A malware detection and classification method based on multi-dimensional feature fusion

Abstract

The present invention relates to a malware detection and classification method based on multi-dimensional feature fusion, comprising the following steps: obtaining system call files and flow files generated in a dynamic running environment of a software sample to be detected; establishing a node graph based on the system call through the system call files; the node graph comprising: edges of the graph with the input and output of the system call and nodes of the graph with the system call parameters; extracting data payloads from the flow files, matching the data payloads with the system call parameters, and adding flow nodes and edges between the matched system calls and flow nodes to the node graph based on the matching results to obtain a system call-flow graph; generating an edge feature matrix based on the system call-flow graph, and inputting the system call-flow graph into a BERT model to obtain a node feature matrix; and inputting the edge feature matrix and the node feature matrix into a classifier to obtain malware detection results.

Description

Technical Field

[0001] The present invention relates to the technical field of malware detection, and in particular to a malware detection and classification method based on multi-dimensional feature fusion. Background Art

[0002] Existing malware detection technologies (malware detection) primarily employ a single-modality approach. Traditional defense models rely on a single dimension of data representation, whereas application attack behavior data is rich, heterogeneous, and multimodal. Therefore, using a single modality for application software detection can lead to false positives and missed detections, compromising detection quality.

[0003] The existing solution, "A container intrusion detection method and system based on system call threat level", filters out unimportant system calls through a method based on word frequency statistics weighting to generate new system call sequences for detection. This method ignores the dependency on call order.

[0004] The existing solution, "A traffic-based malware detection method, device, and electronic device," uses traffic characteristics to detect malware. This method can lead to poor detection results when the malware does not generate any traffic or the noise generated by background traffic is too large.

[0005] The existing solution, "An attack detection system based on Linux system calls", removes redundant system calls, generates a new system call sequence, and then matches it with the system call sequence in the dataset to determine whether it is malicious. This method causes system call sequence confusion. Summary of the Invention

[0006] In order to solve the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a malware detection and classification method based on multi-dimensional feature fusion. The present invention accurately extracts system calls and filters redundant system calls, and performs a one-to-one mapping of system calls and traffic data packets, establishes a stable data relationship, and uses machine learning to perform multimodal malware detection.

[0007] To achieve the above object, the present invention provides the following solutions:

[0008] A malware detection and classification method based on multi-dimensional feature fusion, including:

[0009] Obtaining system call files and flow files generated in the dynamic running environment of the software sample to be tested;

[0010] A node graph based on the system call is established through the system call file; the node graph includes: inputs and outputs of the system call as edges of the graph and system call parameters as nodes of the graph;

[0011] Extracting a data payload from the traffic file, matching the data payload with the system call parameters, and adding a traffic node and an edge between the matched system call and the traffic node to the node graph based on the matching result to obtain a system call-traffic graph;

[0012] Generate an edge feature matrix based on the system call-flow graph, and input the system call-flow graph into a BERT model to obtain a node feature matrix;

[0013] The edge feature matrix and the node feature matrix are input into a classifier to obtain malware detection results; the classifier is trained using a training set and the model parameters are adjusted by minimizing the cross entropy loss function; the training set includes: the original node feature matrix and the original edge feature matrix; a LabelEmbedding layer is added to the input end of the classifier to add an embedded expression of the node label.

[0014] Optionally, establishing the node graph includes:

[0015] Through the system call file, the system call is mapped to a file descriptor. According to the relationship between the system call and the file descriptor, that is, when the file descriptor generated by the system call is applied in a subsequent system call, the system call is connected with the subsequent system call to form a system call chain, thereby further generating the node graph.

[0016] Optionally, extracting the data payload from the traffic file includes:

[0017] Extracting the burst traffic from the traffic file, where the burst traffic is a sequence of continuous data packets in the same transmission direction in a network flow, and capturing the data packets in the burst traffic;

[0018] Associating data packets belonging to the same network flow according to the quintuple of the data packet to obtain a data packet set;

[0019] Set an extraction target condition, extract a continuous subsequence of the packet set based on the extraction target condition, and use the continuous subsequence as a single burst flow, thereby extracting the data payload of all packets in the single burst flow:

[0020]

[0021] Among them, Payload (p) represents the data load corresponding to a single packet, B k Indicates a continuous subsequence,Payload(B k ) represents the data payload corresponding to the continuous subsequence.

[0022] Optionally, the extraction target condition includes:

[0023] Continuity constraint: B k ={p i , p i+1 ,...,p j};

[0024] Directional consistency constraints:

[0025] Among them, p i and p j are all continuous subsequence packets, d i is the direction identifier, Represents a directional consistency constraint.

[0026] Optionally, obtaining a system call-flow graph includes:

[0027] Adding a flow node to the node graph;

[0028] Add an edge between the matched system call and the traffic node on the node graph:

[0029] like This proves the system calls caused by the outbound or inbound direction of a single burst flow;

[0030] Determine the edge direction between the matched system call and the traffic node according to the outgoing direction and the incoming direction:

[0031]

[0032] in, For the outgoing direction, In the inbound direction, Payload (p) indicates the data load corresponding to a single packet, Parameters (s i ) represents the parameters of the system call;

[0033] The system call-traffic graph is obtained by adding a traffic node and an edge between the matched system call and the traffic node to the node graph.

[0034] 6. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1 is characterized in that the edge feature matrix is ​​a three-dimensional feature, and the three-dimensional features include: the frequency of edge occurrence, the interval time and the sent data packet; the frequency of edge occurrence is the probability of edge occurrence between a system call and a subsequent system call in the system call-traffic graph, the interval time is the interval time feature between a system call and a subsequent system call, and the sent data packet is the sum of the sizes of the Burst network traffic data packets.

[0035] Optionally, obtaining the node feature matrix includes:

[0036] Decomposing the target content in the system call parameter in the system call-traffic graph into first words, representing the data packet of the traffic node using a hexadecimal sequence, and performing double-byte encoding, where every two bytes are represented as a second word;

[0037] Embed each of the first words and each of the second words:

[0038] E i =TokenEmbedding(t i )

[0039] P i =PositonEmbedding(t i )

[0040] Among them, E i For token embedding, P i For position embedding, TokenEmbedding(t i ) is the word vector embedding of the i-th word, TokenEmbedding(.) is the embedding layer, PositionEmbedding(t i ) is the position embedding layer for embedding the position information of the word;

[0041] The embedding result is input into the BERT model, and the stacked Transformer encoder in the BERT model is used to capture long-range dependencies while focusing on different regions of the input sequence:

[0042] {H'1,H'2,...,H' n}=TransformerEncoder({H1,H2,...,H n})

[0043] Among them, H' n is H after the Transformer encoder nThe output of TransformerEncoder({H1,H2,...,H n} is to encode the input sequence for the Transformer encoder architecture, H n is the embedding result of the nth character;

[0044] Based on the long-range dependencies and different regions of the input sequence, an embedding of the entire system call node or traffic node is generated, and a feature vector corresponding to each row generated as the expression attribute of the node is generated, that is, the node feature matrix is ​​generated.

[0045] Optionally, obtaining the malware detection result includes:

[0046] The edge feature matrix and the node feature matrix are input into the classifier. A Label Embedding layer is added to the input of the classifier to add an embedded expression of the node label:

[0047] Input=H CLS +W1*Laplacian matrix+W2*Node Label

[0048]

[0049] Among them, Input is the model input, H′ CLS is the embedding feature of the node, Laplacian matrix is ​​the Laplacian matrix, Node Label is the node label, W1 is the learnable weight matrix, w2 is the learnable weight matrix, syscall is the system call node type, and burst is the network traffic node type;

[0050] Self-attention calculations are performed between system call nodes with edges in the input data, and between system call nodes and traffic nodes with edges. Combined with the global average pooling layer, graph-level embedding results are obtained:

[0051]

[0052] Among them, H G is the graph-level embedding result, is the representation of the feature of the i-th node in the L-th layer (the last layer), v i is the i-th node in the graph, V is the set of nodes in the graph, and L is the output of the last graph conversion layer;

[0053] The graph-level embedding result is input into the first fully connected layer to map the global features to the target dimension and randomly dropped through the dropout layer:

[0054] HD =Dropout(ReLU(W1H G +b1))

[0055] Among them, H D is the intermediate feature representation after the discard layer, W1 is the weight of the first fully connected layer, and b1 is the bias of the first fully connected layer;

[0056] The embedding result after random discarding is input into the second fully connected layer to generate the malware detection result.

[0057] Optionally, performing self-attention calculations between system call nodes with edges in the input data includes:

[0058] To set the update of node characteristics:

[0059]

[0060] Among them, b Si 、h Sj They are system call nodes S i 、S j Node features, e ij is the edge feature, W O are different learnable parameter matrices, is the weight matrix used to update the node features (node ​​feature h Si 、h Sj , and edge feature e ij weighted combination of is the node feature output of the h-th attention head, is the concatenated vector of all attention heads, h Si It is the result of normalizing the concatenated output vector of all attention heads and the original node vector. is the output of the last attention head, d K is the dimension of the node feature vector, h Si The original system call node S i The eigenvector of

[0061] To set the update of edge features:

[0062]

[0063] in, is the result of concatenating the weight matrices of all attention heads used to update node features. is the learnable parameter matrix, is the weight matrix of the last attention head, e' ijIt is the result of concatenating the weight matrices of all attention heads and adding them to the original edge feature matrix and then normalizing them.

[0064] Optionally, performing self-attention calculation between the system call node and the traffic node where an edge exists in the input data includes:

[0065] Set the query vector, key vector, and value vector of the traffic node to be multiplied by the first incentive factor:

[0066]

[0067] Among them, α is the first excitation factor, is the weight matrix used to update the node features (node ​​feature h Bi 、h Si , and edge feature e ij weighted combination of is the node feature output of the h-th attention head, is the learnable parameter matrix, h Si is the system call node feature matrix, W O is the learnable parameter matrix, h′ is the traffic node feature output by the last attention head Bj h is the result of normalizing the concatenated vector of network traffic node features output by all attention heads and the original traffic node features. Bj is the original traffic node feature;

[0068] Set the key vector and value vector of the traffic node to be multiplied by the second incentive factor:

[0069]

[0070] Among them, β is the second incentive factor, is the weight matrix used to update node features, is the learnable weight matrix, is the learnable parameter matrix, is the learnable parameter matrix, The system call node feature output of the h-th attention head, h Bj is the characteristic of the traffic node, is the result of concatenating the node features output by all attention heads, W O is the learnable parameter matrix, is the system call node feature output by the last attention head, h′ Si h is the normalized result of adding the concatenated output vector of all attention heads to the original node vector. Si It is the original system call node feature.

[0071] The beneficial effects of the present invention are:

[0072] The present invention constructs the edges of the graph according to the correlation between the output and input of the system call, and completely preserves the dependency on the calling sequence.

[0073] The present invention maps the traffic generated by the application program through the parameters of the system call, and there is no interference from background traffic or the like.

[0074] Since the present invention establishes a relationship based on the file descriptor of the system call and the parameter conditions of the system call, the disorder of the system call sequence caused by CPU scheduling can be solved.

[0075] Currently, the most commonly used method is single-modal detection. Using sequence-based statistical methods during feature extraction introduces excessive meaningless data, generating noise. To address this issue, the present invention accurately extracts system calls and filters out redundant system calls. Furthermore, it maps system calls to traffic data packets, establishes a stable data relationship, and uses machine learning to perform multi-modal malware detection.

[0076] In summary, the present invention integrates system calls with traffic characteristics to accurately capture specific traffic from a complex and massive network traffic environment based on the system calls of a single process or application. BRIEF DESCRIPTION OF THE DRAWINGS

[0077] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0078] Figure 1 This is a flow chart of a malware detection and classification method based on multi-dimensional feature fusion according to an embodiment of the present invention;

[0079] Figure 2 A schematic diagram of a system call-based system according to an embodiment of the present invention;

[0080] Figure 3 A schematic diagram of a Burst flow is shown in a frame according to an embodiment of the present invention;

[0081] Figure 4 Schematic diagram of mapping Burst data payload and system calls according to an embodiment of the present invention;

[0082] Figure 5 A schematic diagram of a flow node embedding process according to an embodiment of the present invention;

[0083] Figure 6 Schematic diagram of the classifier structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0084] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0085] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0086] This embodiment discloses a malware detection and classification method based on multi-dimensional feature fusion, including: obtaining system call files and traffic files generated in the dynamic running environment of a software sample to be detected; establishing a node graph based on the system call through the system call files; the node graph includes: edges with the input and output of the system call as the graph and nodes with the system call parameters as the graph; extracting data payload from the traffic file, matching the data payload with the system call parameters, and based on the matching results, adding traffic nodes and edges between the matched system calls and traffic nodes to the node graph to obtain a system call-traffic graph; generating an edge feature matrix based on the system call-traffic graph, and inputting the system call-traffic graph into a BERT model to obtain a node feature matrix; inputting the edge feature matrix and the node feature matrix into a classifier to obtain malware detection results; the classifier is trained using a training set and the model parameters are adjusted by minimizing the cross-entropy loss function; the training set includes: an original node feature matrix and an original edge feature matrix; a label embedding layer is added to the input end of the classifier to add an embedded expression of the node label.

[0087] Specifically: This embodiment discloses a malware detection and classification method based on multi-dimensional feature fusion, which uses a graph structure to fuse traffic features and system call features so that their modal structures are on the same dimension. The present invention also proposes a new graph feature that uses system call parameter embedding and burst-based traffic embedding as node features. The background and flow chart of the present invention are as follows: Figure 1 shown.

[0088] Step 1: Capture the system call files and traffic files generated by the software application in a dynamic running environment.

[0089] Step 2. Establish a graph based on system calls: Edges are established according to the inputs and outputs of each system call, where the edges represent the data flow relationship and the nodes represent the system calls.

[0090] Step 3. Extract the Burst (burst) traffic and the data payloads of the data packets included in the Burst from the traffic file.

[0091] Step 4. In subsequent work, the present invention matches the data payload of the Burst with the parameters of the system call. If the match is successful, a traffic node is added to the graph, and an edge connecting the matched system call and the traffic node is added, where the edge represents the causal relationship.

[0092] Step 5. For the obtained system call - traffic graph, complete the node embedding through the BERT model to obtain the node feature matrix and edge matrix of the graph.

[0093] Step 6. Input the obtained feature matrix and edge matrix into the classifier to obtain the classification result.

[0094] Furthermore, establishing the node graph includes: Through the system call file, map the system calls to file descriptors. According to the relationship between the system calls and the file descriptors, that is, when the file descriptor generated by a system call is applied in subsequent system calls, connect the system call and the subsequent system call to form a system call chain, thereby further generating the node graph.

[0095] Specifically:

[0096] Capture the system calls and use the obtained system calls to construct a system call set, denoted as S = {s1, s2,..., s n}, where n is the number of system calls.

[0097] Establish a behavior graph based on the captured system call set and packet set.

[0098] Establish a graph based on system calls. The system call s i is an element in the set S = {s1, s2,..., s n}. The present invention constructs a system call - based graph by mapping the system calls to file descriptors (fd) and establishing edges according to their relationships.

[0099] For where i < j < k, when s i generates a file descriptor fd1, and in subsequent system calls, s j , s k uses fd1 as the first parameter (a system can call multiple parameters). Then connect them into a system call chain: s i → sj →s k , if s L When fd1 is used as the second parameter, directly use s i and s L Finally, the system call parameters are used to represent the node.

[0100] For example, file descriptor 62 is generated. The following [B], [C], [D], and [E] all use this descriptor 62, forming a system call chain. [L] uses two file descriptors, 73 and 62. 62 is the second parameter, directly connecting [A] and [L]. The system call parameters corresponding to the node are used as its expression. For example, the [D] node is expressed as (62, prot(443), ip(100.8.8.8)), not getsockopot.

[0101] like Figure 2 As shown in Figure 1, the input of the algorithm is a system call sequence; the output is a system call-based graph constructed through file descriptors.

[0102] Furthermore, extracting the data payload from the traffic file includes: extracting the burst traffic from the traffic file, where the burst traffic is a sequence of continuous data packets in the same transmission direction in a network flow, and capturing the data packets in the burst traffic; correlating the data packets belonging to the same network flow according to the five-tuple of the data packets to obtain a data packet set; setting an extraction target condition, and based on the extraction target condition, extracting a continuous subsequence of the data packet set, treating the continuous subsequence as a single burst traffic, thereby extracting the data payload of all data packets in the single burst traffic:

[0103]

[0104] Among them, Payload (p) represents the data load corresponding to a single packet, B k Indicates a continuous subsequence,Payload(B k ) represents the data payload corresponding to the continuous subsequence.

[0105] Furthermore, the extraction target conditions include: continuity constraint: B k ={p i , p i+1 ,...,p j};

[0106] Directional consistency constraints: Among them, p i and p j are all continuous subsequence packets, d i is the direction identifier, Represents a directional consistency constraint.

[0107] Specifically:

[0108] The data packets (hereinafter referred to as "packets") transmitted in the network (TCP / IP protocol communication transmission) are captured, and the obtained packets are used to construct a packet set, which is recorded as p = {p1, p2, ..., p m}, where m is the number of packets in the packet set.

[0109] Extract the mapping between the data payload and the Burst in the data packet.

[0110] In network traffic analysis, a burst is defined as a sequence of continuous data packets in the same transmission direction in a network flow, which has strict time and direction consistency. This sequence usually represents a short-term high-density data transmission behavior in network communication. Figure 3 shown.

[0111] Associate packets belonging to the same flow (identified by the packet's five-tuple: source address, source port, destination address, destination port, and transport layer protocol). This is defined as a network flow F. Then F can be represented as a collection of packets arranged in chronological order:

[0112] F={p1,p2,p3,...,p n};

[0113] Each data packet has the following attributes: direction identifier d i ∈(in, out), indicating the direction of the data packet.

[0114] If a continuous subsequence B in F k , the following conditions are met:

[0115] Continuity constraint: B k ={p i , p i+1 ,...,p j};

[0116] Directional consistency constraint (same direction):

[0117] Then the subsequence B k It is called a single Burst. According to the direction, it can be expressed as (incoming direction) or (Outgoing direction).

[0118] Payload (p) is the data load corresponding to a single packet. k The data payload extraction of all packets in can be expressed as:

[0119]

[0120] Furthermore, obtaining the system call-flow graph includes: adding a flow node to the node graph;

[0121] Add edges between the matching system calls and traffic nodes to the node graph:

[0122] like This proves the system call caused by the outgoing or incoming direction of a single Burst flow; is an empty set;

[0123] Based on the outbound and inbound directions, determine the edge direction between the matched system call and the traffic node:

[0124]

[0125] in, For the outgoing direction, In the inbound direction, Payload (p) indicates the data load corresponding to a single packet, Parameters (s i ) represents the parameters of the system call;

[0126] By adding traffic nodes and edges between the matched system calls and traffic nodes to the node graph, a system call-traffic graph is obtained.

[0127] Specifically:

[0128] like Figure 4 As shown in Figure 1, the system call parameters are mapped to a single Burst to add traffic nodes. According to the data load in the established Burst, a connection is made with the system call node. Specifically, the parameters of the system call are represented as Parameters(s i ), where s i ∈S, if:

[0129]

[0130] This means that the system call s i Caused by (outward direction), or the (Incoming direction) The system call triggered.

[0131] according to To determine the direction of the edge:

[0132]

[0133] For example:

[0134] sendto(62<TCPv6:[[::ffff:10.0.2.15]:53672-> [::ffff:104.16.160.145]:443]>,"\26\3\1\2\0\1\0\1\374\3\3\336V\272%tR\225\202l\207\364\3036\317\ 17\257\355u\240M\242\315\313\267=\2152f\235Z'\231\\\f\211\344\336\305\346\332ar\21\202\323\303\2 63\17\340Z&\307\342\305\360\250On}3\0\251\266\"\0\"\23\1\23\2\23\3\300+\300,\314\251\300 / \3000\3 14\250\300\t\300\n\300\23\300\24\0\234\0\235\0 / \0005\1\0\1\221\0\0\0\26\0\24\0\0\21api"...)=517;

[0135] Then according to file descriptor 62<TCPv6:[[::ffff:10.0.2.15]:53672-> [::ffff:104.16.160.145]:443]>, filter the flow F to find the burst, such as Figure 2 As shown in the figure, the hexadecimal application layer data payload is converted to ASCII code and a string is cut out, which corresponds to the above Burst content.

[0136] The burst content is:

[0137] ""\26\3\1\2\0\1\0\1\374\3\3\336V\272%tR\225\202l\207\364\3036\317\17\257\355u\240M\242 \315\313\267=\2152f\235Z'\231\\\f\211\344\336\305\346\332ar\21\202\323\303\263\17\340Z& \307\342\305\360\250On}3\0\251\266\"\0\"\23\1\23\2\23\3\300+\300,\314\251\300 / \3000\314 \250\300\t\300\n\300\23\300\24\0\234\0\235\0 / \0005\1\0\1\221\0\0\0\26\0\24\0\0\21api"".

[0138] The hexadecimal sequence of these two packets is then used to represent the burst, which is the outgoing burst.

[0139] The burst is represented as: the hexadecimal sequence (64 bytes) of the first data packet + the hexadecimal sequence (64 bytes) of the second data packet.

[0140] 64 bytes: "52 55 0a 00 02 02 5a 36 c0 42 4a f0 08 00 45 00 00 28 a2 3d40 00 40 06 83 e2 0a 00 02 0f 68 10 a0 91 d1 a8 01 bb df aa 3a ff 8c c3 46 0250 10 ff ff 14 cb 00 00..."

[0141] Finally, establish the edge between the system call node and the traffic node:

[0142] The constructed graph G = (V, E), where V represents a node in the graph, which represents a system call or traffic. Among them, the edge (v i , v j ) indicates that there is a node v i To node v j data flow relationship.

[0143] For example:

[0144] The current expression matrix of the graph is: And an adjacency matrix to represent the connection of the edges, as shown in Table 1, which shows the symbol representation.

[0145] Table 1

[0146]

[0147] Furthermore, the edge feature matrix is ​​a three-dimensional feature, which includes: the frequency of edge occurrence, interval time and data packets sent; the frequency of edge occurrence is the probability of edge occurrence between a system call and a subsequent system call in the system call-traffic graph, the interval time is the interval time feature between a system call and a subsequent system call, and the data packets sent are the sum of the edges between the system call and the traffic node.

[0148] Specifically:

[0149] Generate the edge feature matrix of graph G:

[0150] For the edge feature matrix of graph G, there are three-dimensional features: [edge frequency, interval time, and size of sent data packets].

[0151] For edge occurrence frequency, we count the occurrence frequencies of edges Si and Sj in the graph. That is, we count the occurrence frequencies of edges E(Si, Sj) to indicate where application behaviors are concentrated.

[0152] Regarding the time interval characteristics, since the present invention constructs a new system call sequence through file descriptors, the present invention needs to count the time interval characteristics of system calls Si and Sj to confirm the dependency strength between the system call pairs. In other words, the number of system calls between Si and Sj is counted.

[0153] For example:

[0154] The original system call sequence is: Si, S1, S2, S3, Sj, and the constructed sequence is: Si, Sj. Then the interval time feature of edge E(Si, Sj) is 3.

[0155] For the size characteristics of the sent data packet: For the edge B between the system call Si and the traffic node j The total size E(S i , B j ). By calculating the Burst packet B sent j ={p i , p i+1 ,...,p k}Total size (in bytes) to indicate the interactivity between the system call and traffic. That is:

[0156] Finally, we get the edge feature matrix [x1, x2, x3].

[0157] Furthermore, obtaining the node feature matrix includes:

[0158] Decompose the target content in the system call parameter in the system call-traffic graph into first words, represent the data packet using a hexadecimal sequence for the traffic node, and perform double-byte encoding, with each two bytes representing a second word;

[0159] Embed each first word and each second word:

[0160] E i =TokenEmbedding(t i );

[0161] P i =PositionEmbedding(t i );

[0162] Among them, E i For token embedding, P i for position embedding;

[0163] The embedding result is input into the BERT model, and the stacked Transformer encoder in the BERT model is used to capture long-range dependencies while focusing on different regions of the input sequence:

[0164] {H'1,H'2,...,H' n}=TransformerEncoder({H1,H2,...,H n});

[0165] Among them, H' n is H after the Transformer encoder n The output of TransformerEncoder({H1,H2,...,H n} is to encode the input sequence for the Transformer encoder architecture, H n is the embedding result of the nth character;

[0166] Based on the long-range dependencies and different regions of the input sequence, the embedding of the entire system call node or traffic node is generated, and the feature vector corresponding to each row generated as the expression attribute of the node is generated, that is, the node feature matrix is ​​generated.

[0167] Specifically:

[0168] Generate the feature matrix of the graph G: For the feature matrix of the generated graph, use the expression attributes of the nodes for vectorization.

[0169] For example:

[0170] enter: This matrix is ​​input to the BERT model to generate a vector corresponding to each row, that is, the node feature matrix of the graph is generated, and the output matrix X is:

[0171]

[0172] The following is a detailed explanation of this step:

[0173] For the system call nodes and traffic nodes in graph G, this paper uses the BERT model to generate feature vectors, resulting in rich contextual embeddings. In BERT, with a maximum position embedding of 512, a hidden size of 768, 12 attention heads, and 6 hidden layers, each system call node and traffic node is represented by a 768-dimensional vector.

[0174] Generate a system call node Token. For the system call node s i =[a1,a2,...,a n ], a i Indicates a part of its parameters. i Further decomposed into sub-word tokens:

[0175]

[0176] So for the system call node s i The final expression is: i =[t1,t2,...,t k ], where k is the total number of tokens after all segmentations.

[0177] Generate traffic node token. For traffic node B k ={p1,p2,...,p j}, use hexadecimal sequence to represent the data packet, and then use double-byte encoding to represent each two bytes as a token. Therefore, for traffic node B k The final expression is: B k =[t1,t2,...,t j ], where j is the total number of tokens.

[0178] For example: For example, a B i The hexadecimal sequences of the two packets included are [0x00,0x04...], [...0xdc,0xf9,0x4a].

[0179] The double-byte encoding forms the Token [0004, 0400, ..., dc9f, f94a]. The Token is then input into BERT to obtain the embedding. Figure 5 shown.

[0180] For each Token i , before being used as input for BERT, the following embeddings need to be calculated:

[0181] E i =TokenEmbedding(t i );

[0182] P i =PositionEmbedding(t i );

[0183] Then, the embedded result H i E is embedded in the token i and position embedding P i The sum is obtained and fed into a stacked Transformer encoder, which consists of 6 self-attention layers. This enables the model to focus on different regions of the input sequence while capturing long-range dependencies.

[0184] H i =E i +P i

[0185] {H'1,H'2,...,H' n}=TransformerEncoder({H1,H2,...,H n});

[0186] The output is a series of context-aware embeddings, using the output of the [CLS] token to represent the entire input sequence:

[0187] H′ CLS =CLS;

[0188] Among them, H′ CLS Indicates the entire s i or B k Embedding.

[0189] BERT can effectively learn the relationship patterns of various parts in the parameters and the relationship patterns of various parts in the traffic. CLS as the feature vector of the node.

[0190] By correlating system call parameters with network traffic data payload, a new graph structure is established to aggregate system calls and traffic generated by applications. Furthermore, the present invention innovatively uses the embedding of system call parameters and burst-based traffic as graph features.

[0191] This method can accurately capture the traffic characteristics of applications based on the system calls generated by applications in a complex and massive network traffic environment, thereby achieving system-level and network-level detection of the software.

[0192] Furthermore, obtaining malware detection results includes:

[0193] The edge feature matrix and the node feature matrix are input into the classifier. A Label Embedding layer is added to the input of the classifier to add the embedded expression of the node label:

[0194] Input=H′ CLS +W1*Laplacian matrix+W2*Node Label;

[0195]

[0196] Among them, Input is the model input;

[0197] Self-attention calculations are performed between system call nodes with edges in the input data, and between system call nodes and traffic nodes with edges. Combined with the global average pooling layer, graph-level embedding results are obtained:

[0198]

[0199] Among them, H G is the graph-level embedding result;

[0200] The graph-level embedding result is input into the first fully connected layer to map the global features to the target dimension and randomly discarded through the dropout layer:

[0201] H D =Dropout(ReLU(W1H G +b1);

[0202] Among them, H D is the intermediate feature representation after the discard layer, W1 is the weight of the first fully connected layer, and b1 is the bias of the first fully connected layer;

[0203] The embedding results after random discarding are fed into the second fully connected layer to generate malware detection results.

[0204] Furthermore, performing self-attention calculations between system call nodes with edges in the input data includes:

[0205] To set the update of node characteristics:

[0206]

[0207] Among them, hSi 、h Sj They are the node features of system call nodes Si and Sj, e ij is the edge feature, W O are different learnable parameter matrices;

[0208] To set the update of edge features:

[0209]

[0210] in, is the result of concatenating the weight matrices of all attention heads used to update node features. is the learnable parameter matrix, is the weight matrix of the last attention head, e' ij It is the result of concatenating the weight matrices of all attention heads and adding them to the original edge feature matrix and then normalizing them.

[0211] Furthermore, performing self-attention calculation between the system call node and the traffic node where there is an edge in the input data includes:

[0212] Set the query vector, key vector, and value vector of the traffic node to be multiplied by the first incentive factor:

[0213]

[0214] Among them, α is the first excitation factor, is the weight matrix used to update the node features (node ​​feature h Bi 、h Si , and edge feature e ij weighted combination of );

[0215] Set the key vector and value vector of the traffic node to be multiplied by the second incentive factor:

[0216]

[0217] Among them, β is the second excitation factor.

[0218] S6 performs system call-traffic graph classification:

[0219] S61 will obtain represents the node feature matrix of graph G, where D = 768 represents the attribute dimension. N represents the number of nodes |V| in graph G. Represents the edge feature matrix of graph G, where M is the number of edges and edge features have three dimensions [edge frequency, interval time, and size of sent data packets]. F 、X EInput into the set Graph Transformer.

[0220] Specifically: The original Graph Transformer input is:

[0221] Input=Node Embedding+Position Embedding;

[0222] Detailed input: Input = H' CLS +W1*Laplacian matrix;

[0223] Among them, H′ CLS is the embedding feature of the node, Laplacian matrix = AD, where is the adjacency matrix of the graph, is the degree matrix of the graph nodes.

[0224] The present invention changes the input to:

[0225] Input=Node Embedding+Position Embedding+Label Embedding

[0226] That is, the embedded expression of the node label is added to enhance the input expression of the node.

[0227] In detail, Figure 6 The box is added, and the input is changed to:

[0228] Input=H CLS +W1*Laplacian matrix+W2*Node Label;

[0229]

[0230] For the system call with edge E, the self-attention calculation between nodes is:

[0231] First, for the system call nodes Si and Sj with edge E, their node features are h Si 、h Sj , the edge feature is e ij .

[0232] For the node feature h Si 、h Sj Update:

[0233]

[0234] Where h = [1, H], H represents the number of attention heads;

[0235] For edge feature e ij Update:

[0236]

[0237] For the self-attention calculation of the system call node and the network traffic node with edge E:

[0238] Due to the imbalance between the number of system call nodes and network traffic nodes, the number of system call nodes is greater than the number of network traffic nodes.

[0239] Set the query vector for the network traffic node Key Vector Sum vector Multiply by the incentive factor:

[0240] For the node characteristics corresponding to the system call node Si and the network traffic node Bi: h Fi , h Bj , the corresponding edge feature is e ij For the traffic node query vector Q, multiply it by the incentive factor α>1:

[0241]

[0242] For the key vector K and value vector V of the traffic node, multiply by the incentive factor β>1:

[0243]

[0244] To perform graph classification, we apply a global average pooling layer to derive the graph-level embedding H G . It can be expressed by the equation:

[0245] Among them, L represents the output of the last graph transformation layer.

[0246] In the classification prediction stage, the first fully connected layer maps the global features to a 32-dimensional intermediate representation and randomly discards them through the dropout layer:

[0247] H D =Dropout(ReLU(W1H G +b1);

[0248] W1 and b1 represent the weights and biases of the first fully connected layer. The activation function uses the ReLU activation function to introduce nonlinearity. Dropout is used to randomly discard some neurons to prevent overfitting. D is the intermediate feature representation after the discard layer.

[0249] The second fully connected layer generates the final classification result, predicting whether the graph G represents malicious behavior:

[0250]

[0251] Among them, W c and b c are the weights and biases of the classifier respectively. After training, the model is trained by minimizing the cross entropy loss function To adjust parameters, optimize detection accuracy and improve training efficiency. Where N is the total number of samples in the training set.

[0252]

[0253] Among them, y i is the true label of sample i, is the predicted value of sample i.

[0254] The embodiments described above are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by persons skilled in the art should fall within the scope of protection defined by the claims of the present invention.

Claims

1. A malware detection and classification method based on multi-dimensional feature fusion, characterized in that: include: Obtaining system call files and flow files generated in the dynamic running environment of the software sample to be tested; A node graph based on the system call is established through the system call file; the node graph includes: inputs and outputs of the system call as edges of the graph and system call parameters as nodes of the graph; Extracting a data payload from the traffic file, matching the data payload with the system call parameters, and adding a traffic node and an edge between the matched system call and the traffic node to the node graph based on the matching result to obtain a system call-traffic graph; Generate an edge feature matrix based on the system call-flow graph, and input the system call-flow graph into a BERT model to obtain a node feature matrix; The edge feature matrix and the node feature matrix are input into a classifier to obtain malware detection results; the classifier is trained using a training set and the model parameters are adjusted by minimizing the cross entropy loss function; the training set includes: the original node feature matrix and the original edge feature matrix; a LabelEmbedding layer is added to the input end of the classifier to add an embedded expression of the node label.

2. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1 is characterized in that: Establishing the node graph includes: Through the system call file, the system call is mapped to a file descriptor. According to the relationship between the system call and the file descriptor, that is, when the file descriptor generated by the system call is applied in a subsequent system call, the system call is connected with the subsequent system call to form a system call chain, thereby further generating the node graph.

3. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1 is characterized in that: Extracting the data payload from the traffic file includes: Extracting the burst traffic from the traffic file, where the burst traffic is a sequence of continuous data packets in the same transmission direction in a network flow, and capturing the data packets in the burst traffic; Associating data packets belonging to the same network flow according to the quintuple of the data packet to obtain a data packet set; Set an extraction target condition, extract a continuous subsequence of the packet set based on the extraction target condition, and use the continuous subsequence as a single burst flow, thereby extracting the data payload of all packets in the single burst flow: in, Indicates the data load corresponding to a single packet, represents a continuous subsequence, Indicates the data payload corresponding to consecutive subsequences.

4. The malware detection and classification method based on multi-dimensional feature fusion according to claim 3 is characterized in that: The extraction target conditions include: Continuity constraints: ; Directional consistency constraints: ; in, and are all continuous subsequence packets, is the direction identifier, Represents a directional consistency constraint.

5. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1 is characterized in that: Obtaining the system call-flow graph includes: Adding a flow node to the node graph; Add an edge between the matched system call and the traffic node on the node graph: like , then it proves the system calls caused by the outbound or inbound direction of a single Burst flow; Determine the edge direction between the matched system call and the traffic node according to the outgoing direction and the incoming direction: in, For the outgoing direction, For the inbound direction, Indicates the data load corresponding to a single packet, Represents the parameters of the system call; The system call-traffic graph is obtained by adding a traffic node and an edge between the matched system call and the traffic node to the node graph.

6. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1, characterized in that: The edge feature matrix is ​​a three-dimensional feature, and the three-dimensional features include: the frequency of edge occurrence, the interval time and the sent data packet; the frequency of edge occurrence is the probability of edge occurrence between the system call and the subsequent system call in the system call-traffic graph, the interval time is the interval time feature between the system call and the subsequent system call, and the sent data packet is the sum of the sizes of the Burst network traffic data packets.

7. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1, characterized in that: Obtaining the node feature matrix includes: Decomposing the target content in the system call parameter in the system call-traffic graph into first words, representing the data packet of the traffic node using a hexadecimal sequence, and performing double-byte encoding, where every two bytes are represented as a second word; Embed each of the first words and each of the second words: in, For token embedding, is the position embedding, For the word embeddings, is the embedding layer, Embed the word's position information into a position embedding layer; The embedding result is input into the BERT model, and the stacked Transformer encoder in the BERT model is used to capture long-range dependencies while focusing on different regions of the input sequence: in, After the Transformer encoder The output, To encode the input sequence for the Transformer encoder architecture, is the embedding result of the nth character; Based on the long-range dependencies and different regions of the input sequence, an embedding of the entire system call node or traffic node is generated, and a feature vector corresponding to each row generated as the expression attribute of the node is generated, that is, the node feature matrix is ​​generated.

8. The malware detection and classification method based on multi-dimensional feature fusion according to claim 1, characterized in that: Obtaining the malware detection result includes: The edge feature matrix and the node feature matrix are input into the classifier. A Label Embedding layer is added to the input of the classifier to add an embedded expression of the node label: in, is the model input, is the embedding feature of the node, is the Laplace matrix, is the node label, is the learnable weight matrix, is the learnable weight matrix, is the system call node type, is the network traffic node type; Self-attention calculations are performed between system call nodes with edges in the input data, and between system call nodes and traffic nodes with edges. Combined with the global average pooling layer, graph-level embedding results are obtained: in, is the graph-level embedding result, is the representation of the feature of the i-th node in the L-th layer, is the i-th node in the graph, is the set of nodes in the graph, and L is the output of the last graph conversion layer; The graph-level embedding result is input into the first fully connected layer to map the global features to the target dimension and randomly dropped through the dropout layer: in, is the intermediate feature representation after the discard layer, is the weight of the first fully connected layer, is the bias of the first fully connected layer; The embedding result after random discarding is input into the second fully connected layer to generate the malware detection result.

9. The malware detection and classification method based on multi-dimensional feature fusion according to claim 8, characterized in that: The self-attention calculation between the system call nodes with edges in the input data includes: To set the update of node characteristics: in, They are system call nodes S i 、S j The node characteristics of is the edge feature, are different learnable parameter matrices, is the weight matrix used to update node features, is the node feature output of the h-th attention head, is the concatenated vector of all attention heads, It is the result of normalizing the concatenated output vector of all attention heads and the original node vector. is the output of the last attention head, is the dimension of the node feature vector, The original system call node S i The eigenvector of To set the update of edge features: in, is the result of concatenating the weight matrices of all attention heads used to update node features. is the learnable parameter matrix, is the weight matrix of the last attention head, It is the result of concatenating the weight matrices of all attention heads and adding them to the original edge feature matrix and then normalizing them.

10. The malware detection and classification method based on multi-dimensional feature fusion according to claim 8, characterized in that: The self-attention calculation between the system call node and the traffic node with an edge in the input data includes: Set the query vector, key vector, and value vector of the traffic node to be multiplied by the first incentive factor: in, is the first incentive factor, is the weight matrix used to update node features, is the node feature output of the h-th attention head, is the learnable parameter matrix, is the system call node feature matrix, is the learnable parameter matrix, is the traffic node feature output by the last attention head, It is the result of normalizing the concatenated vector of network traffic node features output by all attention heads and adding the original traffic node features. is the characteristic of the traffic node; Set the key vector and value vector of the traffic node to be multiplied by the second incentive factor: in, is the second motivation factor, is the weight matrix used to update node features, is the learnable weight matrix, is the learnable parameter matrix, is the learnable parameter matrix, The system call node feature output for the h-th attention head output, is the characteristic of the traffic node, It is the result of concatenating the node features output by all attention heads. is the learnable parameter matrix, is the system call node feature output by the last attention head, It is the result of normalizing the concatenated output vector of all attention heads and the original node vector. It is the original system call node feature.

Images