Code classification interpretation method and device based on matrix dictionary and electronic equipment

Abstract

The invention discloses a code classification interpretation method and device based on a matrix dictionary and electronic equipment, and relates to the field of financial science and technology or other related technical fields, and the method comprises the steps that malicious codes are classified through a machine learning model, and a code classification result is obtained, the machine learning model outputs a code classification result based on the feature vector of the malicious code; based on a code classification result, key features are positioned by adopting an attention mechanism; the key features serve as index conditions, a target matrix dictionary is inquired, a key malicious behavior description result of the malicious code is generated, the target matrix dictionary comprises a plurality of feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description result is used for describing malicious behavior details in the code classification result. The technical problem that malicious behaviors in malicious code classification results cannot be explained in related technologies is solved.

Description

Technical Field

[0001] The present invention relates to the field of financial technology or other related fields, and in particular to a code classification and interpretation method and device based on a matrix dictionary, and an electronic device. Background Art

[0002] In the digital age, information security has become a core issue for maintaining network stability and data security, and malicious code detection and classification are key components of information security defense systems. Traditional malicious code classification methods, such as signature-based and behavior-based detection, while offering high detection rates in specific scenarios, often fall short in combating complex and dynamic network attacks due to their fixed nature. In recent years, the rise of machine learning technology has brought new opportunities for malicious code detection. By training models to identify the characteristics of malicious code, it can provide stronger protection against unknown threats.

[0003] However, machine learning-based malicious code classification methods have a significant flaw: they are considered a "black box" model, meaning the model's internal reasoning process when making classification decisions is invisible to users. This lack of transparency is particularly problematic in the field of security operations, as security personnel need to know not only whether code is malicious but also the specific techniques used by the malicious code and the targets it targets, so that they can implement targeted protective measures.

[0004] In the field of image-based malware classification, while some methods exist for interpreting classification results, these methods only account for the similarity of code images and fail to delve into the behavioral aspects of the malware, specifically the malicious behavior behind the code and how it is implemented. Therefore, current malware classification and interpretation technologies cannot fully meet the needs of security operations personnel for effectively handling classification results.

[0005] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0006] The embodiments of the present invention provide a code classification and interpretation method and device based on a matrix dictionary, and an electronic device, so as to at least solve the technical problem in the related art that malicious behaviors in malicious code classification results cannot be interpreted.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a code classification and interpretation method based on a matrix dictionary is provided, including: using a machine learning model to classify malicious code to obtain a code classification result, wherein the machine learning model outputs the code classification result based on the feature vector of the malicious code; based on the code classification result, an attention mechanism is used to locate key features; using the key features as index conditions, a target matrix dictionary is queried to generate a key malicious behavior description result of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description result is used to describe the malicious behavior details in the code classification result.

[0008] Optionally, before using a machine learning model to classify malicious code and obtain code classification results, it also includes: constructing an initial matrix dictionary with malicious targets as dictionary rows and malicious technologies as dictionary columns, wherein the malicious targets refer to targets achieved through malicious behavior, and the malicious technologies refer to technologies used to achieve the malicious targets; classifying malicious code features according to the malicious targets and the malicious technologies respectively, and filling the feature classification results into the initial matrix dictionary to generate the target matrix dictionary.

[0009] Optionally, based on the code classification result, the step of using the attention mechanism to locate key features includes: extracting static features and dynamic features of the malicious code, wherein the static features refer to features used for static limitation and code description in the malicious code, and the dynamic features refer to features of operation behaviors in the malicious code; using the pre-established target matrix dictionary to establish a first routing relationship between static features, malicious technologies and malicious purposes, and to establish a second routing relationship between dynamic features, malicious technologies and malicious purposes; inputting the first routing relationship, the second routing relationship and the code classification result into the attention mechanism model, and the attention matrix is ​​used to locate key features of the malicious code; The mechanism model assigns a first weight value to the first type of feature and a second weight value to the second type of feature, wherein the first type of feature refers to a feature whose correlation degree involved in the malicious code classification is greater than a preset correlation threshold, the first type of feature refers to a feature whose correlation degree involved in the malicious code classification is less than or equal to a preset correlation threshold, and the first weight value is greater than the second weight value; according to the weight assignment result, a fully connected neural network is used to capture the correlation between the feature vectors of the malicious code, and the routing relationship between static features, dynamic features, malicious technologies and malicious purposes is reorganized according to the feature vector correlation capture result; based on the routing relationship reorganization result, the key features of the malicious code are determined.

[0010] Optionally, the step of extracting the static features and dynamic features of the malicious code includes: extracting a static feature set and a dynamic feature set of the malicious code; eliminating features that do not have malicious behavior attributes in the static feature set and the dynamic feature set, and retaining the static features and the dynamic features that have malicious behavior attributes.

[0011] Optionally, the step of assigning a first weight value to the first type of feature and a second weight value to the second type of feature by the attention mechanism model includes: the attention mechanism model uses a bidirectional query strategy to process the input first routing relationship and the second routing relationship to obtain forward and backward attention results, wherein the forward and backward attention results at least include: the forward attention weight value and the backward attention weight value corresponding to each feature of the malicious code; performing weighted summation on each feature of the malicious code to obtain a forward and backward weighted summation result of the features; and combining the forward and backward weighted summation results of the malicious code features to assign a first weight value to the first type of feature and a second weight value to the second type of feature.

[0012] Optionally, the step of determining the key features of the malicious code based on the routing relationship reorganization result includes: determining features in the routing relationship reorganization result that are higher than a preset feature weight threshold as the key features of the malicious code.

[0013] Optionally, the step of using the key feature as an index condition to query the target matrix dictionary and generate a key malicious behavior description result of the malicious code includes: using the key feature as an index condition to query the corresponding malicious technology and malicious target in the target matrix dictionary; entering each of the queried malicious technologies and malicious targets into a behavior description template to generate multiple malicious feature description statements; merging the malicious feature description statements that achieve the same malicious target to generate the key malicious behavior description result.

[0014] According to another aspect of an embodiment of the present invention, a code classification and interpretation device based on a matrix dictionary is also provided, including: a code classification unit, used to classify malicious code using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on the feature vector of the malicious code; a feature positioning unit, used to locate key features based on the code classification result using an attention mechanism; a code behavior interpretation unit, used to query a target matrix dictionary using the key features as index conditions, and generate a key malicious behavior description result of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description result is used to describe the malicious behavior details in the code classification result.

[0015] Optionally, the code classification and interpretation device based on the matrix dictionary also includes: a dictionary construction unit, which is used to classify the malicious code using the machine learning model and obtain the code classification result, and construct an initial matrix dictionary with malicious targets as dictionary rows and malicious technologies as dictionary columns, wherein the malicious target refers to the target achieved through malicious behavior, and the malicious technology refers to the technology used to achieve the malicious target; a feature classification filling unit, which is used to classify the malicious code features according to the malicious target and the malicious technology respectively, and fill the feature classification results into the initial matrix dictionary to generate the target matrix dictionary.

[0016] Optionally, the feature location unit includes: a feature extraction module for extracting static features and dynamic features of the malicious code, wherein the static features refer to features in the malicious code for static limitation and code description, and the dynamic features refer to features of operational behaviors in the malicious code; a routing establishment module for using the pre-established target matrix dictionary to establish a first routing relationship between static features, malicious technologies and malicious purposes, and to establish a second routing relationship between dynamic features, malicious technologies and malicious purposes; a model assignment module for inputting the first routing relationship, the second routing relationship and the code classification result into an attention mechanism model, and the attention mechanism model is used for A first weight value is assigned to the first type of feature, and a second weight value is assigned to the second type of feature, wherein the first type of feature refers to a feature whose correlation degree involved in the classification of malicious code is greater than a preset correlation threshold, the first type of feature refers to a feature whose correlation degree involved in the classification of malicious code is less than or equal to a preset correlation threshold, and the first weight value is greater than the second weight value; a feature reorganization module is used to capture the correlation between the feature vectors of the malicious code according to the weight assignment result using a fully connected neural network, and reorganize the routing relationship between static features, dynamic features, malicious technology and malicious purpose according to the feature vector correlation capture result; a feature determination module is used to determine the key features of the malicious code based on the routing relationship reorganization result.

[0017] Optionally, the feature extraction module includes: a feature extraction submodule, used to extract the static feature set and dynamic feature set of the malicious code; a feature screening submodule, used to eliminate features that do not have malicious behavior attributes in the static feature set and the dynamic feature set, and retain the static features and the dynamic features that have malicious behavior attributes.

[0018] Optionally, the model assignment module includes: a forward and backward processing submodule, which is used by the attention mechanism model to process the input first routing relationship and the second routing relationship using a bidirectional query strategy to obtain forward and backward attention results, wherein the forward and backward attention results at least include: forward attention weight values ​​and backward attention weight values ​​corresponding to each feature of the malicious code; a feature weighted summation module, which is used to perform weighted summation on each feature of the malicious code to obtain a forward and backward weighted summation result of the features; a feature assignment submodule, which is used to combine the forward and backward weighted summation results of the features of the malicious code to assign a first weight value to the first category of features and a second weight value to the second category of features.

[0019] Optionally, the feature determination module includes: a feature determination submodule, configured to determine features in the routing relationship reorganization result that are higher than a preset feature weight threshold as key features of the malicious code.

[0020] Optionally, the code behavior interpretation unit includes: a dictionary query module, used to query the corresponding malicious technologies and malicious targets in the target matrix dictionary using the key features as index conditions; a description statement generation module, used to enter each of the queried malicious technologies and malicious targets into a behavior description template to generate multiple malicious feature description statements; a statement merging module, used to merge malicious feature description statements that achieve the same malicious target to generate the key malicious behavior description result.

[0021] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned matrix dictionary-based code classification and interpretation methods.

[0022] According to another aspect of an embodiment of the present invention, an electronic device is also provided, comprising one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the above-mentioned matrix dictionary-based code classification and interpretation methods.

[0023] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any one of the above-mentioned matrix dictionary-based code classification and interpretation methods.

[0024] In the present disclosure, a machine learning model is used to classify malicious code to obtain a code classification result, wherein the machine learning model outputs the code classification result based on the feature vector of the malicious code; based on the code classification result, an attention mechanism is used to locate key features; using the key features as index conditions, a target matrix dictionary is queried to generate a key malicious behavior description result of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description result is used to describe the malicious behavior details in the code classification result.

[0025] Based on the above-mentioned public content, after classifying the malicious code, it is possible to query the matrix dictionary associated with the malicious behavior, generate key malicious behavior descriptions, and effectively interpret the malicious code classification results, thereby solving the technical problem in related technologies that the malicious behavior in the malicious code classification results cannot be interpreted. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a code classification and interpretation method based on a matrix dictionary is shown;

[0028] Figure 2 is a flowchart of an optional matrix dictionary-based code classification and interpretation method according to an embodiment of the present invention;

[0029] Figure 3 This is a flowchart of a malicious code classification and interpretation method based on a matrix dictionary provided in an embodiment of the present application;

[0030] Figure 4 is a schematic diagram of an optional matrix dictionary-based code classification and interpretation device according to an embodiment of the present invention;

[0031] Figure 5 This is a structural block diagram of an electronic device that executes a code classification and interpretation method based on a matrix dictionary according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] To facilitate those skilled in the art to understand the present invention, some of the terms or nouns involved in the embodiments of the present invention are explained below:

[0035] Malicious code, MC for short, refers to any software or code designed to damage, control or secretly access computer systems, networks or data, including viruses, Trojans, worms, backdoors, botnets, etc.

[0036] A matrix dictionary (MD) is a data structure used to store and represent classified information about malicious behaviors. It uses a matrix format, with malicious objectives (such as reconnaissance and resource preparation) as rows and malicious techniques (such as file operations and registry manipulation) as columns, forming a two-dimensional feature-behavior association table to quickly locate and interpret key behaviors in malicious code.

[0037] Machine Learning (ML) enables computers to learn and improve from data without being explicitly programmed. In this application, machine learning is used to identify and classify malicious code by training models to recognize its characteristics and behavioral patterns.

[0038] Malicious behavior (MB) refers to the actions taken by malicious code when it is executed, designed to achieve its malicious goals. These behaviors may include, but are not limited to, modifying system settings, stealing data, spreading itself, and executing attacks.

[0039] The Attention Mechanism (AM) is a machine learning technique that enables a model to focus on key parts of an input sequence when processing sequential data. In this application, the AM is used to identify key features of malicious code that are most relevant to the classification results, helping to improve classification accuracy and the pertinence of interpretation.

[0040] Static Features, abbreviated as SF, refers to information that can be obtained by analyzing the properties of code or files without executing the code, such as file metadata, hard-coded strings, specific function calls, etc.

[0041] Dynamic features, or DF for short, are behaviors observed during code execution, such as API calls, network communications, file system operations, etc. These features are crucial for understanding the real-time behavior of malicious code.

[0042] A fully connected network (FCN) is a type of neural network in which every neuron in each layer is connected to all neurons in the next layer. In this application, a fully connected network is used to capture the correlation between features, helping to reorganize and focus on key features.

[0043] It should be noted that the code classification and interpretation method based on the matrix dictionary and the device thereof in the present disclosure can be used in the field of financial technology. When the interpretation of malicious behavior in malicious code is realized based on the matrix dictionary, it can also be used in any field other than the field of financial technology. When the interpretation of malicious behavior in malicious code is realized based on the matrix dictionary, the present disclosure does not limit the application field of the code classification and interpretation method based on the matrix dictionary and the device thereof.

[0044] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or institutions. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or institution through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or institution.

[0045] It should be noted that in this disclosure, when collecting and analyzing customer information, the corresponding operation entrance is provided for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered.

[0046] The following embodiments of the present invention can be applied to various systems / applications / devices for code classification and interpretation based on matrix dictionaries. The present invention can be applied to the field of information security, especially in network defense and malware analysis scenarios. For example, for enterprise-level network security protection, in the enterprise's internal network, the present invention can monitor and analyze potential malicious code intrusion events in real time, improving the transparency and response speed of threat detection, or in cloud security service scenarios, in a cloud computing environment, the present invention can provide malicious code detection and classification interpretation services for cloud platforms, enhancing the security of cloud services and user trust. By classifying and interpreting malicious code behavior, operations that may lead to data leakage can be discovered in a timely manner, reducing the risk of sensitive data.

[0047] The present invention can solve the "black box" problem of classification results in traditional machine learning methods, and can clearly explain the classification basis of malicious code, that is, the key malicious behavior. By locating and describing key features, it helps security operation and maintenance personnel quickly understand the attack intentions of malicious code and provide a basis for formulating effective response strategies.

[0048] Furthermore, the malicious behavior descriptions generated by this invention facilitate understanding and action by security teams, accelerating emergency response and handling of malware. Because the embodiments of this application focus on the association between features and malicious behavior, rather than a specific machine learning model, they can be flexibly applied to a variety of malicious code detection systems, enhancing the universality of the solution.

[0049] The present invention will be described in detail below with reference to various embodiments.

[0050] Example 1

[0051] According to an embodiment of the present invention, an embodiment of a code classification and interpretation method based on a matrix dictionary is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0052] The code classification and interpretation method embodiment based on the matrix dictionary provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 The hardware structure block diagram of a computer terminal (or mobile device) for implementing a code classification and interpretation method based on a matrix dictionary is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more ( Figure 1 The computer system includes a processor 102 (shown as 102a, 102b, ..., 102n) (the processor 102 may include but is not limited to a microcontroller unit (MCU) or a field programmable gate array (FPGA)), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, the computer system may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS), a network interface, a power supply, and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0053] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0054] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the code classification and interpretation method based on the matrix dictionary in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned code classification and interpretation method based on the matrix dictionary. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0055] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0056] The display may be, for example, a touch screen liquid crystal display (LCD), which enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0057] Under the above operating environment, this application provides Figure 2 The code classification interpretation method based on matrix dictionary is shown. Figure 2 is a flowchart of an optional code classification interpretation method based on a matrix dictionary according to an embodiment of the present invention. Figure 2 As shown, the method includes the following steps:

[0058] In this embodiment, a matrix dictionary of malicious behavior is pre-built to provide a structured knowledge base for subsequent malicious code classification and interpretation. Optionally, before using a machine learning model to classify malicious code and obtain code classification results, the method further includes: constructing an initial matrix dictionary using malicious targets as dictionary rows and malicious techniques as dictionary columns, where malicious targets refer to the goals achieved through malicious behavior, and malicious techniques refer to the techniques used to achieve the malicious targets; classifying malicious code features according to malicious targets and malicious techniques, and populating the feature classification results into the initial matrix dictionary to generate a target matrix dictionary.

[0059] The initial matrix dictionary constructed consists of rows representing malicious objectives and columns corresponding to malicious techniques. Malicious objectives encompass various strategic goals an attacker might pursue, such as reconnaissance, resource preparation, attack execution, persistent control, privilege escalation, defense evasion, lateral movement, command and control, and data theft. Malicious techniques, on the other hand, detail the specific means an attacker employs to achieve these objectives, such as file operations, process operations, registry operations, memory operations, and network access.

[0060] This embodiment categorizes the collected malicious code features and maps them to the malicious targets and techniques defined above. The categorization process is based on the features' inherent properties and functionality, ensuring that each feature accurately corresponds to a row or column in the dictionary. For example, if a feature involves modifying the registry, it will be classified as a registry manipulation malicious technique. If a feature indicates that the code is attempting to hide itself, this may be associated with a defense evasion malicious goal.

[0061] Once the feature classification is completed, this embodiment will fill the classification results into the initial matrix dictionary to form a target matrix dictionary. Here, the target matrix dictionary is no longer an empty shell, but contains the specific associations between the actual malicious code features and the malicious targets and malicious technologies, becoming a powerful tool for subsequent analysis. The generation of the target matrix dictionary realizes the systematic organization and induction of malicious behaviors. The intersection of each row and each column in the dictionary represents a specific malicious target that can be achieved through a specific malicious technology. In this way, when analyzing a new malicious code sample, this embodiment can quickly locate the relevant entries in the dictionary, not only confirming the existence of the malicious code, but also revealing its specific behavior patterns and attack strategies, thereby providing important intelligence support for the formulation of security policies and emergency response.

[0062] It should be noted that this embodiment can also regularly update or adjust the content of the target matrix dictionary according to new network attack trends, technological developments, and changes in laws and policies to ensure that the dictionary remains effective and becomes an indispensable component of the dynamic defense system.

[0063] Step S201: Classify the malicious code using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on a feature vector of the malicious code.

[0064] It should be noted that this embodiment pre-selects an appropriate machine learning model for training. During the training process, a large number of positive and negative samples are used to enable the machine learning model to learn the characteristic patterns that distinguish malicious and non-malicious code. After training is complete, the model will be able to make classification predictions based on the input feature vectors and output a code classification result. The classification result can be binary (malicious / non-malicious) or multi-class (e.g., different types of malware classification).

[0065] The model type can be a supervised learning model, such as a support vector machine, decision tree, random forest, or neural network, or a deep learning model, such as a convolutional neural network, a recurrent neural network, or a long short-term memory network. This embodiment introduces an attention mechanism to identify key features in the input features that are closely related to the malicious code classification results. The basic principle of the attention mechanism is to allow the model to focus on the most relevant features when processing the feature vector, thereby improving the accuracy and interpretability of the prediction.

[0066] Step S202: Based on the code classification results, the attention mechanism is used to locate key features.

[0067] Optionally, based on the code classification result, the step of using an attention mechanism to locate key features includes: extracting static features and dynamic features of the malicious code, wherein static features refer to features in the malicious code used for static limitation and code description, and dynamic features refer to features containing operational behaviors in the malicious code; using a pre-established target matrix dictionary to establish a first routing relationship between static features, malicious technologies, and malicious purposes, and a second routing relationship between dynamic features, malicious technologies, and malicious purposes; inputting the first routing relationship, the second routing relationship, and the code classification result into an attention mechanism model, and the attention mechanism model assigning a first weight value to the first type of feature and a second weight value to the second type of feature, wherein the first type of feature refers to a feature whose correlation with the malicious code classification is greater than a preset correlation threshold, and the second type of feature refers to a feature whose correlation with the malicious code classification is less than or equal to a preset correlation threshold, and the first weight value is greater than the second weight value; based on the weight assignment result, using a fully connected neural network to capture the correlation between the feature vectors of the malicious code, and reorganizing the routing relationship between the static features, dynamic features, malicious technologies, and malicious purposes based on the feature vector correlation capture result; and determining the key features of the malicious code based on the routing relationship reorganization result.

[0068] In this embodiment, for the classification and interpretation of malicious code, it is necessary to pre-extract its static features and dynamic features. Optionally, the step of extracting the static features and dynamic features of the malicious code includes: extracting a static feature set and a dynamic feature set of the malicious code; eliminating features in the static feature set and the dynamic feature set that do not have malicious behavior attributes, and retaining static features and dynamic features that have malicious behavior attributes.

[0069] Static features include attributes that can be analyzed without executing the code, such as code structure, compilation flags, hard-coded values ​​or paths, etc. These features are usually obtained during the static analysis phase of malware and can provide basic insights into the nature of the code. Dynamic features, on the other hand, are behavioral traces observed while the code is running, including but not limited to network activity, file system operations, registry modifications, process creation or termination, etc. They reveal the actions of malware in the actual environment and are crucial for understanding its operating mode and potential harm.

[0070] After extracting two types of features (static features and dynamic features), this embodiment uses a pre-built target matrix dictionary to establish routing relationships between static features and dynamic features to malicious technologies and malicious purposes, thereby building a bridge between features and known malicious behaviors. By finding malicious technology entries that match the features, the malicious intentions behind these technologies are located. Specifically, for each static feature, this embodiment looks for its corresponding malicious technology entry in the matrix dictionary to determine which malicious behavior the feature is associated with. Similarly, dynamic features also follow this logic and are associated with specific malicious technologies and purposes. In this way, two sets of routing relationships are formed: one set is from static features to malicious technologies and then to malicious purposes, and the other set is the corresponding path of dynamic features.

[0071] Subsequently, this embodiment inputs the first and second routing relationships established above, along with the code classification results, into the attention mechanism model. The attention mechanism identifies which features play a more important role in the classification process. The model assigns weight values ​​to the features by analyzing the strength of the association between the features and malicious intent. Among them, those features whose correlation exceeds a preset threshold are considered first-category features and are assigned a higher first weight value; conversely, features with lower correlation are considered second-category features and are assigned lower weight values. This weight distribution mechanism ensures that the model can focus on the features most likely to lead to malicious behavior, thereby improving the accuracy of classification and the pertinence of subsequent interpretation.

[0072] Next, based on the preliminary results of feature weights, this embodiment uses a fully connected neural network to further explore the deep connections between feature vectors. The fully connected neural network can capture the mutual influence of static and dynamic features and evaluate their joint contribution in malicious code classification. Through this network, the correlation between features can be quantified, guiding the subsequent reorganization of routing relationships and ensuring that those features with high weights can be more comprehensively considered.

[0073] Finally, based on the results of weight assignment and feature vector correlation capture, this embodiment reorganizes the routing relationships of static and dynamic features, aiming to streamline and highlight those features that are most decisive for malicious code classification. This reorganization process, by screening and adjusting feature links, makes the first routing relationship between static features and malicious techniques and malicious purposes, as well as the second routing relationship between dynamic features, closer and more direct, thereby identifying so-called key features. The identification of key features provides a solid foundation for the subsequent generation of malicious behavior descriptions, ensuring the accuracy and practicality of the descriptions.

[0074] Optionally, the step of assigning a first weight value to the first type of feature and a second weight value to the second type of feature by the attention mechanism model includes: the attention mechanism model uses a bidirectional query strategy to process the input first routing relationship and the second routing relationship to obtain forward and backward attention results, wherein the forward and backward attention results at least include: the forward attention weight value and the backward attention weight value corresponding to each feature of the malicious code; performing weighted summation on each feature of the malicious code to obtain a forward and backward weighted summation result of the features; combining the forward and backward weighted summation results of the malicious code features to assign a first weight value to the first type of feature and a second weight value to the second type of feature.

[0075] This embodiment uses an attention mechanism model to assign weights to the extracted feature set to distinguish the importance and relevance of features. The attention mechanism model adopts a bidirectional query strategy, which allows the model to consider not only the forward information of the feature but also the backward information, thereby more comprehensively understanding the location and role of the feature in the code. By processing the first routing relationship and the second routing relationship, the model can calculate the forward and backward attention weight values ​​for each feature and determine the relative importance of the feature in the code sequence.

[0076] After the attention mechanism model outputs the attention weight value, this embodiment performs a weighted summation on the features to generate a forward and backward weighted summation of the features. This result not only takes into account the weight of the features themselves, but also integrates the order information of the features, further improving the feature representation capabilities. Based on the weighted summation results, this embodiment divides the features into two groups: first-category features and second-category features, assigning first and second weight values, respectively. Among them, first-category features are generally highly correlated with malicious behavior and have higher weight values; while second-category features have lower correlation and correspondingly lower weight values.

[0077] Optionally, the step of determining the key features of the malicious code based on the routing relationship reorganization result includes: determining features in the routing relationship reorganization result that are higher than a preset feature weight threshold as the key features of the malicious code.

[0078] Based on the feature weights processed by the attention mechanism model, this embodiment sorts and filters features to identify key features of the malware. Key features are selected based on a preset feature weight threshold, which is used to distinguish which features play a significant role in the malware. All features with weights above this threshold are considered key features, which have a decisive influence on the classification and interpretation of the malware.

[0079] Through this step, this embodiment can focus on the key features that can best reveal the malicious code attack intentions and tactics, thereby providing a solid basis for subsequent malicious behavior interpretation and classification results. This embodiment achieves the purpose of accurately locating key features from massive malicious code features through feature extraction, screening and the application of attention mechanism, providing strong technical support for the classification and interpretation of malicious code, and enhancing the transparency and responsiveness of the security defense system.

[0080] In step S203, the target matrix dictionary is queried using the key features as index conditions to generate key malicious behavior description results of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors. The key malicious behavior description results are used to describe the malicious behavior details in the code classification results.

[0081] Step S203 of this embodiment is a key step in the entire malicious code classification and interpretation process. Its purpose is to query the target matrix dictionary based on the key features identified by the machine learning model to generate a detailed description of the specific malicious behavior of the malicious code. The target matrix dictionary is a structured database that not only contains multiple feature vectors but also associates detailed malicious behavior descriptions with these feature vectors.

[0082] Optionally, the steps of using key features as index conditions to query the target matrix dictionary and generate key malicious behavior description results of malicious code include: using key features as index conditions to query the corresponding malicious technologies and malicious targets in the target matrix dictionary; entering each queried malicious technology and malicious target into a behavior description template to generate multiple malicious feature description statements; merging malicious feature description statements that achieve the same malicious target to generate key malicious behavior description results.

[0083] In this embodiment, once the key features are identified, these features will be used as query conditions to search for corresponding entries in the target matrix dictionary. The construction method of the target matrix dictionary (as described above) ensures that each feature vector corresponds to a specific malicious technology and malicious target. Therefore, the query process can quickly locate malicious behavior information that matches the key features. The malicious technologies and malicious targets found will be entered into a preset behavior description template. This template is designed to combine technology with goals and generate clear and structured malicious feature description statements. For example, "using process operation technology to achieve continuous control goals" not only points out the specific technology used by the malicious code, but also clarifies the attack targets behind the technology, providing in-depth understanding for security operations personnel.

[0084] After generating multiple malicious feature description statements, this embodiment further merges the description statements that achieve the same malicious goal to avoid duplication and generate more refined key malicious behavior description results, thereby improving the efficiency of the description and making the description results more focused on the core attack behavior of the malicious code, which helps the security team to quickly identify the core characteristics of the threat and take effective measures in a timely manner.

[0085] Through the above steps, the malicious code can be classified using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on the feature vector of the malicious code; based on the code classification result, the attention mechanism is used to locate the key features; the key features are used as index conditions to query the target matrix dictionary to generate the key malicious behavior description results of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description results are used to describe the details of the malicious behavior in the code classification results. In this embodiment, after the malicious code is classified, the matrix dictionary associated with the malicious behavior can be queried to generate the key malicious behavior description, thereby achieving an effective interpretation of the malicious code classification results, thereby solving the technical problem in the related art that the malicious behavior in the malicious code classification results cannot be interpreted.

[0086] The following describes in detail another optional specific implementation.

[0087] Figure 3This is a flowchart of a malicious code classification and interpretation method based on a matrix dictionary according to an embodiment of the present application. Figure 3 As shown, the method includes the following steps:

[0088] Step S301: Create a malicious behavior matrix dictionary.

[0089] First, a malicious behavior matrix dictionary is established with malicious targets and malicious techniques as rows and columns respectively.

[0090] Malicious objectives refer to the goals achieved through malicious behavior, including reconnaissance, resource preparation, attack execution, persistent control, privilege escalation, defense evasion, lateral movement, command and control, and data theft. Malicious techniques refer to the techniques used to achieve malicious objectives, including file operations, process operations, registry operations, memory operations, and network access. Malicious code features are categorized by malicious objectives and malicious techniques, and then entered into the malicious behavior matrix dictionary to complete the creation of the malicious behavior matrix dictionary. An example matrix dictionary is shown in Table 1.

[0091] Table 1 Matrix dictionary

[0092]

[0093] It should be noted that, in this embodiment, malicious targets in the matrix dictionary may be added, deleted, or merged according to the actual application environment and local laws and regulations.

[0094] In addition, when distinguishing categories of malicious targets and malicious technologies in this embodiment, they can be summarized based on current actual trends in network attacks, network attack and defense practices, and existing industry standards, and updated with the latest attack and defense technologies.

[0095] Step S302: Classify the malicious code and locate key features.

[0096] First, the static and dynamic features of the malicious code are extracted as input. The dictionary established in step S101 is used to establish the routes between static features -> malicious technology -> malicious purpose, and dynamic features -> malicious technology -> malicious purpose. An attention mechanism is used, with the routes and malicious code types as the input layer. A bidirectional query strategy is used to process the input routes (through bidirectional query, combining forward and backward information can help identify the key features of different types of malicious code). The forward and backward attention results are calculated and weighted summed according to the attention weights. The weights of the input features are learned, and features with greater relevance to malicious code classification are assigned greater weights, while features with less relevance are assigned smaller weights. Based on the weighted summation results, a fully connected network is used to capture the correlation between features and reorganize the input routes, focusing on key features and suppressing irrelevant features. Finally, the weighted route features reorganized by the attention mechanism are mapped to the classifier, and the malicious code is classified into two categories.

[0097] It should be noted that both the static features and dynamic features in this embodiment must have malicious behavior attributes, such as import and export functions, APIs, calls, file operation behaviors, etc., and do not include features that do not have malicious behavior attributes, such as grayscale images and bytecodes.

[0098] The following examples illustrate some of the extracted static and dynamic features and explain how they reflect the attributes of malicious behavior.

[0099] Static features:

[0100] Feature 1: A hardcoded string contains the antivirus software path, such as "c:\user\antivirus.exe";

[0101] Malicious technology 1: anti-killing technology;

[0102] Malicious purpose 1: continuous control;

[0103] Feature 2: The import function table contains encryption API functions;

[0104] Malicious Technique 2: Encryption

[0105] Malicious goal 2: steal data;

[0106] Dynamic features:

[0107] Feature 1: Modify the registry;

[0108] Malicious technique 1: Registry manipulation;

[0109] Malicious goal 1: Privilege escalation, persistent control, and defense evasion.

[0110] Step S303: query the matrix dictionary to generate a description of the key malicious behaviors of the malicious code.

[0111] Take the high-weight feature of step S302 as input, check the malicious technology and malicious target corresponding to the feature in the matrix dictionary, generate a single malicious feature description statement based on the technology and target according to the template of "using technology to achieve the goal", and merge the descriptions of achieving the same goal to generate a malicious behavior description statement, such as using process operations and file operations (multiple malicious technologies) to achieve command and control (malicious targets), and finally integrate and remove duplicate descriptions of all high-weight features to generate the final full malicious behavior description to explain the malicious code classification results.

[0112] It should be noted that, in this embodiment, one or more malicious behavior description statements may be generated according to the number of selected high-weight features.

[0113] Through the above-mentioned implementation manner, the matrix dictionary-based malicious code classification and interpretation method provided by the present invention can first create a malicious behavior matrix dictionary, then classify the malicious code and locate the key features, and then query the matrix dictionary to generate a description of the key malicious behavior of the malicious code, which solves the problem that the relevant malicious code classification technology and interpretation technology cannot interpret the key malicious behavior of the malicious code. By querying the malicious behavior matrix dictionary, the key malicious behavior description is generated, and then an effective interpretation of the malicious code classification results is achieved, which provides favorable conditions for further rapid and efficient emergency response to malicious code.

[0114] The following describes it in detail with reference to another embodiment.

[0115] Example 2

[0116] A code classification and interpretation device based on a matrix dictionary provided in this embodiment includes multiple implementation units, each implementation unit corresponds to each implementation step in the above-mentioned embodiment 1. Its specific implementation method and beneficial effects can be referred to the above-mentioned method embodiment and will not be repeated here.

[0117] Figure 4 is a schematic diagram of an optional code classification and interpretation device based on a matrix dictionary according to an embodiment of the present invention, such as Figure 4 As shown, the code classification and interpretation device based on the matrix dictionary may include: a code classification unit 41, a feature positioning unit 42, and a code behavior interpretation unit 43.

[0118] The code classification unit 41 is configured to classify the malicious code using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on a feature vector of the malicious code;

[0119] A feature localization unit 42 is used to locate key features using an attention mechanism based on the code classification results;

[0120] The code behavior interpretation unit 43 is used to query the target matrix dictionary using key features as index conditions to generate key malicious behavior description results of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors. The key malicious behavior description results are used to describe the malicious behavior details in the code classification results.

[0121] The above-mentioned matrix dictionary-based code classification and interpretation device can classify malicious code using a machine learning model through the code classification unit 41 to obtain a code classification result, wherein the machine learning model outputs the code classification result based on the feature vector of the malicious code, and the feature positioning unit 42 uses the attention mechanism to locate key features based on the code classification result, and the code behavior interpretation unit 43 uses the key features as index conditions to query the target matrix dictionary and generate a key malicious behavior description result of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description result is used to describe the details of the malicious behavior in the code classification result. In this embodiment, after the malicious code is classified, the matrix dictionary associated with the malicious behavior can be queried to generate a key malicious behavior description, thereby achieving an effective interpretation of the malicious code classification result, thereby solving the technical problem in the related art that the malicious behavior in the malicious code classification result cannot be interpreted.

[0122] Optionally, the code classification and interpretation device based on the matrix dictionary also includes: a dictionary construction unit, which is used to classify the malicious code using the machine learning model and obtain the code classification result, and construct an initial matrix dictionary with malicious targets as dictionary rows and malicious technologies as dictionary columns, wherein malicious targets refer to goals achieved through malicious behavior, and malicious technologies refer to technologies used to achieve malicious goals; a feature classification filling unit, which is used to classify malicious code features according to malicious targets and malicious technologies, respectively, and fill the feature classification results into the initial matrix dictionary to generate a target matrix dictionary.

[0123] Optionally, the feature location unit includes: a feature extraction module for extracting static features and dynamic features of the malicious code, wherein the static features refer to features used for static limitation and code description in the malicious code, and the dynamic features refer to features of operation behaviors in the malicious code; a routing establishment module for using a pre-established target matrix dictionary to establish a first routing relationship between static features, malicious technologies and malicious purposes, and to establish a second routing relationship between dynamic features, malicious technologies and malicious purposes; a model assignment module for inputting the first routing relationship, the second routing relationship and the code classification result into the attention mechanism model, and the attention mechanism model is used for the first type of feature Assign a first weight value and assign a second weight value to the second type of feature, wherein the first type of feature refers to a feature whose correlation degree involved in the classification of malicious code is greater than a preset correlation threshold, the second type of feature refers to a feature whose correlation degree involved in the classification of malicious code is less than or equal to the preset correlation threshold, and the first weight value is greater than the second weight value; a feature reorganization module is used to capture the correlation between the feature vectors of the malicious code using a fully connected neural network according to the weight assignment result, and reorganize the routing relationship between static features, dynamic features, malicious technology and malicious purpose according to the feature vector correlation capture result; a feature determination module is used to determine the key features of the malicious code based on the routing relationship reorganization result.

[0124] Optionally, the feature extraction module includes: a feature extraction submodule, used to extract the static feature set and dynamic feature set of malicious code; a feature screening submodule, used to eliminate features that do not have malicious behavior attributes in the static feature set and the dynamic feature set, and retain the static features and dynamic features that have malicious behavior attributes.

[0125] Optionally, the model assignment module includes: a forward and backward processing submodule, which is used to process the input first routing relationship and the second routing relationship using a bidirectional query strategy by the attention mechanism model to obtain forward and backward attention results, wherein the forward and backward attention results at least include: forward attention weight values ​​and backward attention weight values ​​corresponding to each feature of the malicious code; a feature weighted summation module, which is used to perform weighted summation on each feature of the malicious code to obtain a forward and backward weighted summation result of the features; a feature assignment submodule, which is used to combine the forward and backward weighted summation results of the malicious code features to assign a first weight value to the first category of features and a second weight value to the second category of features.

[0126] Optionally, the feature determination module includes: a feature determination submodule, configured to determine features in the routing relationship reorganization result that are higher than a preset feature weight threshold as key features of the malicious code.

[0127] Optionally, the code behavior interpretation unit includes: a dictionary query module, which is used to query the corresponding malicious technologies and malicious targets in the target matrix dictionary using key features as index conditions; a description statement generation module, which is used to enter the queried malicious technologies and malicious targets into the behavior description template to generate multiple malicious feature description statements; a statement merging module, which is used to merge malicious feature description statements that achieve the same malicious goals to generate key malicious behavior description results.

[0128] The above-mentioned code classification and interpretation device based on the matrix dictionary can also include a processor and a memory. The above-mentioned code classification unit 41, feature positioning unit 42, code behavior interpretation unit 43, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0129] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the kernel parameters can be adjusted to achieve the matrix dictionary-based malicious code classification interpretation.

[0130] The above-mentioned memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0131] Example 3

[0132] An embodiment of the present application may provide an electronic device, Figure 5 1 is a structural block diagram of an electronic device that performs a code classification and interpretation method based on a matrix dictionary according to an embodiment of the present application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 Only one is shown) processor 502, memory 504, storage controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0133] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the code classification and interpretation method and device based on the matrix dictionary in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned code classification and interpretation method based on the matrix dictionary. The memory may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0134] The processor can call the information and application programs stored in the memory through the transmission device to perform the following steps: classify the malicious code using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on the feature vector of the malicious code; based on the code classification result, use the attention mechanism to locate the key features; use the key features as index conditions to query the target matrix dictionary and generate the key malicious behavior description results of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description results are used to describe the malicious behavior details in the code classification results.

[0135] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: before using the machine learning model to classify the malicious code and obtain the code classification results, construct an initial matrix dictionary with malicious targets as dictionary rows and malicious technologies as dictionary columns, where malicious targets refer to goals achieved through malicious behavior, and malicious technologies refer to technologies used to achieve malicious targets; classify the malicious code features according to malicious targets and malicious technologies respectively, and fill the feature classification results into the initial matrix dictionary to generate a target matrix dictionary.

[0136] The processor may also call information and applications stored in the memory through the transmission device to perform the following steps: extracting static features and dynamic features of the malicious code, wherein static features refer to features used for static definition and code description in the malicious code, and dynamic features refer to features containing operational behaviors in the malicious code; using a pre-established target matrix dictionary, establishing a first routing relationship between static features, malicious technologies, and malicious purposes, and establishing a second routing relationship between dynamic features, malicious technologies, and malicious purposes; inputting the first routing relationship, the second routing relationship, and the code classification result into an attention mechanism model, the attention mechanism model assigning a first weight value to the first type of feature and a second weight value to the second type of feature, wherein the first type of feature refers to a feature whose correlation with the malicious code classification is greater than a preset correlation threshold, and the second type of feature refers to a feature whose correlation with the malicious code classification is less than or equal to a preset correlation threshold, and the first weight value is greater than the second weight value; based on the weight assignment result, using a fully connected neural network to capture the correlation between the feature vectors of the malicious code, and reorganizing the routing relationship between the static features, dynamic features, malicious technologies, and malicious purposes based on the feature vector correlation capture result; and determining the key features of the malicious code based on the routing relationship reorganization result.

[0137] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: extract the static feature set and dynamic feature set of the malicious code; eliminate the features that do not have malicious behavior attributes in the static feature set and the dynamic feature set, and retain the static features and dynamic features that have malicious behavior attributes.

[0138] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: the attention mechanism model uses a bidirectional query strategy to process the input first routing relationship and the second routing relationship to obtain forward and backward attention results, wherein the forward and backward attention results at least include: the forward attention weight value and the backward attention weight value corresponding to each feature of the malicious code; perform weighted summation on each feature of the malicious code to obtain the forward and backward weighted summation result of the feature; combine the forward and backward weighted summation results of the malicious code features, assign a first weight value to the first category of features, and assign a second weight value to the second category of features.

[0139] The processor may also call the information and application stored in the memory through the transmission device to perform the following steps: determining the features in the routing relationship reorganization result that are higher than a preset feature weight threshold as key features of the malicious code.

[0140] The processor can also call the information and applications stored in the memory through the transmission device to perform the following steps: using the key features as index conditions, querying the corresponding malicious technologies and malicious targets in the target matrix dictionary; entering each malicious technology and malicious target queried into the behavior description template to generate multiple malicious feature description statements; merging the malicious feature description statements that achieve the same malicious target to generate a key malicious behavior description result.

[0141] It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only, and the electronic device may also be a smart phone, a tablet computer, a PDA, a mobile Internet device (MID), a PAD or other terminal device. Figure 5 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 5 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 5 Different configurations shown.

[0142] Those skilled in the art will understand that all or part of the steps in the various matrix dictionary-based code classification and interpretation methods of the above-mentioned embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0143] Example 4

[0144] The embodiment of the present application further provides a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the code classification and interpretation method based on the matrix dictionary provided in the first embodiment.

[0145] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the code classification and interpretation method based on the matrix dictionary of any one of the above-mentioned embodiments.

[0146] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0147] The present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the code classification and interpretation method based on the matrix dictionary described in each embodiment of the present application.

[0148] The present application also provides a computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the code classification and interpretation method based on the matrix dictionary described in each embodiment of the present application are implemented.

[0149] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0150] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0151] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0152] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0153] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0154] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0155] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A code classification and interpretation method based on a matrix dictionary, characterized in that: include: Classifying the malicious code using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on a feature vector of the malicious code; Based on the code classification results, an attention mechanism is used to locate key features; Using the key features as index conditions, query the target matrix dictionary to generate key malicious behavior description results of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description results are used to describe the malicious behavior details in the code classification results.

2. The method according to claim 1, characterized in that Before using the machine learning model to classify malicious code and obtain the code classification results, the following steps are also required: Construct an initial matrix dictionary with malicious targets as dictionary rows and malicious techniques as dictionary columns, where the malicious targets refer to the goals achieved through malicious behavior, and the malicious techniques refer to the techniques used to achieve the malicious targets. The malicious code features are classified according to the malicious targets and the malicious technologies, and the feature classification results are filled into the initial matrix dictionary to generate the target matrix dictionary.

3. The method according to claim 1, characterized in that Based on the code classification results, the steps of using the attention mechanism to locate key features include: Extracting static features and dynamic features of the malicious code, wherein the static features refer to features used for static definition and code description in the malicious code, and the dynamic features refer to features of operational behavior in the malicious code; Using the pre-established target matrix dictionary, a first routing relationship is established between static features, malicious techniques, and malicious purposes, and a second routing relationship is established between dynamic features, malicious techniques, and malicious purposes; Inputting the first routing relationship, the second routing relationship, and the code classification result into an attention mechanism model, the attention mechanism model assigning a first weight value to the first type of feature and a second weight value to the second type of feature, wherein the first type of feature refers to a feature whose correlation with malicious code classification is greater than a preset correlation threshold, the second type of feature refers to a feature whose correlation with malicious code classification is less than or equal to a preset correlation threshold, and the first weight value is greater than the second weight value; Based on the weight assignment results, a fully connected neural network is used to capture the correlation between the feature vectors of the malicious code, and the routing relationship between static features, dynamic features, malicious technology and malicious purpose is reorganized based on the feature vector correlation capture results; Based on the routing relationship reorganization result, key features of the malicious code are determined.

4. The method according to claim 3, characterized in that The step of extracting static features and dynamic features of the malicious code includes: Extracting a static feature set and a dynamic feature set of the malicious code; The features that do not have malicious behavior attributes in the static feature set and the dynamic feature set are eliminated, and the static features and the dynamic features that have malicious behavior attributes are retained.

5. The method according to claim 3, characterized in that The step of assigning a first weight value to the first type of feature and a second weight value to the second type of feature by the attention mechanism model includes: The attention mechanism model processes the input first routing relationship and the second routing relationship using a bidirectional query strategy to obtain forward and backward attention results, wherein the forward and backward attention results at least include: forward attention weight values ​​and backward attention weight values ​​corresponding to each feature of the malicious code; Performing weighted summation on each feature of the malicious code to obtain a forward and backward weighted summation result of the features; Based on the forward and backward weighted summation results of the features of the malicious code, a first weight value is assigned to the first type of features, and a second weight value is assigned to the second type of features.

6. The method according to claim 3, characterized in that The step of determining the key features of the malicious code based on the routing relationship reorganization result includes: The features in the routing relationship reorganization result that are higher than a preset feature weight threshold are determined as key features of the malicious code.

7. The method according to claim 1, characterized in that The step of using the key features as index conditions, querying the target matrix dictionary, and generating a description result of the key malicious behavior of the malicious code includes: Using the key features as index conditions, querying the target matrix dictionary for corresponding malicious technologies and malicious targets; Entering the queried malicious technologies and malicious targets into a behavior description template to generate multiple malicious feature description statements; Malicious feature description statements that achieve the same malicious goal are merged to generate the key malicious behavior description result.

8. A code classification and interpretation device based on a matrix dictionary, characterized in that: include: a code classification unit, configured to classify the malicious code using a machine learning model to obtain a code classification result, wherein the machine learning model outputs the code classification result based on a feature vector of the malicious code; A feature localization unit, configured to locate key features using an attention mechanism based on the code classification result; A code behavior interpretation unit is used to query a target matrix dictionary using the key features as index conditions to generate a key malicious behavior description result of the malicious code, wherein the target matrix dictionary includes multiple feature vectors and malicious behavior descriptions associated with the feature vectors, and the key malicious behavior description result is used to describe the malicious behavior details in the code classification result.

9. An electronic device, characterized in that: It includes one or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the code classification and interpretation method based on the matrix dictionary as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the code classification and interpretation method based on the matrix dictionary described in any one of claims 1 to 7 are implemented.

Images