APT organization malicious code defense method based on prior knowledge guided adversarial training

Abstract

The application discloses an APT organization malicious code defense method based on prior knowledge guided adversarial training, comprising the following steps: extracting distribution information of malicious code labels; calculating the frequency of each label appearing in a data set, which is used as prior knowledge for subsequent adversarial training; in the adversarial training process, selecting a label which is more likely to be misclassified as a target label according to the distribution information of the malicious code labels, and determining the sampling frequency of the target label according to the appearance frequency of the label through a weighted random sampling technology, so as to guide the generation process of the adversarial sample; using a generative adversarial network (GAN) to generate an adversarial sample; training the generated adversarial sample and the original sample as a training set to obtain a malicious code detection model, and the training target is to minimize the weighted combination of standard loss and adversarial loss, and the defense against malicious code attacks is realized based on the malicious code detection model. The application can improve the overall detection capability and robustness of the APT organization malicious code defense system.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of machine learning, and specifically relates to an APT malicious code defense method based on prior knowledge guided adversarial training. BACKGROUND

[0002] With the rapid development of Internet technology and the acceleration of global digital transformation, the network security situation is becoming increasingly severe, especially the emergence of Advanced Persistent Threat (APT) attacks, which has brought unprecedented challenges to the information security of countries, enterprises and individuals. APT attacks are known for their high concealment, explicit targeting and persistence, aiming to penetrate into the target network through a series of complex attack steps and steal sensitive information or destroy critical infrastructure. Such attacks can last for months to years to achieve long-term intelligence collection or strategic destruction purposes.

[0003] Although important breakthroughs have been made in malware detection using deep learning and machine learning techniques in recent years, effective prevention against APT attacks still faces great challenges. Existing malware detection techniques mainly rely on static analysis (based on known malicious code features) and dynamic analysis (based on the behavior patterns of malicious software), which have obvious limitations in the face of APT attacks:

[0004] Data imbalance problem: APT malware is often represented as a minority class in the training dataset due to its uniqueness and customization. This leads most traditional machine learning algorithms to prioritize identifying the more numerous ordinary malware categories, while neglecting the important but rare APT malware category, thus weakening the detection effectiveness.

[0005] Adversarial attacks: APT attackers deliberately create adversarial samples that can bypass existing detection mechanisms, which can successfully evade detection under certain circumstances, increasing the difficulty of identification.

[0006] Insufficient model robustness: Current malware detection models show certain vulnerability in dealing with the continuous innovation and variant strategies of APT attackers. Attackers can make minor changes to malicious code to make the detection model ineffective, affecting the stability and reliability of the system.

[0007] In view of the above problems, it is an urgent need in the field of network security to research and develop a more efficient, accurate and highly adaptable APT malicious code detection system. This not only requires innovation at the algorithm level, but also needs improvement in data collection, model training and practical application, etc. to comprehensively improve the overall effectiveness of the APT attack defense system. SUMMARY

[0008] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, and provide an APT organization malicious code defense method based on prior knowledge guided adversarial training, which can effectively cope with the challenge of uneven distribution of APT malicious code labels by introducing the prior knowledge of malicious code family labels, so that the malicious code detection model performs better in identifying customized and concealed malicious codes.

[0009] In order to achieve the above purpose, the present application adopts the following technical scheme:

[0010] In the first aspect, the present application provides an APT organization malicious code defense method based on prior knowledge guided adversarial training, comprising the following steps:

[0011] The obtained malicious code samples are cleaned and preprocessed as original samples, and the distribution information of malicious code labels is extracted; the malicious code samples include malicious codes and benign codes;

[0012] Based on the distribution information of malicious code labels, the frequency of each label appearing in the data set is calculated, and the frequency is used as prior knowledge for subsequent adversarial training;

[0013] During the adversarial training process, the label that is more likely to be misclassified is selected as the target label according to the distribution information of the malicious code label, and the sampling frequency of the target label is determined according to the frequency of the label by using the weighted random sampling technology, so as to guide the generation process of the adversarial sample;

[0014] An adversarial sample is generated using a generative adversarial network (GAN); the GAN includes a generator G and a discriminator D, the generator G adopts a convolutional neural network (CNN) structure, and the discriminator D adopts a multi-layer perceptron (MLP) structure; a sample with specific perturbation is generated through adversarial training, which will guide the model to produce incorrect classification results;

[0015] The generated adversarial sample and the original sample are trained as a training set to obtain a malicious code detection model, and the training target is to minimize the weighted combination of standard loss and adversarial loss, and the defense against malicious code attacks is realized based on the malicious code detection model.

[0016] As a preferred technical scheme, the obtained malicious code samples are cleaned and preprocessed, and the distribution information of malicious code labels is extracted, specifically:

[0017] The data of the obtained malicious code samples are cleaned to remove noise and invalid samples;

[0018] The malicious code and benign code dataset is input into the sandbox for preprocessing, and the JSON information of the apistat part about API call information is extracted, specifically including:

[0019] First, all dynamic call APIs are extracted from the dataset, and a set containing M API call elements is generated;

[0020] Then, the API call is converted into a feature vector through One-hot encoding;

[0021] Next, the random forest algorithm is used to perform binary classification on the training set data, and the top m features with the largest weights are selected as the final feature set according to the feature importance.

[0022] As a preferred technical solution, the distribution information based on the malicious code label is calculated, and the frequency of each label appearing in the dataset is calculated, specifically:

[0023] In the data preprocessing stage, the number of occurrences of each label in the dataset is counted, and the frequency of each label is calculated based on the total number of samples as prior knowledge for subsequent adversarial training, and the specific calculation formula is:

[0024]

[0025] Where count(c i ) is the number of occurrences of label c i , and n is the total number of samples.

[0026] As a preferred technical solution, in the adversarial training, the sampling frequency of the label is represented as follows:

[0027]

[0028] Where P(y t =c i ) represents the probability of the target label c i being selected, and f(c i ) represents the frequency of label c i in the dataset.

[0029] As a preferred technical solution, in the training process of GAN, the generator G and the discriminator D are trained alternately through multiple iterations, and the goal of the generator G is to generate realistic samples to deceive the discriminator, while the goal of the discriminator D is to distinguish between real samples and generated samples;

[0030] The loss function L G of the generator is composed of the adversarial loss and the reconstruction loss, and is represented as follows:

[0031] L G =Ez～p(z) [-logD(G(z))] + aE x～p(x) [||x-G(z)||]

[0032] where the adversarial loss part E z～p(z) [-logD(G(z))] makes the generator output confuse the discriminator; the reconstruction loss part E x～p(x) [||x-g(z)||] makes the generated samples closer to the original samples by minimizing the deviation of input and output in data space, and the parameter a is a hyperparameter that controls the weight, and z represents a noise vector;

[0033] The loss function L D of the discriminator is designed as follows:

[0034] L D = -E x～p(x) [logD(x)] - E z～p(z) [1-log(1-D(G(z)))] + b|E x～p(x) [y] - E z～p(z) [D(G(z))]|.

[0035] where D(x) represents the probability prediction of the discriminator D on the input sample x being a real sample, with a value range of (0, 1), and the closer to 1, the more confident the discriminator is that the sample is a real sample; G(z) represents the sample generated by the generator G after inputting random noise z, z ~ p(z) represents the distribution of noise Z, E x～p(x) [logD(x)] represents the expectation of the sample in the real sample set p(x), and the goal is to maximize this value to make the discriminator better identify real samples; E z～p(z) [1-log(1-D(G(z)))] represents the expectation of the generated sample set G(z), and the goal is to minimize this value to make the discriminator better distinguish between generated samples and real samples; E x～p(x) [y] represents the expected value of the label of the real sample x, which is used to measure whether the discriminator can accurately predict the real sample as 1; E z～p(z) [D(G(z))] represents the expected value of the generated sample G(z) being predicted as a real sample by the discriminator, which is used to evaluate the judgment ability of the discriminator on the generated sample; b represents the coordination weight; |E x～p(x) [y] - E z～p(z) [D(G(z))]| represents the auxiliary discriminator consistency regularization term, which is used to ensure the consistency of the output of the discriminator, i.e., the distribution prediction value and the expected value of the real sample and the generated sample as a whole are consistent;

[0036] The loss function L DThe ability of discriminating real samples and the ability of identifying generated samples are considered simultaneously, and a regular term of consistency of auxiliary discriminator output with itself is added, and beta is a coordination weight.

[0037] As a preferred technical solution, in the process of generating the adversarial sample, a projection gradient descent (PGD) optimization algorithm is used for updating, and the adversarial sample with a specific direction disturbance is generated based on the target label, so that the prediction of the model is offset to the direction of the target label.

[0038] As a preferred technical solution, the standard loss L std is a cross-entropy loss, and the calculation formula is as follows:

[0039]

[0040] Wherein, y i represents the actual label of the sample x i , and f(x i ; theta) represents the prediction probability of the malicious code detection model.

[0041] The adversarial loss L adv is calculated by the adversarial sample:

[0042]

[0043] Wherein, represents the generated adversarial sample, represents the target label of the adversarial sample. represents the prediction probability distribution of the malicious code detection model for the input sample x i , which is the output result of the model.

[0044] The final training loss function is the weighted combination of the standard loss L std and the adversarial loss L adv :

[0045] L total = L std + lambda L adv

[0046] Wherein, lambda is a hyperparameter for controlling the trade-off between the standard loss and the adversarial loss.

[0047] Secondly, the application provides an APT organization malicious code defense system based on prior knowledge guided adversarial training, which is applied to the APT organization malicious code defense method based on prior knowledge guided adversarial training, and includes a data acquisition module, a prior knowledge acquisition module, a target label selection module, an adversarial sample generation module and a model training module.

[0048] The data acquisition module is configured to acquire malicious code samples, clean and preprocess the acquired malicious code samples as original samples, and extract distribution information of malicious code labels; the malicious code samples include malicious codes and benign codes;

[0049] The prior knowledge acquisition module is configured to calculate a frequency of each label appearing in the data set based on the distribution information of the malicious code labels, and use the frequency as prior knowledge for subsequent adversarial training.

[0050] The target label selection module is configured to select a label that is more likely to be misclassified as a target label according to the distribution information of the malicious code labels during the adversarial training, and determine a sampling frequency of the target label according to the frequency of the label by using a weighted random sampling technique, so as to guide the generation process of the adversarial samples.

[0051] The adversarial sample generation module is configured to generate adversarial samples by using a generative adversarial network (GAN), wherein the GAN includes a generator G and a discriminator D, the generator G adopts a convolutional neural network (CNN) structure, and the discriminator D adopts a multi-layer perceptron (MLP) structure; the adversarial samples with specific perturbations are generated by adversarial training, and the adversarial samples with specific perturbations can guide the model to produce incorrect classification results.

[0052] The model training module is configured to train the generated adversarial samples and the original samples as a training set to obtain a malicious code detection model, the training target is to minimize a weighted combination of a standard loss and an adversarial loss, and the malicious code detection model is used to realize defense against malicious code attacks.

[0053] In a third aspect, the present application provides an electronic device, which comprises:

[0054] at least one processor; and

[0055] a memory connected in communication with the at least one processor; wherein

[0056] the memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to execute the APT organization malicious code defense method based on prior knowledge guided adversarial training.

[0057] In a fourth aspect, the present application provides a computer readable storage medium storing a program, and the program is executed by a processor to implement the APT organization malicious code defense method based on prior knowledge guided adversarial training.

[0058] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0059] 1. Improve minority class detection performance: By introducing the prior knowledge of APT malicious code labels, the invention guides the adversarial training process, significantly improving the detection performance of the model in handling code label imbalance scenarios, especially the recognition ability of minority class codes.

[0060] 2. Make full use of prior knowledge: By extracting the label distribution information of APT malicious codes from the training data, this method can make full use of prior knowledge. This frequency-based prior knowledge can provide strong guidance for adversarial sample generation and target label selection, so as to more targetedly expose the weaknesses of the model on minority class labels.

[0061] 3. Effectiveness of generating adversarial samples: By using the generative adversarial network (GAN) and the projected gradient descent (PGD) algorithm, this method can generate highly realistic adversarial samples. The two-way adversarial training of GAN ensures the authenticity and diversity of generated samples, while the PGD algorithm ensures the effectiveness of adversarial samples, so that the model shows stronger robustness when facing these adversarial samples.

[0062] 4. Enhance model robustness: Through targeted adversarial perturbation generation, the model can effectively deal with the imbalance distribution of APT malicious codes in training, thereby reducing the misclassification rate and enhancing the detection ability of unknown malicious software. BRIEF DESCRIPTION OF DRAWINGS

[0063] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0064] Figure 1 The flowchart of the APT organization malicious code defense method based on prior knowledge guided adversarial training of the embodiment of the present application;

[0065] Figure 2 The block diagram of the APT organization malicious code defense system based on prior knowledge guided adversarial training of the embodiment of the present application.

[0066] Figure 3 The structural diagram of the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0067] In the interest of providing a clear and concise disclosure that enables a person of ordinary skill in the art to make and use the techniques described herein, the techniques are described in terms of particular embodiments. At the same time, the detailed description is intended to be illustrative only and should not be taken as limiting the scope of the application. Various modifications to the illustrated embodiments, as well as other embodiments of the techniques, will be readily apparent to those skilled in the art and are intended to be within the scope of the application. Accordingly, the detailed description is not intended to limit the scope of the application as described herein.

[0068] Reference to "an embodiment" or "one embodiment" in this application means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase "in an embodiment" or "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all directed to the same embodiment, or to one alternative embodiment, to the exclusion of other embodiments.

[0069] APT organizations use malicious code that often has the following characteristics:

[0070] 1. Highly customized: These malicious codes are often tailored for specific targets, with the ability to survive in specific environments, and are significantly different from traditional general-purpose malicious software.

[0071] 2. Strong concealment: In order to evade security detection, APT malicious code often uses various technical means such as encryption, obfuscation, and staged loading, making it difficult to be discovered by traditional protection measures.

[0072] 3. Diversification and frequent variation: APT malicious code is often updated or varied to evade detection rules or signature libraries, making it difficult for traditional detection methods based on feature matching to effectively identify.

[0073] See Figure 1 The embodiment provides an APT organization malicious code defense method based on prior knowledge guided adversarial training, which comprises the following steps:

[0074] S1, data collection and cleaning, specifically:

[0075] S11, collect a large number of malicious software samples and their corresponding code labels from various channels (such as static analysis, dynamic analysis, file signature, etc.);

[0076] S12, clean the collected data, remove noise and invalid samples, and ensure the accuracy and consistency of the data. This step can be automated through programming scripts to improve efficiency.

[0077] S13, data preprocessing: input the malware and benign software dataset into the Cuckoo sandbox, extract the JSON information of the apistat part about API call information. In order to construct a fixed dimension m feature space:

[0078] Firstly, all dynamic call APIs are extracted from the dataset, and a set containing M API call elements is generated;

[0079] Then, these API calls are converted into feature vectors through One-hot encoding.

[0080] Finally, the random forest algorithm is used for binary classification of the training set data, and the top m features with the largest weight are selected as the final feature set according to the feature importance. The final feature set is the core data basis for the subsequent steps, including guiding the generation of adversarial samples, the generator and the discriminator based on the final feature set for sample generation and differentiation; provide the training input of the malicious code detection model; support target label selection, based on the final feature set to calculate the label distribution frequency, which is used to guide the target label selection of weighted random sampling.

[0081] It can be understood that the above-mentioned cleaned and pre-processed data as the original sample, including the cleaned malicious code sample and the benign software sample, after feature extraction and feature screening, as the basis sample for model training, is used for subsequent adversarial sample generation and model training.

[0082] S2, acquire prior knowledge;

[0083] Specifically, the label distribution information of malicious code is extracted from the training data set of the malware detection task. Through statistical analysis, the frequency of each code label appearing in the training data set is calculated, and it is used as prior knowledge. These label frequencies can reflect the distribution of each malicious code in the data set, and provide data support for subsequent target label selection and adversarial sample generation.

[0084] The prior knowledge introduced by the application directly reflects the imbalance of label distribution in the training data set, and guides the adversarial sample generation process to be more optimized for the minority class label. By taking the label frequency as the sampling basis of the target label, the adversarial sample generation is more in line with the weak point exposure demand of the real data distribution, thereby significantly enhancing the adaptability of the model to the minority class label.

[0085] The prior knowledge guided adversarial training strategy is the main difference from the conventional adversarial sample generation method. The traditional adversarial training is usually randomly generated adversarial samples, without considering the label distribution, while the application generates adversarial samples through prior knowledge, which improves the pertinence and sample efficiency of the training process.

[0086] S3, target label selection;

[0087] In each adversarial training, a target label is first sampled from the malware label set. The target label is different from the actual label of the current sample, and its sampling probability is determined by its frequency of occurrence in the training data set. The sampling process can be realized by weighted random sampling technology, in which the weight of each label is proportional to its frequency of occurrence. This process aims to use the label distribution information of malware to select target labels that are more likely to be misclassified, so as to guide the generation of adversarial perturbations and make the model pay more attention to these misclassified minority class labels in training.

[0088] Further, in the adversarial training, the sampling frequency of the target label is represented as follows:

[0089]

[0090] Where P(y t =c i ) represents the probability of the target label c i being selected, and f(c i ) represents the frequency of the label c i occurring in the data set.

[0091] S4, adversarial sample generation;

[0092] Adversarial samples are generated using a generative adversarial network (GAN), which consists of a generator (G) and a discriminator (D). The generator (G) model uses a convolutional neural network (CNN) structure, and the discriminator (D) model uses a multi-layer perceptron (MLP) structure.

[0093] In the training process of GAN, the generator G and the discriminator D are trained alternately through multiple iterations; the goal of the generator is to generate realistic samples to deceive the discriminator, while the goal of the discriminator is to distinguish between real samples and generated samples.

[0094] Further, the loss function of the generator consists of an adversarial loss and a reconstruction loss:

[0095] L G = E z～p(z) [-logD(G(z))] + aE x～p(x) [||x-G(z)||]

[0096] Where the adversarial loss part E z～p(z) [-logD(G(z))] makes the generator output confuse the discriminator; the reconstruction loss part E x～p(x) [||x-G(z)||] minimizes the deviation between the input and the output in the data space, making the generated samples closer to the original samples. The parameter a is a hyperparameter that controls the weight, and z represents the noise vector.

[0097] Further, the loss function of the discriminator is designed as follows:

[0098] L D = -E x～p(x) [logD(x)] - E z～p(z) [1-log(1-D(G(z)))] + β|E x～p(x) [y] - E z～p(z) [D(G(z))]|.

[0099] Wherein, D(x) represents the probability prediction of the discriminator D on the input sample x being a real sample, the value range is (0, 1), the closer to 1, the more confident the discriminator is that the sample is a real sample; G(z) represents the sample generated by the generator G after inputting random noise z, z ~ p(z) represents the distribution of noise Z, E x～p(x) [logD(x)] represents the expectation of the sample in the real sample set p(x), the goal is to maximize this value, so that the discriminator can better identify real samples; E z～p(z) [1-log(1-D(G(z)))] represents the expectation of the generated sample set G(z), the goal is to minimize this value, so that the discriminator can better distinguish between generated samples and real samples; E x～p(x) [y] represents the expected value of the label of the real sample x, which is used to measure whether the discriminator can accurately predict the real sample as 1; E z～p(z) [D(G(z))] represents the expected value of the generated sample G(z) predicted by the discriminator as a real sample, which is used to evaluate the judgment ability of the discriminator on the generated sample; β represents the coordination weight; |E x～p(x) [y] - E z～p(z) [D(G(z))]| represents the auxiliary discriminator consistency regularization term, which is used to ensure the consistency of the discriminator output, that is, the distribution prediction value and the expected value of the real sample and the generated sample as a whole are consistent.

[0100] The loss function of the discriminator considers the ability to distinguish real samples and the ability to identify generated samples, and adds a regularization term to ensure the consistency of the auxiliary discriminator output with its own output, and β is the coordination weight.

[0101] Further, in the process of generating adversarial samples, the projection gradient descent (PGD) optimization algorithm is used for updating, based on the target label to generate adversarial samples with a specific direction of disturbance, so that the prediction of the model is offset to the direction of the target label. Finally, these adversarial samples can effectively expose the weaknesses of the model on the minority class label, helping to improve the performance of the model.

[0102] Further, assuming that the input sample is x, the target label is y t , and the loss function of the model is L(x, y t; θ), where θ is the parameter of the model, and the PGD optimization process is as follows:

[0103] S41, initialization, set the initial value of the adversarial sample as the original sample:

[0104] x (0) = x;

[0105] PGD gradually optimizes the adversarial sample through multiple iterations, in the t-th iteration:

[0106] S42, calculate the gradient, calculate the gradient of the loss function on the input sample:

[0107]

[0108] where L(x (t) , y t ; θ) is the classification loss of the model under the input sample x (t) and the target label y t . This gradient indicates the direction that needs to be adjusted, so that the sample x (t) is more inclined to the target label y t .

[0109] S43, update the adversarial sample, update the sample according to the gradient information:

[0110] x (t+1) = x (t) + η·sign(g)

[0111] where η is the step size, controlling the amplitude of each update; sign(g) is the sign function of the gradient, indicating the direction of the perturbation;

[0112] S44, projection operation, project the updated sample x (t+1) back to the feasible perturbation range P, to ensure that the perturbation does not exceed the specified size limit:

[0113] x (t+1) = Proj p (x (t+1) )

[0114] The role of the projection function Proj p is to ensure that the generated adversarial sample x (t+1) satisfies the perturbation limit, and for the L ∞ norm limit ∈, the projection is defined as:

[0115] x (t+1) = min(max(x (t+1) , x-∈), x+∈)

[0116] S45, repeat the iteration, repeat steps S42 to S44 until the preset maximum iteration number T is reached, or the generated adversarial sample x (T) successfully bias the model's prediction towards the target label y t .

[0117] It can be understood that the malware adversarial perturbation method based on the pseudo API call sequence is an experimental operation in the feature space, which actually never creates a malicious binary file and does not map to the problem space. In order to solve the problem of inverse mapping, an IAT patch tool is used to realize the inverse mapping. The principle is to use hook API injection and PE executable ImportAddressTable patching, and input again into the sandbox Cuckoo to verify whether the adversarial sample created by the reverse mapping method is still executable and retains the original software malicious function.

[0118] S5, model training;

[0119] In the model training phase, the generated adversarial sample and the original sample are jointly input into the malware detection model for training. The goal of training is to minimize the weighted combination of standard loss and adversarial loss.

[0120] Further, the standard loss is usually cross-entropy loss, and the calculation formula is as follows:

[0121]

[0122] Where y i represents the actual label of the sample x i , and f(x i ; θ) represents the prediction probability of the model.

[0123] Further, the adversarial loss is calculated by the adversarial sample:

[0124]

[0125] Where, represents the generated adversarial sample, represents the target label of the adversarial sample.

[0126] Therefore, the final training loss function is a weighted combination of the two:

[0127] L total = L std + λL adv

[0128] Where λ is a hyperparameter that controls the trade-off between standard loss and adversarial loss.

[0129] In this embodiment, through the adversarial training, the model can not only perform well on the standard samples, but also maintain robustness on the adversarial samples, especially in the case of unbalanced malicious code label distribution, effectively improving the detection ability of the minority class code. Finally, the detection performance of each model is evaluated on a separately prepared test set, such as using the Roc-Auc, AvgPrecision and other curve under indicators.

[0130] It should be noted that for the foregoing method embodiments, in order to facilitate description, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited by the order of the described actions, because according to the present application, certain steps can be performed in other order or simultaneously.

[0131] Based on the same idea as the APT organization malicious code defense method based on prior knowledge guided adversarial training in the above embodiment, the present application also provides an APT organization malicious code defense system based on prior knowledge guided adversarial training, which can be used to execute the above-mentioned APT organization malicious code defense method based on prior knowledge guided adversarial training. For the convenience of description, in the structural diagram of the embodiment of the APT organization malicious code defense system based on prior knowledge guided adversarial training, only the part related to the embodiment of the present application is shown, and those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and can include more or fewer components than the illustrated, or combine certain components, or different component arrangements.

[0132] Please refer to Figure 2 In another embodiment of the present application, an APT organization malicious code defense system 100 based on prior knowledge guided adversarial training is provided, which includes a data acquisition module 101, a prior knowledge acquisition module 102, a target label selection module 103, an adversarial sample generation module 104 and a model training module 105;

[0133] The data acquisition module 101 is used to clean and pretreat the acquired malicious code samples as original samples, and extract the distribution information of malicious code labels; the malicious code samples include malicious codes and benign codes;

[0134] The prior knowledge acquisition module 102 is used to calculate the frequency of each label appearing in the data set based on the distribution information of the malicious code labels, and the frequency is used as prior knowledge for subsequent adversarial training;

[0135] The target label selection module 103 is configured to select a label that is more likely to be misclassified as a target label according to distribution information of malicious code labels in an adversarial training process, and determine a sampling frequency of the target label according to an occurrence frequency of the label by using a weighted random sampling technology, so as to guide the generation process of the adversarial sample.

[0136] The adversarial sample generation module 104 is configured to generate the adversarial sample by using a generative adversarial network (GAN). The GAN includes a generator G and a discriminator D. The generator G adopts a convolutional neural network (CNN) structure, and the discriminator D adopts a multi-layer perceptron (MLP) structure. The adversarial sample with a specific perturbation is generated by adversarial training, and the adversarial sample with the specific perturbation can guide the model to produce an incorrect classification result.

[0137] The model training module 105 is configured to train the generated adversarial sample and the original sample as a training set to obtain a malicious code detection model. A training target is to minimize a weighted combination of a standard loss and an adversarial loss. The malicious code detection model is used to realize defense against a malicious code attack.

[0138] It should be noted that the APT organization malicious code defense system based on prior knowledge guided adversarial training of the present application corresponds to the APT organization malicious code defense method based on prior knowledge guided adversarial training of the present application. The technical features and advantages described in the embodiment of the APT organization malicious code defense method based on prior knowledge guided adversarial training are applicable to the embodiment of the APT organization malicious code defense system based on prior knowledge guided adversarial training. For specific content, refer to the description in the method embodiment of the present application. Here, no further description is given, and this is declared.

[0139] In addition, in the embodiment of the APT organization malicious code defense system based on prior knowledge guided adversarial training, the logical division of each program module is only an example. In actual application, the above functions can be completed by different program modules according to needs, for example, according to configuration requirements of corresponding hardware or convenience of software implementation. That is, the internal structure of the APT organization malicious code defense system based on prior knowledge guided adversarial training is divided into different program modules to complete all or part of the functions described above.

[0140] Please refer to Figure 3In one embodiment, an electronic device implementing an APT organization malicious code defense method based on prior knowledge guided adversarial training is provided. The electronic device 200 can include a first processor 201, a first memory 202, and a bus. The electronic device 200 can also include a computer program, such as an APT organization malicious code defense program 203 based on prior knowledge guided adversarial training, stored in the first memory 202 and executable on the first processor 201.

[0141] The first memory 202 includes at least one type of readable storage medium, including a flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the first memory 202 can be an internal storage unit of the electronic device 200, such as a mobile hard disk of the electronic device 200. In other embodiments, the first memory 202 can also be an external storage device of the electronic device 200, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the first memory 202 can include both an internal storage unit and an external storage device of the electronic device 200. The first memory 202 can be used to store application software and various data installed in the electronic device 200, such as the code of the APT organization malicious code defense program 203 based on prior knowledge guided adversarial training, and can also be used to temporarily store data that has been output or will be output.

[0142] The first processor 201 can be composed of an integrated circuit in some embodiments, such as a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, combinations of various control chips, etc. The first processor 201 is the control unit of the electronic device, which connects various components of the electronic device through various interfaces and lines, and executes or runs programs or modules stored in the first memory 202 and calls data stored in the first memory 202 to perform various functions and process data of the electronic device 200.

[0143] Figure 3 Only an electronic device with components is shown, and those skilled in the art can understand that, Figure 3The structure shown does not constitute a limitation on the electronic device 200, and can include fewer or more components than shown, or combine certain components, or different component arrangements.

[0144] The APT organization malicious code defense program 203 stored in the first memory 202 in the electronic device 200 and based on prior knowledge guided adversarial training is a combination of multiple instructions, which, when running in the first processor 201, can implement:

[0145] After cleaning and preprocessing the obtained malicious code samples as original samples, and extracting the distribution information of malicious code labels, the malicious code samples include malicious codes and benign codes;

[0146] Based on the distribution information of the malicious code labels, the frequency of each label appearing in the data set is calculated, and the frequency is used as prior knowledge for subsequent adversarial training;

[0147] During adversarial training, the label that is more likely to be misclassified is selected as the target label according to the distribution information of the malicious code labels, and the sampling frequency of the target label is determined according to the frequency of the label by using the weighted random sampling technology, so as to guide the generation process of the adversarial sample;

[0148] An adversarial sample is generated using a generative adversarial network GAN; the generative adversarial network GAN includes a generator G and a discriminator D, the generator G adopts a convolutional neural network CNN structure, and the discriminator D adopts a multi-layer perceptron MLP structure; a sample with a specific perturbation is generated through adversarial training, and the sample with the specific perturbation will guide the model to produce an incorrect classification result;

[0149] The generated adversarial sample and the original sample are trained as a training set to obtain a malicious code detection model, and the training target is to minimize the weighted combination of standard loss and adversarial loss, and the malicious code detection model is used to realize the defense against malicious code attacks.

[0150] Further, the modules / units of the electronic device 200, if implemented in the form of software function units and sold or used as independent products, can be stored in a non-volatile computer readable storage medium. The computer readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM).

[0151] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The program can be stored in a non-volatile computer readable storage medium, and when the program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0152] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0153] The above embodiments are the preferred embodiments of the present application, but the embodiments of the present application are not limited to the above embodiments, and any changes, modifications, substitutions, combinations and simplifications of the embodiments of the present application without departing from the spirit and principles of the present application are equivalent replacement methods, and are included in the protection scope of the present application.

Claims

1. An APT organizational malicious code defense method based on prior knowledge guided adversarial training, characterized in that, The method comprises the following steps: The acquired malicious code samples are cleaned and preprocessed as original samples, and the distribution information of malicious code labels is extracted; the malicious code samples include malicious codes and benign codes; Based on the distribution information of the malicious code labels, the frequency of each label appearing in the data set is calculated, and the frequency is used as prior knowledge for subsequent adversarial training; During adversarial training, the label that is more likely to be misclassified is selected as the target label according to the distribution information of the malicious code labels, and the sampling frequency of the target label is determined according to the frequency of the label by using a weighted random sampling technique, so as to guide the generation process of the adversarial sample; An adversarial sample is generated by using a generative adversarial network (GAN), wherein the GAN comprises a generator G and a discriminator D, the generator G adopts a convolutional neural network (CNN) structure, and the discriminator D adopts a multi-layer perceptron (MLP) structure; the adversarial sample with a specific perturbation is generated through adversarial training, and the adversarial sample with the specific perturbation can guide the model to produce an incorrect classification result; The generated adversarial sample and the original sample are used as a training set for training to obtain a malicious code detection model, and the training target is to minimize the weighted combination of standard loss and adversarial loss, and the malicious code detection model is used to realize the defense against malicious code attacks. 2.The APT organization malicious code defense method based on prior knowledge guided adversarial training according to claim 1, characterized in that, The acquisition of the malicious code samples, the cleaning and preprocessing of the malicious code samples, and the extraction of the distribution information of the malicious code labels are as follows: The data of the acquired malicious code samples are cleaned to remove noise and invalid samples; The malicious code and benign code data sets are input into a sandbox for preprocessing, and JSON information about the apistat part of API call information is extracted, which specifically includes: First, all dynamic call APIs in the data set are extracted to generate a set containing M API call elements; Then, the API calls are converted into feature vectors through One-hot encoding; Next, a random forest algorithm is used to perform binary classification on the data of the training set, and the first m features with the largest weights are selected as the final feature set according to the feature importance. 3.The APT organization malicious code defense method based on prior knowledge guided adversarial training according to claim 1, characterized in that, Based on the distribution information of the malicious code labels, the frequency of each label appearing in the data set is calculated as follows: During data preprocessing, the number of occurrences of each label in the data set is counted, and the frequency of each label is calculated based on the total number of samples as prior knowledge for subsequent adversarial training, and the specific calculation formula is as follows: where count(c i ) is the number of occurrences of label c i , and n is the total number of samples.

4. The APT organized malicious code defense method based on prior knowledge guided adversarial training according to claim 1, characterized in that, During adversarial training, the sampling frequency of the target label is as follows: where P(y t = c i ) denotes the probability of the target label c i being selected, and f(c i ) denotes the frequency of label c i in the dataset.

5. The APT organized malicious code defense method based on prior knowledge guided adversarial training according to claim 1, characterized in that, During the training process of the GAN, the generator G and the discriminator D are alternately trained through multiple iterations, and the goal of the generator G is to generate realistic samples to deceive the discriminator, while the goal of the discriminator D is to distinguish between real samples and generated samples; The loss L of the generator G The function consists of an adversarial loss and a reconstruction loss, represented as follows: L G = E z～p(z) [-log D(G(z))] + a E x～p(x) [||x - G(z)||] where the adversarial loss part E z～p(z) [logD(G(z))] makes the generator output fool the discriminator; the reconstruction loss part E x～p(x) [||x-G(z)||] makes the generated sample closer to the original sample by minimizing the deviation of input and output in data space, and the parameter a is a hyperparameter that controls the weight, and z represents a noise vector; Loss function L of the discriminator D The design is as follows: L D = -E x～p(x) [logD(x)] - E z～p(z) [1 - log(1 - D(G(z)))] + β|E x～p(x) [y] - E z～p(z) [D(G(z))] | where D(x) represents the probability prediction of the discriminator D on the input sample x being a real sample, with a value range of (0, 1), the closer to 1, the more confident the discriminator is that the sample is a real sample; G(z) represents the sample generated by the generator G after inputting random noise z, z ~ p(z) represents the distribution of noise Z, E x～p(x) [logD(x)] represents the expectation of the sample in the real sample set p(x), the goal is to maximize this value to make the discriminator better identify real samples; E z～p(z) [1 - log(1 - D(G(z)))] represents the expectation of the generated sample set G(z), the goal is to minimize this value to make the discriminator better distinguish between generated samples and real samples; E x～p(x) [y] represents the expected value of the label of the real sample x, used to measure whether the discriminator can accurately predict the real sample as 1; E z～p(z) [D(G(z))] represents the expected value of the generated sample G(z) being predicted as a real sample by the discriminator, which is used to evaluate the discriminator's ability to judge generated samples; β represents the coordination weight; |E x～p(x) [y] - E z～p(z) [D(G(z))] | represents the auxiliary discriminator consistency regularization term, which is used to ensure the consistency of the discriminator output, that is, the distribution prediction value and the expected value of the real sample and the generated sample as a whole are consistent; The loss function L of the discriminator D The ability to distinguish real samples and the ability to identify generated samples are considered simultaneously, and a regular term is added to ensure that the auxiliary discriminator output is consistent with its own output, and β is the coordination weight.

6. The APT organized malicious code defense method based on prior knowledge guided adversarial training according to claim 5, characterized in that, During the generation of the adversarial sample, a projected gradient descent (PGD) optimization algorithm is used for updating, and an adversarial sample with a specific directional perturbation is generated based on the target label, so that the prediction of the model is shifted to the direction of the target label.

7. The APT organized malicious code defense method based on prior knowledge guided adversarial training according to claim 1, characterized in that, Standard loss L std For cross-entropy loss, the formula is as follows: where y i represents the actual label of the sample x i , and f(x i ; θ) represents the prediction probability of the malicious code detection model. The adversarial loss L adv is computed by the adversarial sample wherein, denotes the generated adversarial sample, denotes the target label of the adversarial sample; denotes the prediction probability distribution of the malicious code detection model for the input sample x i is the output result of the model; The final training loss function is a weighted combination of the standard loss L std and the adversarial loss L adv ​ L total = L std + λL adv Wherein, λ is a hyperparameter for controlling the trade-off between the standard loss and the adversarial loss.

8. An APT organization malicious code defense system based on prior knowledge guided adversarial training, characterized by, The APT malicious code defense method based on prior knowledge guided adversarial training according to any one of claims 1-7 comprises a data acquisition module, a prior knowledge acquisition module, a target label selection module, an adversarial sample generation module, and a model training module. The data acquisition module is configured to clean and preprocess the acquired malicious code samples as original samples and extract distribution information of malicious code labels. The prior knowledge acquisition module is configured to calculate the frequency of each label appearing in the data set based on the distribution information of the malicious code labels, and use the frequency as prior knowledge for subsequent adversarial training. The target label selection module is configured to select a label that is more likely to be misclassified as a target label during adversarial training according to the distribution information of the malicious code labels, and determine the sampling frequency of the target label according to the frequency of the label by using a weighted random sampling technique, thereby guiding the generation process of the adversarial samples. The adversarial sample generation module is configured to generate adversarial samples using a generative adversarial network (GAN). The model training module is configured to train the generated adversarial samples and the original samples as a training set to obtain a malicious code detection model, the training target being to minimize the weighted combination of standard loss and adversarial loss, and the malicious code detection model being used to realize the defense against malicious code attacks.

9. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores computer program instructions executable by the at least one processor, and the computer program instructions are executed by the at least one processor to enable the at least one processor to execute the APT malicious code defense method based on prior knowledge guided adversarial training according to any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that, The program is executed by the processor to implement the APT malicious code defense method based on prior knowledge guided adversarial training according to any one of claims 1-7.

Images