Cross-architecture malicious code detection method and device

Abstract

The invention discloses a cross-architecture malicious code detection method and device, and the method comprises the steps: extracting assembly operation codes under different architectures, and building a mapping relation, so that the meaning of an instruction can be accurately understood in cross-architecture analysis, and the understanding difficulty caused by architecture difference can be eliminated; and inputting the mapped instruction into a 3-gram model, generating an embedding vector with a fixed length, calculating an Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample, and obtaining the similarity between the target file and the malicious sample, so that on the basis of adopting expert knowledge, carrying out dynamic analysis on the residual operation codes, and finally obtaining the similarity between the target file and the malicious sample. According to the method, the complete instruction mapping relation table is obtained, the mapped instruction operation codes can be effectively utilized for malicious code detection, the accuracy of malicious code detection under different architectures is improved, the efficiency and accuracy of cross-architecture assembly instruction analysis are remarkably improved, the detection efficiency is improved, and the time cost is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of software security technology, and specifically relates to a cross-architecture malicious code detection method and device. Background Art

[0002] At present, whether it is x86 architecture or ARM architecture, each architecture has its own unique instruction set and execution mode. Accurate analysis and understanding of assembly instructions of different architectures are of great significance for optimizing system performance, improving security and software development efficiency.

[0003] At present, cross-architecture assembly instruction analysis mainly relies on static and dynamic methods. Static analysis is fast but has limited accuracy. Dynamic analysis has a certain impact on system performance and cannot cover all situations. Therefore, how to balance accuracy and efficiency in cross-architecture assembly instruction analysis has practical application significance. Summary of the invention

[0004] In view of this, the purpose of the present invention is to propose a cross-architecture malicious code detection method and device to solve or partially solve the technical problems mentioned in the background technology.

[0005] Based on the above objectives, in a first aspect, the present invention provides a cross-architecture malicious code detection method, comprising:

[0006] Obtain assembly code in an x86 architecture and assembly code in an ARM architecture, parse the assembly code in the x86 architecture to extract opcode instructions in the x86 architecture, and parse the assembly code in the ARM architecture to extract opcode instructions in the ARM architecture;

[0007] A one-to-one correspondence is performed between the semantically clear opcode instructions of the x86 architecture and the ARM architecture by using a K-means clustering algorithm, a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture is established, and an opcode instruction mapping relationship table is obtained;

[0008] For opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, a dynamic analysis tool is used to track and analyze the execution results of the opcode instructions, and the opcode instruction mapping relationship table is improved according to the dynamic analysis results of the opcode instructions;

[0009] The opcode instructions for establishing the mapping relationship are input into the 3-gram model, and a number of consecutive opcode instruction sequences are regarded as a sequence. The occurrence frequency of each sequence is counted to generate an embedding vector of fixed length.

[0010] The Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample is calculated to obtain the similarity between the target file and the malicious sample; based on whether the preset similarity threshold is reached, the target file is marked as a malicious sample or a normal file.

[0011] As a preferred solution for the cross-architecture malicious code detection method, the disassembly tool IDA Pro is used to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, and all the opcode instructions in the x86 architecture are extracted from the assembly code of the x86 architecture; and all the opcode instructions in the ARM architecture are extracted from the assembly code in the ARM architecture.

[0012] As a preferred solution for the cross-architecture malicious code detection method, in the process of establishing a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, the instruction set differences between the x86 architecture and the ARM architecture are combined, and the instruction set differences include instruction format and functional differences.

[0013] As a preferred solution for cross-architecture malicious code detection methods, dynamic analysis tools are used to track and analyze the results of opcode instruction execution: run the target program in a simulator or actual system and monitor the target program execution process;

[0014] Observe the execution results of instructions in the x86 architecture and the ARM architecture, and observe the values ​​in the registers to determine the equivalence of the target program between the x86 architecture and the ARM architecture.

[0015] As a preferred solution for the cross-architecture malicious code detection method, if the similarity between the target file and the malicious sample reaches a preset similarity threshold, the target file is marked as a malicious sample;

[0016] If the similarity between the target file and the malicious sample does not reach the preset similarity threshold, the target file is marked as a normal file.

[0017] In a second aspect, the present invention provides a cross-architecture malicious code detection device, comprising:

[0018] An opcode instruction extraction module is used to obtain assembly code in the x86 architecture and assembly code in the ARM architecture, parse the assembly code in the x86 architecture to extract the opcode instructions in the x86 architecture, and parse the assembly code in the ARM architecture to extract the opcode instructions in the ARM architecture;

[0019] An opcode instruction mapping module is used to perform one-to-one correspondence between semantically clear opcode instructions between the x86 architecture and the ARM architecture through a K-means clustering algorithm, establish a mapping relationship between opcode instructions in the x86 architecture and opcode instructions in the ARM architecture, and obtain an opcode instruction mapping relationship table;

[0020] A mapping relationship table improvement module is used to use a dynamic analysis tool to track and analyze the execution results of opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, and improve the opcode instruction mapping relationship table according to the dynamic analysis results of the opcode instructions;

[0021] The embedding vector generation module is used to input the operation code instructions for establishing the mapping relationship into the 3-gram model, treat a number of consecutive operation code instruction sequences as a sequence, count the occurrence frequency of each sequence, and generate an embedding vector of fixed length;

[0022] The target file analysis module is used to calculate the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample to obtain the similarity between the target file and the malicious sample; based on whether the preset similarity threshold is reached, the target file is marked as a malicious sample or a normal file.

[0023] As a preferred solution of the cross-architecture malicious code detection device, in the opcode instruction extraction module:

[0024] The disassembly tool IDA Pro is used to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, and all the opcode instructions in the x86 architecture are extracted from the assembly code in the x86 architecture; and all the opcode instructions in the ARM architecture are extracted from the assembly code in the ARM architecture.

[0025] As a preferred solution for a cross-architecture malicious code detection device, the opcode instruction mapping module combines the instruction set differences of the x86 architecture and the ARM architecture, and the instruction set differences include instruction format and functional differences.

[0026] As a preferred solution for the cross-architecture malicious code detection device, in the mapping relationship table improvement module:

[0027] Run the target program in the simulator or actual system and monitor the execution process of the target program;

[0028] Observe the execution results of instructions in the x86 architecture and the ARM architecture, and observe the values ​​in the registers to determine the equivalence of the target program between the x86 architecture and the ARM architecture.

[0029] As a preferred solution for the cross-architecture malicious code detection device, in the target file analysis module:

[0030] If the similarity between the target file and the malicious sample reaches a preset similarity threshold, the target file is marked as a malicious sample;

[0031] If the similarity between the target file and the malicious sample does not reach the preset similarity threshold, the target file is marked as a normal file.

[0032] From the above description, it can be seen that the technical solution provided by the present invention, by extracting assembly opcodes under different architectures and establishing a mapping relationship, enables the meaning of instructions to be accurately understood in cross-architecture analysis, which helps to eliminate the difficulty of understanding caused by architecture differences; the mapped instructions are input into the 3-gram model, an embedding vector of a fixed length is generated, and the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample is calculated to obtain the similarity between the target file and the malicious sample, thereby dynamically analyzing the remaining opcodes on the basis of expert knowledge to obtain a complete instruction mapping relationship table, which can effectively use the mapped instruction opcodes for malicious code detection, helps to improve the accuracy of malicious code detection under different architectures, significantly improves the efficiency and accuracy of cross-architecture assembly instruction analysis, improves detection efficiency, and reduces time cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 A schematic diagram of a cross-architecture malicious code detection method provided by an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of a cross-architecture malicious code detection method technology route provided by an embodiment of the present invention;

[0036] Figure 3 An architecture diagram of a cross-architecture malicious code detection device provided by an embodiment of the present invention;

[0037] Figure 4 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0039] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present invention should have the usual meanings understood by people with ordinary skills in the field to which the present invention belongs. The words "include" or "comprise" and the like used in the embodiments of the present invention mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, but do not exclude other elements or objects.

[0040] In today's digital age, computer systems and various intelligent devices have become an indispensable part of modern society. Malicious code detection is an important technology in the field of computer security. Its goal is to identify and prevent the threats posed by malicious software to systems and users. Malicious code exists in various forms, including viruses, worms, Trojans, spyware, etc., which may steal user information, damage system files, tamper with data, launch network attacks, etc. The widespread application of these systems and devices is inseparable from the underlying software support, and assembly language, as the low-level language closest to computer hardware, directly affects the performance and function of the system. In assembly language, assembly instructions are the most basic units for building program logic and execution processes. Their understanding and analysis are crucial for system optimization and security protection.

[0041] With the continuous development of computer technology, the processor architecture involved in malicious code has become more diverse and complex, making it increasingly important to analyze and understand the assembly instructions for different architectures. Whether it is the x86 architecture or the ARM architecture, each architecture has its own unique instruction set and execution method. Therefore, accurate analysis and understanding of the assembly instructions of different architectures is of great significance for optimizing system performance, improving security, and improving the efficiency of software development.

[0042] Currently, cross-architecture assembly instruction analysis mainly relies on two methods: static and dynamic. Static analysis obtains instruction information by parsing assembly code, which is fast but has limited accuracy. Dynamic analysis monitors the running of programs on different architectures to obtain more accurate instruction execution, but it has a certain impact on system performance and cannot cover all situations. Therefore, how to balance accuracy and efficiency in cross-architecture assembly instruction analysis is still an important challenge for current technology.

[0043] In view of this, an embodiment of the present invention provides a cross-architecture malicious code detection method and device, which can effectively use the mapped instruction opcodes to detect malicious code. It helps to improve the accuracy of malicious code detection under different architectures, significantly improve the efficiency and accuracy of cross-architecture assembly instruction analysis, improve detection efficiency, and reduce time costs. The following is the specific content of the embodiment of the present invention.

[0044] In the following implementation, the concepts involved have the following meanings:

[0045] x86: The x86 architecture is a computer language instruction set executed by a microprocessor. It refers to the standard numbering abbreviation for a general-purpose computer series and also identifies a set of general-purpose computer instructions.

[0046] ARM: The ARM architecture, formerly known as Advanced RISC Machine, is a 32-bit RISC processor architecture.

[0047] Semantics: The actual behavior and effects of statements and expressions in a programming language. For example, the semantics of a programming language specifies how variables are declared, assigned, and used, as well as the rules for how control flow statements (such as conditionals and loops) are executed.

[0048] GDB: is a powerful debugging tool used to help programmers debug their programs. It can be used to analyze and modify running programs and help find errors and problems in the program.

[0049] Flag bit: A flag bit is a binary bit used in computer architecture to indicate a specific state or condition. These flag bits are usually stored in the processor's status register or flag register and are set or cleared by the processor based on specific conditions when executing instructions.

[0050] IDA Pro: is a powerful reverse engineering tool used to analyze and disassemble various types of binary files, including executable files, library files, and drivers. It is widely used in security research, vulnerability analysis, malicious code analysis, and other fields.

[0051] l ea instruction: An instruction in the x86 architecture assembly language that means load effective address.

[0052] adrp instruction: An instruction in the ARM architecture used to load the high part of an address into the destination register

[0053] add instruction: An instruction in assembly language used to perform addition operations.

[0054] adrp+add instruction group: used to calculate the complete address. In the ARM architecture, this combination is often used to load the address of the data and add the offset to obtain the complete memory address.

[0055] 3-gram: A commonly used technique in text analysis. It is a statistical language model used to analyze the combination of three consecutive units (such as letters, words, or other symbols) in a text.

[0056] See also Figure 1 and Figure 2The embodiment of the present invention provides a cross-architecture malicious code detection method, comprising the following steps:

[0057] S1. Obtain assembly code in an x86 architecture and assembly code in an ARM architecture, parse the assembly code in the x86 architecture to extract opcode instructions in the x86 architecture, and parse the assembly code in the ARM architecture to extract opcode instructions in the ARM architecture;

[0058] S2. Perform one-to-one correspondence between the semantically clear opcode instructions of the x86 architecture and the ARM architecture by using a K-means clustering algorithm, establish a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, and obtain an opcode instruction mapping relationship table;

[0059] S3. For the opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, a dynamic analysis tool is used to track and analyze the execution results of the opcode instructions, and the opcode instruction mapping relationship table is improved according to the dynamic analysis results of the opcode instructions;

[0060] S4, inputting the operation code instructions for establishing the mapping relationship into the 3-gram model, treating a number of consecutive operation code instruction sequences as a sequence, counting the occurrence frequency of each sequence, and generating an embedding vector of fixed length;

[0061] S5. Calculate the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample to obtain the similarity between the target file and the malicious sample; and mark the target file as a malicious sample or a normal file according to whether a preset similarity threshold is reached.

[0062] In this embodiment, in step S1, the disassembly tool IDA Pro is used to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, and all the opcode instructions in the x86 architecture are extracted from the assembly code of the x86 architecture; and all the opcode instructions in the ARM architecture are extracted from the assembly code in the ARM architecture.

[0063] Among them, IDA Pro is a powerful disassembly tool used to analyze and disassemble various types of binary files, including executable files, library files, and drivers, etc. It is widely used in security research, vulnerability analysis, malicious code analysis and other fields.

[0064] In this embodiment, in step S2, in the process of establishing a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, the instruction set differences between the x86 architecture and the ARM architecture are combined, and the instruction set differences include instruction format and functional differences.

[0065] Specifically, for the extracted opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, a clear opcode mapping relationship is established using the K-means clustering method. This process needs to take into account the differences in instruction sets between the x86 architecture and the ARM architecture, including differences in instruction formats, functions, etc., to ensure the accuracy and completeness of the mapping relationship.

[0066] Among them, in the operation code mapping relationship, the K-means clustering method can divide the operation codes (or similar features) into different categories. The specific steps are as follows:

[0067] Data preprocessing: preprocess the opcode data, including normalization, outlier processing, etc.;

[0068] Initialization: Randomly select K opcodes as initial cluster centers;

[0069] Assignment: Calculate the distance between each operation code and each cluster center, and assign each operation code to the category represented by the cluster center closest to it;

[0070] Update: Recalculate the center of each category, usually taking the average of all opcodes within the category;

[0071] Iteration: Repeat the assignment step and the update step until the cluster center no longer changes significantly or the preset number of iterations is reached.

[0072] Result analysis: Based on the final clustering results, the mapping relationship and characteristics of different operation codes are analyzed.

[0073] Through the above steps, the K-means clustering method can help identify and classify different opcode patterns, thereby optimizing the performance and efficiency of the system. The opcode instruction mapping relationship table is shown in Table 1:

[0074] ARM instructions x86 instructions Mapping Instructions Instruction meaning eor xor xor XOR instruction orr or or Logical OR operation mvn not not Invert the operand bit by bit asl sal sal Arithmetic left shift operation rrx rcr rcr Circular right shift operation with carry b.le jle jle Signed comparison, jump if less than or equal b.lt jl jl Signed comparison, jump if less than b.gt jg jg Signed comparison, jump if greater than tst test cmp Logical comparison to change flags sdiv idiv div Signed division

[0075] Table 1 Operation code instruction mapping relationship table style

[0076] In this embodiment, in step S3, a dynamic analysis tool is used to track and analyze the execution results of the opcode instructions: the target program is run in a simulator or an actual system, and the execution process of the target program is monitored;

[0077] Observe the execution results of instructions in the x86 architecture and the ARM architecture, and observe the values ​​in the registers to determine the equivalence of the target program between the x86 architecture and the ARM architecture.

[0078] Specifically, for opcode instructions that cannot be directly mapped, such as the l ea instruction in the x86 architecture and the adrp instruction in the ARM architecture, the dynamic analysis tool GDB is used for tracking and analysis. This step can run the target program in a simulator or an actual system and monitor its execution process. By observing the execution results of the instructions on different architectures and observing the values ​​in the registers, the equivalence between different architectures is further determined. For the adrp instruction, since the ARM architecture instruction is 32 bits, an additional 32 bits are required for 64-bit computers to calculate the address. The usual solution is to follow the adrp instruction with the add instruction to calculate the 64-bit address. Therefore, the adrp+add instruction group can be regarded as an offset address calculation operation.

[0079] In this embodiment, in step S4, the mapped opcode instructions are used as input, and the three consecutive opcode sequences are converted into embedding vectors using the 3-gram model. These embedding vectors will be used as feature vectors to represent the instruction sequence of each file for similarity calculation in subsequent steps. In step S5, the similarity between the target file and the malicious sample can be obtained by calculating the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample. If the similarity between the target file and the malicious sample reaches a preset similarity threshold, the target file is marked as a malicious sample; if the similarity between the target file and the malicious sample does not reach the preset similarity threshold, the target file is marked as a normal file.

[0080] In summary, the present invention obtains assembly code in the x86 architecture and assembly code in the ARM architecture, parses the assembly code in the x86 architecture to extract the opcode instructions in the x86 architecture, and parses the assembly code in the ARM architecture to extract the opcode instructions in the ARM architecture; uses the K-means clustering algorithm to perform one-to-one correspondence between the semantically clear opcode instructions of the x86 architecture and the ARM architecture, establishes a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, and obtains an opcode instruction mapping relationship table; for the opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, the opcode instruction mapping relationship table is obtained. The method comprises the following steps: extracting the opcode instructions of the target file, using a dynamic analysis tool to track and analyze the execution results of the opcode instructions, and improving the opcode instruction mapping relationship table according to the dynamic analysis results of the opcode instructions; inputting the opcode instructions for establishing the mapping relationship into the 3-gram model, treating a plurality of continuous opcode instruction sequences as a sequence, counting the occurrence frequency of each sequence, and generating an embedding vector of a fixed length; calculating the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample, and obtaining the similarity between the target file and the malicious sample; and marking the target file as a malicious sample or a normal file according to whether a preset similarity threshold is reached. The present invention extracts assembly opcodes under different architectures and uses the K-means clustering method to establish a clear mapping relationship, so that the meaning of the instructions can be accurately understood in cross-architecture analysis, which helps to eliminate the difficulty of understanding caused by architectural differences. The unmapped assembly instructions are tracked and analyzed by a dynamic analysis tool, and their equivalence between different architectures is further determined, thereby improving the comprehensiveness and accuracy of the analysis. Traditional static analysis may not be able to fully obtain information during dynamic execution, while dynamic analysis may be affected by system performance and cannot cover all possible execution paths. The mapped instruction opcode is used as input, and the 3-gram model is used to convert three consecutive opcode sequences into embedding vectors. The similarity between the embedding vector of the target file and the embedding vector of the malicious sample is calculated to obtain the similarity between them. According to the set similarity threshold, the target file is marked as a malicious sample or a normal file. Based on the complete instruction mapping relationship table, this method uses the 3-gram model to generate embedding vectors, and effectively improves the detection efficiency of cross-architecture malicious code through calculation and judgment between embedding vectors.

[0081] It should be noted that the method of the embodiment of the present invention can be performed by a single device, such as a computer or a server. The method of this embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present invention, and the multiple devices will interact with each other to complete the described method.

[0082] It should be noted that some embodiments of the present invention are described above. In some cases, the actions or steps recorded can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] See also Figure 3 Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, an embodiment of the present invention further provides a cross-architecture malicious code detection device, including:

[0084] The opcode instruction extraction module 100 is used to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, parse the assembly code in the x86 architecture to extract the opcode instructions in the x86 architecture, and parse the assembly code in the ARM architecture to extract the opcode instructions in the ARM architecture;

[0085] The opcode instruction mapping module 200 is used to perform one-to-one correspondence between the semantically clear opcode instructions of the x86 architecture and the ARM architecture through a K-means clustering algorithm, establish a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, and obtain an opcode instruction mapping relationship table;

[0086] A mapping relationship table improvement module 300 is used to use a dynamic analysis tool to track and analyze the execution results of opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, and improve the opcode instruction mapping relationship table according to the dynamic analysis results of the opcode instructions;

[0087] The embedding vector generation module 400 is used to input the operation code instruction for establishing the mapping relationship into the 3-gram model, treat a plurality of consecutive operation code instruction sequences as a sequence, count the occurrence frequency of each sequence, and generate an embedding vector of fixed length;

[0088] The target file analysis module 500 is used to calculate the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample to obtain the similarity between the target file and the malicious sample; and mark the target file as a malicious sample or a normal file according to whether a preset similarity threshold is reached.

[0089] In this embodiment, in the operation code instruction extraction module 100:

[0090] The disassembly tool IDA Pro is used to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, and all the opcode instructions in the x86 architecture are extracted from the assembly code in the x86 architecture; and all the opcode instructions in the ARM architecture are extracted from the assembly code in the ARM architecture.

[0091] In this embodiment, the opcode instruction mapping module 200 combines the instruction set differences between the x86 architecture and the ARM architecture, and the instruction set differences include instruction format and functional differences.

[0092] In this embodiment, in the mapping relationship table improvement module 300:

[0093] Run the target program in the simulator or actual system and monitor the execution process of the target program;

[0094] Observe the execution results of instructions in the x86 architecture and the ARM architecture, and observe the values ​​in the registers to determine the equivalence of the target program between the x86 architecture and the ARM architecture.

[0095] In this embodiment, in the target file analysis module 500:

[0096] If the similarity between the target file and the malicious sample reaches a preset similarity threshold, the target file is marked as a malicious sample;

[0097] If the similarity between the target file and the malicious sample does not reach the preset similarity threshold, the target file is marked as a normal file.

[0098] The device of the above embodiment is used to implement a corresponding cross-architecture malicious code detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0099] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a cross-architecture malicious code detection method described in any of the above embodiments is implemented.

[0100] Figure 4 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 610, a memory 620, an input / output interface 630, a communication interface 640, and a bus 650. The processor 610, the memory 620, the input / output interface 630, and the communication interface 640 are connected to each other through the bus 650 in the device.

[0101] The processor 610 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0102] The memory 620 may be implemented in the form of ROM (Read On ly Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 620 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 620 and are called and executed by the processor 610.

[0103] The input / output interface 630 is used to connect the input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0104] The communication interface 640 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WI FI, Bluetooth, etc.).

[0105] The bus 650 comprises a pathway for transmitting information between the various components of the device (eg, the processor 610, the memory 620, the input / output interface 630, and the communication interface 640).

[0106] It should be noted that, although the above device only shows the processor 610, the memory 620, the input / output interface 630, the communication interface 640 and the bus 650, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0107] The electronic device of the above embodiment is used to implement a corresponding cross-architecture malicious code detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0108] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present invention also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute a cross-architecture malicious code detection method as described in any of the above embodiments.

[0109] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0110] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute a cross-architecture malicious code detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0111] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of the embodiments of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0112] In addition, to simplify the description and discussion, and in order not to obscure the embodiments of the present invention, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the devices may be shown in the form of block diagrams to avoid obscuring the embodiments of the present invention, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present invention will be implemented (i.e., these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present invention, it will be apparent to those skilled in the art that embodiments of the present invention may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0113] Although the present invention has been described in conjunction with specific embodiments of the present invention, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0114] The embodiments of the present invention are intended to cover all such substitutions, modifications and variations that fall within the scope of the protection claimed. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present invention should be included in the protection scope of the present invention.

Claims

1. A cross-architecture malicious code detection method, wherein: include: Obtain assembly code in an x86 architecture and assembly code in an ARM architecture, parse the assembly code in the x86 architecture to extract opcode instructions in the x86 architecture, and parse the assembly code in the ARM architecture to extract opcode instructions in the ARM architecture; A one-to-one correspondence is performed between the semantically clear opcode instructions of the x86 architecture and the ARM architecture by using a K-means clustering algorithm, a mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture is established, and an opcode instruction mapping relationship table is obtained; For opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, a dynamic analysis tool is used to track and analyze the execution results of the opcode instructions, and the opcode instruction mapping relationship table is improved according to the dynamic analysis results of the opcode instructions; The opcode instructions for establishing the mapping relationship are input into the 3-gram model, and a number of consecutive opcode instruction sequences are regarded as a sequence. The occurrence frequency of each sequence is counted to generate an embedding vector of fixed length. The Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample is calculated to obtain the similarity between the target file and the malicious sample; based on whether the preset similarity threshold is reached, the target file is marked as a malicious sample or a normal file.

2. A cross-architecture malicious code detection method according to claim 1, wherein: Use the disassembly tool IDAPro to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, and extract all the opcode instructions in the x86 architecture from the assembly code of the x86 architecture; extract all the opcode instructions in the ARM architecture from the assembly code in the ARM architecture.

3. A cross-architecture malicious code detection method according to claim 1, wherein: In the process of establishing the mapping relationship between the opcode instructions in the x86 architecture and the opcode instructions in the ARM architecture, the instruction set differences between the x86 architecture and the ARM architecture are combined, and the instruction set differences include instruction format and function differences.

4. A cross-architecture malicious code detection method according to claim 1, wherein: In the process of using dynamic analysis tools to track and analyze the results of opcode instruction execution: run the target program in a simulator or actual system and monitor the target program execution process; Observe the execution results of instructions in the x86 architecture and the ARM architecture, and observe the values ​​in the registers to determine the equivalence of the target program between the x86 architecture and the ARM architecture.

5. A cross-architecture malicious code detection method according to claim 1, wherein: If the similarity between the target file and the malicious sample reaches a preset similarity threshold, the target file is marked as a malicious sample; If the similarity between the target file and the malicious sample does not reach the preset similarity threshold, the target file is marked as a normal file.

6. A cross-architecture malicious code detection device, wherein: include: An opcode instruction extraction module is used to obtain assembly code in the x86 architecture and assembly code in the ARM architecture, parse the assembly code in the x86 architecture to extract the opcode instructions in the x86 architecture, and parse the assembly code in the ARM architecture to extract the opcode instructions in the ARM architecture; An opcode instruction mapping module is used to perform one-to-one correspondence between semantically clear opcode instructions between the x86 architecture and the ARM architecture through a K-means clustering algorithm, establish a mapping relationship between opcode instructions in the x86 architecture and opcode instructions in the ARM architecture, and obtain an opcode instruction mapping relationship table; A mapping relationship table improvement module is used to use a dynamic analysis tool to track and analyze the execution results of opcode instructions that cannot be directly mapped between the x86 architecture and the ARM architecture, and improve the opcode instruction mapping relationship table according to the dynamic analysis results of the opcode instructions; The embedding vector generation module is used to input the operation code instructions for establishing the mapping relationship into the 3-gram model, treat a number of consecutive operation code instruction sequences as a sequence, count the occurrence frequency of each sequence, and generate an embedding vector of fixed length; The target file analysis module is used to calculate the Euclidean distance between the embedding vector of the target file and the embedding vector of the malicious sample to obtain the similarity between the target file and the malicious sample; based on whether the preset similarity threshold is reached, the target file is marked as a malicious sample or a normal file.

7. A cross-architecture malicious code detection device according to claim 6, wherein: In the opcode instruction extraction module: The disassembly tool IDA Pro is used to obtain the assembly code in the x86 architecture and the assembly code in the ARM architecture, and all the opcode instructions in the x86 architecture are extracted from the assembly code in the x86 architecture; and all the opcode instructions in the ARM architecture are extracted from the assembly code in the ARM architecture.

8. A cross-architecture malicious code detection device according to claim 6, wherein: In the opcode instruction mapping module, the instruction set differences between the x86 architecture and the ARM architecture are combined, and the instruction set differences include instruction format and functional differences.

9. A cross-architecture malicious code detection device according to claim 6, wherein: In the mapping relationship table improvement module: Run the target program in the simulator or actual system and monitor the execution process of the target program; Observe the execution results of instructions in the x86 architecture and the ARM architecture, and observe the values ​​in the registers to determine the equivalence of the target program between the x86 architecture and the ARM architecture.

10. A cross-architecture malicious code detection device according to claim 6, wherein: In the target file analysis module: If the similarity between the target file and the malicious sample reaches a preset similarity threshold, the target file is marked as a malicious sample; If the similarity between the target file and the malicious sample does not reach the preset similarity threshold, the target file is marked as a normal file.

Images