Fine-grained malicious behavior positioning method and system based on semantic enhancement

Abstract

The invention relates to the technical field of digital information application security, in particular to a fine-grained malicious behavior positioning method and system based on semantic enhancement, and the method comprises the steps: carrying out the feature extraction of a benign sample and a to-be-detected malicious sample, designing a feature set containing a semantic embedding API sequence, carrying out the coding through a weight, generating a node embedding expression, and carrying out the recognition of the feature set. Fusing the numerical features and the sequence features, and constructing an attribute control flow diagram; optimizing the attribute control flow diagram; training a graph attention auto-encoder model containing bidirectional propagation and multiple masks based on a benign sample; a malicious sample is input into the trained auto-encoder model for reconstruction, a reconstruction error is calculated, and basic block level fine-grained malicious behavior positioning is realized; according to the method, the related semantics of malicious behaviors in malicious samples are highly condensed, a feature coding technology and a graph structure optimization strategy are fused, and a trained model can accurately position basic blocks of the malicious behaviors through a customized loss function.

Description

Technical Field

[0001] The present invention relates to the field of digital information application security technology, and in particular to a fine-grained malicious behavior positioning method and system based on semantic enhancement. Background Art

[0002] As malware threats become increasingly severe, efficient malicious sample analysis has become an important topic in the field of network security. Traditional manual analysis methods are inadequate in malicious sample analysis, and their time-consuming and inefficient nature limits rapid response to malware threats. The development of automated analysis technology is crucial to improving the efficiency of malicious sample analysis, which can significantly shorten analysis time and increase response speed.

[0003] However, the application of existing automated analysis technology in malware behavior positioning is in its infancy, and due to the lack of environment and data sets, progress in this field is relatively slow. In addition, existing methods have not been applied vertically, and have failed to fully combine the typical characteristics of malicious behavior and the business needs of reverse analysis, and cannot achieve optimized matching for malicious behavior.

[0004] Therefore, the current malicious behavior analysis methods have the following problems: (1) There are few fine-grained methods for locating malicious behaviors. Existing methods mainly focus on coarse-grained distinction between benign and malicious samples, or classification of malicious samples, and usually perform malicious behavior detection on a file basis, which cannot meet the needs of virus analysts for locating specific malicious functions. (2) Existing malicious behavior location methods are insufficient in refining API semantics. Methods based on API statistics have a high false negative rate. For example, there are two basic block control flow graphs (a) and (b) with similar structures, which call the CreateDirectory and AddUsersToEncryptedFile APIs respectively. CreateDirectory is used to create a new directory, and AddUsersToEncryptedFile is used to add users to an encrypted file and allow these users to access the file. Both are APIs related to file operations, but AddUsersToEncryptedFile is obviously more sensitive. In the process of feature representation, the method based on API statistics will represent the two cases (a) and (b) as the same feature, ignoring the semantic differences between AddUsersToEncryptedFile and CreateDirectory. Although the method based on API call sequence can more accurately identify malicious behaviors, it cannot effectively understand synonymous APIs. For example, CreateSymbolicLink is an uncommonly used API that is used to create a symbolic link pointing to an existing file or directory. If this API is not involved in the training data set, even benign behavior will be misreported as malicious. This is because the model cannot understand the actual meaning of the API, which makes it difficult to cope with rapidly mutating malware and the model aging problem is obvious. (3) Existing malicious behavior location methods are insufficient in extracting contextual semantics. Existing malicious behavior location methods based on deep learning transplant mature model frameworks, but have not been adapted and optimized for malicious behavior location scenarios, resulting in errors in contextual semantic extraction. In terms of preprocessing, a rough truncation method is used to process variable-length inputs, without considering the loss of contextual information of the basic blocks at the truncation position; in terms of models, traditional rule-based machine learning methods cannot cope with rapidly mutating malware. Classic neural networks are based on sequential data or undirected graph data, which do not conform to the contextual association characteristics of program data, and there are deviations in the information aggregation process. Summary of the invention

[0005] In order to solve the problem that the existing deep learning analysis methods fail to fully combine the typical characteristics and reverse analysis of malicious behaviors, the API semantics and context semantics are not refined enough, and there is a lack of "optimized matching" malicious behavior positioning methods, which cannot meet the Fine-grained positioning methods cannot meet the needs of analysts, and the positioning methods do not sufficiently refine API semantics and context semantics, and have poor understanding capabilities. The purpose of this invention is to provide a fine-grained malicious behavior positioning method based on semantic enhancement. The technical solutions adopted are as follows: Get benign samples and malicious samples to be detected respectively, perform feature extraction to design a feature set containing semantically embedded API sequences, encode them through weights, generate node embedding expressions, fuse numerical features and sequence features, and construct an attribute control flow graph; Optimize the attribute control flow graph to pre-process the malicious samples to be detected; Based on benign samples, we train a graph attention autoencoder model that includes bidirectional propagation and multiple masks; The preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated to achieve fine-grained malicious behavior positioning at the basic block level.

[0006] Preferably, benign samples and malicious samples to be detected are obtained respectively, and feature extraction is performed based on the two samples to obtain a feature set containing a semantically embedded API sequence, which is encoded by weights to generate node embedding expressions, and numerical features and sequence features are integrated to construct an attribute control flow graph, including: Based on benign samples and malicious samples to be detected, numerical features and sequence features are extracted, and semantic embedding is performed based on the sequence features to obtain an indefinite length API call sequence, which is recorded as a sequence feature vector; Calculate the difference between any two nodes and record it as the distance between the nodes. Count the frequency of repetition of each feature as the weight. Cluster all nodes by weight to get several clusters. Generate a codebook based on the node closest to the corresponding cluster centroid in each cluster and encode it. Construct the attribute control flow graph, denoted as ,in, Represents a property control flow graph; Represents a feature set; An adjacency matrix representing the attributed control flow graph; Represents the node feature matrix.

[0007] Preferably, the numerical features include the number of basic arithmetic instructions, the number of logical operation instructions, the number of displacement instructions, the number of stack operation instructions, the number of register operation instructions and the number of port operation instructions; and the sequence features include an API call sequence.

[0008] Preferably, the difference value of the node is calculated, and the corresponding calculation formula is:

[0009] in, , Represents any two nodes; Represents the number of numerical features; , Respectively represent nodes and nodes The corresponding numerical eigenvector; , Respectively represent nodes and nodes The corresponding sequence feature vector; express , The edit distance between two sequence feature vectors; , Respectively represent the sequence and sequence Length.

[0010] Preferably, the attribute control flow graph is optimized to pre-process the malicious samples to be detected, including: Prune unimportant nodes whose features are all 0, remove the corresponding nodes and the outgoing and incoming edges that represent dependencies, and add new edges to connect all predecessor nodes and successor nodes of the pruned nodes; Fusing consecutive basic block nodes of sequential structures; Subgraphs of equal size are obtained by subgraph sampling.

[0011] Preferably, a graph attention autoencoder model including bidirectional propagation and multiple masks is trained based on benign samples, including: The benign samples are transferred to the graph attention autoencoder model including the bidirectional propagation mechanism and the multiple re-masking mechanism, and the initial loss function is designed. The corresponding calculation formula is:

[0012]

[0013] in, Indicates Initial loss function after heavy masking; , Respectively represent Nodes and Nodes The corresponding eigenvector; , Respectively represent nodes and nodes The The reconstructed feature vector is output after the second heavy mask and the decoder operation; Indicates the number of nodes in the attribute control flow graph in the input model; , All represent hyperparameters; represents the regularization term; Represents the graph attention autoencoder model with bidirectional propagation mechanism and multiple re-masking mechanism. The weight matrix of the layer; The average value is obtained by the number of multiple masks, and the initial loss function is corrected to obtain the total loss function. The corresponding calculation formula is:

[0014] in, represents the total loss function; Indicates the number of multiple masking; Indicates Initial loss function after heavy masking.

[0015] Preferably, the preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated to achieve fine-grained malicious behavior positioning at the basic block level, including: The preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated. The corresponding calculation formula is:

[0016] in, represents the reconstruction error; Indicates the number of multiple masking; , Respectively represent Nodes and Nodes The corresponding eigenvector; , Respectively represent nodes and nodes The The reconstructed feature vector is output after the second heavy mask and the decoder operation; Indicates the number of nodes in the attribute control flow graph in the input model; , All represent hyperparameters; Represents the graph attention autoencoder model with bidirectional propagation mechanism and multiple re-masking mechanism. The weight matrix of the layer; A judgment threshold is set. When the reconstruction error is greater than the judgment threshold, it indicates that the basic block corresponding to the current analysis node is a malicious basic block; when the reconstruction error is less than the judgment threshold, it indicates that the basic block corresponding to the current analysis node is a benign basic block.

[0017] To solve the above technical problems, the present invention provides another technical solution as follows: a fine-grained malicious behavior positioning system based on semantic enhancement, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of a fine-grained malicious behavior positioning method based on semantic enhancement as described in any one of the foregoing are implemented.

[0018] The present invention has the following beneficial effects: 1. The present invention adopts weight-based clustering feature coding, integrates numerical features and sequence features of different scales, and effectively solves the problem of single feature processing and inability to fully utilize API semantic information in traditional methods; analyzes the basic blocks in malicious samples for feature analysis and modeling, realizes basic block-level positioning of malicious behaviors, significantly improves the precision and accuracy of malicious behavior positioning, solves the shortcomings of existing methods in fine-grained positioning, and provides virus analysts with a more accurate malicious function positioning tool; uses benign samples to train a graph attention autoencoder model containing bidirectional propagation and multiple masks, so that the model learns the rules of benign samples, can effectively restore the code information flow, enhance the understanding of malicious behaviors, and can locate malicious behaviors according to the difference between good and evil in the absence of labeled data sets, thereby improving the reliability of malicious behavior positioning; at the same time, through variable-length output processing technology, the positioning range is quickly narrowed, adapted to the fixed-length input requirements, and the efficiency of malicious sample analysis is improved; in addition, by semantically embedding the API call sequence, combined with pruning and subgraph sampling, the ability to cope with newly emerging malicious behaviors and variants can be improved, the dependence on frequently updated models can be reduced, and the long-term availability and stability of the malicious behavior positioning method can be improved.

[0019] 2. The present invention also provides a fine-grained malicious behavior localization system based on semantic enhancement, which is used to implement the aforementioned fine-grained malicious behavior localization method based on semantic enhancement. The system has the same beneficial effects as the aforementioned fine-grained malicious behavior localization method based on semantic enhancement, which will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 A flowchart of a method for locating fine-grained malicious behavior based on semantic enhancement provided by an embodiment of the present invention; Figure 2A schematic diagram of a flow chart of feature extraction and encoding of a semantically enhanced fine-grained malicious behavior location method provided by an embodiment of the present invention; Figure 3 A structural diagram of a graph attention autoencoder model including bidirectional propagation and multiple masks, in a fine-grained malicious behavior localization method based on semantic enhancement provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in combination with the accompanying drawings and preferred embodiments, describes in detail the specific implementation method, structure, features and effects of a fine-grained malicious behavior positioning method and system based on semantic enhancement proposed by the present invention. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0023] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0024] The specific scheme of a semantically enhanced fine-grained malicious behavior positioning method and system provided by the present invention is described in detail below with reference to the accompanying drawings.

[0025] Due to the rapid mutation capability and escape means of malware, traditional static analysis methods rely on rich prior knowledge, are limited by fixed rules, and the model ages quickly. In addition, they fail to fully combine the typical characteristics of malicious behavior and the business needs of reverse analysis, and the API semantics and context semantics are not refined enough, and it is impossible to achieve "optimal matching" malicious behavior positioning; the first embodiment of the present invention provides a fine-grained malicious behavior positioning method based on semantic enhancement. The method uses a graph attention autoencoder model containing a bidirectional propagation mechanism and a multiple re-masking mechanism after training based on benign samples through feature encoding and graph structure optimization, and highly condenses the semantics related to malicious behavior in malicious samples, so that the model can effectively distinguish the benign and malicious parts in malicious samples, accurately locate the basic blocks of malicious behavior, realize rapid diagnosis of malicious samples, and improve the automation and accuracy of static malicious sample analysis; in order to solve a fine-grained malicious behavior positioning method based on semantic enhancement, the second embodiment of the present invention provides a fine-grained malicious behavior positioning system based on semantic enhancement, which is essentially a software system, which is composed of various units that implement corresponding functions. The specific steps in the method are now introduced in detail.

[0026] See also Figure 1, which shows a flow chart of a method for locating fine-grained malicious behavior based on semantic enhancement provided by an embodiment of the present invention, the method comprising: Step S1: Obtain benign samples and malicious samples to be detected respectively, perform feature extraction to design a feature set containing a semantically embedded API sequence, encode it through weights, generate node embedding expressions, fuse numerical features and sequence features, and construct an attribute control flow graph; Step S2: Optimize the attribute control flow graph and pre-process the malicious samples to be detected; Step S3: training a graph attention autoencoder model including bidirectional propagation and multiple masks based on benign samples; Step S4: Input the preprocessed malicious samples into the trained autoencoder model for reconstruction, calculate the reconstruction error, and achieve fine-grained malicious behavior positioning at the basic block level.

[0027] It can be explained that with the development of mobile Internet and the popularization of intelligent terminal devices, malicious behaviors are becoming more and more common during program operation, and the user group that suffers from malicious behaviors of terminal devices is also gradually expanding, which not only disrupts the normal order of the network market, but also poses a threat to users. That is, most malware implants a large number of advertisements that affect the normal use of users. Some malware even implants some hidden malicious codes, affecting the information security of users; or exploits application vulnerabilities and writes malicious scripts to achieve the purpose of making money or stealing privacy, posing a threat to the daily life and property safety of users; and the methods proposed on the market have certain limitations, resulting in low accuracy in locating malicious behaviors appearing in program codes, errors in semantic extraction, and failure to meet the application requirements of "optimized matching"; therefore, the technical solution of this embodiment is proposed to improve the precision and accuracy of malicious behavior positioning and provide a more efficient and reliable solution for malicious behavior positioning.

[0028] For better explanation, a basic block refers to an instruction sequence in a program with a single entry and exit, with no internal jumps. As the basic unit of malicious behavior analysis, it provides basic data support for subsequent graph structure construction and feature extraction. An API (Application Programming Interface) call sequence refers to the interface call sequence for the interaction between the software and the operating system in each basic block. It is used to capture the high-level semantics of software behavior and can reflect the software's operational intent.

[0029] As an optional implementation, in this embodiment, benign samples refer to normal behavior or harmless data samples that conform to the normal use and expected behavior of the system and do not contain any malicious intent or potential attack behavior, such as normal program operation, legal user behavior or normal network communication; malicious samples refer to data samples of potential malicious behavior or known malicious behavior, usually operations initiated by attackers or malicious users of the system or network, such as abnormal system calls, unknown code execution paths, suspicious network traffic, or privacy-invading tampered data.

[0030] See also Figure 2 , which shows a flowchart of feature extraction and encoding of a fine-grained malicious behavior localization method based on semantic enhancement provided by an embodiment of the present invention.

[0031] Furthermore, step S1 includes: Step S11: extract numerical features and sequence features based on benign samples and malicious samples to be detected, and perform semantic embedding based on the sequence features to obtain an indefinite length API call sequence, which is recorded as a sequence feature vector.

[0032] Furthermore, the numerical features include the number of basic arithmetic instructions, the number of logical operation instructions, the number of displacement instructions, the number of stack operation instructions, the number of register operation instructions and the number of port operation instructions; the sequence features include the API call sequence.

[0033] To clarify, numerical features refer to the statistics and analysis of the number of specific instructions during the design and execution of computer programs, including the number of basic arithmetic instructions, such as addition, subtraction, multiplication and division; the number of logical operation instructions, such as AND, OR, NOT, etc.; the number of displacement instructions, used to shift bits left or right; the number of stack operation instructions, which refers to push and pop in the stack structure; the number of register operation instructions, which is used to directly read and write the internal registers of the processor; the number of port operation instructions, which refers to data exchange with the input and output ports of the computer hardware; sequence features, that is, API call sequences can be used as key features to capture high-level system operations required to perform malicious behavior operations, such as network communication, file system interaction, registry access, and process management, thereby directly mapping the specific behavior patterns of malware in the underlying operating system or host environment.

[0034] In real life, malware often uses APIs with similar functions but different functions to evade detection. Therefore, an API semantic knowledge graph is constructed to semantically embed all APIs provided by the system to reduce detection errors. That is, the API semantic knowledge graph is constructed using the API description document to strengthen the technical problem of insufficient API semantic extraction, so as to strengthen the understanding of semantics in model training through semantic embedding, and ensure that each API can accurately understand and execute its assigned tasks; then all APIs in the system are clustered to obtain different cluster categories, and APIs in the same cluster category are regarded as semantically similar, and the specific API name is replaced by the number of the cluster category where the API is located to simplify the calculation, and then determine the indefinite length API call sequence corresponding to any node after the semantic embedding is completed, which is recorded as the sequence feature vector of the basic block corresponding to the node.

[0035] Step S12: Calculate the difference between any two nodes, record it as the distance between the nodes, count the frequency of repetition of each feature as the weight, cluster all nodes by weight to get several clusters, generate a code book based on the node closest to the corresponding cluster centroid in each cluster, and encode it.

[0036] Furthermore, the difference value of the node is calculated, and the corresponding calculation formula is:

[0037] in, , Represents any two nodes; Represents the number of numerical features; , Respectively represent nodes and nodes The corresponding numerical eigenvector; , Respectively represent nodes and nodes The corresponding sequence feature vector; express , The edit distance between two sequence feature vectors; , Respectively represent the sequence and sequence Length.

[0038] To explain, Represents the number of numerical features, which is specifically expressed as The value range is ; express , The edit distance between two sequence feature vectors refers to the sequence feature vector How many insertion, deletion, or replacement operations are required to become a sequence feature vector , which measures the minimum number of operations required to convert one string into another; , Respectively represent the sequence and sequence In the worst case, the number of operations required between the two sequences reaches the maximum possible value, which means that each element must be modified by insertion, deletion or replacement until the two sequences are completely different. At this time, the edit distance between the two sequence feature vectors is the sum of the lengths of the two sequence feature vectors.

[0039] Specifically, the frequency of repetition of each feature is recorded as a weight, and the weight-based DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm is used to perform cluster analysis on the nodes to obtain several clusters. In this embodiment, according to the sample situation, clusters, and take the node in each cluster that is closest to the centroid of the cluster, that is , generate a codebook ; The node The feature encoding is , the corresponding logic formula is:

[0040] in Representation Node and the corresponding node in the codebook The difference value .

[0041] It can be shown that, assuming a particular node The codebook node that is most similar to it , use a Dimensional vector To represent the node , and this vector is 0 in most dimensions, except for the codebook node There is a non-zero value at the corresponding position, that is, if the node With codebook node The most similar Dimensional vector Include 0, but for the codebook node In the The value at the dimension is the node With codebook node The difference value In addition, according to the actual application scenario, you can also choose to The vectors of nodes in the top three most similar codebooks are constructed , at this time, the vector There are non-zero values ​​in the dimensions corresponding to these three codebook nodes, and the remaining dimensions are still 0; this method can simplify the data structure and reduce the amount of encoding processing. The representation of non-zero values ​​can quickly locate the codebook node that is most similar to the node, speeding up information retrieval and enabling rapid identification and classification of similar nodes during deep learning.

[0042] Step S13: Construct the attribute control flow graph, denoted as ,in, Represents a property control flow graph; Represents a feature set; An adjacency matrix representing the attributed control flow graph; Represents the node feature matrix.

[0043] To explain, , Indicates the number of nodes; An adjacency matrix representing the attributed control flow graph; represents the node feature matrix, where Represents the dimension of the input node features, that is, the length of the codebook.

[0044] Furthermore, step S2 includes: Step S21: Prune unimportant nodes whose features are all 0, remove the corresponding nodes and the outgoing and incoming edges representing the dependencies, and add new edges to connect all the predecessor nodes and successor nodes of the pruned nodes.

[0045] To clarify, pruning refers to reducing the complexity of data by removing redundant, irrelevant or unimportant parts of the data, eliminating unnecessary nodes or edges, and highlighting the key behaviors of the program; specifically, first remove unimportant nodes whose features are all 0, and their outgoing and incoming edges that represent dependencies, that is, according to the program dependencies, remove nodes and redundant paths that are irrelevant as a whole or irrelevant to the target behavior to retain valuable information; then supplement the pruned nodes to maintain the integrity and connectivity of the network structure.

[0046] Step S22: Merge consecutive basic block nodes of the sequential structure.

[0047] It is explained that the sequential structure refers to the nodes in the program that are executed sequentially from top to bottom, and the continuous basic block nodes represent a continuous code sequence that does not contain jump instructions in the attribute control flow graph; specifically, multiple adjacent basic blocks that do not contain branch or jump instructions are merged into a single basic block, and the merger does not destroy the original program logic, thereby reducing the number of nodes in the attribute control flow graph and improving the efficiency of model optimization to simplify the attribute control flow graph.

[0048] Step S23: obtaining sub-images of equal size through sub-image sampling.

[0049] Preferably, in this embodiment, the shaDow-GNN (Shadow Graph Neural Network) method is used for subgraph sampling to process graphs of different sizes of the attribute control flow graph into subgraphs of the same size, solve the problem of variable-length input data, and provide a more compact and efficient graph structure for model training and reasoning; the subgraph contains sufficient information to support accurate learning and avoid the technical problem of insufficient semantic extraction; that is, subgraph sampling is to extract a subset from the entire graph in the attribute control flow graph, and the subset can be analyzed as an independent graph.

[0050] It is explained that shaDow-GNN is a graph neural network algorithm used to solve the problems of neighborhood explosion and over-smoothing of the global graph in the process of large-scale graph data learning. First, the IID (Independent and Identically Distributed) node sampler randomly selects nodes from the entire graph to ensure the independent and identical distribution of samples, reduce bias and enhance the generalization ability of the model. Secondly, the k-hop sampler expands to its k-hop neighbors based on the selected central node, and prevents neighborhood explosion by controlling the size of the receptive field of each node, where k represents the maximum number of hops from the central node. In addition, the PPR (Personalized PageRank) sampler adopts a personalized version based on PageRank, assigning probability weights according to the importance of specific nodes, so that the sampling process tends to select neighboring nodes that are more important to the central node, retaining the key information flow path. Finally, the randomized version of the PPR sampler, as a variant of the PPR sampler, further enhances the diversity of sampling by introducing randomness, which helps to avoid overfitting and improve the robustness of the model. The above components work together to ensure that shaDow-GNN avoids over-smoothing and neighborhood explosion problems of the global graph while ensuring that the subgraph contains enough information.

[0051] See also Figure 3, which shows a structural diagram of a graph attention autoencoder model including bidirectional propagation and multiple masks, in a fine-grained malicious behavior localization method based on semantic enhancement provided by an embodiment of the present invention.

[0052] It can be understood that the bidirectional propagation mechanism refers to the optimization based on the traditional propagation mechanism, that is, inside the original encoder and decoder, the two branches of forward propagation and backward propagation are divided into two branches to independently aggregate information until the last layer of the encoder and decoder, and the two branches of bidirectional propagation are re-aggregated; in the branch structure of the attribute control flow graph, different branches cannot be executed simultaneously at runtime, where loops or other situations lead to the reuse of a code block, which is regarded as multiple runs. Therefore, it is not in line with actual needs for different branches under the same node to aggregate each other's information. Therefore, the adjacency matrix and adjacency matrix transpose of the directed graph are adopted, that is, the bidirectional propagation mechanism is used as two independent information aggregation routes, where forward propagation and backward propagation share weights, forward propagation uses the real directed graph adjacency matrix, and backward propagation uses the adjacency matrix transpose to realize the inverse control flow propagation of information, which can not only solve the problem of context connection, but also effectively avoid the information fusion of different branches.

[0053] Specifically, in the bidirectional propagation mechanism, the node information in the same control flow path can be collected in a targeted manner. The corresponding logical formula is:

[0054] in, Indicates The output of the forward propagation of the layer, Indicates Output of layer backpropagation; represents the adjacency matrix; represents the adjacency matrix transpose; Indicates Layer weights; then, the last layer of the encoder and decoder merges the information independently aggregated at each node, and the corresponding logical formula is:

[0055] in, Represents the encoding, i.e., the final output of the graph attention autoencoder model that includes a bidirectional propagation mechanism and a multiple-masking mechanism, which corresponds to the second masked input in the multiple-masking mechanism.

[0056] It can be explained that the multiple re-occlusion mechanism is a technology used to deal with the situation where the target is occluded. When the target is partially or completely occluded by a non-target, the use of the multiple re-occlusion mechanism can help the system identify, track and reconstruct the object.

[0057] Specifically, the mechanism is respectively at the input encoder and the encoding The data is masked twice when it is input to the decoder. The first mask is before the data is input to the encoder, and a random Masking is performed without changing the adjacency matrix , in the node feature matrix After masking, we get , so that the decoder cannot obtain complete data information, so as to enable it to better learn the characteristics of benign samples and grasp the changing rules of benign samples; the second masking is in the encoder Before entering the decoder, Randomly select nodes in the encoding Re-mask on , Indicates The masked node selected is obtained after masking. , That is, multiple masking techniques are used to simulate the situation where some nodes or edges are missing, thereby enhancing the model's ability to capture local and global information.

[0058] Next, the graph attention mechanism is used to enable the graph attention autoencoder model containing bidirectional propagation and multiple masks to automatically learn the importance weights assigned to different neighbor nodes, making it more efficient and accurate when aggregating neighbor information.

[0059] Optionally, in this embodiment, a calculation method of additive attention coefficient is used; specifically, defining the node pair , represents the target node, Indicates the neighbor node corresponding to the target node, and calculates the importance of the node to the two nodes. The corresponding calculation formula is:

[0060] in, and Respectively represent nodes and The eigenvector of Represents a shared weight matrix used to linearly transform node feature vectors; The function is a single-layer feedforward neural network with input Perform the splicing operation and connect the nodes and nodes The features after linear transformation are concatenated together to form a new vector, which realizes the similarity calculation in additive attention and obtains the importance of all neighbor nodes of the target node currently analyzed. The softmax function is used to convert all importance into probability distribution to obtain the attention weight. , the corresponding calculation formula is:

[0061] in, Represents the attention weight, that is, the final target node For neighbor nodes The attention coefficient reflects the importance of neighbor nodes to the target node. Indicates the current analysis node The set of neighbor nodes in the forward propagation branch , in the backpropagation branch ; The function ensures that each target node The sum of the attention coefficients of all neighbor nodes is 1, and the attention coefficient is regarded as a probability distribution, which is conducive to filtering out target information from the input information, reducing data overload, reducing the attention to irrelevant information, and even filtering out irrelevant information, thereby improving the efficiency and accuracy of task processing.

[0062] It can be explained that after using benign samples to train the graph attention autoencoder model that includes bidirectional propagation and multiple masks, the autoencoder model can better grasp the change rules of benign samples. That is, through learning from benign samples, the model can identify the characteristics and patterns of benign behavior, and then more quickly identify the characteristics and patterns of malicious behavior, thereby improving the reliability of malicious behavior positioning; it can also effectively restore the code information flow, capture the complex relationship between program codes, and enhance the model's understanding of malicious behavior to solve the problem of fine-grained positioning.

[0063] Specifically, the obtained The decoder is used to reconstruct the features and obtain the corresponding , respectively calculated With the original node feature matrix The initial loss function between The value of The average of the loss function values , as the total loss function of the attribute control flow graph.

[0064] Furthermore, step S3 includes: Step S31: Transmit the benign sample to the graph attention autoencoder model including the bidirectional propagation mechanism and the multiple re-masking mechanism, design the initial loss function, and the corresponding calculation formula is:

[0065]

[0066] in, Indicates Initial loss function after heavy masking; , Respectively represent Nodes and Nodes The corresponding eigenvector; , Respectively represent nodes and nodes The The reconstructed feature vector is output after the second heavy mask and the decoder operation; Indicates the number of nodes in the attribute control flow graph in the input model; , All represent hyperparameters; represents the regularization term; Represents the graph attention autoencoder model with bidirectional propagation mechanism and multiple re-masking mechanism. The weight matrix of the layer.

[0067] To explain, Represents the mean square error, which is used to evaluate the difference between the model's predicted value and the true value; Indicates the number of nodes in the attribute control flow graph in the input model, that is, the number of rows in the input matrix; Represents the range constraint part, which is used to calculate the actual value and reconstruction value The biggest difference between .

[0068] Step S32: Obtain the average value through the number of multiple maskings, and correct the initial loss function to obtain the total loss function. The corresponding calculation formula is:

[0069] in, represents the total loss function; Indicates the number of multiple masking; Indicates Initial loss function after heavy masking.

[0070] It is explained that by using masks multiple times to process the node losses and taking the average value, the impact of single randomness can be reduced, making the model more stable, and improving the robustness and generalization ability of the model; it can also effectively prevent the model from overfitting the data in benign samples and improve the interpretability of the model.

[0071] Furthermore, step S4 includes: The preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated. The corresponding calculation formula is:

[0072] in, represents the reconstruction error; Indicates the number of multiple masking; , Respectively represent Nodes and Nodes The corresponding eigenvector; , Respectively represent nodes and nodes The The reconstructed feature vector is output after the second heavy mask and the decoder operation; Indicates the number of nodes in the attribute control flow graph in the input model; , All represent hyperparameters; Represents the graph attention autoencoder model with bidirectional propagation mechanism and multiple re-masking mechanism. The weight matrix of the layer; A judgment threshold is set. When the reconstruction error is greater than the judgment threshold, it indicates that the basic block corresponding to the current analysis node is a malicious basic block; when the reconstruction error is less than the judgment threshold, it indicates that the basic block corresponding to the current analysis node is a benign basic block.

[0073] Optionally, the judgment threshold is recorded as , which represents the boundary error value for distinguishing benign samples from malicious samples. It is determined according to the actual situation of the sample data. For example, in the detection of a malicious behavior, the reconstruction error of any basic block is 0.735. At this time, the corresponding judgment threshold , that is, the basic block is a malicious basic block, and the location of the malicious basic block is obtained through its corresponding node. On the contrary, if the reconstruction error of the basic block is less than , indicating that the basic block is a benign basic block, indicating that the current program runs well.

[0074] It can be understood that the present invention adopts weight-based clustering feature encoding, integrates numerical features and sequence features of different scales, and effectively solves the problem of single feature processing and inability to fully utilize API semantic information in traditional methods; analyzes the basic blocks in malicious samples for feature analysis and modeling, realizes basic block-level positioning of malicious behaviors, significantly improves the precision and accuracy of malicious behavior positioning, solves the shortcomings of existing methods in fine-grained positioning, and provides virus analysts with a more accurate malicious function positioning tool; uses benign samples to train a graph attention autoencoder model containing bidirectional propagation and multiple masks, so that the model learns the rules of benign samples, can effectively restore the code information flow, enhance the understanding of malicious behaviors, and can locate malicious behaviors according to the difference between good and evil in the absence of labeled data sets, thereby improving the reliability of malicious behavior positioning; at the same time, through variable-length output processing technology, the positioning range is quickly narrowed to adapt to the fixed-length input requirements, and the efficiency of malicious sample analysis is improved; in addition, by semantically embedding the API call sequence, combined with pruning and subgraph sampling, the ability to cope with newly emerging malicious behaviors and variants can be improved, the dependence on frequently updated models can be reduced, and the long-term availability and stability of the malicious behavior positioning method can be improved.

[0075] An embodiment of the present invention also proposes a fine-grained malicious behavior positioning system based on semantic enhancement, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of a fine-grained malicious behavior positioning method based on semantic enhancement are implemented as described in any of the aforementioned embodiments.

[0076] It is to be noted that a fine-grained malicious behavior positioning system based on semantic enhancement has the same beneficial effects as the fine-grained malicious behavior positioning method based on semantic enhancement provided above, which will not be elaborated here.

[0077] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0078] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A fine-grained malicious behavior location method based on semantic enhancement, characterized in that: The method comprises: Get benign samples and malicious samples to be detected respectively, perform feature extraction to design a feature set containing semantically embedded API sequences, encode them through weights, generate node embedding expressions, fuse numerical features and sequence features, and construct an attribute control flow graph; Optimize the attribute control flow graph to pre-process the malicious samples to be detected; Based on benign samples, we train a graph attention autoencoder model that includes bidirectional propagation and multiple masks; The preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated to achieve fine-grained malicious behavior positioning at the basic block level.

2. According to the semantic enhancement-based fine-grained malicious behavior positioning method of claim 1, it is characterized in that: We obtain benign samples and malicious samples to be detected respectively, extract features based on the two samples to obtain a feature set containing a semantically embedded API sequence, encode them through weights, generate node embedding expressions, fuse numerical features and sequence features, and construct an attribute control flow graph, including: Based on benign samples and malicious samples to be detected, numerical features and sequence features are extracted, and semantic embedding is performed based on the sequence features to obtain an indefinite length API call sequence, which is recorded as a sequence feature vector; Calculate the difference between any two nodes and record it as the distance between the nodes. Count the frequency of repetition of each feature as the weight. Cluster all nodes by weight to get several clusters. Generate a codebook based on the node closest to the corresponding cluster centroid in each cluster and encode it. Construct the attribute control flow graph, denoted as ,in, Represents a property control flow graph; Represents a feature set; An adjacency matrix representing the attributed control flow graph; Represents the node feature matrix.

3. According to the semantic enhancement-based fine-grained malicious behavior positioning method of claim 2, it is characterized in that: The numerical features include the number of basic arithmetic instructions, the number of logical operation instructions, the number of displacement instructions, the number of stack operation instructions, the number of register operation instructions and the number of port operation instructions; the sequence features include the API call sequence.

4. According to the semantic enhancement-based fine-grained malicious behavior positioning method of claim 2, it is characterized in that: Calculate the difference value of the node, the corresponding calculation formula is: ； in, , Represents any two nodes; Represents the number of numerical features; , Respectively represent nodes and nodes The corresponding numerical eigenvector; , Respectively represent nodes and nodes The corresponding sequence feature vector; express , The edit distance between two sequence feature vectors; , Respectively represent the sequence and sequence Length.

5. According to the semantic enhancement-based fine-grained malicious behavior positioning method of claim 2, it is characterized in that: Optimize the attribute control flow graph and pre-process the malicious samples to be detected, including: Prune unimportant nodes whose features are all 0, remove the corresponding nodes and the outgoing and incoming edges that represent dependencies, and add new edges to connect all predecessor nodes and successor nodes of the pruned nodes; Fusing consecutive basic block nodes of sequential structures; Subgraphs of equal size are obtained by subgraph sampling.

6. According to the semantic enhancement-based fine-grained malicious behavior positioning method of claim 5, it is characterized in that: Based on benign samples, we train a graph attention autoencoder model with bidirectional propagation and multiple masks, including: The benign samples are transferred to the graph attention autoencoder model including the bidirectional propagation mechanism and the multiple re-masking mechanism, and the initial loss function is designed. The corresponding calculation formula is: ； ； in, Indicates Initial loss function after heavy masking; , Respectively represent Nodes and Nodes The corresponding eigenvector; , Respectively represent nodes and nodes The The reconstructed feature vector is output after the second heavy mask and the decoder operation; Indicates the number of nodes in the attribute control flow graph in the input model; , All represent hyperparameters; represents the regularization term; Represents the graph attention autoencoder model with bidirectional propagation mechanism and multiple re-masking mechanism. The weight matrix of the layer; The average value is obtained by the number of multiple masks, and the initial loss function is corrected to obtain the total loss function. The corresponding calculation formula is: ； in, represents the total loss function; Indicates the number of multiple masking; Indicates Initial loss function after heavy masking.

7. The method for locating fine-grained malicious behavior based on semantic enhancement according to claim 6 is characterized in that: The preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated to achieve fine-grained malicious behavior positioning at the basic block level, including: The preprocessed malicious samples are input into the trained autoencoder model for reconstruction, and the reconstruction error is calculated. The corresponding calculation formula is: ； in, represents the reconstruction error; Indicates the number of multiple masking; , Respectively represent Nodes and Nodes The corresponding eigenvector; , Respectively represent nodes and nodes The The reconstructed feature vector is output after the second heavy mask and the decoder operation; Indicates the number of nodes in the attribute control flow graph in the input model; , All represent hyperparameters; Represents the graph attention autoencoder model with bidirectional propagation mechanism and multiple re-masking mechanism. The weight matrix of the layer; A judgment threshold is set. When the reconstruction error is greater than the judgment threshold, it indicates that the basic block corresponding to the current analysis node is a malicious basic block; when the reconstruction error is less than the judgment threshold, it indicates that the basic block corresponding to the current analysis node is a benign basic block.

8. A semantically enhanced fine-grained malicious behavior positioning system, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of a fine-grained malicious behavior positioning method based on semantic enhancement are implemented as described in any one of claims 1 to 7.

Images