Malicious code detection method and device based on abstract semantic behavior graph mark retrieval and medium
By constructing graph nodes in graph databases and using large language models to mark semantic behavior labels, the problem of low malicious code detection efficiency in the existing technology is solved, and efficient static feature detection and path tracking are achieved.
Patent Information
- Application Number
- CN202510671402.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-23
- Publication Date
- 2025-08-01
AI Technical Summary
The prior art is difficult to effectively detect malicious code, especially obfuscated malicious code, and the detection method based on dynamic features has problems such as high software, hardware and labor costs and low efficiency.
The abstract syntax tree is constructed by parsing the object code, and then standardized it and converted into graph nodes in the graph database. The large language model is used to mark semantic behavior labels, and graph retrieval and path tracking are performed to detect malicious code.
It realizes efficient detection of malicious code under static characteristics, can understand the code execution process and intention behavior, reduces detection costs and improves efficiency.
Smart Images
Figure CN120407370A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network attack and defense technologies, and more particularly, to a malicious code detection method based on abstract semantic behavior graph marker retrieval. Background Art
[0002] With the continuous evolution of network attack and defense, the complexity and diversity of malicious code variants have increased dramatically. Malicious code is usually obfuscated and encrypted, and the true intention of the code is hidden in a large number of deeply nested meaningless redundant codes, making it difficult for static feature-based methods to effectively detect malicious code. In addition, dynamic feature-based detection methods rely on parsing and executing the code and detecting it by identifying abnormal code behaviors. This process usually relies on a large amount of expert experience and knowledge, and has problems such as high software and hardware and human costs and low efficiency. To address the above problems, there is an urgent need for a method for detecting malicious code based on static features. Summary of the Invention
[0003] The present invention aims to at least solve one of the above technical problems existing in the prior art.
[0004] To this end, a first aspect of the present invention provides a malicious code detection method based on abstract semantic behavior graph marker retrieval.
[0005] A second aspect of the present invention provides a computer device.
[0006] A third aspect of the present invention provides a computer-readable storage medium.
[0007] The present invention provides a malicious code detection method based on abstract semantic behavior graph marker retrieval, including: Parsing the target code to be detected, constructing an abstract syntax tree of the code, and forming an initial abstract syntax tree; Performing a standardization process on the initial abstract syntax tree, converting the different lexical and syntactic differences of different programming languages according to a defined unified specification, and obtaining a standard abstract syntax tree; Defining a graph database graph node specification, and converting the standard abstract syntax tree into graph nodes, attributes, and relationships according to the defined graph node specification, to obtain a first code graph; Defining malicious code semantic behavior labels; the malicious code semantic behavior labels are used to describe the key behavior characteristics of malicious code; Using a large language model to perform semantic analysis on the first code graph, and marking semantic behavior labels on the code graph nodes, to obtain a marked code graph; Writing the marked code graph into a graph database; In the graph database, performing malicious code detection and path tracing based on marker retrieval.
[0008] The malicious code detection method based on abstract semantic behavior graph marking retrieval according to the above technical solution of the present invention may further have the following additional technical features: In the above technical solution, parsing the target code to be detected, constructing an abstract syntax tree of the code, and forming an initial abstract syntax tree includes: Performing lexical analysis on the target code to be detected, parsing each code step, and representing the corresponding code of the step and the call relationship between them in a tree form, where each node on the tree represents a structure in the source code; the formed initial abstract syntax tree is used to represent all possible execution paths of the code.
[0009] In the above technical solution, standardizing the initial abstract syntax tree, and converting the different lexical and syntactic differences of programming languages according to the defined unified specification to obtain a standard abstract syntax tree, includes: Defining a unified abstract syntax tree specification, where the common lexical and syntactic elements in different programming languages are retained, and the different lexical and syntactic differences in different programming languages are converted into specified common tags in the specification; Traversing the initial abstract syntax tree, and converting all tree nodes according to the unified abstract syntax tree specification to obtain a standard abstract syntax tree.
[0010] In the above technical solution, defining the graph node specification of the graph database, and converting the standard abstract syntax tree into graph nodes, attributes, and relationships according to the defined graph node specification to obtain a first code graph, includes: Defining the graph node types, relationships, and attributes of the graph database in the graph node specification of the graph database; where the graph node types include variables, functions, classes, conditions, and loops, and each graph node type corresponds to a common node type in the abstract syntax tree; the graph node relationships include references, calls, and uses, which are used to represent the logical associations between nodes; the graph node attributes include object types, states, values, parameter lists, and call sequences, which are used to describe the characteristics and related information of nodes in detail; each graph node has a unique ID; Traversing the standard abstract syntax tree, creating graph nodes of corresponding types according to their types in the abstract syntax tree according to the graph node specification of the graph database; assigning a unique ID to each graph node, and filling its attributes according to the information of the node in the abstract syntax tree; while converting the graph nodes, establishing the relationships between the graph nodes according to the relationships of the nodes in the abstract syntax tree.
[0011] In the above technical solution, defining malicious code semantic behavior tags includes: Obtaining a number of code samples; Automatically annotating the code samples at the function level and business level based on a large language model to form semantic behavior tags; The generated semantic behavior labels are manually screened to conform to the malicious code detection logic to obtain malicious code semantic behavior labels; malicious code semantic behavior labels can describe the key behavioral characteristics of the code. Semantic behavior labels include file operations, directory operations, database operations, command execution, process startup and arbitrary parameters to describe malicious behaviors and form a limited set of semantic behavior labels.
[0012] In the above technical solution, the use of a large language model to perform semantic analysis on the first code graph, marking the code graph nodes with semantic behavior labels, and obtaining a marked code graph includes: Perform a bottom-up breadth-first traversal of all nodes in the first code graph, perform semantic analysis on each traversed node based on the large language model, and add semantic behavior labels to the nodes; wherein, a node is allowed to have multiple semantic behavior labels; When the child node processing is completed and the parent node is traversed, the semantic behavior labels of all child nodes under the parent node are extracted, and the current parent node information is integrated to perform semantic behavior analysis on the parent node and add any possible semantic behavior labels of the parent node.
[0013] In the above technical solution, writing the marked code graph into the graph database includes: The graph nodes of the marked code graph are traversed through depth-first traversal. For a traversed graph node and all its child nodes, the parent-child graph node type, attribute and relationship information are constructed, and the graph information is written into the graph database.
[0014] In the above technical solution, the malicious code detection and path tracing based on tag retrieval in the graph database include: Search all nodes in the graph database based on a graph retrieval language. The retrieval criteria are possible malicious code semantic behavior labels or label combinations. The label combinations are generated by a large language model based on a limited set of semantic behavior labels. When a malicious code node that meets the conditions is retrieved, it indicates that any node with this node as the initial node and all its child nodes contains a malicious code risk, that is, calling and executing this initial node or its child nodes will generate malicious behavior; Retrieve the semantic behavior labels of all child nodes under the initial node, that is, perform path tracing on the malicious code.
[0015] The present invention provides a computer device comprising a processor and a memory, wherein the memory stores a computer program. When the computer program is loaded and executed by the processor, the malicious code detection method based on abstract semantic behavior graph label retrieval as described in any one of the above technical solutions is implemented.
[0016] A computer-readable storage medium provided by the present invention stores a program that, when loaded by a processor, implements the malicious code detection method based on abstract semantic behavior graph label retrieval described in any one of the above technical solutions.
[0017] In summary, due to the adoption of the above technical features, the beneficial effects of the present invention are as follows: The present invention transforms the target code into a graph structure, semantically understands and analyzes the code based on a large language model, marks various behaviors of the code, and then performs combined label retrieval on the marked code graph through graph retrieval syntax to achieve the detection of malicious code composed of different behavior combinations.
[0018] Specifically, the method of the present invention can transform the target code into a graph structure, semantically understand and analyze the code based on a large language model, and mark various behaviors of the code, realizing the understanding and marking of the execution process and intended behaviors of malicious code based on static features. By performing combined label retrieval on the marked code graph through graph retrieval syntax, the detection of malicious code composed of different behavior combinations is achieved, and the tracking of the execution path of malicious code can be realized in a non-dynamic analysis scenario.
[0019] The additional aspects and advantages of the present invention will become apparent in the following description section or be understood through the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS
[0020] The above and / or additional aspects and advantages of the present invention will become apparent and be readily understood from the description of the embodiments in conjunction with the following drawings, wherein: Figure 1 is a schematic diagram of the malicious code detection method based on abstract semantic behavior graph label retrieval according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0021] In order to more clearly understand the above objects, features, and advantages of the present invention, the present invention will be further described in detail below with reference to the drawings and specific embodiments. It should be noted that, without conflict, the embodiments of the present application and the features in the embodiments can be combined with each other.
[0022] Many specific details are set forth in the following description in order to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited by the specific embodiments disclosed below.
[0023] The following refers to Figure 1 to describe the malicious code detection method based on abstract semantic behavior graph label retrieval according to some embodiments of the present invention.
[0024] Some embodiments of the present application provide a malicious code detection method based on abstract semantic behavior graph marker retrieval.
[0025] As Figure 1 shown, the first embodiment of the present invention proposes a malicious code detection method based on abstract semantic behavior graph marker retrieval, including the following steps S1 - S7.
[0026] S1. Analyze the target code to be detected, construct a code abstract syntax tree, and form an initial abstract syntax tree.
[0027] In some embodiments, step S1 includes: performing lexical analysis on the target code to be detected, parsing each code step, representing the functions, classes, object declarations, etc. of the corresponding steps and their call relationships in a tree form, where each node on the tree represents a structure in the source code; the formed initial abstract syntax tree is used to represent all possible execution paths of the code.
[0028] Specifically, first perform lexical analysis on the source code to decompose the code into a series of tokens. For example, identify keywords, identifiers, operators, literals, etc. in the code. Tools such as Lex or Flex can be used to assist in completing lexical analysis. Based on lexical analysis, according to the grammar rules of the target language, parse the token sequence to construct an abstract syntax tree. Common syntax analysis methods include recursive descent method, LR analysis method, etc. Tools such as Yacc or Bison can be used to implement syntax analysis and construct an abstract syntax tree.
[0029] S2. Standardize the initial abstract syntax tree, convert the different lexical and syntactic differences of different programming languages according to the defined unified specification, and obtain a standard abstract syntax tree.
[0030] In some embodiments, step S2 includes: Define a unified abstract syntax tree specification, where the common lexical and syntactic elements in different programming languages are retained, such as references (such as variable references, etc.), definitions (variable definitions, function definitions, etc.), calls (function calls, etc.), loops (such as for, while, etc.), conditional judgments (such as if, switch, etc.), and functions, etc. in programming languages; convert the different lexical and syntactic differences in different programming languages into specified common tokens in the specification; where the different lexical and syntactic differences refer to the specific lexical and syntactic elements in each programming language.
[0031] Traverse the initial abstract syntax tree, convert all tree nodes according to the unified abstract syntax tree specification, and obtain a standard abstract syntax tree.
[0032] In a specific embodiment, the differential lexical and grammatical rules in different programming languages are converted into specified general tags in the specification. Specific prefixes, suffixes, or custom identifiers can be used to distinguish these specific grammatical elements. For example, the prefix LANG_SPECIFIC_ can be used to mark language-specific lexical elements. For instance, LANG_SPECIFIC_java_static represents the static keyword in Java (a programming language), which is a language-specific grammar. The standardized standard abstract syntax tree can still represent all possible execution paths of the code. That is, during the entire conversion process, it is necessary to pay attention to retaining all execution flow information of the original code. Whether it is a general grammatical structure or a language-specific grammatical part with special tags, it is necessary to ensure that the logical order, control flow, etc. of the code are accurately reflected in the standard abstract syntax tree, so that the second abstract syntax tree can completely represent all possible execution paths of the code. Thus, subsequent operations such as malicious code detection can be performed based on this standardized tree without losing key code execution logic information.
[0033] S3. Define the graph node specification of the graph database, and convert the standard abstract syntax tree into graph nodes, attributes, and relationships according to the defined graph node specification to obtain the first code graph.
[0034] In some embodiments, step S3 includes: Define the graph node types, relationships, and attributes of the graph database in the graph database graph node specification; among them, the graph node types include variables, functions, classes, conditions, and loops, etc., and each graph node type corresponds to a general node type in the abstract syntax tree; the graph node relationships include references, calls, and uses, etc., which are used to represent the logical associations between nodes; the graph node attributes include object types, states, values, parameter lists, and call sequences, etc., which are used to describe the characteristics and related information of the nodes in detail; each graph node has a unique ID; Traverse the standard abstract syntax tree, create graph nodes of corresponding types according to their types in the abstract syntax tree in accordance with the graph database graph node specification for all tree nodes; assign a unique ID to each graph node, and fill its attributes according to the information of the node in the abstract syntax tree; while converting the graph nodes, establish the relationships between the graph nodes according to the relationships of the nodes in the abstract syntax tree; finally, form the first code graph.
[0035] Specifically, the process of forming the first code graph includes: Create an empty graph database for storing the graph nodes, relationships, and attributes to be converted.
[0036] Starting from the root node of the standard abstract syntax tree, visit each node in turn in the manner of depth-first search or breadth-first search.
[0037] For each visited node, create a graph node of the corresponding type according to its type in the abstract syntax tree. For example, if it is a function definition node, create a graph node of the function type; if it is a conditional judgment node, create a graph node of the conditional type. Assign a unique ID to each graph node and fill in its attributes according to the information of the node in the syntax tree, such as object type (determined according to the role of the node in the code, such as function, variable, etc.), status (such as whether it has been initialized, etc.), value (if it is a constant node, store its value), parameter list (if it is a function node, store its parameter list), call sequence (if it is a function call node, record information such as the call order).
[0038] While transforming the graph nodes, establish the relationships between the graph nodes according to the parent-child relationships, reference relationships, etc. of the nodes in the syntax tree. For example, if a function node contains a call to another function in the syntax tree, then establish a call relationship between the two corresponding graph nodes; if a variable node is referenced by a function node, then establish a reference relationship between the two. When establishing the relationships, also assign a unique ID to each relationship and set the attributes of the relationship as needed, such as the number of calls, the context of the reference, etc.
[0039] Store the transformed graph nodes and their attributes in the graph database. Each graph node is identified by a unique ID and stores its type and attribute information.
[0040] S4. Define malicious code semantic behavior labels; the malicious code semantic behavior labels are used to describe the key behavior characteristics of malicious code.
[0041] In some embodiments, step S4 includes: Obtain a number of code samples; the code samples include normal code and malicious code, and the code samples should be as comprehensive as possible, but need to meet the actual computing power.
[0042] Automatically generate semantic behavior labels for the code samples at the function level and business level based on a large language model; Manually screen the generated semantic behavior labels to conform to the malicious code detection logic to obtain malicious code semantic behavior labels. It can be understood that the purpose of this process is to reliably screen the semantic behavior labels of malicious code. During the process of professional personnel handling, the handling by different personnel will not bring differences in results. Even if there are differences in results and the screening is incomplete, it will not affect the subsequent detection steps, only slightly affecting the detection rate; the malicious code semantic behavior labels can describe the key behavior characteristics of the code, and the semantic behavior labels include file operations, directory operations, database operations, command execution, process startup, and arbitrary parameters to comprehensively describe malicious behaviors and form a finite semantic behavior label set.
[0043] S5. Use a large language model to perform semantic analysis on the first code graph, mark semantic behavior labels for the code graph nodes, and obtain a marked code graph.
[0044] In some embodiments, step S5 includes: Perform a breadth-first traversal from bottom to top on all nodes in the first code graph, perform semantic analysis on each traversed node based on the large language model, and add semantic behavior labels to the nodes; wherein, a node is allowed to have multiple semantic behavior labels; When the processing of the child nodes is completed and the parent node is traversed, extract the semantic behavior labels of all child nodes under the parent node, and comprehensively analyze the semantic behavior of the parent node based on the current parent node information, and add the possible semantic behavior labels of the parent node. Repeat this process until the entire code graph is marked to obtain a marked code graph.
[0045] S6. Write the marked code graph into a graph database.
[0046] In some embodiments, step S6 includes: Traverse the graph nodes of the marked code graph through depth-first traversal. For a traversed graph node and all its child nodes, construct the type, attributes, and relationship information of the parent and child graph nodes, and write the complete graph information such as nodes, relationships, attributes, and labels into the graph database.
[0047] S7. In the graph database, perform malicious code detection and path tracing based on marked retrieval.
[0048] Specifically, step S7 includes: Perform retrieval among all nodes in the graph database based on the graph retrieval language, and the retrieval condition is possible malicious code semantic behavior labels or label combinations; the label combinations are generated by the large language model based on a finite set of semantic behavior labels. For example, the large language model selects some malicious code semantic behavior labels from the finite set of semantic behavior labels for combination, and the several combined results can be further screened by experts to improve rationality.
[0049] When a malicious code node that meets the conditions is retrieved, it indicates that there is a malicious code risk in any node among the initial node and all its child nodes included. That is, by executing the call to the initial node or its child nodes, malicious behavior will occur.
[0050] Retrieve the semantic behavior labels of all child nodes under the initial node, that is, perform path tracing for the malicious code execution.
[0051] The second embodiment of the present invention provides a computer device, which includes a processor and a memory. A computer program is stored in the memory, and when the computer program is loaded and executed by the processor, it implements the malicious code detection method based on abstract semantic behavior graph label retrieval as described in any of the above embodiments.
[0052] The third embodiment of the present invention provides a computer-readable storage medium storing a program, and when the program is loaded by a processor, it implements the malicious code detection method based on abstract semantic behavior graph label retrieval as described in any of the above embodiments.
[0053] In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples.
[0054] Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.
Claims
1. A malicious code detection method based on abstract semantic behavior graph marking retrieval, characterized in that, Including: Analyze the target code to be detected, construct a code abstract syntax tree, and form an initial abstract syntax tree; Perform standardization processing on the initial abstract syntax tree, convert the different lexical and syntactic differences of different programming languages according to the defined unified specification, and obtain a standard abstract syntax tree; Define the graph node specification of the graph database, and convert the standard abstract syntax tree into graph nodes, attributes, and relationships according to the defined graph node specification to obtain the first code graph; Define malicious code semantic behavior labels; the malicious code semantic behavior labels are used to describe the key behavior characteristics of malicious code; Use a large language model to perform semantic analysis on the first code graph, mark semantic behavior labels for the code graph nodes, and obtain a marked code graph; Write the marked code graph into the graph database; In the graph database, perform malicious code detection and path tracing based on marked retrieval.
2. The malicious code detection method based on abstract semantic behavior graph label retrieval according to claim 1, characterized in that The analyzing the target code to be detected, constructing a code abstract syntax tree, and forming an initial abstract syntax tree includes: Perform lexical analysis on the target code to be detected, parse each code step, represent the corresponding code of the step and the call relationship between them in a tree form, where each node on the tree represents a structure in the source code; the formed initial abstract syntax tree is used to represent all possible execution paths of the code.
3. The malicious code detection method based on abstract semantic behavior graph label retrieval according to claim 1, wherein The performing standardization processing on the initial abstract syntax tree, converting the different lexical and syntactic differences of different programming languages according to the defined unified specification, and obtaining a standard abstract syntax tree includes: Define a unified abstract syntax tree specification, where the common lexical and syntactic elements in different programming languages are retained, and the different lexical and syntactic differences in different programming languages are converted into specified common tags in the specification; Traverse the initial abstract syntax tree, and convert all tree nodes according to the unified abstract syntax tree specification to obtain a standard abstract syntax tree.
4. The malicious code detection method based on abstract semantic behavior graph marker retrieval according to claim 1, wherein The defining the graph node specification of the graph database, converting the standard abstract syntax tree into graph nodes, attributes, and relationships according to the defined graph node specification, and obtaining the first code graph includes: Define the graph node types, relationships, and attributes of the graph database in the graph database graph node specification; among them, the graph node types include variables, functions, classes, conditions, and loops, and each graph node type corresponds to a common node type in the abstract syntax tree; the graph node relationships include reference, call, and use, which are used to represent the logical association between nodes; the graph node attributes include object type, status, value, parameter list, and call sequence, which are used to describe the characteristics and related information of the nodes in detail; each graph node has a unique ID; Traverse the standard abstract syntax tree, create graph nodes of the corresponding type for all tree nodes according to their types in the abstract syntax tree according to the graph database graph node specification; assign a unique ID to each graph node, and fill its attributes according to the information of the node in the abstract syntax tree; while converting the graph nodes, establish the relationships between the graph nodes according to the relationships of the nodes in the abstract syntax tree.
5. The malicious code detection method based on abstract semantic behavior graph marker retrieval according to claim 1, characterized in that The defining the malicious code semantic behavior labels includes: Obtain a number of code samples; Automatically generate function-level and business-level annotations for the code samples based on a large language model to form semantic behavior labels; Manually screen the generated semantic behavior tags to conform to the malicious code detection logic, and obtain malicious code semantic behavior tags; the malicious code semantic behavior tags can describe the key behavior characteristics of the code, and the semantic behavior tags include file operations, directory operations, database operations, command execution, process startup, and arbitrary parameters to describe malicious behaviors and form a finite semantic behavior tag set.
6. The malicious code detection method based on abstract semantic behavior graph label retrieval according to claim 1, characterized in that, The semantic analysis of the first code graph by using the large language model and the marking of semantic behavior tags for the code graph nodes to obtain a marked code graph includes: Perform a breadth-first traversal from bottom to top on all nodes in the first code graph, perform semantic analysis on each traversed node based on the large language model, and add semantic behavior tags to the nodes; among them, it is allowed that a node has multiple semantic behavior tags; When the processing of the child nodes is completed and the parent node is traversed, extract the semantic behavior tags of all child nodes under the parent node, and comprehensively analyze the semantic behavior of the parent node based on the current parent node information, and add the possible semantic behavior tags of the parent node.
7. The malicious code detection method based on abstract semantic behavior graph label retrieval according to claim 1, characterized in that The writing of the marked code graph into the graph database includes: Traverse the graph nodes of the marked code graph through depth-first traversal. For a traversed graph node and all its child nodes, construct the parent-child graph node type, attribute, and relationship information, and write the graph information into the graph database.
8. The malicious code detection method based on abstract semantic behavior graph label retrieval according to claim 1, wherein In the graph database, the malicious code detection and path tracing based on marked retrieval include: Perform a search among all nodes in the graph database based on the graph retrieval language, and the search condition is possible malicious code semantic behavior tags or tag combinations, and the tag combinations are generated by the large language model based on the finite semantic behavior tag set; When a malicious code node that meets the conditions is retrieved, it indicates that there is a malicious code risk in any node among the initial node and all its child nodes included in this node, that is, malicious behaviors will be generated through the call execution of this initial node or its child nodes; Retrieve the semantic behavior tags of all child nodes under the initial node, that is, perform path tracing on the malicious code execution path.
9. A computer device, characterized in that, It includes a processor and a memory, and a computer program is stored in the memory. When the computer program is loaded and executed by the processor, it implements the malicious code detection method based on abstract semantic behavior graph marking retrieval as described in any one of claims 1 to 8.
10. A computer-readable storage medium, characterized in that, A program is stored, and when the program is loaded by the processor, it implements the malicious code detection method based on abstract semantic behavior graph marking retrieval as described in any one of claims 1 to 8.