Program detection method and device, computer equipment and storage medium

Abstract

The embodiment of the invention provides a program detection method and device, computer equipment and a storage medium, relates to the technical field of computers, and can be applied to the financial field or other technical fields. The method comprises the steps of obtaining a multi-dimensional feature vector of a to-be-detected program according to an API sequence and a traffic sequence of the to-be-detected program during operation; the multi-dimensional feature vector is input into a preset encoder model, the safety of the to-be-detected program is judged, the preset encoder model has a classification function, and the training process of the preset encoder model comprises unsupervised training and supervised fine adjustment. According to the application, feature extraction and feature fusion are performed on the API calling sequence and the flow sequence of the to-be-detected program in the running process, and the multi-dimensional feature value of the to-be-detected program is constructed, so that the running features of the to-be-detected program can be more accurately described by the multi-dimensional feature value; and in combination with the characteristic that the deep learning network can learn behavior types of more malicious programs, full-range and high-precision detection of the programs is realized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a program detection method, apparatus, computer equipment and storage medium. Background Art

[0002] With the rapid development of the digital economy, malicious programs have gradually become a serious threat that is highly harmful and difficult to avoid. They can cause significant economic losses by attacking important systems of companies or institutions, encrypting important customer data, and other means. The current security detection of malicious programs is mainly classified by program behavior, including master boot record, data destruction, encrypted files, and stolen files.

[0003] Common malware designs complex encryption algorithms to encrypt the files or information of the attacked party, thereby stealing files and threatening the data security of the attacked party. The program security detection solution combines the attack characteristics of programs with lower security to perform security detection on the program. The detected behavior categories are relatively single, and as the behavior categories of the programs change, it is difficult to identify malicious programs, resulting in low detection accuracy. Summary of the invention

[0004] The embodiments of the present application provide a program detection method, apparatus, computer device, and storage medium for realizing high-precision and wide-range detection of programs with low security.

[0005] In a first aspect, an embodiment of the present application provides a program detection method, comprising:

[0006] Extract the API call information of the program to be tested during runtime and obtain the API sequence;

[0007] Extract the network traffic information of the program to be detected when it is running and obtain the traffic sequence;

[0008] According to the API sequence and traffic sequence, a multi-dimensional feature vector of the program to be detected is obtained;

[0009] The multidimensional feature vector is input into a preset encoder model to judge the security of the program to be detected. The preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning.

[0010] In a possible implementation, extracting API call information of the program to be detected during runtime to obtain an API sequence includes:

[0011] Obtain the API call information of the program to be detected when it runs within a preset time period, and obtain the initial API sequence;

[0012] When the length of the initial API sequence is less than the preset length, the missing bits in the initial API sequence are filled to obtain an API sequence;

[0013] When the length of the initial API sequence is greater than the preset length, the initial API sequence is intercepted according to the preset length to obtain an API sequence.

[0014] In a possible implementation, a multi-dimensional feature vector of the program to be detected is obtained according to the API sequence and the traffic sequence, including:

[0015] Taking each API in the API sequence as an input, input it into the first feature extraction model to obtain an API feature vector;

[0016] Each type of information in the traffic sequence is used as an input to the second feature extraction model to obtain a traffic feature vector;

[0017] The API feature vector and the traffic feature vector are combined to obtain a multi-dimensional feature vector of the program to be detected.

[0018] In a possible implementation, the traffic sequence includes one or more of protocol information, domain name information, timestamp information, destination IP address information, port information, and URL information during transmission.

[0019] In a possible implementation, the preset encoder model includes a coding module and a classification module; and the training process of the preset encoder model includes:

[0020] Obtaining a sample database, the sample database includes a multidimensional feature vector and a true classification value corresponding to each original sample;

[0021] Add random noise to each original sample and input it into the encoding and decoding module to obtain the reconstructed data corresponding to each original sample;

[0022] Adjusting the weight parameters of the encoding and decoding module according to a first loss function between the reconstructed data of each original sample and the original sample;

[0023] Input the reconstructed data of each original sample into the classification module to obtain the predicted classification value of each original sample;

[0024] According to a second loss function between the predicted classification value and the true classification value of each original sample, the model parameters of the preset encoder model are adjusted.

[0025] In a possible implementation, the training process further includes:

[0026] Determine the predicted classification results of all original samples in the sample database based on the trained preset encoder model;

[0027] Determine the evaluation index of the trained preset encoder model based on the predicted classification results and the actual classification results of all original samples;

[0028] When the evaluation index of the trained preset encoder model meets the preset conditions, the classification detection result of the program to be detected is determined according to the trained preset encoder model.

[0029] In a possible implementation, the evaluation index includes one or more of a true positive rate, a false positive rate, a precision rate, an accuracy rate, and a performance score;

[0030] Among them, the true positive rate indicates the proportion of positive samples detected by the model as true; the false positive rate indicates the proportion of negative samples detected by the model as false; the precision rate indicates the proportion of samples detected by the model as true that are actually true; the accuracy rate indicates the proportion of all samples that can be correctly identified as false or true; the performance score is used to measure the overall detection performance of the model.

[0031] In a second aspect, an embodiment of the present application provides a program detection device, including:

[0032] The first extraction module is used to extract the API call information of the program to be detected when it is running, and obtain the API sequence;

[0033] The second extraction module is used to extract the network traffic information of the program to be detected when it is running, and obtain the traffic sequence;

[0034] The feature representation module is used to obtain a multi-dimensional feature vector of the program to be detected based on the API sequence and the traffic sequence;

[0035] The result detection module is used to input the multi-dimensional feature vector into a preset encoder model to determine the security of the program to be detected. The preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning.

[0036] In a third aspect, an embodiment of the present application provides a computer device, including: a memory, a processor;

[0037] Memory stores computer-executable instructions;

[0038] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementations of the first aspect.

[0040] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0041] The program detection method, device, computer equipment and storage medium provided in the embodiments of the present application extract the API call information of the program to be detected during operation to obtain an API sequence; extract the network traffic information of the program to be detected during operation to obtain a traffic sequence; obtain a multi-dimensional feature vector of the program to be detected based on the API sequence and the traffic sequence; input the multi-dimensional feature vector into a preset encoder model to judge the security of the program to be detected. The preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning. The present application constructs a multi-dimensional feature value of the program to be detected by extracting and fusing features of the API call sequence and traffic sequence of the program to be detected during operation. The multi-dimensional feature value can more accurately describe the operating characteristics of the program to be detected, and combined with the characteristics of the deep learning network that can learn more types of malicious program behaviors, it can achieve full-range and high-precision detection of the program. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0043] Figure 1 A schematic diagram of a scenario of a program detection method provided in this application;

[0044] Figure 2 A schematic diagram of a program detection method provided in one embodiment of the present application Figure 1 ;

[0045] Figure 3 A schematic diagram of a program detection method provided in one embodiment of the present application Figure 2 ;

[0046] Figure 4 A structural diagram of a feature representation network model provided in one embodiment of the present application;

[0047] Figure 5 A network structure diagram of a preset encoder model provided in one embodiment of the present application;

[0048] Figure 6 A schematic diagram of a program detection method provided in one embodiment of the present application Figure 3 ;

[0049] Figure 7A schematic diagram of the structure of a program detection device provided in one embodiment of the present application;

[0050] Figure 8 A schematic diagram of the structure of a computer device provided in one embodiment of the present application.

[0051] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0052] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0053] In the description of the embodiments of the present application, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0054] With the rapid development of the digital economy, malicious programs have gradually become a serious threat that is highly harmful and difficult to avoid. They can cause significant economic losses by attacking important systems of companies or institutions, encrypting important customer data, and other means. The current security detection of malicious programs is mainly classified by program behavior, including master boot record, data destruction, encrypted files, and stolen files.

[0055] At the same time, with the development of enterprise cloud applications, a large number of system workloads have been moved from traditional data centers to the cloud, which has improved ease of use, but also increased the risk of attacks. Many malicious programs use AI technology to identify vulnerabilities, automatically write various phishing emails, and use encryption, evasion and other detection technologies to greatly improve the success rate of attacks. Once a cloud application is attacked by a malicious program, the system applications of multiple containers in the cloud environment will be attacked, causing significant losses.

[0056] Therefore, conducting research in the field of malicious program detection and designing fast and high-precision detection solutions are of great significance for ensuring the stable operation of software systems of individuals or corporate organizations. Common detection solutions mainly include static feature detection, dynamic sandbox detection, honeypot triggering, network behavior analysis, file behavior analysis, etc. Static feature detection is to analyze the static features of the program without running the program to achieve detection, mainly by analyzing features such as byte sequences and performing byte matching. Dynamic sandbox detection is to run the software in a virtual environment and monitor dynamic behavior to achieve judgment. Honeypot triggering is to set up a false high-value target in a real environment to attract malicious programs. If the program chooses to attack the high-value target, the program is judged to be dangerous. Network traffic analysis is to analyze the features of the program's network data packets to extract and detect them. The specific features include port numbers, communication protocols, etc. File behavior analysis is to extract features by analyzing the various file operation behaviors of malicious programs for detection.

[0057] With the continuous development of deep learning theory and AI technology, and its wide application in multiple detection fields, it has attracted widespread attention from many researchers and scholars. Designing program detection solutions based on deep learning models has gotten rid of the traditional solutions' dependence on program feature rule libraries, improved detection progress and stability, and can effectively achieve detection.

[0058] In the related art, a bait file is placed on an operating system with malware. Once the system detects that data writing and name changing operations have been performed on the bait file, the program corresponding to the process is determined to be a malicious program. The advantage of this solution is that the time point when the system places the bait file is active and dynamic. When the system detects that the file list traversal operation is triggered, the bait file is placed, which improves the effectiveness and accuracy of the detection scheme. However, this solution has the following disadvantages: 1. The category of malicious programs detected is single. This solution can only detect malicious programs such as file information theft. When the program performs a write operation or a name change operation on the file, it is judged that such a program is a malicious program. It is difficult to resist other types of ransomware threats. 2. The detection conditions have limitations. The feature of this solution is that the bait file is placed, and the system monitors the status of the bait file. Once it is detected that the bait file is written or renamed, the judgment condition will be triggered. If the malicious program does not operate on the bait file, it is difficult for the system to determine that the software is a malicious program, resulting in a long detection cycle and poor detection capability and real-time performance.

[0059] Based on the above technical problems, the present application embodiment provides a program detection method with a wide recognition range and high accuracy, which is applied to Figure 1In the application environment shown. Among them, the terminal 102 is used to obtain the operation data of the program to be detected during operation. The terminal 102 communicates with the server 104 through the network, sends the acquired operation data to the server 104, and the server 104 processes and analyzes the operation data to realize the security identification of the program to be detected. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers.

[0060] The terminal may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0061] In one embodiment, Figure 2 As shown, a program detection method is provided, which is applied to Figure 1 Taking the server 104 in the example as an example, the method includes the following steps:

[0062] Step 202, extracting API call information of the program to be detected during runtime to obtain an API sequence;

[0063] Step 204, extracting network traffic information of the program to be detected when it is running, and obtaining a traffic sequence;

[0064] Step 206, obtaining a multi-dimensional feature vector of the program to be detected according to the API sequence and the traffic sequence;

[0065] Step 208, input the multi-dimensional feature vector into a preset encoder model to determine the security of the program to be detected, the preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning.

[0066] Among them, the API interface during software runtime is the channel for the application to interact with the operating system. In order to realize resource calls and function operation, the program will access the API interface set by the Linux, Windows and other operating systems. The API sequence is a sequence composed of a series of APIs called by the software program to realize specific functions, which can reflect the behavioral characteristics of the program. During the operation, the malicious program executes a certain number of specific APIs or system operation commands to achieve malicious purposes. For example, in the attack behavior of the malicious program, the most critical step is the encryption and locking operation of the system files, so before the encryption and locking operation, it will frequently call APIs such as file scanning, file copying and key generation. The sequence composed of its call operations will be significantly different from the call sequence of the benign program at the same time, and it has characteristics and regularity. At the same time, on different systems, although the types and names of APIs are different, the functions are very different. It is known that the sequence characteristics of the same function have certain similarities, such as the API sequence characteristics of DARKSIDE in Linux environment and Windows environment.

[0067] In addition, malicious programs will continuously request the network to communicate and transmit data with attackers or attack systems during operation. The data packets carried during transmission are also different from those of benign programs when accessing the network. Based on such traffic characteristics, traffic capture tools such as Libpcap and Wireshark are used to capture and analyze network traffic packets, which can extract network traffic information during transmission, form a traffic sequence, and characterize the traffic data characteristics of the program to be detected.

[0068] For example, when the program to be detected is running, a traffic collection program is designed using code libraries such as Libpcap to capture and analyze the data packets when the program to be detected is running. Under normal circumstances, when a data packet is to be sent or arrives, the operating system will first put the data packet in the kernel buffer and wait for the interface to be ready before processing it. During this period, the data packet can be extracted through the traffic collection program, unpacked and analyzed, and features such as protocol information, IP address and port information, domain name information, and traffic data information can be obtained, and the data packet can be represented as a traffic sequence.

[0069] In one embodiment, a running environment is deployed in a sandbox environment, and multiple types of data files are placed in it, including document data, table data, and binary data. In this environment, the program to be tested is run, and the API call information of the program to be tested during runtime is extracted to obtain an API sequence, which specifically includes:

[0070] Obtain the API call information of the program to be detected when it runs within a preset time period, and obtain the initial API sequence;

[0071] When the length of the initial API sequence is less than the preset length, the missing bits in the initial API sequence are filled to obtain an API sequence;

[0072] When the length of the initial API sequence is greater than the preset length, the initial API sequence is intercepted according to the preset length to obtain an API sequence.

[0073] The preset duration refers to the duration of data collection for the program to be tested. The preset duration needs to be set to ensure that the running characteristics of the program to be tested can be fully obtained, that is, the API data called after the program to be tested runs within the preset duration is representative. For example, the API data called within 3 to 5 seconds after the program to be tested runs can be collected as API call information to generate an API sequence.

[0074] The preset length refers to the set length of the API sequence. When generating an API sequence based on API call information, the initial API sequence refers to the most initial sequence generated based on the API call information. Since the number of APIs called by each program to be tested will be different, and the number of API call information obtained within different preset time lengths will also be different, the length of the initial API sequence of each program to be tested will also be different. However, the API sequence needs to be generated as a feature vector through model processing and traffic sequence. In order to ensure the accuracy of the model input and processing results, the length of the API sequence needs to be limited. By presetting the length, the initial API sequence is padded when it is less than the preset length, and it is truncated when the length of the initial API sequence is greater than the preset length.

[0075] The missing bits can be filled with fixed data, such as filling the missing bits with 0; the missing bits can also be filled with fixed format data, such as filling the initial API sequence with a sequence of 12345... In addition, the built-in sequence type method can be used to intercept the API sequence. For example, use the slice operator, itertools.islice.

[0076] By limiting the collection time and sequence length, the consistency and effectiveness of the API sequence can be ensured, the output accuracy and effectiveness of the multi-dimensional feature vector can be improved, and the accuracy and timeliness of the program security testing results can be guaranteed.

[0077] In the embodiment of the present application, the API sequence and the traffic sequence can be characterized by the Word2vec scheme to obtain a multi-dimensional feature vector of the program to be detected. Word2vec is a neural network model used to represent word vectors in natural language processing. It is used to mine semantic information in language and project semantic relationships into a multi-dimensional vector space. Each word in the language text can be represented by a K-dimensional vector. There are mainly two schemes, the CBOW model and the Skip-Gram model. The CBOW model predicts the target word based on the context of the text to train the word vector, while the Skip-Gram model predicts the text context based on the target word to train the word vector.

[0078] In one embodiment, Figure 3 As shown, according to the API sequence and traffic sequence, a multi-dimensional feature vector of the program to be detected is obtained, including:

[0079] Step 302, taking each API in the API sequence as an input and inputting it into a first feature extraction model to obtain an API feature vector;

[0080] Step 304, taking each type of information in the traffic sequence as an input and inputting it into the second feature extraction model to obtain a traffic feature vector;

[0081] Step 306: merge the API feature vector and the traffic feature vector to obtain a multi-dimensional feature vector of the program to be detected.

[0082] The API sequence includes multiple APIs, and the traffic sequence includes one or more of the protocol information, domain name information, timestamp information, destination IP address information, port information, and URL information during transmission. The first feature extraction model and the second feature extraction model are used to represent the sequence in a high-dimensional space, and then merge the API feature vector and the traffic feature vector into a multi-dimensional feature vector as the input of the preset encoder model.

[0083] For example, the CBOW model is used for feature extraction and representation. Figure 4 As shown in the figure, each API in the API sequence and each piece of information in the traffic sequence are input into the CBOW model, and the output is a feature vector that the model can recognize. After synthesis, a multi-dimensional feature vector is obtained. The CBOW model uses word embedding to set the window value of the central word and the word vector dimension value. After continuous training, the sequence is projected into a multi-dimensional space, and the output is used for classification detection of subsequent models.

[0084] The feature extraction model is used to extract and represent the features of API sequences and traffic sequences, and output feature vectors that can be recognized by the preset encoder model; and the API features and traffic features can be mapped into multi-dimensional vectors to obtain richer features.

[0085] The preset encoder model is used for training and classification detection, the encoder network is used for compressing data, and the decoder network is used for dimensional data upgrading. After subsequent supervised fine-tuning, malicious program detection is achieved. The overall structure of the preset encoder model proposed in this embodiment includes an encoder network and a decoder network. The structure can be as follows: Figure 5 As shown in the figure, the encoder network and decoder network are composed of multi-layer convolutional networks, pooling networks and neural networks. At the same time, in order to enable the preset encoder model to have the function of classifying samples, the intermediate layer output is extracted, and supervised fine-tuning is performed to achieve classification detection.

[0086] In the method provided in the above embodiment, the API call information of the program to be detected during operation is extracted to obtain an API sequence; the network traffic information of the program to be detected during operation is extracted to obtain a traffic sequence; based on the API sequence and the traffic sequence, a multi-dimensional feature vector of the program to be detected is obtained; the multi-dimensional feature vector is input into a preset encoder model to judge the security of the program to be detected, the preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning. The present application constructs a multi-dimensional feature value of the program to be detected by extracting and fusing features of the API call sequence and the traffic sequence of the program to be detected during operation. The multi-dimensional feature value can more accurately describe the operating characteristics of the program to be detected, and combined with the characteristics of the deep learning network that can learn more types of behavior of malicious programs, it can achieve full-range and high-precision detection of the program.

[0087] In one embodiment, if Figure 6 As shown, the preset encoder model includes a coding module and a classification module; the training process of the preset encoder model includes:

[0088] Step 602, obtaining a sample database, the sample database including a multi-dimensional feature vector and a true classification value corresponding to each original sample;

[0089] Step 604, adding random noise to each original sample and inputting the resultant sample into a coding / decoding module to obtain reconstructed data corresponding to each original sample;

[0090] Step 606, adjusting the weight parameters of the encoding and decoding module according to the first loss function between the reconstructed data of each original sample and the original sample;

[0091] Step 608, inputting the reconstructed data of each original sample into the classification module to obtain the predicted classification value of each original sample;

[0092] Step 610: Adjust model parameters of the preset encoder model according to a second loss function between the predicted classification value and the true classification value of each original sample.

[0093] The sample database consists of identified malicious programs and benign programs, each of which is a sample, including the sample's multi-dimensional feature vector, true classification value, and true classification result. The training of the preset encoder model is completed based on the sample database.

[0094] The training of the preset encoder model includes two stages. The first stage is unsupervised pre-training, and the second stage is supervised fine-tuning. Among them, the unsupervised pre-training mainly trains the weight parameters of the encoder and decoder modules. The encoder and decoder modules include encoder networks and decoder networks. The first stage process includes:

[0095] S01, randomly initialize parameters and add a certain amount of noise to each original input sample. Here, the original input sample is represented as x, and the sample after adding noise is represented as x^;

[0096] S02, pass the noise sample x^ into the encoder network to obtain the hidden layer output, where the output is represented by h;

[0097] S03, input the hidden layer output h into the decoder network to obtain the reconstructed data y;

[0098] S04. Define the loss function between the original sample and the reconstructed data, and use the mean square error loss function MSE. The loss function is shown in the following formula. Continuously tune and update the weight parameters of the encoder network.

[0099] ;

[0100] S05. Perform steps S02 to S04 in sequence until the loss function value is optimal, thus achieving unsupervised training.

[0101] The second phase process includes:

[0102] S11, input each original sample into a preset encoder model, that is, a model including a classification network, and output a predicted classification value of each original sample;

[0103] S12. Define the loss function between the predicted classification value and the true classification value, use the mean square error loss function to calculate the error, perform fine-tuning training, and realize parameter updating and classification detection of new samples in the later stage.

[0104] In the method provided in the above embodiment, by adopting a deep learning model to achieve the security classification result of the program to be detected, the training phase and the detection phase of the detection model of the program to be detected are made simpler and faster, and the applicability of program security detection in different scenarios is higher. And the training process of the preset encoder model provided in this application includes unsupervised training and supervised fine-tuning, which improves the detection accuracy of the model and improves the robustness of the model.

[0105] In one embodiment, the training process further includes:

[0106] Determine the predicted classification results of all original samples in the sample database based on the trained preset encoder model;

[0107] Determine the evaluation index of the trained preset encoder model based on the predicted classification results and the actual classification results of all original samples;

[0108] When the evaluation index of the trained preset encoder model meets the preset conditions, the classification detection result of the program to be detected is determined according to the trained preset encoder model.

[0109] The predicted classification result is determined by the predicted classification value to determine whether the sample is a malicious program. The evaluation index is used to evaluate the evaluation accuracy of the preset encoder model. The evaluation index is calculated through the predicted classification results and the actual classification results of all original samples in the sample database to measure the training effect of the preset encoder model. Only when the evaluation index of the preset encoder model meets the preset conditions, it means that the trained preset encoder model can accurately detect the program to be detected and determine whether it is a malicious program.

[0110] Specifically, the evaluation indicators include one or more of the true positive rate (TPR), false positive rate (FPR), precision, accuracy and performance score (F-score); among them, the true positive rate indicates the proportion of positive samples detected by the model as true; the false positive rate indicates the proportion of negative samples detected by the model as false; the precision rate indicates the proportion of samples detected by the model as true that are actually true; the accuracy rate indicates the proportion of all samples that can be correctly identified as false or true; the performance score is used to measure the overall detection performance of the model.

[0111] The above evaluation indicators are determined by statistically analyzing the prediction conditions of all original samples in the sample database. For example, the following evaluation parameters are set and the evaluation indicators are determined according to the following evaluation parameters.

[0112] Table 1 Evaluation parameters

[0113]

[0114] The calculation formula of the evaluation index is:

[0115] ;

[0116] ;

[0117] ;

[0118] ;

[0119] ;

[0120] Among the above evaluation indicators, the closer the values ​​of Precision, Accuracy, and F1 score are to 1, the more accurate and stable the model detection accuracy is.

[0121] In the method provided in the above embodiment, the training effect of the preset encoder model is detected by setting evaluation indicators, and a model with accurate and stable detection accuracy is used to detect the program to be detected, thereby improving the detection effect.

[0122] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0123] Based on the same inventive concept, an embodiment of the present application also provides a program detection device. The implementation solution for solving the problem provided by the device is similar to the implementation solution recorded in the above method. Therefore, the specific limitations in one or more program detection device embodiments provided below can refer to the limitations on the program detection method above and will not be repeated here.

[0124] In one embodiment, Figure 7 As shown, the program detection device includes a first extraction module 701, a second extraction module 702, a feature representation module 703 and a result detection module 704, wherein:

[0125] The first extraction module 701 is used to extract the API call information of the program to be detected when it is running, and obtain an API sequence;

[0126] The second extraction module 702 is used to extract the network traffic information of the program to be detected when it is running, and obtain the traffic sequence;

[0127] The feature representation module 703 is used to obtain a multi-dimensional feature vector of the program to be detected according to the API sequence and the traffic sequence;

[0128] The result detection module 704 is used to input the multi-dimensional feature vector into the preset encoder model to determine the security of the program to be detected. The preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning.

[0129] In one possible embodiment, the first extraction module 701 is further used for:

[0130] Obtain the API call information of the program to be detected when it runs within a preset time period, and obtain the initial API sequence;

[0131] When the length of the initial API sequence is less than the preset length, the missing bits in the initial API sequence are filled to obtain an API sequence;

[0132] When the length of the initial API sequence is greater than the preset length, the initial API sequence is intercepted according to the preset length to obtain an API sequence.

[0133] In one possible embodiment, the feature representation module 703 is further used for:

[0134] Taking each API in the API sequence as an input, input it into the first feature extraction model to obtain an API feature vector;

[0135] Each type of information in the traffic sequence is used as an input to the second feature extraction model to obtain a traffic feature vector;

[0136] The API feature vector and the traffic feature vector are combined to obtain a multi-dimensional feature vector of the program to be detected.

[0137] In one possible embodiment, the second providing module 702 is further used to determine that the traffic sequence includes one or more of the protocol information, domain name information, timestamp information, destination IP address information, port information and URL information during transmission.

[0138] In one possible embodiment, the program detection device further includes a model training module, and the model training module is used to:

[0139] Obtaining a sample database, the sample database includes a multidimensional feature vector and a true classification value corresponding to each original sample;

[0140] Add random noise to each original sample and input it into the encoding and decoding module to obtain the reconstructed data corresponding to each original sample;

[0141] Adjusting the weight parameters of the encoding and decoding module according to a first loss function between the reconstructed data of each original sample and the original sample;

[0142] Input the reconstructed data of each original sample into the classification module to obtain the predicted classification value of each original sample;

[0143] According to a second loss function between the predicted classification value and the true classification value of each original sample, the model parameters of the preset encoder model are adjusted.

[0144] In one possible embodiment, the model training module is also used to:

[0145] Determine the predicted classification results of all original samples in the sample database based on the trained preset encoder model;

[0146] Determine the evaluation index of the trained preset encoder model based on the predicted classification results and the actual classification results of all original samples;

[0147] When the evaluation index of the trained preset encoder model meets the preset conditions, the classification detection result of the program to be detected is determined according to the trained preset encoder model.

[0148] In one possible embodiment, the model training module is further used to determine that the evaluation indicators include one or more of true positive rate, false positive rate, precision rate, accuracy rate and performance score;

[0149] Among them, the true positive rate indicates the proportion of positive samples detected by the model as true; the false positive rate indicates the proportion of negative samples detected by the model as false; the precision rate indicates the proportion of samples detected by the model as true that are actually true; the accuracy rate indicates the proportion of all samples that can be correctly identified as false or true; the performance score is used to measure the overall detection performance of the model.

[0150] Each module in the above program detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0151] Figure 8 This is a schematic diagram of the structure of the computer device provided in this application. Figure 8As shown, the computer device 80 provided in this embodiment includes: at least one processor 801 and a memory 802. Optionally, the device 80 also includes a communication component 803. The processor 801, the memory 802 and the communication component 803 are connected via a bus 804.

[0152] In a specific implementation process, at least one processor 801 executes the computer-executable instructions stored in the memory 802, so that at least one processor 801 executes the above method.

[0153] The specific implementation process of the processor 801 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0154] In the above embodiments, it should be understood that the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly implemented as a hardware processor, or can be implemented by a combination of hardware and software modules in the processor.

[0155] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (NVM), such as at least one disk storage.

[0156] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0157] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0158] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0159] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0160] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist in the device as discrete components.

[0161] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0162] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0163] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0164] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0165] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0166] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A program detection method, characterized in that: The method comprises: Extract the API call information of the program to be tested during runtime and obtain the API sequence; Extracting network traffic information of the program to be detected when it is running to obtain a traffic sequence; Obtaining a multi-dimensional feature vector of the program to be detected according to the API sequence and the traffic sequence; The multidimensional feature vector is input into a preset encoder model to judge the security of the program to be detected, the preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning.

2. The method according to claim 1, characterized in that The step of extracting the API call information of the program to be detected during operation to obtain the API sequence includes: Obtain the API call information of the program to be detected when it runs within a preset time period, and obtain the initial API sequence; When the length of the initial API sequence is less than a preset length, filling the missing bits in the initial API sequence to obtain an API sequence; In the case that the length of the initial API sequence is greater than the preset length, the initial API sequence is intercepted according to the preset length to obtain an API sequence.

3. The method according to claim 1, characterized in that The step of obtaining a multi-dimensional feature vector of the program to be detected according to the API sequence and the traffic sequence includes: Taking each API in the API sequence as an input, inputting it into a first feature extraction model to obtain an API feature vector; Taking each type of information in the traffic sequence as an input, inputting it into a second feature extraction model to obtain a traffic feature vector; The API feature vector and the traffic feature vector are combined to obtain a multi-dimensional feature vector of the program to be detected.

4. The method according to any one of claims 1 or 3, characterized in that The traffic sequence includes one or more of the protocol information, domain name information, timestamp information, destination IP address information, port information and URL information during transmission.

5. The method according to claim 1, characterized in that The preset encoder model includes a coding module and a classification module; the training process of the preset encoder model includes: Acquire a sample database, wherein the sample database includes a multidimensional feature vector and a true classification value corresponding to each original sample; Adding random noise to each original sample and then inputting it into the encoding and decoding module to obtain reconstructed data corresponding to each original sample; Adjusting the weight parameters of the encoding and decoding module according to a first loss function between the reconstructed data of each original sample and the original sample; Inputting the reconstructed data of each original sample into the classification module to obtain a predicted classification value of each original sample; The model parameters of the preset encoder model are adjusted according to a second loss function between the predicted classification value and the true classification value of each original sample.

6. The method according to claim 5, characterized in that The training process also includes: Determining predicted classification results of all original samples in the sample database based on the trained preset encoder model; Determining the evaluation index of the trained preset encoder model according to the predicted classification results and the actual classification results of all the original samples; When the evaluation index of the trained preset encoder model meets the preset conditions, determining the classification detection result of the program to be detected according to the trained preset encoder model; Among them, the evaluation indicators include one or more of the true positive rate, false positive rate, precision rate, accuracy rate and performance score; the true positive rate indicates the proportion of positive samples detected by the model as true; the false positive rate indicates the proportion of negative samples detected by the model as false; the precision rate indicates the proportion of samples detected by the model as true that are actually true; the accuracy rate indicates the proportion of all samples that can be correctly identified as false or true; the performance score is used to measure the overall detection performance of the model.

7. A program detection device, characterized in that: The device comprises: The first extraction module is used to extract the API call information of the program to be detected when it is running, and obtain the API sequence; A second extraction module is used to extract network traffic information of the program to be detected when it is running, and obtain a traffic sequence; A feature representation module, used for obtaining a multi-dimensional feature vector of the program to be detected according to the API sequence and the traffic sequence; The result detection module is used to input the multidimensional feature vector into a preset encoder model to determine the security of the program to be detected. The preset encoder model has a classification function, and the training process of the preset encoder model includes unsupervised training and supervised fine-tuning.

8. A computer device, characterized in that: include: Memory, processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor performs the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images