Internet of Things malicious software detection method, device and equipment for air conditioner load management system and storage medium
By converting the opcode into an intermediate representation sequence and combining the feature vector of the abstract syntax tree, the problem of difficulty in detecting malware of different CPU architectures in the prior art is solved, and efficient and accurate detection of IoT malware is achieved.
Patent Information
- Application Number
- CN202411868063.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-18
- Publication Date
- 2025-04-22
AI Technical Summary
The existing IoT malware detection methods are difficult to compatible with different CPU architectures, and lack of feature extraction, which affects the accuracy and efficiency of detection.
By converting the opcode into an intermediate representation sequence and fusing it with the feature vectors of the abstract syntax tree, it is input to the IoT software classification model for identification. This model adopts 1D-CNN and BiLSTM networks to extract local features through multi-branch 1D-CNN, and BiLSTM analyzes time relationships and long-term dependencies to improve the accuracy of detection.
It realizes efficient detection of IoT malware in different CPU architectures, with more comprehensive feature representation and higher accuracy, improving the efficiency and accuracy of detection.
Smart Images
Figure CN119862571A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to software detection technology, and in particular to an Internet of Things malware detection method, device, equipment and storage medium based on an air conditioning load management system. Background Art
[0002] With the rapid development of Internet of Things (IoT) technology, air conditioning load management systems are gradually being embedded with more and more IoT intelligent control and data communication devices, making air conditioning load management systems more flexible and intelligent in terms of energy regulation, power optimization and user comfort management. However, while this intelligent trend brings about technological innovation, it also makes air conditioning load management systems face increasingly severe network security challenges. In recent years, malware targeting IoT devices (IoT Malware) has continued to evolve. It not only has the potential for large-scale remote distributed intrusion, but also can accurately attack air conditioning load management systems through advanced penetration and concealment methods, causing serious consequences such as equipment paralysis, abnormal energy consumption, and data leakage. Researching how to effectively defend, detect and mitigate the security threats of IoT malware to air conditioning load management systems in this emerging and vulnerable field has become a key task in the intersection of energy and information security.
[0003] Existing IoT malware detection methods face many challenges when dealing with complex attack scenarios. The diversity and heterogeneity of IoT devices lead to the existence of multiple CPU architectures within the system, which requires the detection method to be compatible with and process malware samples under different architectures, thereby increasing the complexity and difficulty of detection. Most traditional malware detection technologies extract opcodes and directly use opcodes as features or further extract features based on opcodes. However, IoT malware is based on multiple CPU architectures, and the opcode types are not uniform, which makes it impossible for traditional malware detection technologies to detect IoT malware. In addition, existing technologies often have deficiencies in feature extraction, making it difficult to fully and accurately characterize the behavioral characteristics of malware, which in turn affects the accuracy and efficiency of detection. Summary of the invention
[0004] In view of the problems existing in the prior art, the purpose of the present invention is to provide an Internet of Things malware detection method, device, equipment, program product and storage medium for an air conditioning load management system with high accuracy and efficiency.
[0005] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:
[0006] An Internet of Things malware detection method for an air conditioning load management system, comprising:
[0007] Get the opcodes of the IoT malware to be detected;
[0008] Convert the opcodes of IoT malware to intermediate representation sequences;
[0009] Extract the abstract syntax tree of the executable file of the IoT malware to be detected;
[0010] Convert the abstract syntax tree into a vector form to obtain a source code feature vector;
[0011] Fusing the intermediate representation sequence and the source code feature vector to obtain a fused feature vector;
[0012] The fused feature vector is input into an IoT software classification model to identify the software type of the IoT malware to be detected, wherein the IoT software classification model is trained by fused feature vectors of IoT malware of different CPU architectures with several known software type labels.
[0013] Furthermore, the step of converting the operation code of the IoT malware to be detected into an intermediate representation sequence specifically includes:
[0014] Binary reverse parsing tools are used to convert the opcodes of the IoT malware to be detected into intermediate representation sequences.
[0015] Furthermore, after converting the operation code of the IoT malware to be detected into an intermediate representation sequence, the method further includes: removing redundant information that appears repeatedly in the intermediate representation sequence.
[0016] Furthermore, the fusing the intermediate representation sequence and the source code feature vector to obtain a fused feature vector specifically includes:
[0017] Converting the intermediate representation sequence into a high-dimensional vector form;
[0018] The source code feature vector is concatenated after the intermediate representation sequence in the form of a high-dimensional vector to obtain a fused feature vector.
[0019] Furthermore, the Internet of Things software classification model includes several recognition networks connected in sequence, each recognition network includes several 1D-CNNs, a first splicing unit, a BiLSTM network and a second splicing unit, the input end of each 1D-CNN inputs a fused feature vector or is connected to the output end of the previous recognition network, the input end of the first splicing unit is connected to the output ends of all 1D-CNNs, the input end of the BiLSTM network is connected to the output end of the first splicing unit, the input end of the second splicing unit is connected to the output end of the first splicing unit and the output end of the BiLSTM network, and the output end of the second splicing unit is used as the output end of the current recognition network.
[0020] An Internet of Things malware detection device for an air conditioning load management system, comprising:
[0021] An operation code acquisition module is used to obtain the operation code of the IoT malware to be detected;
[0022] An opcode conversion module, used to convert the opcode of the IoT malware to be detected into an intermediate representation sequence;
[0023] An abstract syntax tree extraction module, used to extract the abstract syntax tree of the executable file of the IoT malware to be detected;
[0024] A source code feature vector extraction module, used for converting the abstract syntax tree into a vector form to obtain a source code feature vector;
[0025] A fused feature vector acquisition module, used to fuse the intermediate representation sequence and the source code feature vector to obtain a fused feature vector;
[0026] The software detection module is used to input the fused feature vector into an IoT software classification model to identify the software type of the IoT malware to be detected, wherein the IoT software classification model is trained by fused feature vectors of IoT malware of different CPU architectures with several known software type labels.
[0027] Furthermore, the opcode conversion module is specifically a binary reverse parsing tool.
[0028] Furthermore, the device also includes a redundancy processing module, which is used to remove redundant information that appears repeatedly in the intermediate representation sequence.
[0029] Furthermore, the fusion feature vector acquisition module specifically includes:
[0030] A vector conversion unit, used to convert the intermediate representation sequence into a high-dimensional vector form;
[0031] The vector concatenation unit is used to concatenate the source code feature vector to the intermediate representation sequence in the form of a high-dimensional vector to obtain a fused feature vector.
[0032] Furthermore, the Internet of Things software classification model includes several recognition networks connected in sequence, each recognition network includes several 1D-CNNs, a first splicing unit, a BiLSTM network and a second splicing unit, the input end of each 1D-CNN inputs a fused feature vector or is connected to the output end of the previous recognition network, the input end of the first splicing unit is connected to the output ends of all 1D-CNNs, the input end of the BiLSTM network is connected to the output end of the first splicing unit, the input end of the second splicing unit is connected to the output end of the first splicing unit and the output end of the BiLSTM network, and the output end of the second splicing unit is used as the output end of the current recognition network.
[0033] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above method.
[0034] A computer-readable storage medium stores a computer program / instruction thereon, wherein the computer program / instruction implements the above method when executed by a processor.
[0035] A computer program product comprises a computer program / instruction, wherein the computer program / instruction implements the above method when executed by a processor.
[0036] Compared with the prior art, the present invention has the following beneficial effects: the present invention converts the operation code into an intermediate representation sequence, realizes the detection of Internet of Things malware of different architectures, and is highly efficient; adopts a fused feature vector that fuses the intermediate representation sequence and the abstract syntax tree for identification, comprehensively covers the logic flow and the control flow, and the feature representation is more comprehensive and the accuracy is higher; the Internet of Things software classification model adopts 1D-CNN for dimensionality reduction and local feature extraction, fully extracts various types of local features through multi-branch 1D-CNN, and then forms global features through splicing, and then adopts BiLSTM analysis to capture time relationships and long-term dependencies, and then adopts residuals to add the outputs of 1D-CNN and BiLSTM, thereby increasing classification accuracy and preventing gradient disappearance or gradient explosion. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] Figure 1 It is a flow chart of an embodiment of the method for detecting malware in the Internet of Things for an air conditioning load management system provided by the present invention;
[0038] Figure 2 It is a schematic diagram of the model structure of the Internet of Things software classification model provided by the present invention;
[0039] Figure 3 This is a graph of the validation set experimental results of the Internet of Things software classification model provided by the present invention;
[0040] Figure 4 This is a test set experimental result diagram of the Internet of Things software classification model provided by the present invention;
[0041] Figure 5 It is a diagram of the experimental results of the validation set of the detection model of the present invention and the prior art;
[0042] Figure 6 It is a test set experimental result diagram of the detection model of the present invention and the prior art;
[0043] Figure 7 It is a structural schematic diagram of an embodiment of an Internet of Things malware detection device for an air conditioning load management system provided by the present invention;
[0044] Figure 8 It is a structural schematic diagram of an embodiment of a computer device provided by the present invention. DETAILED DESCRIPTION
[0045] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.
[0046] Embodiment 1
[0047] The embodiment of the present invention provides an Internet of Things malware detection method for an air conditioning load management system, such as Figure 1 As shown, the following steps are included:
[0048] S101. Obtain an operation code of the IoT malware to be detected.
[0049] Among them, the opcode refers to the part of the instruction or field (usually represented by code) specified in the computer program to perform the operation. In fact, it is the instruction sequence number, which is used to tell the CPU which instruction needs to be executed. Different instructions are represented by different encodings of the opcode field, and each encoding represents an instruction. The opcode can directly instruct the computer to perform specific operations, such as loading values, performing arithmetic operations, comparing data, controlling program flow, etc. Modern high-level languages (such as Java, C++) will automatically convert high-level instructions into opcodes so that the hardware processor can understand and execute them. This process is called compilation, which translates the source code into machine language, which contains a series of opcodes to realize the functions of the program.
[0050] S102: Convert the operation code of the IoT malware to be detected into an intermediate representation sequence.
[0051] In specific implementation, after obtaining the opcode, a binary reverse parsing tool can be used to convert the opcode of the IoT malware to be detected into an intermediate representation sequence. For example, the B2R2 tool can be used to standardize the opcodes of the IoT malware to be detected, regardless of whether they are from MIPS, Intel 80386 or ARM CPU architectures, into a unified intermediate representation (IR) sequence, thereby eliminating differences between architectures and facilitating further analysis and processing. The calculation process is expressed by the following formula:
[0052] f IR =B2R2(f executable )
[0053] Where B2R2() is the B2R2 function, f executable represents the operation code of the IoT malware to be detected, f IR It represents the IR sequence output by B2R2. It can be understood that in other embodiments, other similar tools can also be used to achieve the conversion of operation codes.
[0054] It should be noted that the intermediate representation (IR) sequence converted from the opcode here is not a disassembly process, but an intermediate data obtained after parsing the opcode. The use of this intermediate data can achieve the unification of software of different CPU architectures without the need to perform disassembly like traditional technology. It is faster and more efficient, and provides a basis for subsequent processing.
[0055] In addition, in other embodiments, after obtaining the intermediate representation (IR) sequence, the repeated redundant information can also be removed. For example, the IR sequence output by B2R2 contains two types of redundant information, which hinders the effective processing and accuracy of the classification model. The first type of redundancy is the repeated occurrence of a specific IR sequence. The second type of redundancy is the continuous repetition of a specific sequence. Identify and record the repeated opcodes in the IR sequence, and retain only two instances for each repeated IR sequence; use the sliding window technology to identify and delete the continuously repeated IR sequences. By effectively removing redundant information, the deduplication model ensures high-quality and valid input data, providing more refined and representative feature data for subsequent deep learning classification models. The computational details of the IR sequence redundant information processing are as follows:
[0056]
[0057] Among them, IR_Deduplication_1() represents the deduplication algorithm of the first type of redundant information, f IR-1 Represents the IR sequence obtained after IR_Deduplication_1() processing; IR_Deduplication_2(f IR-1 ) represents the deduplication algorithm of the second type of redundant information, fIR-2 Represents the IR sequence obtained after IR_Deduplication_1() processing.
[0058] S103: extracting an abstract syntax tree of the executable file of the IoT malware to be detected.
[0059] In the specific implementation, first obtain the executable file of the IoT malware to be detected, and then extract the AST abstract syntax tree that can be used for the executable file. Specifically, it can be expressed as follows:
[0060] f ast =AST(T executable )
[0061] In the formula, f ast represents the abstract syntax tree, AST() represents the abstract syntax tree extraction algorithm, T executable Indicates an executable file.
[0062] S104: Convert the abstract syntax tree into a vector form to obtain a source code feature vector.
[0063] The abstract syntax tree can be converted into a vector using the Graph2Vec method or other vector conversion methods. The specific algorithm is as follows:
[0064] y g =Graph2Vec(f ast )
[0065] In the formula, y g Represents the source code feature vector.
[0066] S105: Fusing the intermediate representation sequence and the source code feature vector to obtain a fused feature vector.
[0067] When implementing this step, first convert the intermediate representation sequence into a high-dimensional vector form; then concatenate the source code feature vector after the intermediate representation sequence in the high-dimensional vector form to obtain a fused feature vector. The algorithm is expressed as:
[0068] y w =Word_Embedding(f IR-2 )
[0069] y=[y w ,y g ]
[0070] In the formula, y w represents the intermediate representation sequence in the form of a high-dimensional vector, and y represents the fused feature vector.
[0071] The intermediate representation sequence covers the semantic relationship of the software code, that is, the logical relationship of the code. The abstract syntax tree covers the control behavior information of the software. The fused feature vector fuses the intermediate representation sequence and the abstract syntax tree, so that the code logic and control flow can be more comprehensively represented, improving the completeness of feature expression and the accuracy of the detection model.
[0072] S106: Input the fused feature vector into an IoT software classification model to identify the software type of the IoT malware to be detected.
[0073] The IoT software classification model is obtained by training the fused feature vectors of IoT malware with different CPU architectures and known software type labels.
[0074] like Figure 2 As shown, the Internet of Things software classification model includes several recognition networks connected in sequence, each recognition network includes several 1D-CNNs, a first splicing unit, a BiLSTM network and a second splicing unit, the input end of each 1D-CNN inputs a fusion feature vector or is connected to the output end of the previous recognition network, the input end of the first splicing unit is connected to the output end of all 1D-CNNs, the input end of the BiLSTM network is connected to the output end of the first splicing unit, the input end of the second splicing unit is connected to the output end of the first splicing unit and the output end of the BiLSTM network, and the output end of the second splicing unit is used as the output end of the current recognition network. The algorithm is expressed as:
[0075] y cnn,k,l+1 =1D-CNN k,l+1 (y cnn,l +y lstm,l )
[0076] y cnn,l+1 =[y cnn,1,l+1 ,y cnn,2,l+1 …,y cnn,n,l+1 ]
[0077] y lstm,l+1 =BiLSTM l+1 (y cnn,l+1 )
[0078] 1D-CNN k,l+1 is the function of the kth 1D-CNN of the l+1th recognition network, y cnn,k,l+1 For 1D-CNN k,l+1 The output of all 1D-CNNs is concatenated together to get y cnn,l+1 ; Where n is the total number of 1D-CNN. BiLSTM l+1 It is the BiLSTM network of the l+1th recognition network, and the output is y lstm,l+1 .
[0079] This IoT software classification model uses 1D-CNN to reduce dimension and extract local features. Multi-branch 1D-CNN fully extracts various types of local features, and then forms global features through splicing. BiLSTM analysis is then used to capture temporal relationships and long-term dependencies. The residual is then used to add the outputs of 1D-CNN and BiLSTM to increase classification accuracy and prevent gradient vanishing or gradient explosion.
[0080] The IoT malware of four different architectures, namely Intel 80386, ARM, X86-64 and MIPS, is divided into training set, validation set and test set to ensure effective evaluation and adjustment at different stages. The detailed data of the dataset is shown in Table 1:
[0081] Table 1. Number of normal samples of datasets with different architectures
[0082] Intel 80386 ARM X86-64 MIPS Training set 2062 2095 2031 2014 Validation set 571 581 541 558 Test Set 269 254 252 262
[0083] The malware distribution of each architecture is listed. In order to maintain the balance of positive and negative samples in the dataset, we specially collected legitimate samples of these four architectures to ensure that the number of normal samples and malicious samples in each architecture remains roughly consistent, as shown in Table 2. The evaluation indicators used in this invention are precision, recall and F1 score.
[0084] Table 2 Number of malicious samples in datasets with different architectures
[0085] Intel 80386 ARM X86-64 MIPS Training set 2073 2081 2046 2053 Validation set 569 585 555 567 Test Set 260 252 251 255
[0086] Next, we analyze and verify the semantic extraction ability of IR sequences, and compare the combined learning model with the individual 1D-CNN and LSTM models. Specifically, we compare the F1 scores of different models on the validation set to evaluate the effectiveness of their semantic information extraction. Figure 3 As shown, the experimental results show that the single 1D-CNN classification model has the lowest F1 score of only 83.23%, which reveals the model's inadequacy in extracting semantic information. In contrast, the independent LSTM model improves the F1 score to 88.87%, which demonstrates the advantages of LSTM in processing sequence data and extracting semantic information. Most notably, when the present invention is used, the F1 score is significantly improved to 95.96%, which fully demonstrates the excellent ability of the present invention in extracting complex semantic features in IR sequences. In addition, Figure 4The experimental results on the test set are shown, which are consistent with the results on the validation set, further confirming the stable performance of the proposed model on different data sets and showing no signs of overfitting. The experimental results on the test set also show that the deep learning classification model combining 1D-CNN and LSTM is significantly better than the separate 1D-CNN and LSTM models in terms of F1 score, thus verifying the reliability and practicality of the method of the present invention.
[0087] Next, we will compare the method with other malware detection methods. Specifically, the method of the present invention is compared with two existing models. The first model was proposed by Darabian et al., which mainly focuses on analyzing and classifying malware opcodes using machine learning models; the second model was proposed by Riaz et al., which uses bag-of-words technology to convert text into vectors and then uses machine learning models for malware identification. The experimental results are shown in Figure 2. Figure 5 and Figure 6 As shown, Figure 3 The results on the validation set are presented, which clearly show that the detection method of the present invention outperforms the two existing models in performance. The bag-of-words technique used by Riaz et al. is prone to losing semantic information in the IR sequence during word vector conversion, while the simple machine learning models (such as support vector machines and k-nearest neighbors) relied on by Darabian et al. are difficult to effectively analyze the complex semantic relationships in the opcodes, resulting in their detection performance being inferior to that of the method of the present invention. Figure 6 The results on the test set are shown, and Figure 5 The results are similar to those of the previous paper, which further proves the superiority of the proposed IoT malware detection method in terms of accuracy and verifies the effectiveness and practicability of the method of the present invention.
[0088] Embodiment 2
[0089] The embodiment of the present invention provides an IoT malware detection device for an air conditioning load management system, which can be implemented in software and / or hardware, and can be configured in a terminal device. Figure 7 As shown, the device comprises:
[0090] An operation code acquisition module 201 is used to acquire an operation code of the IoT malware to be detected;
[0091] An operation code conversion module 202 is used to convert the operation code of the IoT malware to be detected into an intermediate representation sequence; specifically, a binary reverse parsing tool may be used;
[0092] An abstract syntax tree extraction module 203 is used to extract an abstract syntax tree of an executable file of the IoT malware to be detected;
[0093] A source code feature vector extraction module 204 is used to convert the abstract syntax tree into a vector form to obtain a source code feature vector;
[0094] A fused feature vector acquisition module 205 is used to fuse the intermediate representation sequence and the source code feature vector to obtain a fused feature vector;
[0095] The software detection module 206 is used to input the fused feature vector into an IoT software classification model to identify the software type of the IoT malware to be detected, wherein the IoT software classification model is trained by fused feature vectors of IoT malware of different CPU architectures with several known software type labels.
[0096] In other embodiments, the apparatus may further include: a redundancy processing module, configured to remove redundant information that appears repeatedly in the intermediate representation sequence.
[0097] Among them, the Internet of Things software classification model includes several recognition networks connected in sequence, each recognition network includes several 1D-CNNs, a first splicing unit, a BiLSTM network and a second splicing unit, the input end of each 1D-CNN inputs a fusion feature vector or is connected to the output end of the previous recognition network, the input end of the first splicing unit is connected to the output ends of all 1D-CNNs, the input end of the BiLSTM network is connected to the output end of the first splicing unit, the input end of the second splicing unit is connected to the output end of the first splicing unit and the output end of the BiLSTM network, and the output end of the second splicing unit is used as the output end of the current recognition network.
[0098] The fusion feature vector acquisition module 205 specifically includes:
[0099] A vector conversion unit, used to convert the intermediate representation sequence into a high-dimensional vector form;
[0100] The vector concatenation unit is used to concatenate the source code feature vector to the intermediate representation sequence in the form of a high-dimensional vector to obtain a fused feature vector.
[0101] The device provided in the embodiment of the present invention can be used to execute the method provided in the first embodiment of the present invention, and has the corresponding functions and beneficial effects of executing the method.
[0102] It is worth noting that in the embodiment of the above-mentioned determination device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.
[0103] The embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, or of course, it can be implemented only by hardware, as long as the function or effect can be achieved.
[0104] Embodiment 3
[0105] Figure 8 Schematic diagram of the structure of a computer device provided by an embodiment of the present invention. The embodiment of the present invention provides services for implementing the method of the above-mentioned embodiment 1 of the present invention. Figure 8 As shown, the device may include: a memory 301 storing a computer executable program; a processor 302 coupled to the memory 301; the processor 302 calls the computer executable program stored in the memory 301 to execute the steps in the method described in the first embodiment.
[0106] The memory 301 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the memory 301 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as "hard drives"). A program / utility having a set (at least one) of program modules may be stored in, for example, the memory 301, such program modules including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include the implementation of a network environment. The computer executable program of the program module typically performs the functions and / or methods in the embodiments described in the present invention.
[0107] The processor 302 executes various functional applications and data processing by running the program stored in the memory 301, such as implementing the method provided in the first embodiment of the present invention.
[0108] The code of the computer executable program can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" language or similar programming languages.
[0109] Embodiment 4
[0110] An embodiment of the present invention provides a storage medium including a computer executable program. When the computer executable program is executed by a computer processor, it is used to execute the method of the first embodiment.
[0111] The storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.
[0112] Of course, the storage medium including a computer executable program provided by an embodiment of the present invention, the computer executable program is not limited to the above method operations, and can also execute related operations in the method provided by any embodiment of the present invention.
[0113] Embodiment 5
[0114] The embodiment of the present invention also provides a computer product, such as an app on a mobile phone, a tablet, an installation program on a computer, etc., which includes a computer program / instruction, and the computer program / instruction is executed by a processor to implement the method described in Example 1. The code of the computer executable program for performing the operation of the present invention can be written in one or more programming languages or a combination thereof, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).
[0115] It should be understood that the above embodiments and descriptions only describe the principles, main features and advantages of the present invention. Without departing from the spirit and scope of the present invention, the present invention may be subject to various changes and improvements, and these changes and improvements all fall within the scope of protection of the present invention.
Claims
1. A method for detecting malware in the Internet of Things for an air conditioning load management system, characterized in that: include: Get the opcodes of the IoT malware to be detected; Convert the opcodes of IoT malware to intermediate representation sequences; Extract the abstract syntax tree of the executable file of the IoT malware to be detected; Convert the abstract syntax tree into a vector form to obtain a source code feature vector; Fusing the intermediate representation sequence and the source code feature vector to obtain a fused feature vector; The fused feature vector is input into an IoT software classification model to identify the software type of the IoT malware to be detected, wherein the IoT software classification model is trained by fused feature vectors of IoT malware of different CPU architectures with several known software type labels.
2. The method for detecting malware in the Internet of Things for an air conditioning load management system according to claim 1, characterized in that: The step of converting the operation code of the IoT malware to be detected into an intermediate representation sequence specifically includes: Binary reverse parsing tools are used to convert the opcodes of the IoT malware to be detected into intermediate representation sequences.
3. The method for detecting malware in the Internet of Things for an air conditioning load management system according to claim 1, characterized in that: After converting the operation code of the IoT malware to be detected into an intermediate representation sequence, the method further includes: Remove redundant information that appears repeatedly in the intermediate representation sequence.
4. The method for detecting malware in the Internet of Things for an air conditioning load management system according to claim 1, characterized in that: The fusing the intermediate representation sequence and the source code feature vector to obtain a fused feature vector specifically includes: Converting the intermediate representation sequence into a high-dimensional vector form; The source code feature vector is concatenated with an intermediate representation sequence in a high-dimensional vector form to obtain a fused feature vector.
5. The method for detecting malware in the Internet of Things for an air conditioning load management system according to claim 1, characterized in that: The Internet of Things software classification model includes several recognition networks connected in sequence, each recognition network includes several 1D-CNNs, a first splicing unit, a BiLSTM network and a second splicing unit, the input end of each 1D-CNN inputs a fused feature vector or is connected to the output end of the previous recognition network, the input end of the first splicing unit is connected to the output ends of all 1D-CNNs, the input end of the BiLSTM network is connected to the output end of the first splicing unit, the input end of the second splicing unit is connected to the output end of the first splicing unit and the output end of the BiLSTM network, and the output end of the second splicing unit is used as the output end of the current recognition network.
6. An IoT malware detection device for an air conditioning load management system, characterized in that: include: An operation code acquisition module is used to obtain the operation code of the IoT malware to be detected; An opcode conversion module, used to convert the opcode of the IoT malware to be detected into an intermediate representation sequence; An abstract syntax tree extraction module, used to extract the abstract syntax tree of the executable file of the IoT malware to be detected; A source code feature vector extraction module, used for converting the abstract syntax tree into a vector form to obtain a source code feature vector; A fused feature vector acquisition module, used to fuse the intermediate representation sequence and the source code feature vector to obtain a fused feature vector; The software detection module is used to input the fused feature vector into an IoT software classification model to identify the software type of the IoT malware to be detected, wherein the IoT software classification model is trained by fused feature vectors of IoT malware of different CPU architectures with several known software type labels.
7. The Internet of Things malware detection device for air conditioning load management system according to claim 6, characterized in that: The operation code conversion module is specifically a binary reverse parsing tool.
8. The Internet of Things malware detection device for air conditioning load management system according to claim 6, characterized in that: The device also includes: The redundancy processing module is used to remove redundant information that appears repeatedly in the intermediate representation sequence.
9. The Internet of Things malware detection device for air conditioning load management system according to claim 6, characterized in that: The fusion feature vector acquisition module specifically includes: A vector conversion unit, used to convert the intermediate representation sequence into a high-dimensional vector form; The vector concatenation unit is used to concatenate the source code feature vector to the intermediate representation sequence in the form of a high-dimensional vector to obtain a fused feature vector.
10. The Internet of Things malware detection device for air conditioning load management system according to claim 6, characterized in that: The Internet of Things software classification model includes several recognition networks connected in sequence, each recognition network includes several 1D-CNNs, a first splicing unit, a BiLSTM network and a second splicing unit, the input end of each 1D-CNN inputs a fused feature vector or is connected to the output end of the previous recognition network, the input end of the first splicing unit is connected to the output ends of all 1D-CNNs, the input end of the BiLSTM network is connected to the output end of the first splicing unit, the input end of the second splicing unit is connected to the output end of the first splicing unit and the output end of the BiLSTM network, and the output end of the second splicing unit is used as the output end of the current recognition network.
11. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the computer program to implement the method according to any one of claims 1 to 5.
12. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: The computer program / instructions, when executed by a processor, implement the method of any one of claims 1-5.
13. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.