding layer reduces the dimension to 8. Finally, the length of the input sequence is set to 100, which is the number of API call sequences. This reduces the dimensionality of the input data in the embedding layer from 100*307 to 100*8. This approach reduces the risk of overfitting during training.

[0100] The second layer is the batch normalization layer. The main purpose of adding the batch normalization layer is to save resources, speed up learning efficiency, enhance the generalization ability of the model, and prevent overfitting to a certain extent. This layer does not change the dimension of the input data and will maintain the same dimension as the embedding layer.

[0101] The third layer is the convolution layer, whose main function is to perform convolution operations on the input matrix and filter out the API call data that are not related to malicious control instructions from the first 100 non-repeated continuous API call data associated with the API call parent process. The embodiment of the present invention can determine whether the data is suitable for training in the network. The first 100 non-repeated continuous API calls associated with its parent process will not have a decisive impact on determining whether the control instructions of the software are malicious control instructions. Among these 100 non-repeated continuous API calls, there may be some that have no significant impact on whether the software control instructions are malicious. However, inputting these API calls that will not have a significant impact as input data into the model will increase the computational complexity but will not bring significant benefits. Therefore, the receptive field is used in CNN to avoid the process of extracting features from all data.

[0102] The receptive field refers to the perception area of ​​a neuron in a certain layer of the network on the input data. For a convolutional layer, the receptive field R can be calculated by the following formula:

[0103] R=R prev +(k-1)×S

[0104] Among them, R prev is the receptive field size of the previous layer, k is the size of the current convolution kernel, which can be 3, indicating a 3*3 convolution kernel, and S is the stride, which indicates the step length of the convolution kernel moving on the input.

[0105] The fourth layer is the max pooling layer, which uses a one-dimensional max pooling method. The pooling layer size is 2, and the stride here uses the default size, which is the same as the pooling layer size. The input of this layer is the output of the convolutional layer, with a data shape of 100*32. After pooling, the maximum value is extracted from the range of size 2, reducing the original feature map size to 50*307.

[0106] S3.4. Establish an output layer to output characteristic data related to malicious control instructions. The characteristic data includes the network communication destination of the control instruction, the target path of the control instruction operation, and the behavior pattern of the control instruction.

[0107] Specifically, the output of the maximum pooling layer of the CNN model is input into the LSTM model. The specific steps are as follows:

[0108] After batch normalization, the data is fed into a one-dimensional convolutional layer for training. The convolutional outputs are then pooled and fed into an LSTM layer for training. Each batch contains 512 samples. Setting the return sequence to FALSE indicates that only the hidden state values ​​from the previous time period are required. Furthermore, setting the dropout value to 0.2 means that 20% of neurons are randomly selected and dropped during each training iteration. This probabilistically affects the inputs and recurrent connections of the LSTM neurons during forward propagation and weight updates. This method effectively avoids overfitting and improves model performance. In effect, a portion of neurons is randomly omitted to conserve computational resources and prevent or mitigate overfitting.

[0109] For example, if one of the behavioral features in the API call sequence is reading and writing files, then the behavior of reading the smart terminal unit is a feature that is unrelated to malicious control instructions. In the hybrid model based on CNN and LSTM, the behavioral feature of reading the smart terminal unit will be filtered out, and the behavioral feature related to malicious control instructions will be obtained.

[0110] It's important to note that the CNN component is responsible for extracting spatial features from the input data. For example, it can identify specific call patterns or features that may be associated with malicious behavior. The LSTM component is responsible for capturing temporal features in the input data. It can memorize the order of API call sequences, understand contextual relationships, and capture temporal trends in features. It then extracts data features related to malicious instructions, thereby better determining the maliciousness of control instructions.

[0111] S3.5. Establish a classification layer, input the feature data output by the output layer into the classification layer, and output whether the control instruction to be detected is a malicious control instruction based on the classification, completing the construction of the hybrid model based on CNN and LSTM.

[0112] Optionally, in the classification layer, a Sigmoid function is used to output the probability that the control instruction to be detected is a malicious control instruction according to the feature data.

[0113] Specifically, the Sigmoid function is used to map the output result to between 0 and 1, where 1 represents a malicious control instruction and 0 represents a benign control instruction.

[0114] The classification layer includes classifiers and regressors, and the loss function usually consists of two parts: classification loss and localization loss. The classification loss trains the classifier to identify the category of the detected control instruction, while the localization loss trains the regressor to determine the position or time of a specific API call in the sequence or the size of the frequency of certain API calls. The loss function used in the embodiment of the present invention is the binary cross entropy loss function. This loss function is mainly used for binary classification problems. For binary classification, the observed value represents the true category of the sample, and the two categories are malicious and benign. Regardless of the actual observed value, it uses {0, 1} instead of y. Obviously, it conforms to the Bernoulli distribution, which has only one parameter,

[0115] P θ (y=1)=θ (1)

[0116] P θ (y=0)=1-θ (2)

[0117] Where, formula (1) is the model's predicted value for the i-th sample, that is, the probability θ that the model predicts the label value of the i-th sample is 1. Combining the above two equations, we can express them in one equation:

[0118] P θ (y) = θ y (1-θ) 1-y (3)

[0119] Here, y represents the true label value, i.e., the actual value. A y value of 1 indicates a malicious sample, and a y value of 0 indicates a benign sample. This function better reflects the difference between the model's predicted value and the label, thereby better evaluating the accuracy of the model's predictions. Furthermore, the binary cross-entropy loss function is relatively easy to optimize and converge.

[0120] Assume that the data set is D=(x1,y1),(x2,y2),...,(x N ,y N ) Assuming that these observed data points are iid (independent and identically distributed), then the likelihood of their observed log (linklihood function) function is equal to

[0121]

[0122] Among them, θ is the parameter of the model, that is, the probability that the model predicts the label value of the i-th sample is 1, y iis the binary label value 0 or 1 of the i-th sample, the likelihood function l(θ) is the target function, and N is the number of samples. Adding a minus sign in front of it, it becomes a loss function. By observing the above equation and comparing it with the cross entropy formula, we can see that this loss function is y i and the cross entropy H of θ y (θ). Update the model parameters by minimizing the loss function.

[0123] The loss function selected in the embodiment of the present invention is the Sigmoid loss function. After being processed by the Sigmoid loss function, a classification result is obtained.

[0124] S4. Evaluate the performance of the malicious control instruction detection model.

[0125] S4 specifically includes: using a confusion matrix to perform calculations based on the output results of the malicious control instruction detection model, the rows of the confusion matrix represent actual categories, and the columns represent categories output by the malicious control instruction detection model. The confusion matrix includes four cells, each cell corresponds to a preset category, and the preset categories include true positive, false positive, false negative, and true negative. The value in each cell represents the number of times the malicious control instruction detection model predicts the actual category as the preset category; obtaining an evaluation result based on the confusion matrix calculation.

[0126] A true positive indicates that a sample is positive and the model predicts it is positive; a false positive indicates that a sample is negative and the model predicts it is positive; a false negative indicates that a sample is positive and the model predicts it is negative; and a true negative indicates that a sample is negative and the model predicts it is negative. This confusion matrix can more intuitively show where the true and predicted values ​​match and don't match, further improving predictive capabilities.

[0127] Optionally, the accuracy, recall, precision, and F1 score are calculated based on the confusion matrix, and the evaluation result is obtained by calculating the accuracy, recall, precision, and F1 score.

[0128] Precision is the ratio of the number of targets correctly identified by the model to the total number of targets. Precision reflects the model's ability to distinguish targets. The higher the probability of false positives, the lower the probability. The specific formula is as follows:

[0129]

[0130] TP refers to true positive, FP refers to false positive, TN refers to true negative, and FN refers to false negative.

[0131] Recall is the ratio of the number of targets correctly identified by the model to the number of targets that actually exist. Recall reflects the model's coverage of the targets. The higher the probability of correct identification, the lower the recall. The specific formula is as follows:

[0132]

[0133] Accuracy and F1 scores provide the harmonic mean of the precision and recall of the classification results. Users can further make more accurate decisions by evaluating the metric values ​​and identify areas for improvement, such as adjusting the hyperparameters of the hybrid model. Equations (7) and (8) respectively represent the calculation methods for accuracy and F1 scores:

[0134]

[0135] The embodiment of the present invention uses various evaluation indicators such as accuracy, precision, and F1 score to evaluate the performance of the model. Through the above evaluation indicators, the performance of different malicious control instruction detection methods can be more objectively compared and analyzed.

[0136] Furthermore, the evaluation results are obtained by calculating the accuracy, recall, precision and F1 score according to the following formula:

[0137] Z=ξ1×ln(Precision+1)+ξ2×ln(Recall+1)+ξ3×ln(Accuracy+1)+ξ4×ln(F1+1)(9)

[0138] Where Z is the performance evaluation result, Precision represents accuracy, Recall represents recall, Accuracy represents precision, F1 represents the F1 score, and ξ1, ξ2, ξ3, and ξ4 are the weights of the corresponding indicators, satisfying ξ1 + ξ2 + ξ3 + ξ4 = 1. This embodiment of the present invention places equal emphasis on precision, recall, accuracy, and F1 score, so the weights are all set to 0.25.

[0139] Combine Figure 5 As shown, the test set consists of 284 benign control instruction data instances. Of these, 208 were accurately detected and 75 were misclassified. Furthermore, there were 10,686 malicious control instruction data instances, of which 10,665 were correctly identified and only 21 were misclassified. This demonstrates that the method provided by the embodiments of the present invention can improve the detection efficiency of malicious control instructions.

[0140] S5. Adjust the parameters of the feature extraction model according to the loss function and the evaluation result, wherein the parameters include at least one of the following: pooling rate, number of layers, number of channels, and number of hidden neurons.

[0141] When training a hybrid model, this embodiment of the present invention removes the hash values ​​corresponding to the first column of the API call sequence in Table 1 and adds the labels corresponding to the API call sequence in the last column. Label values ​​are limited to 0 and 1, where 0 represents a benign sample and 1 represents a malicious sample. The required data is from t_0 to t_99. For each row, the value at index 99 is extracted and mapped to the label of each sample to construct the dataset.

[0142] 80% of the rows in the dataset were selected as the training set for the hybrid model, and 20% of the rows were selected as the validation set. In the experiment, one epoch refers to the time the model has learned all training examples from the entire training dataset. This embodiment of the present invention trained each model using 140 epochs, and recorded the F1 score for each epoch to ultimately determine the optimal model.

[0143] Specifically, the parameters of the malicious control command detection model are adjusted according to the loss function and evaluation results, including the following:

[0144] The comprehensive index value is calculated according to the loss function and evaluation results according to the following formula;

[0145] Q = α × e lnL +β×(1-e lnZ ) (10)

[0146] Among them, Q represents the comprehensive index value, L is the loss value of the malicious control instruction monitoring model, which is calculated by the loss function, Z is the evaluation result of the malicious control instruction detection model performance, α and β are weight coefficients, which are non-negative numbers.

[0147] When Q is greater than the tuning threshold, the parameters of the malicious control instruction detection model are tuned.

[0148] Optionally, the tuning threshold is 0.45, the weight value range is [0, 1], and α+β=1 is satisfied. The present invention attaches equal importance to the loss function and the performance evaluation result, and sets α=0.5 and β=0.5.

[0149] Furthermore, when Q is less than 0.45, the malicious control instruction detection model can meet the performance requirements, and can still be further optimized to make Q smaller and obtain better parameters.

[0150] It should be noted that those skilled in the art can set the weight value and the tuning threshold according to actual applications, and the embodiment of the present invention does not limit the specific values ​​of the weight value and the tuning threshold.

[0151] More specifically, the backpropagation algorithm is used to calculate the gradient of the loss function with respect to each parameter. Backpropagation uses the chain rule to pass the gradient of the loss value to the output layer by layer, and finally obtains the gradient of each parameter. The gradient descent method is used to update the model parameters according to the calculated gradient:

[0152]

[0153] Among them, θ is the model parameter, η is the learning rate, is the gradient of the loss function with respect to the parameters.

[0154] Furthermore, when Q is greater than 0.45, the parameters of the malicious control command detection model are tuned as follows:

[0155] Adjust the pooling rate: a. Try different pooling rates (2x2, 3x3, etc.). A larger pooling rate can reduce the size of the feature map faster, but may lose important information. b. Experiment with different pooling layer positions: Try adding a pooling layer after different convolutional layers to observe the impact on model performance.

[0156] Adjust the number of layers: Gradually increase the number of layers: Start with fewer layers and gradually increase the number of layers (such as from 2 layers to 5 layers).

[0157] Adjust the number of channels: The number of channels determines the ability of each layer to extract features. Increasing the number of channels can improve the expressiveness of the model. Gradually increase the number of channels in the convolutional layer (from 32 to 64, 128).

[0158] Adjust the number of hidden neurons: a. Gradually increase the number of hidden neurons: Start with a smaller number of hidden neurons (such as 32 or 64) and gradually increase it to 128 or 256. b. Try different activation functions in the hidden layer (such as ReLU, Leaky ReLU, tanh, etc.) to improve the model's nonlinear expression capabilities. The number of neurons in the hidden layer determines the model's complexity and learning ability.

[0159] Draw as Figure 6 Learning curve: Record training and validation loss, accuracy and other indicators, draw a learning curve to help analyze whether the model is overfitting or underfitting.

[0160] Find the optimal network structure by adjusting the pooling rate, number of layers, number of channels, and number of hidden neurons. For example, you can increase the number of layers while appropriately reducing the number of channels per layer to maintain computational efficiency. Figure 6 It shows the loss and accuracy impact during training. The larger the parameters, the more computing resources are consumed, but it has little effect on improving the F1 score and may even cause performance degradation.

[0161] The experimental results show that the CNN-LSTM model achieves superior evaluation metrics for malicious control command detection compared to the other two detection models. In terms of accuracy, the CNN-LSTM model achieves improvements of 24% and 22% compared to the CNN and LSTM models, respectively. In terms of F1 score, the CNN-LSTM model outperforms the other models by at least 16% and 14%. The comparison results for the different models are shown in Table 2. This means that the CNN-LSTM hybrid model proposed in this chapter performs better in malicious control command detection.

[0162] Table 2

[0163]

[0164]

[0165] Embodiment 2 of the present invention provides a malicious control instruction detection system, which runs the malicious control instruction detection method based on the CNN-LSTM hybrid model described in Embodiment 1. The system includes:

[0166] An acquisition module, used to acquire multiple API call sequences generated when the control instruction to be detected is executed in the distribution network communication network software;

[0167] An encryption module, used to encrypt multiple API call sequences into hash values ​​using a hash algorithm to obtain multiple encrypted API call sequences;

[0168] A detection module is used to input multiple encrypted API call sequences into a pre-built malicious control instruction detection model, and output whether the control instruction to be detected is a malicious control instruction; the malicious control instruction detection model is a hybrid model constructed based on CNN and LSTM, and the malicious control instruction detection model is obtained through machine learning training using multiple groups of data, and the multiple groups of data include a first category of data and a second category of data. Each group of data in the first category of data includes an encrypted API call sequence of an API call sequence generated when a malicious control instruction is executed in the distribution network communication network software, and each group of data in the second category of data includes an encrypted API call sequence of an API call sequence generated when a benign control instruction is executed in the distribution network communication network software.

[0169] Embodiment 3 of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the malicious control instruction detection method based on the CNN-LSTM hybrid model described in embodiment 1 is implemented.

[0170] Embodiment 4 of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the malicious control instruction detection method based on the CNN-LSTM hybrid model described in embodiment 1.

[0171] Compared with the prior art, the beneficial effects of the present invention include at least:

[0172] A method for detecting malicious control instructions in distribution network communication network is proposed, and the efficiency of the method is confirmed through data analysis and comparison.

[0173] Compared with the existing malicious control instruction detection method, the original detection method has the problem that the malicious control instruction samples are scarce and variable, and the distribution of positive and negative samples is extremely unbalanced, which makes it difficult to learn and train the model, making it difficult to judge malicious control instructions. The detection method proposed by the present invention finds the key information for identifying malicious control instructions - API call sequence. Since these data are generated by the behavior of the control instruction itself, it is difficult to confuse them. Therefore, the present invention uses the API call sequence extracted from the Cuckoo Sandbox report as the data set for effective malicious control instruction detection, overcoming the problems of the original method such as small number of samples, difficulty in training and overfitting.

[0174] Compared with existing methods, the present invention proposes a detection method using a CNN-LSTM hybrid model. The CNN-LSTM hybrid model can process different parts of the input data simultaneously, facilitating the simultaneous extraction and integration of data features. It can capture information related to various aspects of the data generated by the execution of control instructions, significantly improving computational efficiency and accelerating the model training and inference process. Specifically, compared with other models, the CNN-LSTM hybrid model achieved an improvement in accuracy of 24% and 22%, respectively, and an improvement in F1 score of at least 16% and 14%. These results demonstrate the effectiveness of the model proposed in the embodiments of the present invention in enhancing the ability to detect malicious control instructions.

[0175] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0176] The present disclosure may be a system, method and / or computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0177] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0178] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0179] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., utilizing an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions. The electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. A malicious control instruction detection method based on a CNN-LSTM hybrid model, applied to a distribution network communication network, characterized in that: include: Obtain multiple API call sequences generated when the control instruction to be detected is executed in the distribution network communication network software; Use a hash algorithm to encrypt multiple API call sequences into hash values ​​to obtain multiple encrypted API call sequences; Input multiple encrypted API call sequences into a pre-built malicious control instruction detection model, and output whether the control instruction to be detected is a malicious control instruction; the malicious control instruction detection model is a hybrid model constructed based on CNN and LSTM, and the malicious control instruction detection model is obtained through machine learning training using multiple sets of data, and the multiple sets of data include a first type of data and a second type of data, each set of data in the first type of data includes an encrypted API call sequence of an API call sequence generated when a malicious control instruction is executed in the distribution network communication network software, and each set of data in the second type of data includes an encrypted API call sequence of an API call sequence generated when a benign control instruction is executed in the distribution network communication network software; Building a hybrid model based on CNN and LSTM involves: Select an API call sequence from the encrypted API call sequence as an input sequence; Construct a CNN model, which includes convolutional layers and pooling layers. Input the input sequence into the CNN model and process it through the convolutional layers and pooling layers in turn. Build an LSTM model, input the output of the pooling layer into the LSTM model, and input the output of the LSTM model into the fully connected layer; Establishing an output layer for outputting characteristic data related to malicious control instructions, including the network communication destination of the control instruction, the target path of the control instruction operation, and the behavior pattern of the control instruction; A classification layer is established, and the feature data output by the output layer is input into the classification layer. The classification layer outputs whether the control instruction to be detected is a malicious control instruction, completing the construction of the hybrid model based on CNN and LSTM.

2. The malicious control instruction detection method based on the CNN-LSTM hybrid model according to claim 1 is characterized in that: The plurality of API call sequences includes first 100 non-repeating consecutive API call sequences associated with a parent process of the called API.

3. The malicious control instruction detection method based on the CNN-LSTM hybrid model according to claim 1 is characterized in that: The CNN model also includes: Embedding layer, used to reduce the dimensionality of the input sequence; Batch normalization is done on one layer, connected to the embedding layer, to normalize the data output by the embedding layer to a preset range, and then the normalized data is input to the convolutional layer.

4. The malicious control instruction detection method based on the CNN-LSTM hybrid model according to claim 1 is characterized in that: In the classification layer, the Sigmoid function is used to output the probability that the control instruction to be detected is a malicious control instruction based on the feature data.

5. The malicious control instruction detection method based on the CNN-LSTM hybrid model according to claim 4 is characterized in that: The method further comprises: Evaluate the performance of the malicious control instruction detection model and obtain the evaluation results Parameters of the malicious control instruction detection model are adjusted according to the loss function and the evaluation results, where the parameters include at least one of the following: pooling rate, number of layers, number of channels, and number of hidden neurons.

6. The malicious control instruction detection method based on the CNN-LSTM hybrid model according to claim 5 is characterized in that: The performance evaluation of the malicious control command detection model includes: A confusion matrix is ​​used to calculate based on the output of the malicious control instruction detection model, where the rows of the confusion matrix represent the actual categories, and the columns represent the categories output by the malicious control instruction detection model. The confusion matrix includes four cells, each cell corresponding to a preset category, and the preset categories include true positive, false positive, false negative, and true negative. The value in each cell represents the number of times the malicious control instruction detection model predicted the actual category as the preset category; Calculate the evaluation results based on the confusion matrix.

7. The malicious control instruction detection method based on the CNN-LSTM hybrid model according to claim 5 or 6 is characterized in that: Adjust the parameters of the malicious control command detection model based on the loss function and evaluation results, including: The comprehensive index value is calculated according to the loss function and evaluation results according to the following formula; Q=α×e lnL +β×(1-e lnZ ) Where Q represents the comprehensive index value, L is the loss value of the malicious control instruction monitoring model, which is calculated by the loss function, Z is the evaluation result of the malicious control instruction detection model performance, α and β are weight coefficients, which are non-negative numbers; When Q is greater than the tuning threshold, the parameters of the malicious control instruction detection model are tuned.

8. A malicious control instruction detection system using the malicious control instruction detection method based on the CNN-LSTM hybrid model according to any one of claims 1 to 7, characterized in that: include: An acquisition module, used to acquire multiple API call sequences generated when the control instruction to be detected is executed in the distribution network communication network software; An encryption module, used to encrypt multiple API call sequences into hash values ​​using a hash algorithm to obtain multiple encrypted API call sequences; A detection module is used to input multiple encrypted API call sequences into a pre-built malicious control instruction detection model, and output whether the control instruction to be detected is a malicious control instruction; the malicious control instruction detection model is a hybrid model constructed based on CNN and LSTM, and the malicious control instruction detection model is obtained through machine learning training using multiple groups of data, and the multiple groups of data include a first category of data and a second category of data. Each group of data in the first category of data includes an API call sequence generated when a malicious control instruction is executed in the distribution network communication network software, and each group of data in the second category of data includes an API call sequence generated when a benign control instruction is executed in the distribution network communication network software.

9. An electronic device comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instruction to execute the steps of the malicious control instruction detection method based on the CNN-LSTM hybrid model according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the malicious control instruction detection method based on the CNN-LSTM hybrid model described in any one of claims 1 to 7 are implemented.

Images