A method and system for identifying APT malware organizations

Abstract

This invention provides a method and system for identifying APT malware organizations, relating to the field of network security technology. The method includes disassembling the original APT malware file to be trained or tested to obtain the disassembled code; analyzing the disassembled code to obtain disassembled code instruction lines; recording the number of various types of disassembled code instruction lines, extracting feature information from the disassembled code instruction lines and generating feature vectors; using the feature vectors and malware tags as training data for a decision tree model, and preprocessing the training data; inputting the preprocessed training data into the decision tree model for training to obtain a trained decision tree model; and using the trained decision tree model to identify APT malware. The aim is to improve the efficiency of APT organization detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for identifying APT malware organizations. Background Technology

[0002] In today's information age and globalized world, cybersecurity is becoming increasingly serious, serving as a crucial component of national security, economic security, and even social order. With the widespread adoption of the internet and continuous technological development, cyberspace is gradually becoming a new battleground for competition and conflict among nations. State-level cyberattacks, especially those launched by Advanced Persistent Threat (APT) groups, are receiving increasing attention. APT attacks are not only highly covert and persistent but also highly targeted, often bypassing conventional security measures through various means, causing significant economic losses and the risk of information leaks.

[0003] In the execution of APT attacks, malware plays a crucial role as one of the core tools. This malware is typically highly customizable and complex, capable of remaining dormant within victim systems for extended periods, collecting sensitive data, disrupting system stability, or exercising remote control. The types and techniques of malware are increasingly diverse, ranging from traditional viruses and Trojans to spyware, ransomware, and even sophisticated adaptive attack tools. APT groups continuously improve and evolve these tools to evade detection by security systems.

[0004] Existing technologies for detecting malware related to APT groups suffer from the following limitations: limited detection dimensions; current technologies primarily focus on the malware's functionality itself, lacking correlation analysis with the characteristics of the APT group's developers, making it difficult to predict and attribute attacks based on intent and organizational attributes; high deployment and computational costs; for example, APTmalInsight relies on API call sequences to build a knowledge base, resulting in excessive time consumption; methods based on heterogeneous graph neural networks or NLP multi-task fusion require high-performance computing equipment and extensive manual annotation, leading to high training costs, complex configurations, and difficulty in rapid deployment in real-world environments; weak portability and adaptability; existing deep learning solutions heavily rely on hardware resources such as graphics cards, resulting in poor portability on resource-constrained devices and limiting their widespread application in diverse terminal environments; and low model iteration efficiency; models employing high-dimensional features and complex network structures have low training efficiency, making it difficult to achieve rapid localized model updates and responses, and failing to adapt to the rapidly evolving needs of APT attack techniques. Therefore, a solution is urgently needed to address these issues. Summary of the Invention

[0005] The purpose of this invention is to provide a method for identifying APT malware organizations, which can improve the problems of low configuration efficiency, weak migration ability and inability to iterate quickly in existing technologies.

[0006] In a first aspect, the present invention provides a method for identifying APT malware organizations, comprising:

[0007] Disassemble the original files of the APT malware to be trained or tested to obtain the disassembled code of the APT malware;

[0008] Analyzing the disassembled code yields the disassembled code instruction line;

[0009] Record the number of disassembled code instruction lines of each type, extract feature information from the disassembled code instruction lines and generate feature vectors;

[0010] The feature vectors and malware labels are used as training data for the decision tree model, and the training data is preprocessed.

[0011] The preprocessed training data is input into the decision tree model for training to obtain a trained decision tree model.

[0012] The trained decision tree model is used to identify APT malware.

[0013] This invention provides a method for identifying APT malware organizations, which combines efficient machine learning algorithms to ensure that the detection accuracy is maintained within an acceptable range while improving the efficiency of APT organization detection. It has the technical effects of high efficiency, strong transferability and fast iteration speed.

[0014] Optionally, when disassembling the original APT malware file to be trained or tested to obtain the disassembled code of the APT malware, the process includes: using a disassembler tool, and storing the generated disassembled code in the form of a text file; the disassembler tool includes IDA Pro, Ghidra, and Radare2.

[0015] Optionally, when extracting feature information from the disassembled code instruction line and generating a feature vector, the process includes: extracting feature information from the disassembled code instruction line, recording the total number of instructions, and obtaining the final feature vector based on the ratio of the number of different features to the total number of instructions; the feature information includes the number of mathematical instructions, the number of logical instructions, the number of repeated instructions, and the number of system call information occurrences.

[0016] Optionally, when using the feature vector and malware labels as training data for a decision tree model, the method includes: extracting a 19-dimensional feature vector from APT malware, and using the 19-dimensional feature vector and malware labels as training data for decision tree training.

[0017] Optionally, when inputting the preprocessed training data into the decision tree model for training, the following steps are included:

[0018] The decision tree model recursively partitions the dataset and generates decision rules based on the value of each feature. The decision rules are as follows: based on the partitioning criteria, each partition selects a feature and divides the dataset into subsets according to the best split point of the feature. The partitioning criteria include information gain index, information gain ratio index and Gini index index.

[0019] When constructing a decision tree, the decision tree is split based on preset stopping conditions, which include the depth of the tree, the number of samples in a node, and the minimum gain.

[0020] Cross-validation is performed on the decision tree model, and the performance of the decision tree is optimized by adjusting the parameters to finally obtain a trained decision tree model. The parameters include the depth of the tree and the minimum number of sample splits.

[0021] Optionally, when using the trained decision tree model to identify APT malware, the following steps are included:

[0022] Extract a 19-dimensional feature vector of the APT malware to be classified, wherein each dimension of the 19-dimensional feature vector corresponds to a feature of the APT malware to be classified, and the features include file features, network behavior and process activity;

[0023] The 19-dimensional feature vector of the APT malware to be classified is input into the pre-trained decision tree model. The decision tree makes a layer-by-layer judgment on the APT malware to be classified based on the decision rules: the pre-trained decision tree model makes a decision along the path of the decision tree based on the features of the APT malware to be classified. Each layer node will split and make a judgment based on the features. If the features meet the judgment conditions, the judgment will continue along the branch of the decision tree until the leaf node is reached.

[0024] By storing the corresponding APT organization tags based on the leaf nodes, the organization identification of APT malware can be completed.

[0025] Secondly, the present invention provides an APT malware organization identification system, comprising:

[0026] The data acquisition module is used to disassemble the original files of APT malware to be trained or tested to obtain the disassembled code of APT malware; analyze the disassembled code to obtain the disassembled code instruction lines; record the number of each type of disassembled code instruction line; extract the feature information in the disassembled code instruction lines and generate feature vectors.

[0027] The model training module uses the feature vectors and malware labels as training data for the decision tree model and preprocesses the training data.

[0028] The model generation module inputs the preprocessed training data into the decision tree model for training, and obtains the trained decision tree model.

[0029] The organization identification module uses the trained decision tree model to identify APT malware. Attached Figure Description

[0030] Figure 1 This is a flowchart of an APT malware organization identification method provided by an embodiment of the present invention;

[0031] Figure 2 This is a structural diagram of an APT malware organization identification system provided in an embodiment of the present invention. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0033] join Figure 1 This invention provides a lightweight intelligent identification method for APT malware, comprising the following steps:

[0034] S1. Disassemble the original APT malware files to be trained or tested to obtain the disassembled code of the APT malware;

[0035] S2. Analyze the disassembled code to obtain the disassembled code instruction line;

[0036] S3. Record the number of various disassembled code instruction lines, extract feature information from the disassembled code instruction lines and generate feature vectors;

[0037] S4. Use the feature vectors and malware labels as training data for the decision tree model, and preprocess the training data.

[0038] S5. Input the preprocessed training data into the decision tree model for training to obtain the trained decision tree model.

[0039] S6. Use the trained decision tree model to identify APT malware.

[0040] In some embodiments, step S1 involves disassembling the original malware file to be trained or tested to obtain the malware's disassembled code. This process typically uses disassemblers such as IDA Pro. The generated disassembled code is stored as a text file, which allows for content analysis while ensuring system security.

[0041] Disassembly is the process of converting machine code (usually binary files) back into assembly language. This technique is crucial for reverse engineering and is often used to analyze and understand malware, crack software encryption, or break protection mechanisms. Disassembly allows security researchers to delve into the low-level logic of a program, examine its execution path and instruction set, and thus identify behavioral patterns and potential malicious behaviors. By disassembling malware, researchers can discover hidden payloads, backdoors, or other malicious functions, thereby helping to develop more robust detection and protection mechanisms. Commonly used disassembly tools include IDA Pro, Ghidra, and Radare2.

[0042] In some embodiments, when analyzing the disassembled code in step S2 to obtain the disassembled code instruction lines, the instruction lines are obtained by analyzing the disassembled text of the sample to be tested or the sample to be trained line by line.

[0043] In some embodiments, feature information in the instruction line is extracted in step S3, including the number of mathematical, logical, and repetitive instructions, as well as the number of system call information such as authorization, DLL, and file. The total number of instructions is recorded, and finally, the number of different features is used to calculate the ratio with the number of instructions to obtain the final feature vector.

[0044] In some embodiments, in step S4, a 19-dimensional feature vector is extracted from malware labeled with APT organization tags, and the feature vector and tags are used as training data for the decision tree model. Before training the model, data preprocessing is recommended to ensure the completeness and consistency of feature values. Missing data is imputed or deleted, and outliers are identified and processed to improve the quality of the training data. After the feature vectors are prepared, the decision tree model is trained using these datasets as input.

[0045] In some embodiments, in step S5, the model first generates decision rules based on the value of each feature by recursively partitioning the dataset. Each partition selects a feature and divides the dataset into subsets based on the optimal splitting point of that feature, ensuring that the sample labels in each subset are as consistent as possible. The partitioning criteria typically use metrics such as information gain, information gain ratio, or Gini index to measure the splitting effect of the feature and select the optimal splitting feature.

[0046] During the construction of the decision tree, the algorithm continuously splits until preset stopping conditions are met, such as tree depth, number of samples in a node, and minimum gain. These conditions effectively prevent overfitting and ensure the model's generalization ability. Through these decision rules, the model can classify different malware samples and predict their APT group labels.

[0047] During training, the model undergoes cross-validation to evaluate its performance. By adjusting parameters such as tree depth and minimum number of sample splits, the performance of the decision tree is optimized, ultimately resulting in a more accurate classification model. This model can then be used to classify new malware samples and predict whether they belong to a known APT group.

[0048] Decision trees generate decision rules by recursively partitioning the dataset. In each partition, a feature is selected, and the dataset is divided into subsets based on the optimal split point, ensuring that the sample labels in each subset are as consistent as possible. For example, information gain partitioning can be used as an example.

[0049] Information gain is shown in formula (1):

[0050]

[0051] in, For dataset Use features The information gain obtained by partitioning For dataset entropy, Let V be the subsets partitioned according to the value v of feature A, where V is the set of values ​​for feature A. For subset The entropy.

[0052] The first step in training a decision tree is to select features, as shown in formula (2). At each node, a feature A is selected, and the optimal split point is calculated according to the information gain splitting standard.

[0053]

[0054] in, For dataset Based on features The result of selecting the optimal partition. For use features For dataset Evaluation criteria function for partitioning.

[0055] The prediction formula of the decision tree is shown in (3). For a sample x to be classified (containing multiple feature values), the decision tree starts from the root node and traverses the path along the branches corresponding to the feature values ​​until it reaches a leaf node. After reaching the leaf node, the label stored in the node is output. .

[0056]

[0057] in, For the sample Predicting paths in decision trees; The root node of the decision tree. This refers to the movement relationships in the decision path, i.e., selecting the branch direction based on the feature values; As an internal node in a decision tree, each node selects the next branch based on the feature value of the sample. A leaf node represents the endpoint of a decision path.

[0058] In some embodiments, after model training is complete in step S6, the decision tree can be used to identify APT labels for new samples. First, for each malware sample to be classified, the model makes predictions based on the sample's 19-dimensional feature vector. Each dimension in the feature vector corresponds to a certain behavioral feature or attribute of the sample, such as file features, network behavior, process activity, etc. These features are input into the pre-trained decision tree, which then makes layer-by-layer judgments on the samples based on previously learned decision rules.

[0059] Specifically, the decision tree model makes decisions along the path of the tree based on the feature values ​​of the sample. Each node at each level makes a split judgment based on a specific feature. If the sample features meet a certain judgment condition, the model continues to judge along a branch of the tree until it reaches a leaf node. The leaf node stores the corresponding APT organization label, which is the predicted APT organization to which the sample belongs. The judgment condition is generated automatically by the malware input into the training model and is invoked automatically by the decision tree model during decision-making without human intervention.

[0060] For example, if a decision tree, while making a judgment at a certain node, finds that a certain behavioral feature of the sample (such as a malicious network traffic pattern) matches the features of a certain APT organization in the training data, the tree will continue to make judgments along the corresponding branch. Eventually, the model will reach a leaf node, which contains the APT organization label corresponding to this sample, thus completing the classification.

[0061] This process is fast and automated. The model can efficiently determine whether a sample belongs to a known APT attack group based on the values ​​of each dimension in the feature vector, and predict its most likely label. This automated classification capability enables decision trees to play a crucial role in large-scale malware analysis.

[0062] See Figure 2 This invention provides an APT malware organization identification system, comprising the following steps:

[0063] The data acquisition module is used to disassemble the original files of APT malware to be trained or tested to obtain the disassembled code of APT malware; analyze the disassembled code to obtain the disassembled code instruction lines; record the number of various types of disassembled code instruction lines, extract feature information from the disassembled code instruction lines and generate feature vectors;

[0064] The model training module uses feature vectors and malware labels as training data for the decision tree model and preprocesses the training data.

[0065] The model generation module inputs the preprocessed training data into the decision tree model for training, and obtains the trained decision tree model.

[0066] The organization identification module uses a trained decision tree model to identify APT malware.

[0067] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as set forth in the claims. Furthermore, the invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. An APT malware organization identification method, characterized by, The method comprises the following steps: disassembling an APT malicious software original file to be trained or to be tested to obtain disassembled code of the APT malicious software; analyzing the disassembled code to obtain disassembled code instruction lines; recording the number of various disassembled code instruction lines, extracting feature information in the disassembled code instruction lines, and generating a feature vector, including: extracting the feature information in the disassembled code instruction lines, recording the total amount of instructions, and obtaining the final feature vector according to the ratio of the number of different features to the total amount of instructions; the feature information includes the number of mathematical instructions, the number of logical instructions, the number of repeated instructions, and the number of system call information; using the feature vector and the malicious software label as training data of a decision tree model, and preprocessing the training data; inputting the preprocessed training data into the decision tree model for training to obtain a trained decision tree model; using the trained decision tree model to identify APT malicious software, including: extracting a 19-dimensional feature vector of the APT malicious software to be classified, wherein each dimension of the 19-dimensional feature vector corresponds to a feature of the APT malicious software to be classified, and the features include file features, network behaviors, and process activities; inputting the 19-dimensional feature vector of the APT malicious software to be classified into the trained decision tree model, and the decision tree making a layer-by-layer judgment on the APT malicious software to be classified based on a decision rule: the trained decision tree model making a decision along the path of the decision tree based on the features of the APT malicious software to be classified, each layer of nodes making a split judgment according to the features, if the features meet the judgment condition, continuing to make a judgment along the branch of the decision tree until reaching a leaf node; and completing the organization identification of the APT malicious software based on the corresponding APT organization label stored in the leaf node.

2. The identification method according to claim 1, characterized in that, When disassembling an APT malicious software original file to be trained or to be tested to obtain disassembled code of the APT malicious software, the following steps are included: using a disassembling tool to generate disassembled code stored in the form of a text file; the disassembling tool includes IDA Pro, Ghidra, and Radare2.

3. The identification method according to claim 1, characterized in that, When using the feature vector and the malicious software label as training data of a decision tree model, the following steps are included: extracting a 19-dimensional feature vector from the APT malicious software, and using the 19-dimensional feature vector and the malicious software label as training data for decision tree training.

4. The identification method according to claim 1, characterized in that, When preprocessing the training data, the following steps are included: filling or deleting missing data in the training data, and identifying and processing abnormal values.

5. The identification method according to claim 1, characterized in that, When inputting the preprocessed training data into the decision tree model for training, the following steps are included: the decision tree model recursively divides the data set and generates a decision rule based on the value of each feature, the decision rule being: based on a division standard, selecting a feature at each division, and dividing the data set into subsets according to the best split point of the feature, the division standard including an information gain index, an information gain ratio index, and a Gini index. When constructing the decision tree, the decision tree is split based on preset stop conditions, including the depth of the tree, the number of samples in the node, and the minimum gain; Cross-validation is performed on the decision tree model to optimize the performance of the decision tree by adjusting parameters, including the depth of the tree and the minimum number of sample splits.

6. An APT malware organization identification system, comprising: It comprises: A data acquisition module for disassembling the APT malicious software original file to be trained or tested to obtain the disassembled code of the APT malicious software; Analyzing the disassembled code to obtain disassembled code instruction lines; recording the number of various disassembled code instruction lines, extracting feature information from the disassembled code instruction lines and generating a feature vector; A model training module that uses the feature vector and malicious software labels as training data for a decision tree model, pre-processes the training data, including extracting feature information from the disassembled code instruction lines and recording the total number of instructions, and obtaining the final feature vector based on the ratio of the number of different features to the total number of instructions; the feature information includes the number of mathematical instructions, the number of logical instructions, the number of repeated instructions, and the number of system call information; A model generation module that inputs the pre-processed training data into a decision tree model for training to obtain a trained decision tree model; An organization identification module that uses the trained decision tree model to identify APT malicious software, including: extracting a 19-dimensional feature vector of the APT malicious software to be classified, where each dimension of the 19-dimensional feature vector corresponds to a feature of the APT malicious software to be classified, including file features, network behavior, and process activity; inputting the 19-dimensional feature vector of the APT malicious software to be classified into the trained decision tree model, and the decision tree making a layer-by-layer judgment on the APT malicious software to be classified based on decision rules: the trained decision tree model making decisions along the path of the decision tree based on the features of the APT malicious software to be classified, each layer of nodes making split judgments based on the features, if the features meet the judgment conditions, continuing to judge along the branches of the decision tree until reaching the leaf nodes; and based on the corresponding APT organization labels stored in the leaf nodes, completing the organization identification of the APT malicious software.

Images