Automatic dynamic feature tracing method based on malicious codes

Abstract

The invention relates to the field of network security, in particular to an automatic dynamic feature tracing method based on malicious codes. The invention provides an automatic dynamic feature tracing method based on malicious codes, which is characterized in that dynamic features of malicious software and prompt information of priori knowledge are obtained based on malicious software samples, and prompt vectors obtained by encoding the dynamic features and the prompt information of the priori knowledge are input into a BERT model for supervised learning. The gradient of a loss function is calculated through back propagation, the BERT model is optimized, the output features of the BERT model are further learned through a traditional machine learning algorithm, and the result and the output features of the BERT model are subjected to weighted fusion. The method aims at solving the problems that in the prior art, manual operation or semi-automatic tool processing efficiency is low, and large-scale data sets are difficult to expand, the problem that priori knowledge is insufficient in utilization in a traditional classification method is solved, and the inherent interpretability of the classification process is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to an automated dynamic feature tracing method based on malicious code. Background Art

[0002] As network security threats become increasingly complex, the types of malware and attack methods are becoming more diverse and advanced. APT organizations are particularly prominent in network attacks, and their attacks are usually highly concealed and persistent. In order to cope with such complex threats, malware classification and APT organization identification have become important research directions in network security.

[0003] Traditional malware classification methods extract features through manual operations or semi-automated tools. The limitations of these methods are that the feature extraction and engineering process is cumbersome and requires human participation, and cannot automatically process a large number of samples. In addition, manual feature engineering relies on the experience of domain experts, resulting in instability in feature construction and difficulty in extending to the classification of multiple malware. In the classification of APT organizations, prior knowledge can provide strong support for classification, but traditional methods find it difficult to fully utilize this domain knowledge, resulting in a lack of pertinence and interpretability in the classification model. Traditional methods often use rule-driven or feature splicing methods, which cannot fully utilize the deep semantic information of prior knowledge, and have poor adaptability. They lack effective use of prior knowledge and cannot guide the model to focus on APT-specific behavior patterns.

[0004] It can be seen that existing methods have great limitations in the automatic extraction of dynamic features, the use of prior knowledge, and the guided application of deep learning models. This invention aims to solve these problems and improve the accuracy and efficiency of malware classification by automatically extracting dynamic features of malware and introducing prior knowledge into the prompt tuning process of the BERT model. Summary of the invention

[0005] The purpose of the present invention is to automatically acquire the dynamic characteristics of malware and generate prompt information of prior knowledge, introduce a multi-layer prompt strategy to enhance the ability to capture malware characteristics, improve the problems of low efficiency of manual operation or semi-automatic tool processing in the existing technology and difficulty in expanding to large-scale data sets, the problem of insufficient utilization of prior knowledge in traditional classification methods, and improve the inherent interpretability of the classification process.

[0006] The present invention provides an automated dynamic feature tracing method based on malicious code, comprising the following steps:

[0007] Calculate the hash value of the malware sample and analyze it to obtain a dynamic behavior analysis report of the malware, parse and transform the dynamic behavior analysis report to obtain prompt information of prior knowledge, input the prompt vector obtained by encoding the dynamic features obtained by parsing the dynamic behavior analysis report and the prompt information of prior knowledge into the BERT model for supervised learning, calculate the gradient of the loss function through back propagation and optimize the BERT model, further learn the output features of the BERT model through traditional machine learning algorithms and weightedly fuse the results with the output features of the BERT model;

[0008] Classify unknown malware samples using the trained BERT model and explain the classification results.

[0009] The present invention provides an automated dynamic feature tracing method based on malicious code, which has the technical effects of being efficient, accurate, easy to maintain and having a certain degree of explainability.

[0010] Optionally, the steps of analyzing and obtaining a dynamic behavior analysis report of the malware are: using a script to batch upload hash values ​​of the malware to the VirusTotal platform, and querying and downloading the corresponding dynamic behavior analysis report in JSON format.

[0011] Optionally, the step of parsing the dynamic behavior analysis report to obtain dynamic features is: using an automated script to batch parse the dynamic behavior analysis report, and extracting fields that are closely related to malware behavior analysis as dynamic features of the malware.

[0012] Optionally, the step of converting the dynamic features parsed from the dynamic behavior analysis report into prompt information of prior knowledge is: adjusting and cleaning the dynamic features and converting them into a text format for BERT model input, and converting the dynamic features processed by the data tool into structured prompt information of prior knowledge through a predefined prompt template.

[0013] Optionally, after obtaining the prompt information of the prior knowledge, the prompt information is encoded into a trainable prompt vector using a prompt tuning technique, and the prompt vector is optimized and input into the BERT model together with the dynamic feature.

[0014] Optionally, the input of the BERT model generates deep feature representation in multiple encoding layers, and a multi-layer optimization strategy is adopted to introduce prompt vectors for optimization in multiple encoding layers. The output features of the BERT model are obtained by CLS marking of the last layer or pooling the outputs of multiple layers.

[0015] Optionally, when calculating the gradient of the loss function by back-propagation and optimizing the BERT model, the loss function uses a cross entropy loss function.

[0016] Optionally, when further learning the output features of the BERT model through traditional machine learning algorithms, the traditional machine learning algorithms that can be used include: logistic regression, support vector machine, and random forest.

[0017] Optionally, when further learning the output features of the BERT model through a traditional machine learning algorithm and weighted fusion of the results with the output features of the BERT model, the BERT model and the traditional machine learning method adopt an end-to-end training method and share the loss function.

[0018] Optionally, when classifying unknown malware samples through the trained BERT model, a classification confidence threshold is set, and when the predicted probability is lower than the preset confidence threshold, the result is marked for further analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is the overall flow chart of this method;

[0020] Figure 2 It is a structural diagram of the multi-layer optimization strategy of this method;

[0021] Figure 3 It is a flow chart of the classification prediction steps of this method. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0023] The embodiment of the present invention provides an automated dynamic feature tracing method based on malicious code, comprising the following steps:

[0024] S1. Calculate the hash value of the malware sample and analyze it to obtain a dynamic behavior analysis report of the malware;

[0025] S2, prompt information of prior knowledge obtained by parsing and converting the dynamic behavior analysis report;

[0026] S3, inputting the prompt vector obtained by encoding the dynamic features obtained by parsing the dynamic behavior analysis report and the prompt information of the prior knowledge into the BERT model for supervised learning;

[0027] S4. Calculate the gradient of the loss function through back propagation and optimize the BERT model;

[0028] S5. Further learn the output features of the BERT model through traditional machine learning algorithms and perform weighted fusion of the results with the output features of the BERT model;

[0029] S6. Classify unknown malware samples using the trained BERT model and explain the classification results.

[0030] like Figure 1 As shown, the overall process of the method includes the above steps.

[0031] When executing step S1, the steps of analyzing the dynamic behavior analysis report of the malware are: using a script to batch upload the hash values ​​of the malware to the VirusTotal platform, query and download the corresponding JSON format dynamic behavior analysis report. Among them, the JSON format report contains detailed dynamic behavior information, such as file operations, API calls, network connections, etc., and records the dynamic behavior characteristics of the malware in the sandbox environment. This information can reflect the runtime characteristics of the malware and is suitable for classification analysis.

[0032] When executing step S2, the step of parsing the dynamic behavior analysis report to obtain dynamic features is: batch parsing the dynamic behavior analysis report using an automated script, and extracting fields that are closely related to malware behavior analysis as dynamic features of malware.

[0033] These fields include but are not limited to:

[0034] calls_highlighted: Notable API calls, indicating critical system operations performed by the malware.

[0035] files_opened: Opened file paths, reflecting file system resources accessed by the malware.

[0036] modules_loaded: Loaded modules, showing the libraries and components loaded by the malware during execution.

[0037] mutexes_created and mutexes_opened: Created and opened mutexes, possibly used for synchronization between processes.

[0038] processes_terminated and processes_tree: Terminated processes and process trees, reflecting the malware’s process management behavior.

[0039] registry_keys_opened: Opened registry keys, indicating the malware’s attempts to modify the system configuration.

[0040] tags and text_highlighted: Tags and text highlighting are used to mark the characteristics of malicious behavior.

[0041] The steps of converting the dynamic features parsed from the dynamic behavior analysis report into prompt information of prior knowledge are: adjusting and cleaning the dynamic features into a text format for BERT model input, and converting the dynamic features processed by the data tool into structured prompt information of prior knowledge through a predefined prompt template. For example, multiple API call behaviors are described as "The malware called the following APIs: CreateFile, ReadFile, and WriteFile.

[0042] The design of prompt information is based on the extracted features, which are converted into structured prompt information through predefined prompt templates. For example, when multiple API call features are extracted, the following prompt information can be constructed:

[0043] “[CLS] Known APT characteristics: A certain APT group (such as APT 1 group) usually calls system APIs frequently. [SEP] The behavior of this malware is as follows: the following APIs are called: CreateFile, ReadFile, and WriteFile. [SEP]”

[0044] The prompt template can be flexibly adjusted to adapt to different types of features. For example, when the registry operation is extracted, the prompt information can be expressed as:

[0045] “[CLS] Known APT signature: Certain APT groups (e.g. APT 1) may modify the registry to alter system behavior. [SEP] The malware attempts to access the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion.

[0046] [SEP]”

[0047] Prompt information can be dynamically generated based on the specific behavioral characteristics of each sample. When extracting features, the automated script will select the appropriate prompt template based on the type and content of the feature. By setting the matching rules for the features, APT-related prior knowledge can be incorporated into the dynamically generated prompt information. This dynamically generated prompt information can automatically construct prompts associated with APT organizational characteristics based on the characteristics of the actual sample, making the prompt information more targeted and contextually relevant.

[0048] Through the above steps, the present invention realizes the automatic processing of dynamic feature extraction and conversion into prompt information of prior knowledge, which greatly improves the efficiency and consistency of malware analysis and lays a solid data foundation for subsequent model training and APT organization classification.

[0049] When executing step S3, after obtaining the prompt information of the prior knowledge, the prompt information is encoded into a trainable prompt vector using the prompt tuning technology, and the prompt vector is optimized and input into the BERT model together with the dynamic feature.

[0050] Soft hints encode hint information into trainable hint vectors and attach them to the appropriate positions of the BERT input sequence. These hint vectors are fed into the BERT model together with the input of sample features to guide the BERT model to better focus on behaviors related to APT organizations. During the training process, the hint vectors are optimized through back propagation so that their parameters gradually learn the best representation of APT features. The goal of the optimization is to enable the model to more accurately identify whether a sample belongs to an APT organization after combining the hint information and sample features.

[0051] Hint vectors can be inserted at the beginning, middle, or end of the BERT input sequence. For APT classification tasks, it is recommended to place the hint vector at the beginning of the sequence so that the model can first process the hint information and guide the classification process. In addition, a multi-layer optimization strategy can introduce hint vectors in multiple Transformer layers of BERT, so that the hint information is continuously strengthened in deep feature extraction. By optimizing the hint information at different levels, the model can make better use of the APT-related prior knowledge for classification.

[0052] During the training process, the content of the prompt information and the optimization strategy of the prompt vector are automatically adjusted according to the feature type and complexity of the sample. For example, if the sample contains multiple complex API call sequences, the length of the prompt vector can be appropriately increased or the position of the prompt information can be adjusted to ensure that the prompt information can better guide the model for classification.

[0053] The input of the BERT model generates deep feature representation in multiple encoding layers. A multi-layer optimization strategy is adopted, and prompt vectors are introduced in multiple encoding layers for optimization. The output features of the BERT model are obtained through the CLS tag of the last layer or by pooling the outputs of multiple layers.

[0054] like Figure 2 As shown in Figure 1, the multi-layer optimization strategy introduces hint vectors in multiple encoding layers of BERT, so that the hint information is continuously strengthened in the feature extraction process at different levels. This multi-layer optimization can improve the guiding effect of hint information on APT features.

[0055] According to the complexity of sample features and the content of the hint information, the position and length of the hint vector are automatically adjusted during the training process. For example, when processing samples containing a large number of complex dynamic features, the length of the hint vector can be increased or hint information can be introduced in more layers to enhance the ability to capture APT features.

[0056] When executing step S4, when the gradient of the loss function is calculated by back propagation and the BERT model is optimized, the loss function uses the cross entropy loss function.

[0057] The cross-entropy loss function is used to measure the gap between the model output and the true label. The specific loss function is defined as:

[0058]

[0059] Where N is the number of samples, y i is the true label, is the probability predicted by the model.

[0060] Backpropagation is used to calculate the gradient of the loss function and update the parameters of the BERT model, including the weights of the Transformer layer and the parameters of the prompt vector. In this way, the model can gradually optimize its ability to identify the characteristics of APT organizations.

[0061] The parameters of the prompt vector are adjusted through training to better guide the BERT model to play a role in APT feature recognition. The initial prompt vector can be randomly initialized or pre-trained based on APT knowledge. As training progresses, the prompt vector will gradually learn the optimal representation.

[0062] When executing step S5, when further learning the output features of the BERT model through traditional machine learning algorithms, the traditional machine learning algorithms that can be used include: logistic regression, support vector machine, and random forest.

[0063] In order to further improve the classification effect, these features can be classified in combination with traditional machine learning classifiers.

[0064] Extract sentence-level feature vectors from the last layer output of the BERT model or the feature representation after the pooling operation. These feature vectors can make comprehensive use of the deep information of the BERT model and the guiding effect of the prompt information. Common machine learning classifiers (such as logistic regression, support vector machine, random forest, etc.) can be selected to classify the feature representation. These classifiers help improve the accuracy of APT organization classification by further learning the features generated by BERT.

[0065] When the output features of the BERT model are further learned through traditional machine learning algorithms and the results are weightedly fused with the output features of the BERT model, the BERT model and traditional machine learning methods use an end-to-end training method, share loss functions, and jointly optimize the parameters of the BERT model and classifier to further improve the overall classification performance.

[0066] like Figure 3 As shown, when executing step S6, when classifying unknown malware samples through the trained BERT model, a classification confidence threshold is set, and when the predicted probability is lower than the preset confidence threshold, the result is marked for further analysis.

[0067] For unknown malware samples to be classified, their dynamic behavior features are first extracted through the VirusTotal platform. The automated script parses the JSON report downloaded from VirusTotal and extracts key features, such as significant API calls, file access paths, registry operations, loaded modules, network communications, etc. The extracted features are preprocessed through bash scripts and data processing tools (such as jq, sed) to convert raw data into structured text descriptions for easy processing by the BERT model.

[0068] Based on the extracted dynamic features, the predefined prompt template is used to generate prompt information. The prompt information is combined with the feature description to form standardized input text data, which is used as the input data of the BERT model in the form of "prompt information + dynamic feature description". This allows the model to process the prompt information first when predicting, thereby better focusing on the characteristics of the APT organization.

[0069] The constructed input data is input into the fine-tuned BERT model for forward propagation to generate the prediction results of APT organization classification. The model extracts features from the input text through multi-layer encoding (Transformer layer) and outputs the probability of each APT organization category in the classification layer. The output is normalized using the softmax function and converted into a probability distribution of the category. The category corresponding to the maximum probability is selected as the final prediction result.

[0070] Set a classification confidence threshold. When the prediction probability is lower than a certain threshold, mark the result as "unknown" or "further analysis" to reduce the impact of classification uncertainty on practical applications.

[0071] In the present invention, the interpretability of the classification model is enhanced by the guidance of a reasonably designed input mechanism and prompt information. Although deep learning models are often regarded as "black boxes", our method makes the judgment process of the model more transparent. By incorporating APT-related prior knowledge and prompt information into the model input, the decision-making process of the model is effectively guided. After the classification results are generated, the analyst can analyze based on the relationship between the output and input features of the model. Combined with the prompt information and dynamic features, the analyst can perform logical reasoning and understand how the model uses this information to make judgments. The design of the model enables analysts to see how the model processes input information and understand the decision-making basis of the model during classification. This transparency reduces uncertainty and enhances the credibility of the classification results. Analysts can form targeted security strategies based on the relationship between model output and features, thereby more effectively responding to potential threats.

[0072] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. An automated dynamic feature tracing method based on malicious code, characterized in that: The following steps are involved: Calculate the hash value of the malware sample and analyze it to obtain a dynamic behavior analysis report of the malware, parse and transform the dynamic behavior analysis report to obtain prompt information of prior knowledge, input the prompt vector obtained by encoding the dynamic features parsed from the dynamic behavior analysis report and the prompt information of prior knowledge into the BERT model for supervised learning, calculate the gradient of the loss function through back propagation and optimize the BERT model, further learn the output features of the BERT model through traditional machine learning algorithms and weightedly fuse the results with the output features of the BERT model; Classify unknown malware samples using the trained BERT model and explain the classification results.

2. The automated dynamic feature tracing method according to claim 1, characterized in that: The steps to obtain the dynamic behavior analysis report of the malware are as follows: use the script to batch upload the hash values ​​of the malware to the VirusTotal platform, query and download the corresponding JSON format dynamic behavior analysis report.

3. The automated dynamic feature tracing method according to claim 1, characterized in that: The step of parsing the dynamic behavior analysis report to obtain dynamic features is: using an automated script to batch parse the dynamic behavior analysis report, and extracting fields that are closely related to malware behavior analysis as dynamic features of malware.

4. The automated dynamic feature tracing method according to claim 1, characterized in that: The steps of converting the dynamic features parsed from the dynamic behavior analysis report into prompt information of prior knowledge are: adjusting and cleaning the dynamic features and converting them into a text format for BERT model input, and converting the dynamic features processed by the data tool into structured prompt information of prior knowledge through a predefined prompt template.

5. The automated dynamic feature tracing method according to claim 1, characterized in that: After obtaining the prompt information of the prior knowledge, the prompt information is encoded into a trainable prompt vector using the prompt tuning technology, and the prompt vector is optimized and input into the BERT model together with the dynamic feature.

6. The automated dynamic feature tracing method according to claim 1, characterized in that: The input of the BERT model generates deep feature representation in multiple encoding layers. A multi-layer optimization strategy is adopted, and prompt vectors are introduced in multiple encoding layers for optimization. The output features of the BERT model are obtained through the CLS tag of the last layer or by pooling the outputs of multiple layers.

7. The automated dynamic feature tracing method according to claim 1, characterized in that: When calculating the gradient of the loss function through back propagation and optimizing the BERT model, the loss function uses the cross entropy loss function.

8. The automated dynamic feature tracing method according to claim 1, characterized in that: When further learning the output features of the BERT model through traditional machine learning algorithms, the traditional machine learning algorithms that can be used include: logistic regression, support vector machine, and random forest.

9. The automatic dynamic feature tracing method according to claim 1, characterized in that: When the output features of the BERT model are further learned through traditional machine learning algorithms and the results are weightedly fused with the output features of the BERT model, the BERT model and traditional machine learning methods use an end-to-end training method and share the loss function.

10. The automatic dynamic feature tracing method according to claim 1, characterized in that: When classifying unknown malware samples through the trained BERT model, a classification confidence threshold is set. When the predicted probability is lower than the preset confidence threshold, the result is marked for further analysis.

Images