Generation method of malicious software training sample based on atomic function module assembly

Abstract

The invention relates to the technical field of network security, and discloses a malicious software training sample generation method based on atomic function module assembly. According to the technical and tactical description granularity of the CK, atomic function fragments are disassembled, and an atomic function module and a malicious software atomic function library are obtained; selecting an atomic function module according to a training sample generation demand, and generating a configuration file; generating a calling graph by the configuration file, and converting an atomic function module in the calling graph into an atomic function intermediate representation in an IR form; respectively converting all nodes and edges into corresponding node types and edge types; linking all atomic function intermediate representations to a main module, and processing dependency of each atomic function module; creating corresponding calling logic; and compiling to generate a malicious software training sample. The malicious software training samples can be actively generated, and the problem that the malicious software training samples are insufficient is effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for generating malware training samples based on the assembly of atomic functional modules. Background Art

[0002] Malware refers to malicious programs or codes that invade computer systems, steal data, damage devices, or manipulate systems through various means. With the continuous progress of technology and the increasing complexity of attack methods, the types and propagation methods of malware are constantly evolving, greatly increasing the information security risks. Whether it is traditional viruses, Trojans, ransomware, or increasingly complex APTs (Advanced Persistent Threats), they may all pose serious threats to the digital assets and privacy security of individuals, enterprises, and even national critical infrastructures. According to the report of the well-known global cybersecurity company Kaspersky, in 2023, its system detected nearly 125 million malware samples in total, and the daily detection volume has increased to 40,000, a 62.5% increase compared to 2022. These data fully reflect the increasing and evolving trend of malware, and also reveal that how to effectively detect, identify, and defend against malware has become the core issue that needs to be solved urgently in the current field of network security.

[0003] Currently, the detection methods of malware mainly include traditional signature detection and machine learning-based detection technologies. The signature detection is to compare the file to be detected with the feature signatures in the known malware database, which is a mature and efficient detection method. However, this method has poor adaptability to new malware, especially when facing malware variants or zero-day attacks, it cannot effectively identify their malicious behaviors. To overcome these limitations, machine learning-based malware detection technologies have gradually emerged. Such methods build large-scale datasets and use machine learning models to extract the code features and behavior patterns of malware to achieve automated detection and classification. Although machine learning methods show obvious advantages over traditional methods in improving detection accuracy and adaptability, their performance is still significantly restricted by the quality and diversity of the training data. An effective training dataset is the key to ensuring the generalization ability of the model, while the quantity, variability, and representativeness of existing malware training samples are often insufficient, resulting in a significant decline in the detection effect of machine learning models when facing unknown or new malware.

[0004] In practical applications, the collection of malware training samples faces many challenges, mainly reflected in the rapid emergence of new malware, the diversification of malware variants, and their high concealment. These factors make it difficult for existing malware detection models to comprehensively capture various types of malware, thus affecting the detection accuracy and robustness of malware detection models. Therefore, how to effectively generate representative malware training samples and then expand the existing training dataset has become the key to improving malware detection capabilities. Summary of the Invention

[0005] The present invention provides a method for generating malware training samples based on the assembly of atomic function modules. By disassembling existing malware source code to construct a multi-language malware atomic function library and splicing and assembling atomic function fragments, malware training samples with diverse functions are obtained, expanding the existing malware training dataset for training existing malware detection models to improve their detection accuracy and robustness, solving the problem of insufficient current malware training samples, and enhancing the overall performance of the detection system.

[0006] The method for generating malware training samples based on the assembly of atomic function modules in the present invention includes:

[0007] Constructing an atomic function library: According to the technical and tactical description granularity of ATT&CK (a knowledge base for describing the tactics, techniques, and sub-techniques of attackers in cyberattacks), atomic function fragments are disassembled, and these fragments are combined with the corresponding ATT&CK technical and tactical descriptions to form atomic function modules, and then a malware atomic function library is constructed;

[0008] Generating a configuration file: According to the functional requirements of the required malware training samples, appropriate atomic function modules are selected to generate a configuration file, and the structure of the configuration file includes a node set and an edge set;

[0009] Generating a call graph and converting it to an intermediate representation: A call graph is generated according to the configuration file. The nodes in the call graph represent atomic function modules, and the edges in the call graph record the execution flow and runtime context environment; the atomic function modules in the call graph are converted into atomic function intermediate representations in IR (Intermediate Representation) form to obtain a set of atomic function intermediate representations;

[0010] Converting node types and edge types: Traverse the call graph and convert all nodes and edges into corresponding node types and edge types respectively;

[0011] Assembling and processing dependencies: Create a main module, and in the call order of the nodes and edges in the call graph, sequentially link all the intermediate representations in the set of atomic function intermediate representations to the main module and process the dependencies of each atomic function module;

[0012] Create call logic and compile to generate a sample: Traverse the entire call graph according to the node type and edge type, and create the corresponding call logic in the main module; after the traversal is completed, obtain the assembled result IR and compile it to generate the final executable malware training sample.

[0013] The present invention is based on the idea of "promoting defense through attack". It constructs a malware atomic function library by manually splitting the existing multi-language malware source code, assembles atomic function modules organized by ATT&CK technology granularity according to the functional requirements of the required malware training sample, processes and analyzes the call relationships between modules, and actively generates executable malware training samples with different functions to provide diverse data for the training of malware detection models.

[0014] Furthermore, in constructing the atomic function library, atomic function fragments are disassembled from the existing malware source code. The existing malware source code includes those from public code hosting platforms, public data sets, and manually written code; after collecting the malware source code, the collected malware source code is manually split to obtain atomic function fragments, and the atomic function fragments are organized according to the technology granularity in ATT&CK to obtain atomic function modules.

[0015] Furthermore, when generating the configuration file, the structure of configuration file P is:

[0016] {nodes:list <node>, edges: list <edge>}};

[0017] Among them, the Edge structure is as follows:

[0018] Edge: {from: string, to: string, label?: boolean};

[0019] In the Edge structure, the from parameter represents the start node of the edge; the to parameter represents the end node of the edge; the label parameter is used to indicate whether the node connected by this edge is a branch node;

[0020] The Node structure is as follows:

[0021] Node: {id: string, name: string, modulePath: string, params?: list <param> , result?: Result, condition?: Condition};

[0022] In the Node structure, the id parameter is globally unique and is used to identify the node; the name parameter represents the node name; the modulePath represents the storage path of the atomic function module corresponding to the node; the params parameter is an optional parameter and represents the call parameters of the atomic function module corresponding to the node; the result parameter is an optional parameter and represents the call result of the atomic function module corresponding to the node; the condition parameter is an optional parameter and represents the judgment condition of the branch node. Only the branch node has this module.

[0023] Furthermore, in the step of converting node types and edge types, the node types include: basic nodes, start nodes, end nodes, branch nodes, and call nodes. Among them, all atomic function modules belong to call nodes.

[0024] Furthermore, in the step of converting node types and edge types, the edge types include: plain edges (edges used when constructing the minimum spanning tree) and branch edges (edges connecting parent nodes to child nodes).

[0025] Furthermore, in the step of creating call logic and compiling to generate samples, traversing the entire call graph according to the node types and edge types and creating corresponding call logic in the main module includes:

[0026] a. Starting from the start node, traverse the entire call graph, and recursively process the call logic of each node according to the node types of each node and the edge types of each edge;

[0027] b. If the current node has been processed, end the processing of the call graph; otherwise, perform the next step of processing on the node according to the type of the node;

[0028] c. Determine the node type. If it is a successor node, initialize the call logic as empty and further process it in step d. If it is a conditional jump node, create a basic block for it and create a conditional branch through the conditional expression. If it is an end node, create an end block for it.

[0029] d. Determine the successor node type. If the current node is a call node, create the call logic of the current node. If the current node has only one successor node, create a jump instruction. If the current node has multiple successor nodes, create a thread-related function call and recursively process each successor node.

[0030] The beneficial effects of the present invention include:

[0031] 1. It can actively generate malware training samples, providing diverse data for the training of malware detection models.

[0032] 2. It can effectively solve the problem of insufficient malware training samples, expand the data source of the malware dataset, indirectly improve the ability of existing malware detection methods to discover and identify unknown malware, create a new mode of sample collection in the malware detection process, and promote the development of network security defense technologies.

[0033] 3. It can expand the dataset without relying on a large number of real malware samples, enhancing the overall performance of the malware detection system.

[0034] 4. It significantly improves the effectiveness of existing security protection strategies, provides an important theoretical basis for network security defense, and promotes the improvement of the overall security of various systems. Brief Description of the Drawings

[0035] Figure 1 It is a flowchart of the method for generating malware training samples based on atomic function module assembly of the present invention.

[0036] Figure 2 It is a schematic diagram of the construction of the malware atomic function library of the present invention.

[0037] Figure 3 It is a class diagram of a specific implementation of the present invention.

[0038] Figure 4 It is a flowchart of traversing the call graph of the start node of the present invention to create call logic. Detailed Embodiments

[0039] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only a part rather than all of the embodiments of this application. The components of the embodiments of this application usually described and illustrated in the accompanying drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative efforts belong to the scope of protection of this application.

[0040] As Figure 1 shown, the method for generating malware training samples based on atomic function module assembly according to the present invention includes:

[0041] Construct an atomic function library: From existing malware source code, according to the technical and tactical description granularity in ATT&CK (a knowledge base used to describe the tactics, techniques, and sub-techniques of attackers in cyberattacks), through manual analysis and disassembly, collect atomic function fragments.

[0042] For example, an atomic function fragment can be a code fragment that conforms to the Encrypt Data (T1486) technique under the Impact (TA0040) tactic in the ATT&CK technical and tactical description. These atomic function fragments are not restricted by programming languages and can be written in multiple languages such as C, C++, assembly, and Python. Then, combine the atomic function fragments with their corresponding ATT&CK technical and tactical descriptions to obtain atomic function modules; finally, form a malware atomic function library from different atomic function modules, and the process is as Figure 2 shown.

[0043] In Figure 2 an example of the process of constructing a malware atomic function library is given. First, collect a set of malware source code written in languages such as C / C++, assembly, and Python from channels such as public code hosting platforms, public data sets, and manually written code. Then, through manual processing, split the collected malware source code according to the ATT&CK technical granularity to obtain atomic function fragments (i.e., Figure 2 the malicious function fragments in Figure 2 ). Then, organize the atomic function fragments according to the technical granularity in ATT&CK to obtain atomic function modules, that is: an atomic function module consists of an atomic function fragment + technical and tactical function description.

[0044] Finally, a malware atomic function library is constructed from each atomic function segment. The public code hosting platform includes but is not limited to well-known code hosting platforms such as Github; the public dataset includes but is not limited to public datasets such as TheZoo that provide malware source code; the manually written code is malware sample code written by security engineers themselves.

[0045] Generate a configuration file: According to the functional requirements of the required malware training samples, select atomic function modules that can meet the corresponding functional requirements. For example, if you need to generate a ransomware training sample with data encryption and anti-detection analysis capabilities, you need to select the atomic function modules for encrypting data and sandbox analysis. Then generate a configuration file P in JSON format from the selected atomic function modules. The structure of the configuration file P includes a node set and an edge set, and the node set and edge set contain the names, running parameters, relationships with other modules, and the execution order of each selected atomic function module.

[0046] Specifically, the structure of the configuration file P is as follows:

[0047] {nodes:list <node>, edges: list <edge>}};

[0048] Among them, the Edge structure is as follows:

[0049] Edge: {from: string, to: string, label?: boolean};

[0050] In the Edge structure, the from parameter represents the starting node of the edge; the to parameter represents the ending node of the edge; the label parameter is used to indicate whether the nodes connected by this edge are branch nodes; string indicates that the data is in string structure, and boolean indicates that the data is in boolean structure.

[0051] The Node structure is as follows:

[0052] Node: {id: string, name: string, modulePath: string, params?: list <param> , result?: Result, condition?: Condition};

[0053] In the Node structure, the id parameter is globally unique and is used to identify the node; the name parameter represents the node name; the modulePath represents the storage path of the atomic function module corresponding to the node; the params parameter is an optional parameter and represents the call parameters of the atomic function module corresponding to the node; the result parameter is an optional parameter and represents the call result of the atomic function module corresponding to the node; the condition parameter is an optional parameter and represents the judgment condition of the branch node. Only branch nodes have this module.

[0054] In the Node structure, structures such as Param, Result, and Condition are also defined. Their specific structures are as follows:

[0055] Param: {type: string, valueType: string, value: string, name: string, argNumber: int};

[0056] In this structure, the type parameter represents the type of the node parameter; the valueType parameter represents the value type of the node parameter; the value parameter represents the specific value of the node parameter; the name parameter represents the parameter name of the node; the argNumber parameter represents the serial number of the node parameter.

[0057] Result: {type: string, value: string};

[0058] The type parameter in this structure represents the type of the result; the value parameter represents the value of the result.

[0059] Condition: {left?: Condition, right?: Condition, op?: string, type?: string, valueType?: string, value?: string};

[0060] The left parameter in this structure is an optional parameter and is the left value of the op parameter; the right parameter is an optional parameter and is the right value of the op parameter; the op parameter is an optional parameter and is the op type; the type parameter is an optional parameter and represents the type of the condition parameter; the valueType parameter is an optional parameter and represents the value type of the condition parameter.

[0061] Generate a call graph and convert the intermediate representation: Generate a call graph G according to the configuration file P. The call graph G consists of nodes and edges. Each node represents an atomic function module, and the edges record the execution flow of the corresponding atomic function module and maintain the running context environment for generating malware training samples.

[0062] Then parse the used atomic function modules from the call graph G and convert them into the atomic function intermediate representation Fcs in the form of IR (Intermediate Representation). i , and obtain the atomic function intermediate representation set Fcs = {Fcs1, Fcs2, Fcs3,..., Fcs n}, where both i and n are natural numbers, and i ∈ n.

[0063] Convert node types and edge types: Traverse all nodes in the call graph G and convert them into corresponding node types. The node types include: basic nodes, start nodes, end nodes, branch nodes, and call nodes. Among them, all atomic function modules belong to call nodes.

[0064] Traverse all edges in the call graph G and convert them into corresponding edge types. The edge types include: plain edges (edges used when constructing the minimum spanning tree) and branch edges (edges connecting child nodes from the parent node).

[0065] Assemble and process dependencies: Create the main module M. According to the call order of each node and each edge in the call graph G during the step of converting node types and edge types, and link all the atomic function intermediate representations Fcs in the atomic function intermediate representation set Fcs i to the main module M in sequence.

[0066] Then, based on the call graph G and the intermediate representations Fcs corresponding to each atomic functional module i , the dependencies of each atomic functional module are processed. For example, if an atomic functional module needs to call APIs such as CreateThread to create a process and CloseHandle to close a handle, it needs to depend on the dynamic link library file kernel32.dll. Therefore, the file kernel32.dll needs to be introduced as the atomic functional module dependency of this atomic functional module.

[0067] Figure 3 The class diagram in the specific implementation of the present invention is shown, which is used to abstractly describe the generation process. In Figure 3 the class diagram, there are 12 classes including: Management Class (Manager), Value Class (Value), Parameter Class (Parameter), Result Class (Result), Branch Node Class (BRNode), Called Node Class (CalledNode), Entry Node Class (EntryNode), End Node Class (EndNode), Successor Node Class (SuccessorNode), Recursive Condition Class (RCondition), Value Condition Class (ICondition), and Symbol Condition Class (SCondition), and 2 interfaces including Base Node Interface (BaseNode) and Base Condition Interface (BaseCondition). Among them:

[0068] Management Class: This class is used to manage all nodes and the call graph in the malware.

[0069] Value Class: This class is used to represent any value in the malware, including symbolic values and specific numerical values. Symbolic values represent the results of atomic function calls or global variables in the malware, and specific values represent specific numerical values or specific strings, etc.

[0070] Parameter Class: This class inherits from the Value Class and is used to represent the parameters required for the operation of atomic functions.

[0071] Result Class: This class inherits from the Value Class and is used to represent the results obtained from the operation of atomic functions.

[0072] The Base Node Interface defines the common methods and attributes of all node classes, and defines a unified specification for other derived node classes.

[0073] The Branch Node Class, Called Node Class, Entry Node Class, and End Node Class all belong to the Node Class and inherit the Base Node Interface. The Called Node Class and the Entry Node Class further abstract the Successor Node Class. Among them:

[0074] Branch Node Class: This class is composed of various conditional nodes and is used to represent the branch structure during the operation of the malware.

[0075] Call node class: This class consists of a parameter class and a result class, and all atomic functions belong to call nodes.

[0076] Start node class: This class is used to represent the start of malware.

[0077] End node class: This class is used to represent the end of malware.

[0078] Successor node class: This class is abstracted from the call node class and the start node class. This class is a special representation of the call node class. If an atomic function is represented by this class, then the atomic function has a successor atomic function node.

[0079] The basic condition interface defines the common methods and attributes of all condition classes, and defines a unified specification for other derived condition classes.

[0080] The value condition class, the symbol condition class, and the recursive condition class are all condition classes and inherit the basic condition interface.

[0081] Among them:

[0082] Value condition class: This class inherits from the value class and is used to represent conditional operations on specific values.

[0083] Symbol condition class: This class inherits from the value class and is used to represent conditional operations on symbolic values.

[0084] Recursive condition class: This class is used to represent complex conditional operations and can be composed of the value condition class, the symbol condition class, or itself.

[0085] Create call logic and compile to generate samples: Find the call graph G and the start node Entry. Starting from this start node Entry, traverse the entire call graph G according to the node types of each node and the edge types of each edge, and create the corresponding call logic in the main module M. As Figure 4 shown, it includes the steps:

[0086] a. Starting from the start node Entry, traverse the entire call graph G, and recursively process the call logic of each node according to the node types of each node and the edge types of each edge;

[0087] b. If the current node has been processed, then end the processing of the call graph G, otherwise perform the next step of processing on the node according to the type of the node;

[0088] c. Judge the node type. If it is a successor node, initialize the call logic to be empty and further process it in step d; if it is a conditional jump node, create a basic block for it and create a conditional branch through the conditional expression; if it is an end node, then create an end block for it;

[0089] d. Determine the type of the successor node. If the current node is a call node, create the call logic of the current node. If the current node has only one successor node, create a jump instruction. If the current node has multiple successor nodes, create a thread-related function call and recursively process each successor node.

[0090] After the traversal of the call graph G is completed, the assembly result IR is obtained, and then the assembly result IR is compiled to generate the final executable malware training sample.

[0091] The present invention is based on the idea of "promoting defense through attack". By manually splitting the existing multi-language malware source code, a malware atomic function library is constructed. According to the functional requirements of the required malware training sample, the atomic function modules organized by ATT&CK technology are assembled, the call relationships between the modules are processed and parsed, and executable malware training samples with different functions are actively generated to provide diverse data for the training of malware detection models.

[0092] The above embodiments only represent the specific implementation manners of the present application, and the description is relatively specific and detailed, but it should not be construed as a limitation to the protection scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the idea of the technical solution of the present application, relevant deformations and improvements can also be made, and these all belong to the protection scope of the present application.< / edge> < / node> < / edge> < / node>

Claims

1. A method for generating malware training samples based on the assembly of atomic functional modules, characterized in that Including: Constructing an atomic function library: According to the technical and tactical description granularity of ATT&CK, disassembling atomic function fragments, combining these fragments with the corresponding ATT&CK technical and tactical descriptions to form atomic function modules, and then constructing a malicious software atomic function library; Generating a configuration file: According to the functional requirements of the required malicious software training samples, selecting appropriate atomic function modules to generate a configuration file, and the structure of the configuration file includes a node set and an edge set; Generating a call graph and converting the intermediate representation: Generating a call graph according to the configuration file, where the nodes in the call graph represent atomic function modules, and the edges in the call graph record the execution flow and the running context environment; Converting the atomic function modules in the call graph into an atomic function intermediate representation in IR form to obtain a set of atomic function intermediate representations; Converting node types and edge types: Traversing the call graph and converting all nodes and edges into corresponding node types and edge types respectively; Assembling and processing dependencies: Creating a main module, and sequentially linking all the intermediate representations in the set of atomic function intermediate representations to the main module according to the call order of the nodes and edges in the call graph, and processing the dependencies of each atomic function module; Creating call logic and compiling to generate samples: Traversing the entire call graph according to the node types and edge types, creating corresponding call logic in the main module; After the traversal is completed, obtaining the assembled result IR and compiling it to generate the final executable malicious software training sample.

2. The method for generating malware training samples based on the assembly of atomic functional modules as claimed in claim 1, characterized in that: In constructing the atomic function library, disassembling atomic function fragments from existing malicious software source codes.

3. The method for generating malware training samples based on atomic functional module assembly according to claim 1, wherein: When generating the configuration file, the structure of the configuration file is: {nodes: list <node>, edges: list <edge>}；< / edge> < / node> Among them, the Edge structure is: Edge:{from:string,to:string,label?:boolean}; In the Edge structure, the from parameter represents the start node of the edge; the to parameter represents the end node of the edge; the label parameter is used to indicate whether the node connected by this edge is a branch node; The Node structure is: Node: {id: string, name: string, modulePath: string, params?: list <param> , result?: Result, condition?: Condition}; In the Node structure, the id parameter is globally unique and is used to identify the node; the name parameter represents the node name; the modulePath represents the storage path of the atomic function module corresponding to the node; the params parameter is an optional parameter and represents the call parameters of the atomic function module corresponding to the node; the result parameter is an optional parameter and represents the call result of the atomic function module corresponding to the node; the condition parameter is an optional parameter and represents the judgment condition of the branch node, and only the branch node has this module.

4. The method for generating malware training samples based on the assembly of atomic functional modules according to claim 1, characterized in that: In the step of converting node types and edge types, the node types include: basic nodes, start nodes, end nodes, branch nodes, and call nodes, where all atomic function modules belong to call nodes.

5. The method for generating malware training samples based on the assembly of atomic functional modules as claimed in claim 1, characterized in that: In the step of converting node types and edge types, the edge types include: plain edges and branch edges.

6. The method for generating malware training samples based on the assembly of atomic functional modules according to claim 1, characterized in that: In the step of creating call logic and compiling to generate samples, the traversing the entire call graph according to the node and edge types and creating corresponding call logic in the main module includes: a. Starting from the start node, traversing the entire call graph, and recursively processing the call logic of each node according to the node types of each node and the edge types of each edge; b. If the current node has been processed, end the processing of the call graph; otherwise, perform the next step of processing on the node according to its type. c. Determine the node type. If it is a successor node, initialize the call logic to be empty and further process it in step d. If it is a conditional jump node, create a basic block for it and create a conditional branch through the conditional expression. If it is an end node, create an end block for it. d. Determine the successor node type. If the current node is a call node, create the call logic for the current node. If the current node has only one successor node, create a jump instruction. If the current node has multiple successor nodes, create a thread-related function call and recursively process each successor node.

Images