Malicious software detection method and device, computer equipment and readable storage medium

Abstract

The invention discloses a malicious software detection method and device, computer equipment and a readable storage medium, relates to the technical field of computer security and malicious code detection, combines a gene coding technology and a frequency domain data analysis method, and improves the detection efficiency and accuracy. The method comprises the following steps: running to-be-detected software, and continuously simulating user behaviors; collecting an interface calling sequence, and coding the interface calling sequence based on a time sequence gene coding technology to obtain a software gene sequence; matching the software gene sequence with a sample gene sequence included in a malicious software gene pool, and acquiring software frequency domain data under the condition that the matching determines that the sample gene sequence similar to the software gene sequence does not exist; matching the software frequency domain data with sample frequency domain data included in the malicious sample frequency domain database, and determining the to-be-detected software as malicious software under the condition of determining that the sample frequency domain data similar to the software frequency domain data exists through matching.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security and malicious code detection, and particularly relates to a malicious software detection method and device, a computer device and a readable storage medium. BACKGROUND

[0002] With the continuous progress of information technology, the types and quantities of malicious software are increasing, which include viruses, Trojans and the like, and the malicious software aims to steal user privacy information, destroy system data, control computer devices and the like. Therefore, how to effectively detect and prevent malicious software and guarantee the safe and stable operation of computer systems and networks has become a problem to be solved in the field of computer security.

[0003] In the related art, there are various malicious software detection methods, such as a characteristic code comparison technology, a single dimension detection method and a machine learning model detection method.

[0004] However, the applicant finds that the related technology is difficult to identify variant codes that change their characteristic codes by modifying part of the code, encryption, polymorphism and other technical means, and the method based on single dimension detection is easy to be bypassed by malicious software with an anti-detection system. In addition, although a complex machine learning model has strong detection capability in theory, it needs a large amount of computing resources to support the training and inference process of the model in actual application, and it is difficult to realize real-time and efficient detection, which affects the detection efficiency and accuracy, and has poor effectiveness and reliability, and cannot meet the increasingly complex and changeable information security requirements. SUMMARY

[0005] Therefore, the present application provides a malicious software detection method and device, a computer device and a readable storage medium, which mainly aims to solve the problem that the related technology is difficult to identify variant codes that change their characteristic codes by modifying part of the code, encryption, polymorphism and other technical means, and the method based on single dimension detection is easy to be bypassed by malicious software with an anti-detection system. In addition, although a complex machine learning model has strong detection capability in theory, it needs a large amount of computing resources to support the training and inference process of the model in actual application, and it is difficult to realize real-time and efficient detection, which affects the detection efficiency and accuracy, and has poor effectiveness and reliability, and cannot meet the increasingly complex and changeable information security requirements.

[0006] According to a first aspect of the present application, a malware detection method is provided, which comprises:

[0007] running a software to be detected, and continuously simulating user behaviors during the running of the software to be detected;

[0008] collecting an interface calling sequence of the software to be detected during the running, and encoding the interface calling sequence based on a time sequence gene encoding technology to obtain a software gene sequence of the software to be detected;

[0009] matching the software gene sequence with sample gene sequences included in a pre-constructed malware gene library, and obtaining software frequency domain data of the software to be detected in a case where it is determined through the matching that there is no sample gene sequence similar to the software gene sequence in the malware gene library;

[0010] matching the software frequency domain data with sample frequency domain data included in a pre-constructed malware sample frequency domain database, and determining that the software to be detected is malware in a case where it is determined through the matching that there is sample frequency domain data similar to the software frequency domain data in the malware sample frequency domain database.

[0011] According to a second aspect of the present application, a malware detection device is provided, which comprises:

[0012] a simulation module, configured to run a software to be detected, and continuously simulate user behaviors during the running of the software to be detected;

[0013] an encoding module, configured to collect an interface calling sequence of the software to be detected during the running, and encode the interface calling sequence based on a time sequence gene encoding technology to obtain a software gene sequence of the software to be detected;

[0014] an obtaining module, configured to match the software gene sequence with sample gene sequences included in a pre-constructed malware gene library, and obtain software frequency domain data of the software to be detected in a case where it is determined through the matching that there is no sample gene sequence similar to the software gene sequence in the malware gene library;

[0015] a matching module, configured to match the software frequency domain data with sample frequency domain data included in a pre-constructed malware sample frequency domain database, and determine that the software to be detected is malware in a case where it is determined through the matching that there is sample frequency domain data similar to the software frequency domain data in the malware sample frequency domain database.

[0016] According to a third aspect of the present application, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the steps of the method of any one of the first aspect when executing the computer program.

[0017] According to a fourth aspect of the present application, a readable storage medium is provided, storing a computer program, and the computer program implementing the steps of the method of any one of the first aspect when executed by a processor.

[0018] By means of the above technical solution, the malware detection method, device, computer device and readable storage medium provided by the present application run the software to be detected, continuously simulate user behavior in the process of running the software to be detected, collect the interface call sequence of the software to be detected in the running process, encode and process the interface call sequence based on the time sequence gene coding technology, obtain the software gene sequence of the software to be detected, match the software gene sequence with the sample gene sequence included in the pre-constructed malware gene library, acquire the software frequency domain data of the software to be detected in the case that it is determined that there is no sample gene sequence similar to the software gene sequence in the malware gene library, match the software frequency domain data with the sample frequency domain data included in the pre-constructed malware sample frequency domain database, determine the software to be detected as malware in the case that it is determined that there is sample frequency domain data similar to the software frequency domain data in the malware sample frequency domain database, combine the gene coding technology and the frequency domain data analysis method to detect whether the software is malicious, utilize the high efficiency of the gene coding technology and the mechanism similar to DAN matching to more easily and quickly identify the essential characteristics of the malware, and further analyze the dynamic characteristics of the software to be detected through frequency domain data analysis, so that some malware that escapes detection by means of shell can also be accurately detected, while realizing real-time and efficient detection, the detection efficiency and accuracy are improved, the effectiveness and reliability are good, and the information security requirements of increasingly complex and variable information security requirements can be met.

[0019] The above description is only a summary of the technical solutions of the present application. In order to enable the technical means of the present application to be more clearly understood, and to be implemented according to the content of the description, and in order to enable the above and other purposes, features and advantages of the present application to be more apparent and easy to understand, the following detailed description of the specific embodiments of the present application is provided. BRIEF DESCRIPTION OF DRAWINGS

[0020] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are intended to further aid the full and complete understanding of the preferred embodiments. The same reference numerals are used throughout the drawings to represent the same components. In the drawings:

[0021] Figure 1 A flowchart of a malware detection method provided by an embodiment of the present application is shown;

[0022] Figure 2A A flowchart of another malware detection method provided by an embodiment of the present application is shown;

[0023] Figure 2B A flowchart of still another malware detection method provided by an embodiment of the present application is shown;

[0024] Figure 3 A structural diagram of a malware detection device provided by an embodiment of the present application is shown;

[0025] Figure 4 A structural diagram of a computer device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0026] Exemplary embodiments of the present application will be described in detail with reference to the drawings. Although exemplary embodiments of the present application are shown in the drawings, it is understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that the present application can be more thoroughly understood and so that the scope of the present application can be completely conveyed to those skilled in the art.

[0027] An embodiment of the present application provides a malware detection method, as shown in the figure, the method comprises: Figure 1

[0028] 101, running the software to be detected, and continuously simulating user behavior in the process of running the software to be detected.

[0029] An embodiment of the present application can be applied to a software detection system, which is based on a server and integrates gene coding technology and frequency domain data analysis method to form an efficient and accurate detection mechanism. Users can put the software to be detected into a designated area through a front-end interactive page provided by the software detection system to start the detection process. The software detection system will automatically run the software to be detected on the background server, continuously simulate real user behavior to cope with the anti-detection mechanism of advanced malware, collect the interface call sequence in the process of running the software and code it into the software gene sequence, and match it with the pre-constructed malware gene library; if the matching is not successful, further acquire the frequency domain data of the software and match it with the malware sample frequency domain database to finally determine whether the software is malware. The entire detection process is real-time and efficient, which can meet the increasingly complex and variable information security needs while providing convenient and accurate software detection services for users.

[0030] ​In the embodiments of the present application, the applicant realizes that advanced malware generally has anti-detection mechanisms (such as sandbox escape or machine learning model confrontation), and the malware can bypass the software detection system using various methods, such as constructing a false call chain. Therefore, the present application will carry out anti-sniffing, that is, running the software to be detected first, and simulating user behavior during the running of the software to be detected to simulate a real user environment. In the specific application process, the software detection system will start the software to be detected in the detection environment, and use a pseudo-user random noise generation technology to simulate a real user environment. The pseudo-user random noise generation technology refers to adding randomly generated user operation related data in the sandbox environment, which covers mouse movement trajectory, keyboard key frequency, window switching operation, etc., and the purpose is to create an environment atmosphere similar to that when a real user uses software, which can effectively interfere with the judgment of the sandbox environment by malicious code, so that it is difficult to determine that it is in a detected state, thereby unable to hide malicious features specifically, laying a foundation for subsequent accurate detection.

[0031] For example, when detecting a suspected malware, after simulating a normal user opening the software in the sandbox, some page browsing, function clicking and other operations are randomly performed, and random noise such as random mouse movement and keyboard key pressing is added. In this way, if the malware tries to judge whether it is in the sandbox by detecting the user operation mode, it will not be able to accurately judge due to the random noise, and thus expose its real behavior, thereby effectively dealing with the anti-detection mechanism of advanced malware by simulating a real user environment, improving the accuracy and reliability of detection, and avoiding missed detection due to the hiding of malicious behavior by the malware when it recognizes the detection environment.

[0032] 102. Collecting an interface call sequence of the software to be detected during the running process, and encoding and processing the interface call sequence based on a time sequence gene coding technology to obtain a software gene sequence of the software to be detected.

[0033] The applicant realizes that the traditional feature code or feature vector detection method needs to collect multi-modal or multi-feature fusion data such as file header and byte entropy, which not only consumes time, but also is prone to errors in feature weighting matching, leading to misjudgment of normal program code as malicious code.

[0034] Therefore, in this embodiment, during the operation of the software under test, the software detection system collects its interface call sequence in real time. The interface call sequence refers to a series of call order records generated when various modules of the software under test interact through interfaces during operation. Subsequently, based on time-series gene coding technology, such as time-series DNA coding technology (using the Needleman-Wunsch algorithm), the software detection system converts the collected interface call sequence into a coding system similar to DNA bases, obtaining the software gene sequence of the software under test. The DNA base coding system typically uses letters such as A, T, C, and G to represent different bases. Therefore, in this embodiment, the interface call sequence is mapped to a base-like coding system according to a preset coding rule, so that variant samples can be identified subsequently through gene alignment principles.

[0035] In this way, by using gene coding technology, the software detection speed can reach the millisecond level, and this DNA-like matching method is more biomimetic, which can more accurately identify the essential characteristics of malicious code, greatly improving detection efficiency and accuracy.

[0036] 103. Match the software gene sequence with the sample gene sequences included in the pre-constructed malware gene library. If the matching determines that there is no sample gene sequence in the malware gene library that is similar to the software gene sequence, obtain the software frequency domain data of the software to be detected.

[0037] In this embodiment, the software detection system matches the software gene sequence with sample gene sequences included in a pre-constructed malware gene library. The pre-constructed malware gene library is a collection of sample gene sequences obtained by genetically encoding a large number of known malware programs. Considering that advanced malware often uses packers to evade scanning, while existing dynamic monitoring techniques can dynamically decrypt at runtime, they make it difficult to identify the static features of malware, relying instead on dynamic features such as machine learning and feature vector recognition for detection. However, feature vector detection uses weighted fusion methods, and the weighting coefficients are difficult to balance, leading to inaccurate feature extraction. Therefore, in this embodiment, if the software detection system determines during the matching process that no sample gene sequence similar to the software gene sequence exists in the malware gene library, it further acquires the software frequency domain data of the software to be detected. By analyzing the frequency domain features of the software during operation, it obtains more comprehensive dynamic feature information of the software, further improving the accuracy of detection.

[0038] In actual application, the process electrocardiogram of the to-be-detected software can be generated to record the changes of various process states in the running process of the to-be-detected software, and then the process electrocardiogram is subjected to Fourier transform to obtain the software frequency domain data of the to-be-detected software. The Fourier transform is a mathematical method for converting time domain signals into frequency domain signals, which is commonly used in the image field and the communication field. After the Fourier transform, the software frequency domain data can be obtained, and the spectrum characteristics of the software frequency domain data are analyzed to match the malicious code blood relationship, thereby effectively avoiding the problems such as shell evading scanning, and improving the comprehensiveness and accuracy of software detection.

[0039] 104. The software frequency domain data is matched with the sample frequency domain data included in the pre-constructed malicious sample frequency domain database, and in a case where it is determined through the matching that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, the to-be-detected software is determined to be malicious software.

[0040] In the embodiment of the present application, the software detection system matches the obtained software frequency domain data with the sample frequency domain data included in the pre-constructed malicious sample frequency domain database. The pre-constructed malicious sample frequency domain database is a database formed after collecting a large amount of frequency domain data of known malicious software. If it is determined in the matching process that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, the to-be-detected software is determined to be malicious software.

[0041] In this way, through the double detection mechanism, the advantages of the two technologies can be fully utilized by combining the genetic coding technology and the frequency domain data analysis method to realize accurate detection of malicious software. The genetic coding technology can quickly identify the essential characteristics of malicious software, and the frequency domain data analysis method can deeply mine the dynamic characteristics of software, especially for malicious software that evades detection by means of shell and the like, which can also be effectively identified, thereby forming a complete and efficient malicious software detection system. While realizing real-time and efficient detection, the detection efficiency and accuracy are significantly improved, and the effectiveness and reliability are good, which can meet the increasingly complex and variable information security requirements.

[0042] The method provided in the embodiment of the application runs the software to be detected, simulates user behavior continuously in the process of running the software to be detected, collects the interface calling sequence of the software to be detected in the running process, encodes and processes the interface calling sequence based on a timing gene coding technology to obtain a software gene sequence of the software to be detected, matches the software gene sequence with a sample gene sequence included in a pre-constructed malicious software gene library, acquires software frequency domain data of the software to be detected in a case where it is determined through matching that there is no sample gene sequence similar to the software gene sequence in the malicious software gene library, matches the software frequency domain data with sample frequency domain data included in a pre-constructed malicious sample frequency domain database, and determines that the software to be detected is malicious software in a case where it is determined through matching that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database. The gene coding technology and the frequency domain data analysis method are combined to detect whether the software is malicious software. The essence feature of the malicious software can be more easily and quickly identified by using the high efficiency of the gene coding technology and the mechanism similar to DAN matching. The dynamic feature of the software to be detected can be analyzed by further analyzing the frequency domain data, so that the malicious software that escapes detection by shell can also be accurately detected. The detection efficiency and accuracy are improved, and the effectiveness and reliability are good. The information security requirements that are increasingly complex and changeable can be met.

[0043] Further, as a refinement and expansion of the specific implementation of the above embodiment, in order to completely describe the specific implementation process of the embodiment, another malicious software detection method is provided in the embodiment of the application, as shown in Figure 2A The method comprises the following steps.

[0044] 201. Run the software to be detected, and simulate user behavior continuously in the process of running the software to be detected.

[0045] The technical solution of the embodiment of the application can be applied to a software detection system, and the detailed information of the software detection system can be referred to the introduction of the software detection system in the above embodiment, which will not be described here. In the software detection system, after the user uploads the software to be detected through the front-end interactive page, the software detection system will place the software to be detected in a preset detection environment for running. The preset detection environment can be a sandbox environment. The sandbox is a virtual environment for isolating the running of the software to be detected. It can simulate a running space similar to the real system, isolate the software to be detected from the actual system, and prevent the software to be detected from damaging the actual system in the running process, such as stealing user data and damaging system files.

[0046] In the detection environment, in order to effectively deal with the sandbox escape or machine learning model confrontation of the anti-detection mechanism commonly possessed by advanced malicious software, the software detection system will continuously simulate the real user behavior. Specifically, the software detection system will control the pointer component (i.e. the mouse pointer) to move a first preset number of pixels every first time interval. The first time interval and the first preset number can be flexibly set according to actual conditions, for example, the first time interval can be set to 1 minute, and the first preset number can be set to 5-20 pixels. Through such random mouse movement operation, the irregular movement of the mouse of the real user when using the software can be simulated, so that the malicious software is difficult to determine that it is in the detected sandbox environment by judging the mouse movement pattern.

[0047] At the same time, the software detection system will also input a second preset number of random characters every second time interval. The second time interval and the second preset number can also be set according to actual needs, such as the second time interval can be set to 1 minute, and the second preset number can be set to 3-10 characters. These random characters can be any combination of letters, numbers, symbols, etc., simulating the randomness and uncertainty of real users when inputting information. Advanced malicious software may monitor the regularity of keyboard input to determine whether it is in a detection environment, and this random character input method can effectively interfere with the judgment of malicious software, so that it cannot accurately identify the environment it is in, and thus cannot hide malicious behavior.

[0048] For example, when detecting a suspected malicious game software, in the sandbox environment, the software detection system controls the mouse pointer to move 20 pixels every 1 minute, simulating the user's random mouse movement to view the game scene in the game interface; input 5 random characters every 1 minute, simulating the user's random input operation in the game chat window or input box. Even if the game software has built-in anti-detection mechanisms, it will not be able to accurately determine that it is in a detection state due to these random and real user behavior simulations, thereby exposing its possible malicious behavior, such as secretly collecting user information, downloading malicious programs in the background, etc. In this way, by simulating real and random user behavior in the sandbox environment, the judgment of the detection environment by malicious software can be effectively interfered, the anti-detection mechanism of advanced malicious software can be dealt with, the accuracy and reliability of detection can be improved, and the missed detection caused by the malicious software hiding malicious behavior due to the identification of the detection environment can be avoided.

[0049] 202, collect the interface call sequence of the software to be detected during the running process, encode the interface call sequence based on the time sequence gene coding technology, and obtain the software gene sequence of the software to be detected.

[0050] In the process of continuously running the software to be detected in the preset detection environment, the software detection system collects a plurality of interface functions called by the software to be detected in the running process in real time. These interface functions cover various functional interfaces used by the software to interact with the operating system, other software components or external devices, such as file operation interface, registry modification interface, network communication interface, process injection interface, etc. After collecting a plurality of interface functions, the software detection system constructs an interface calling sequence according to the calling sequence of the interface functions. The interface calling sequence can accurately reflect the calling relationship of each interface function in the running process of the software to be detected, and provide basic data for subsequent analysis of software behavior mode.

[0051] Next, based on the time sequence gene coding technology, the software detection system will query the encoding symbol corresponding to each interface function in the preset gene coding rule. In actual application, a method similar to the time sequence DNA coding technology can be used to convert the interface calling sequence into a DNA base-like coding system, so as to identify the variation sample by gene comparison principle. The specific gene coding rule is shown in Table 1 as follows:

[0052] Table 1

[0053] API type Encoding symbol File operation A Registry modification T Network communication C Process injection G Other X

[0054] In Table 1, a set of software interface function coding rules based on time sequence gene coding technology is presented. The core is to assign specific encoding symbols to various interface functions called in the software running process, similar to the bases in DNA coding. Referring to Table 1, the file operation type interface function corresponds to the encoding symbol "A". This type of function involves various operations of the software on the file system, such as creating, reading and writing, deleting files, etc. The registry modification type interface function corresponds to "T", which is mainly used for adding, modifying and deleting key values of the system registry to realize the storage and change of configuration information. The network communication type interface function corresponds to "C", which covers the functions called when the software interacts with the network, such as establishing network connection, sending and receiving data packets, etc. The process injection type interface function corresponds to "G", which refers to the interface function that the software injects its own code into other process space for running, which is often used by malicious software to hide its behavior. For other API types other than the above four types, they are uniformly coded as "X". Further, in actual application, the encoding "X" can be further subdivided according to different system calls, such as encoding the write function (used for writing file operation) as X1, encoding the fork function (used for creating a new process) as X2, and so on. In this way, through the preset gene coding rule, the complex interface calling behavior of the software can be converted into a simple encoding sequence, which provides convenience for subsequent analysis of software behavior and identification of malicious software variation samples using gene comparison principle.

[0055] According to the above gene coding rules, the software detection system can convert each interface function into a corresponding code symbol, thereby obtaining a plurality of code symbols corresponding to a plurality of interface functions. For example, if the software to be detected successively calls a file operation interface, a network communication interface, and an interface calling the write function during running, the corresponding code symbols are A, C, and X1, respectively.

[0056] Finally, the software detection system arranges the plurality of code symbols in the order of the interface calling sequence to form a complete sequence, and takes the sequence as the software gene sequence of the software to be detected. The software gene sequence represents the behavior characteristics of the software to be detected during running in a concise and biologically characteristic manner, and provides a key basis for subsequent operations such as security detection and malicious behavior identification of the software.

[0057] 203、matching the software gene sequence with sample gene sequences included in a pre-constructed malicious software gene library, in a case where it is determined through matching that there is no sample gene sequence similar to the software gene sequence in the malicious software gene library, performing steps 204 to 205 below; in a case where it is determined through matching that there is a sample gene sequence similar to the software gene sequence in the malicious software gene library, performing step 206 below.

[0058] In the embodiments of the present application, in order to accurately determine whether the software is malicious, a malicious software sample library is provided in the software detection system, that is, a plurality of malicious software samples collected are used to construct the malicious software sample library; and the software detection system performs dynamic sample subscription, and pulls a subscription source at regular intervals (such as every day) to obtain incremental malicious software samples, and uses a FIFO (First In First Out) algorithm to update the incremental malicious software samples to the malicious software sample library, so as to ensure that the samples in the sample library are the latest.

[0059] In addition, in order to realize the identification of the software gene sequence, a malicious software gene library is also provided in the embodiments of the present application, and a large number of sample gene sequences are included in the malicious software gene library. The generation of these sample gene sequences also adopts the gene coding technology, and specific descriptions of the gene coding technology can be referred to the description of step 202 above, which will not be described here. Further, in order to ensure the continuous updating of the samples in the malicious software gene library, the embodiments of the present application also obtain an incremental sample interface calling sequence corresponding to an incremental malicious software sample, encode the incremental sample interface calling sequence based on the time sequence gene coding technology to obtain an incremental sample gene sequence of the incremental malicious software sample, and update the incremental sample gene sequence to the malicious software gene library.

[0060] With the constructed malicious software gene library, the software detection system can match the software gene sequence with the sample gene sequences included in the pre-constructed malicious software gene library, and the specific process is as follows:

[0061] First, the dynamic programming algorithm and the sliding window algorithm are used to calculate the sequence similarity between the software gene sequence and each sample gene sequence included in the malicious software gene library, and a plurality of sequence similarities are obtained. Specifically, the dynamic programming algorithm is first used to construct a sliding window. After the sliding window is constructed, for each sample gene sequence, the sliding window is placed at the starting position of the software gene sequence and the sample gene sequence. At this time, the sliding window covers the starting part of the two sequences, which sets the initial range for subsequent similarity calculation. Then, within the current sliding window, the number of matching characters between the software gene sequence and the sample gene sequence is counted, and the matching characters refer to the characters with the same coding symbols at the corresponding positions of the two sequences. The number of matching characters is used to calculate the gene fragment similarity of the sliding window at the current position. For example, if the current window position of the software gene sequence is "ATC" and the corresponding window position of the sample gene sequence is "ATX", then the number of matching characters is 2 ("A" and "T" match), and the number of matching characters is divided by the size of the sliding window to obtain a similarity value between 0 and 1. The closer this value is to 1, the higher the similarity of the two sequences in the current window. After completing the gene fragment similarity calculation at the current position, the sliding window is controlled to move on the software gene sequence and the sample gene sequence according to the preset sliding distance, and the gene fragment similarity of the sliding window at the current position is recalculated until each character in the software gene sequence and the sample gene sequence is traversed. A plurality of gene fragment similarities are obtained, which reflect the similarity of the two sequences at different positions of the sliding window. Finally, the maximum gene fragment similarity is extracted from the plurality of gene fragment similarities, and the maximum value represents the maximum similarity of the software gene sequence and the current sample gene sequence in a local region during the entire sequence matching process. The maximum gene fragment similarity is taken as the sequence similarity between the software gene sequence and the currently processed sample gene sequence, so as to comprehensively and accurately measure the similarity of the to-be-detected software gene sequence and each sample gene sequence in the malicious software gene library, and to provide a key basis for subsequent judgment of whether the to-be-detected software is malicious software.

[0062] In actual application, the dynamic programming algorithm can be the Needleman-Wunch algorithm. The Needleman-Wunch algorithm and the sliding window are used to traverse the malicious software gene library for similarity matching. For example, the to-be-detected software gene sequence is ATCGGA, and a sample gene sequence in the malicious software gene library is ATCXA. The similarity of the dynamically matched gene fragments using the Needleman-Wunch algorithm and the sliding window is shown in Table 2.

[0063] Table 2

[0064] Window position Matching character number Sequence similarity 1-4 3 / 4 75％ 2-5 2 / 4 50％ 3-6 1 / 4 25％

[0065] In Table 2, the "window position" indicates the range of characters covered by the sliding window on the two sequences, for example, "1-4" means that the window starts from the 1st character and covers the 4th character on the two sequences; the "matching character number" records the number of characters with the same encoding symbol in the two sequences at the current window position, for example, when the window position is "1-4", there are 3 matching characters in the corresponding part of the two sequences; the sequence similarity is calculated according to the matching character number and the window size, and is used to intuitively reflect the similarity of the two sequences in the current window, for example, when the window position is "1-4", the similarity is 75% (3 / 4). In this way, the matching conditions at different positions are recorded in the table as the sliding window moves on the sequences, and detailed local data support is provided for finally determining the overall similarity of the two sequences.

[0066] Then, the plurality of sequence similarities are compared with a preset sequence similarity threshold, and the matching of the software gene sequence and the malicious software gene library is completed. Specifically, when the comparison determines that there is no specified sequence similarity greater than the sequence similarity threshold in the plurality of sequence similarities, it is determined that there is no sample gene sequence similar to the software gene sequence in the malicious software gene library, and further detection is required, that is, steps 204 to 205 are executed. When the comparison determines that there is a specified sequence similarity greater than the sequence similarity threshold in the plurality of sequence similarities, the maximum value 75% in the above example is taken as the similarity, and if it is greater than the threshold (such as 50%), it can be determined that the software to be detected is malicious software, that is, step 206 is executed.

[0067] 204. Obtain the software frequency domain data of the software to be detected.

[0068] In the embodiments of the present application, when the comparison determines that there is no specified sequence similarity greater than the sequence similarity threshold in the plurality of sequence similarities, spectrum feature matching needs to be performed. The specific implementation process is as follows:

[0069] First, the preset time period and the preset sampling rate are determined. The preset time period is the duration of data collection, and the preset sampling rate determines the frequency of data collection. If sampling is set to occur once every 10 ms, then the sampling rate is 100 Hz, which means that 100 data points will be collected per second. Within the preset time period, the software detection system will collect the processor occupancy rate and the memory occupancy rate of the software to be detected according to the preset sampling rate. The processor occupancy rate reflects the processor resource occupancy of the software during operation, and the memory occupancy rate reflects the degree of software memory resource usage. The collected multiple processor occupancy rates are arranged into a processor occupancy time domain signal, and the multiple memory occupancy rates are arranged into a memory occupancy time domain signal. In actual application, process behavior electrocardiogram algorithm can be used for auxiliary processing. Taking the processor occupancy time domain signal as an example, the processor occupancy time domain signal of the software to be detected can be represented as x(t), which specifically presents CPU occupancy rates of 10%, 40%, 90%, etc. This means that the CPU occupancy rate is 10% in the first unit of time, 40% in the second unit of time, and 90% in the third unit of time.

[0070] Then, the processor occupancy time domain signal and the memory occupancy time domain signal are windowed using the Hanning window function. The Hanning window function is a windowing method. Since actual signals are not infinitely long but are truncated, windowing can effectively prevent spectral leakage and make subsequent spectral analysis results more accurate. Then, the Fourier transform algorithm is used to convert the windowed processor time domain signal and the memory occupancy time domain signal. The Fourier transform algorithm can convert the time domain signal to the frequency domain signal, and the converted processor time domain signal and the memory occupancy time domain signal are used as software frequency domain data of the software to be detected. Continuing with the above example, the processor occupancy time domain signal of the software to be detected is x(t), and the converted processor time domain signal obtained after Fourier transform is represented as freq_x, freq_x = np.fft.fft(x).

[0071] In this way, through the above process, the processor and memory occupancy rate data of the software to be detected during operation are collected and converted into frequency domain signals, which can analyze the behavior characteristics of the software from different dimensions. Among them, genetic sequence matching is mainly based on the structure and logic characteristics of the software, and spectral feature matching focuses on the dynamic resource usage of the software during operation. The combination of the two can more comprehensively and accurately judge whether the software is malicious software, and improve the accuracy and reliability of the detection.

[0072] 205. Match the software frequency domain data with the sample frequency domain data included in the pre-built malicious sample frequency domain database. If the matching determines that there are sample frequency domain data in the malicious sample frequency domain database that are similar to the software frequency domain data, proceed to step 206 below. If the matching determines that there are no sample frequency domain data in the malicious sample frequency domain database that are similar to the software frequency domain data, proceed to step 207 below.

[0073] To achieve the identification of software frequency domain data, this embodiment also includes a malicious sample frequency domain database. This database contains a large amount of sample frequency domain data. Specifically, it requires obtaining the sample time domain signal of each malicious software sample, using a Fourier transform algorithm to convert the sample time domain signal of each malicious software sample to obtain the sample frequency domain data of each malicious software sample, and constructing the malicious sample frequency domain database using multiple sample frequency domain data corresponding to multiple malicious software samples. The sample time domain signal is used to describe the processor usage rate sequence and memory usage rate sequence of the corresponding malicious software sample within a preset time period. For example, the sample time domain signal of a certain malicious software sample can be y(t), and the sample frequency domain data obtained after performing a Fourier transform can be freq_y, where freq_y = np.fft.fft(y). It should be noted that the generation of this sample frequency domain data also follows the process described in step 204 above, which will not be repeated here. Furthermore, to ensure the continuous updating of samples in the malicious sample frequency domain database, this embodiment also acquires the incremental sample time domain signal of the incremental malicious software sample, uses a Fourier transform algorithm to transform the incremental sample time domain signal of the incremental malicious software sample to obtain the incremental sample frequency domain data of the incremental malicious software sample, and updates the incremental sample frequency domain data to the malicious sample frequency domain database. In this way, by constructing the malicious sample frequency domain database, a wealth of reference samples are provided for the identification of software frequency domain data, enabling the software detection system to more accurately determine whether the software to be detected is malicious software based on the frequency domain characteristics of known malicious software; at the same time, continuous database updates ensure that the software detection system can identify newly emerging malicious software, improving the timeliness and comprehensiveness of detection.

[0074] Using the malware gene library constructed above, the software detection system can match the software gene sequence with the sample gene sequences included in the pre-constructed malware gene library. Specifically, the matching process requires calculating the frequency domain similarity between the software's frequency domain data and the frequency domain data of each sample, resulting in multiple frequency domain similarities. These similarities include memory amplitude spectrum similarity, memory coherence similarity, processor amplitude spectrum similarity, and processor coherence similarity. The processor amplitude spectrum similarity can specifically be the CPU amplitude spectrum similarity, and the processor coherence similarity can specifically be the CPU coherence similarity. The calculation process is as follows:

[0075] For each sample frequency domain data, first, sample memory occupation time domain signal and sample processor occupation time domain signal are extracted in the sample frequency domain data, and memory occupation time domain signal and processor occupation time domain signal are extracted in the software frequency domain data.

[0076] Then, the sample memory occupation time domain signal and the memory occupation time domain signal are calculated by using the amplitude difference index formula to obtain the memory amplitude spectrum similarity, and the sample processor occupation time domain signal and the processor occupation time domain signal are calculated by using the amplitude difference index formula to obtain the processor amplitude spectrum similarity. Taking the calculation of the processor amplitude spectrum similarity as an example, the amplitude difference index formula can be formula 1 as follows:

[0077] Formula 1:

[0078] In the frequency domain analysis, the signal can be decomposed into a combination of different frequency components, and f is used to identify the positions of these different frequencies; taking the calculation of the processor amplitude spectrum similarity as an example, X(f) represents the amplitude value of the processor occupation time domain signal at the frequency point f; Y(f) represents the amplitude value of the sample processor occupation time domain signal at the frequency point f; |X(f)| represents the absolute value of X(f), and |Y(f)| represents the absolute value of Y(f); because the amplitude value itself is a scalar and non-negative, the absolute value operation here is mainly to ensure that the calculated value is non-negative, which is convenient for subsequent calculation of the amplitude difference; max(|X(f)|, |Y(f)| represents the maximum value of |X(f)| and |Y(f)|; D A (f) represents the processor amplitude spectrum similarity. As can be seen from formula 1, when calculating the processor amplitude spectrum similarity, the processor occupation amplitude difference of the sample processor occupation time domain signal and the processor occupation time domain signal at each frequency point is first calculated, then the processor occupation amplitude difference of the sample processor occupation time domain signal and the processor occupation time domain signal at each frequency point is calculated, and according to the amplitude difference at each frequency point, the processor amplitude spectrum similarity is calculated, and the principle of calculating the memory amplitude spectrum similarity is the same. In the actual application, formula 1 is used to calculate D A (f), when D A (f) > 0.3, it can be determined that there is a significant difference. In this way, by calculating the frequency domain similarity, the feature difference between the software to be detected and the malicious software sample can be analyzed more carefully from the frequency domain, making up for the possible shortcomings of gene sequence matching and improving the accuracy of software detection; moreover, by calculating the amplitude spectrum similarity of the memory and the processor respectively, the characteristics of the software in terms of resource occupation can be more comprehensively understood, which is helpful to discover some hidden malicious behaviors.

[0079] In view of the fact that the amplitude spectrum can only reflect the amplitude variation in the frequency domain, in order to comprehensively evaluate the software features, in the embodiments of the present application, the coherence similarity is also calculated. Specifically, the memory occupation cross-power spectral density based on the sample memory occupation time domain signal and the memory occupation time domain signal, and the processor occupation cross-power spectral density based on the sample processor occupation time domain signal and the processor occupation time domain signal are calculated, wherein the memory occupation cross-power spectral density is used to describe the correlation degree of the sample memory occupation signal and the to-be-detected software memory occupation signal in the frequency domain, and the processor occupation cross-power spectral density is used to reflect the correlation of the sample processor occupation signal and the to-be-detected software processor occupation signal in the frequency domain; at the same time, the memory occupation self-power spectral density and the processor occupation self-power spectral density of the to-be-detected software are obtained, the memory occupation self-power spectral density is the characteristic description of the to-be-detected software memory occupation signal itself in the frequency domain, and the processor occupation self-power spectral density is the characteristic of the to-be-detected software processor occupation signal itself in the frequency domain. The memory occupation cross-power spectral density and the memory occupation self-power spectral density are calculated by using the coherence similarity formula, and the processor occupation cross-power spectral density and the processor occupation self-power spectral density are calculated by using the coherence similarity formula, and the processor occupation cross-power spectral density and the processor occupation self-power spectral density are calculated by using the coherence similarity formula. The coherence similarity is used to measure the correlation degree of the sample signal and the to-be-detected software signal in the frequency domain, and includes the memory coherence similarity and the processor coherence similarity. The following takes the calculation of the processor coherence similarity as an example to illustrate. The processor occupation cross-power spectral density calculated in advance can be calculated by using the following formula 2:

[0080] Formula 2: P xy (f) = X(f) · Y`(f)

[0081] Wherein, P xy (f) represents the processor occupation cross-power spectral density; X(f) represents the amplitude value of the processor occupation time domain signal at the frequency point f; Y(f) represents the amplitude value of the sample processor occupation time domain signal at the frequency point f; Y`(f) is the complex conjugate of Y(f), and the complex conjugate is to take the opposite number of the imaginary part of the complex number. The product of X(f) and Y`(f) is calculated to the processor occupation cross-power spectral density, which reflects the interaction of the sample processor occupation signal and the to-be-detected software processor occupation signal in the frequency domain.

[0082] Then, the processor occupation cross-power spectral density calculated is used to calculate the processor coherence similarity by using the following formula 3:

[0083] Formula 3:

[0084] Wherein, P xy (f) represents the processor occupation cross-power spectral density; P xx(f) represents the processor occupation self-power spectral density of the software to be detected; P yy (f) represents the sample processor occupation self-power spectral density of the sample processor occupation time domain signal at frequency point f; C xy (f) represents the calculated processor coherence similarity.

[0085] From the above formula 2 and formula 3, in the calculation of the coherence similarity, the processor coherence coefficient at frequency point f is obtained by comparing the square of the cross-power spectral density with the product of the two self-power spectral densities, so as to measure the correlation degree of the sample processor occupation signal and the processor occupation signal of the software to be detected at the frequency point. The coherence similarity of the memory is calculated in the same way. In the actual application, the value of C xy (f) is in the value interval 【0, 1】, C xy (f) > 0.5 represents strong correlation, indicating that the directions of the two signals at each frequency are consistent. By calculating the coherence similarity, the characteristics between the software to be detected and the malicious software sample can be further analyzed from the perspective of signal correlation. Combined with the amplitude spectrum analysis, the characteristics of the software in the frequency domain can be more comprehensively and deeply understood, and the accuracy and reliability of the malicious software detection can be improved. Moreover, the coherence similarity can reflect the direction consistency of the signal at each frequency, which is helpful to discover some malicious behavior characteristics that are difficult to detect through amplitude changes.

[0086] After completing the above calculation process, the software detection system will take the memory amplitude spectrum similarity, the memory coherence similarity, the processor amplitude spectrum similarity and the processor coherence similarity as the frequency domain similarities between the software frequency domain data and the sample frequency domain data currently processed. Next, the software detection system will compare the multiple frequency domain similarities with the preset frequency domain similarity threshold, so as to complete the matching of the software frequency domain data and the malicious sample frequency domain database. Specifically, when the comparison determines that there is a specified frequency domain similarity included in the multiple frequency domain similarities, each similarity of which is greater than the frequency domain similarity threshold, it is determined that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, and the software to be detected is determined to be malicious software, that is, the following step 207 is executed; when the comparison determines that there is no specified frequency domain similarity included in the multiple frequency domain similarities, each similarity of which is greater than the frequency domain similarity threshold, it is determined that there is no sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, and the software to be detected is determined to be non-malicious software. Taking the frequency domain similarity threshold as 0.5 as an example, when the above-mentioned memory amplitude spectrum similarity, memory coherence similarity, processor amplitude spectrum similarity and processor coherence similarity calculated for a certain sample frequency domain data are all greater than 0.5, it is considered that the frequency domain similarity of the software to be detected is greater than 0.5, and the software to be detected is determined to be malicious software.

[0087] For example, when detecting a new software, the memory amplitude spectrum similarity is 0.6, the memory coherence similarity is 0.7, the processor amplitude spectrum similarity is 0.55, and the processor coherence similarity is 0.65, and the frequency domain similarity threshold is set to 0.5. Since all the four similarities are greater than 0.5, according to the above comparison rule, the software detection system determines that there is similar sample frequency domain data in the malicious sample frequency domain database, and determines that the new software is malicious software. By comparing the frequency domain similarities in multiple dimensions, the similarity between the software and the malicious sample can be more comprehensively and accurately evaluated, not relying on a single indicator, avoiding inaccurate detection results due to errors in individual indicators, greatly improving the accuracy and reliability of malicious software detection, and helping to timely discover and prevent malicious software attacks.

[0088] 206、determine that the software to be detected is malicious software.

[0089] When it is determined in step 203 that there is similar sample genetic sequence in the malicious software gene library, or it is determined in step 205 that there is similar sample frequency domain data in the malicious sample frequency domain database, the software detection system determines that the software to be detected is malicious software. The result is based on the comprehensive detection and analysis of the previous steps, and has high accuracy and reliability. By combining genetic coding technology and frequency domain data analysis method, the characteristics of malicious software can be recognized from different angles, whether it is essential characteristics or dynamic characteristics, which can effectively capture and accurately determine the maliciousness of the software.

[0090] 207、determine that the software to be detected is non-malicious software.

[0091] When it is determined in step 205 that there is no similar sample frequency domain data in the malicious sample frequency domain database, the software detection system determines that the software to be detected is non-malicious software, indicating that after the double detection of genetic coding technology and frequency domain data analysis method, no malicious characteristics are found in the software to be detected. Therefore, it can be determined that it is a safe non-malicious software, thereby ensuring the accurate classification of the software, avoiding the misjudgment of normal software as malicious software, and reducing the interference to the user's normal use of software.

[0092] In summary, the logical process of the malicious software detection method proposed in the present application is as follows: see Figure 2BThe malware sample library 1 to N is subscribed, the incremental malicious samples newly entered into the library are collected in time, and the incremental malicious samples are respectively subjected to genetic coding processing and Fourier transform, and then the constructed malware gene library and the malware sample frequency domain database are updated. In the actual detection process, the software to be detected is put into a sandbox, and pseudo-user noise is added in the sandbox. According to the running of the software to be detected, firstly, the software gene sequence of the software to be detected is obtained, and the software gene sequence of the software to be detected is identified by using the malware gene library. When it is determined that there is a sample software gene sequence with a similarity greater than 50% with the software gene sequence of the software to be detected in the malware gene library, it can be directly determined as malicious software. When it is determined that there is no sample software gene sequence with a similarity greater than 50% with the software gene sequence of the software to be detected in the malware gene library, the software frequency domain data of the software to be detected is continuously identified by using the malware sample frequency domain database. When it is determined that there is sample frequency domain data with a similarity greater than 50% with the software frequency domain data of the software to be detected in the malware sample frequency domain database, it can be determined that the software to be detected is malicious software, otherwise, it is determined that the software to be detected is non-malicious software.

[0093] The method provided by the embodiment of the application runs the software to be detected, continuously simulates user behavior in the process of running the software to be detected, collects the interface calling sequence of the software to be detected in the running process, encodes the interface calling sequence based on the time sequence genetic coding technology to obtain the software gene sequence of the software to be detected, matches the software gene sequence with the sample gene sequence included in the pre-constructed malware gene library, in the case that it is matched and determined that there is no sample gene sequence similar to the software gene sequence in the malware gene library, obtains the software frequency domain data of the software to be detected, matches the software frequency domain data with the sample frequency domain data included in the pre-constructed malware sample frequency domain database, in the case that it is matched and determined that there is sample frequency domain data similar to the software frequency domain data in the malware sample frequency domain database, determines that the software to be detected is malicious software, combines the genetic coding technology and the frequency domain data analysis method to detect whether the software is malicious software, uses the high efficiency of the genetic coding technology and the mechanism similar to the DAN matching to more easily and quickly identify the essential characteristics of the malicious software, and further analyzes the dynamic characteristics of the software to be detected through the frequency domain data analysis, so that some malicious software that escapes detection by shell can also be accurately detected, while realizing real-time and efficient detection, the detection efficiency and accuracy are improved, the effectiveness and reliability are good, and the information security demand that is increasingly complex and changeable can be met.

[0094] Further, as Figure 1 The method is specifically implemented, and the embodiment of the application provides a malware detection device, such as Figure 3As shown, the device comprises: an analog module 301, an encoding module 302, an acquisition module 303 and a matching module 304

[0095] The analog module 301 is configured to run the software to be detected, and continuously simulate user behaviors during the running of the software to be detected.

[0096] The encoding module 302 is configured to collect an interface calling sequence of the software to be detected during the running, and perform encoding processing on the interface calling sequence based on a timing gene encoding technology to obtain a software gene sequence of the software to be detected.

[0097] The acquisition module 303 is configured to match the software gene sequence with a sample gene sequence included in a pre-constructed malicious software gene library, and acquire software frequency domain data of the software to be detected in a case where it is determined through the matching that there is no sample gene sequence similar to the software gene sequence in the malicious software gene library.

[0098] The matching module 304 is configured to match the software frequency domain data with sample frequency domain data included in a pre-constructed malicious sample frequency domain database, and determine that the software to be detected is malicious software in a case where it is determined through the matching that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database.

[0099] In a specific application scenario, the device further comprises:

[0100] A construction module is configured to construct a malicious software sample library by using collected multiple malicious software samples, acquire a sample interface calling sequence corresponding to each of the malicious software samples, perform encoding processing on the sample interface calling sequence corresponding to each of the malicious software samples based on the timing gene encoding technology to obtain a sample gene sequence of each of the malicious software samples, and construct the malicious software gene library by using multiple sample gene sequences corresponding to the multiple malicious software samples; acquire a sample time domain signal of each of the malicious software samples, convert the sample time domain signal of each of the malicious software samples by using a Fourier transform algorithm to obtain sample frequency domain data of each of the malicious software samples, and construct the malicious sample frequency domain database by using multiple sample frequency domain data corresponding to the multiple malicious software samples, wherein the sample time domain signal is used to describe a processor occupation rate sequence and a memory occupation rate sequence of the corresponding malicious software sample within a preset time period.

[0101] In a specific application scenario, the construction module is further configured to acquire incremental malware samples at a regular time interval, update the incremental malware samples to the malware sample library using a first-in-first-out algorithm, acquire an incremental sample interface call sequence corresponding to the incremental malware samples, encode the incremental sample interface call sequence based on the time sequence gene encoding technology to obtain an incremental sample gene sequence of the incremental malware samples, and update the incremental sample gene sequence to the malware gene library, acquire an incremental sample time domain signal of the incremental malware samples, convert the incremental sample time domain signal of the incremental malware samples using the Fourier transform algorithm to obtain incremental sample frequency domain data of the incremental malware samples, and update the incremental sample frequency domain data to the malware sample frequency domain database.

[0102] In a specific application scenario, the simulation module 301 is configured to place the to-be-detected software in a preset detection environment for running, and in the detection environment, move a first preset number of pixel points every first time interval using a pointer component and input a second preset number of random characters every second time interval to complete continuous simulation of user behaviors.

[0103] In a specific application scenario, the encoding module 302 is configured to acquire a plurality of interface functions called by the to-be-detected software during running, construct the interface call sequence using the plurality of interface functions, query a corresponding encoding symbol of each of the interface functions in a preset gene encoding rule based on the time sequence gene encoding technology to obtain a plurality of encoding symbols corresponding to the plurality of interface functions, arrange the plurality of encoding symbols into a sequence, and take the arranged sequence as a software gene sequence of the to-be-detected software.

[0104] In a specific application scenario, the acquisition module 303 is configured to calculate a sequence similarity between the software gene sequence and each sample gene sequence included in the malware gene library using a dynamic programming algorithm and a sliding window algorithm to obtain a plurality of sequence similarities, and compare the plurality of sequence similarities with a preset sequence similarity threshold to complete matching of the software gene sequence and the malware gene library.

[0105] In a specific application scenario, the acquisition module 303 is configured to construct a sliding window by using the dynamic programming algorithm; for each sample gene sequence, the sliding window is placed at the starting position of the software gene sequence and the sample gene sequence; the number of matching characters between the software gene sequence and the sample gene sequence is counted in the current sliding window, and the gene fragment similarity of the current position of the sliding window is calculated by using the number of matching characters; the sliding window is moved on the software gene sequence and the sample gene sequence according to a preset sliding distance, and the gene fragment similarity of the current position of the sliding window is recalculated until each character in the software gene sequence and the sample gene sequence is traversed, to obtain a plurality of gene fragment similarities; the maximum gene fragment similarity is extracted from the plurality of gene fragment similarities, and the maximum gene fragment similarity is taken as the sequence similarity between the software gene sequence and the currently processed sample gene sequence.

[0106] In a specific application scenario, the acquisition module 303 is further configured to determine that there is no sample gene sequence similar to the software gene sequence in the malicious software gene library when it is determined by comparison that there is no specified sequence similarity greater than the sequence similarity threshold in the plurality of sequence similarities; and determine that the software to be detected is malicious software when it is determined by comparison that there is a specified sequence similarity greater than the sequence similarity threshold in the plurality of sequence similarities.

[0107] In a specific application scenario, the acquisition module 303 is configured to determine a preset time period and a preset sampling rate, collect the processor occupancy rate and the memory occupancy rate of the software to be detected according to the preset sampling rate in the preset time period; arrange the collected plurality of processor occupancy rates into a processor occupancy time domain signal, and arrange the collected plurality of memory occupancy rates into a memory occupancy time domain signal; perform windowing processing on the processor occupancy time domain signal and the memory occupancy time domain signal by using a Hann window function, and convert the windowed processor time domain signal and the windowed memory occupancy time domain signal by using a Fourier transform algorithm, and take the converted processor time domain signal and the converted memory occupancy time domain signal as software frequency domain data of the software to be detected.

[0108] In a specific application scenario, the matching module 304 is configured to calculate the frequency domain similarity between the software frequency domain data and each sample frequency domain data to obtain a plurality of frequency domain similarities, the frequency domain similarity including a memory amplitude spectrum similarity, a memory coherence similarity, a processor amplitude spectrum similarity, and a processor coherence similarity; compare the plurality of frequency domain similarities with a preset frequency domain similarity threshold to complete the matching of the software frequency domain data and the malicious sample frequency domain database.

[0109] In a specific application scenario, the matching module 304 is configured to, for each of the sample frequency domain data, extract a sample memory occupation time domain signal and a sample processor occupation time domain signal from the sample frequency domain data, and extract a memory occupation time domain signal and a processor occupation time domain signal from the software frequency domain data; calculate the sample memory occupation time domain signal and the memory occupation time domain signal by using an amplitude difference index formula to obtain a memory amplitude spectrum similarity, and calculate the sample processor occupation time domain signal and the processor occupation time domain signal by using the amplitude difference index formula to obtain a processor amplitude spectrum similarity; calculate a memory occupation cross power spectrum density based on the sample memory occupation time domain signal and the memory occupation time domain signal, and calculate a processor occupation cross power spectrum density based on the sample processor occupation time domain signal and the processor occupation time domain signal; obtain a memory occupation self-power spectrum density and a processor occupation self-power spectrum density of the software to be detected, calculate the memory occupation cross power spectrum density and the memory occupation self-power spectrum density by using a coherence similarity formula to obtain a memory coherence similarity, and calculate the processor cross power spectrum density and the processor self-power spectrum density by using the coherence similarity formula to obtain a processor coherence similarity; and take the memory amplitude spectrum similarity, the memory coherence similarity, the processor amplitude spectrum similarity, and the processor coherence similarity as the frequency domain similarity between the software frequency domain data and the sample frequency domain data currently processed.

[0110] In a specific application scenario, the matching module 304 is configured to, when it is determined by comparison that each of the specified frequency domain similarities included in the plurality of frequency domain similarities is greater than the frequency domain similarity threshold, determine that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, and determine that the software to be detected is non-malicious software; and when it is determined by comparison that there is no specified frequency domain similarity included in the plurality of frequency domain similarities that is greater than the frequency domain similarity threshold, determine that there is no sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, and determine that the software to be detected is non-malicious software.

[0111] The device provided by the embodiment of the application runs the software to be detected, continuously simulates user behaviors in the process of running the software to be detected, collects the interface calling sequence of the software to be detected in the running process, encodes and processes the interface calling sequence based on the time sequence gene coding technology, obtains the software gene sequence of the software to be detected, matches the software gene sequence with the sample gene sequence included in the pre-constructed malicious software gene library, obtains the software frequency domain data of the software to be detected in the case that it is determined that there is no sample gene sequence similar to the software gene sequence in the malicious software gene library, matches the software frequency domain data with the sample frequency domain data included in the pre-constructed malicious sample frequency domain database, determines that the software to be detected is malicious software in the case that it is determined that there is sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, combines the gene coding technology and the frequency domain data analysis method to detect whether the software is malicious software, uses the high efficiency of the gene coding technology and the mechanism similar to the DAN matching to more easily and quickly identify the essential characteristics of the malicious software, and further analyzes the dynamic characteristics of the software to be detected through the frequency domain data analysis, so that the malicious software that escapes detection by shell can also be accurately detected, the detection efficiency and accuracy are improved while real-time and efficient detection is realized, the effectiveness and reliability are good, and the information security requirements that are increasingly complex and changeable can be met.

[0112] It should be noted that other corresponding descriptions of the functions of the malicious software detection device provided by the embodiment of the application can be referred to the corresponding descriptions in Figure 1 and Figure 2A to Figure 2B , which will not be described here.

[0113] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the application are all information and data authorized by the user or authorized by all parties.

[0114] The above embodiments and each technical feature in the embodiments can be combined with each other, and to make the description simple, not all possible combinations of the technical features in the above embodiments are described, however, as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the description.

[0115] The above-described embodiments only express several implementation manners of the application, the description is more specific and detailed, but it should not be understood as a limitation on the patent scope of the application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the application, a number of modifications and improvements can be made, which are within the protection scope of the application. Therefore, the protection scope of the application should be subject to the appended claims.

[0116] In the example embodiment, referring to Figure 4 A computer device is also provided, which comprises a bus, a processor, a memory and a communication interface, and can further comprise an input / output interface and a display device, wherein the respective functional units can communicate with each other through the bus. The memory stores a computer program, and the processor is configured to execute the program stored in the memory to implement the malware detection method in the above embodiment.

[0117] A computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the malware detection method.

[0118] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be implemented by hardware, or by means of software and a necessary general hardware platform. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.), and includes several instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in various embodiments of the present application.

[0119] Those skilled in the art can understand that the accompanying drawings are only schematic of a preferred embodiment, and the modules or processes in the drawings are not necessarily required for implementing the present application.

[0120] Those skilled in the art can understand that the modules in the device in the embodiment can be distributed in the device in the embodiment as described in the embodiment, or can be changed and located in one or more devices different from the embodiment. The modules in the above embodiment can be combined as one module, or can be further split into multiple sub-modules.

[0121] The above application number is only for description, and does not represent the advantages and disadvantages of the embodiment.

[0122] The above disclosure is only some specific embodiments of the present application, but the present application is not limited thereto, and any changes that can be thought of by those skilled in the art should fall within the protection scope of the present application.

Claims

1. A method for detecting malicious software, characterized in that, include: Run the software to be tested, and continuously simulate user behavior during the running of the software; The interface call sequence of the software under test during operation is collected, and the interface call sequence is encoded based on time-series gene coding technology to obtain the software gene sequence of the software under test. The software gene sequence is matched with sample gene sequences included in a pre-constructed malware gene library. If the matching determines that there is no sample gene sequence in the malware gene library that is similar to the software gene sequence, the software frequency domain data of the software to be detected is obtained. The software frequency domain data is matched with sample frequency domain data included in a pre-built malicious sample frequency domain database. If the matching determines that there are sample frequency domain data in the malicious sample frequency domain database that are similar to the software frequency domain data, the software to be detected is determined to be malicious software.

2. The method according to claim 1, characterized in that, Before collecting the interface call sequences of the software under test during its operation and encoding the interface call sequences based on time-series gene coding technology to obtain the software gene sequence of the software under test, the method further includes: A malware sample library was built using multiple collected malware samples; Obtain the sample interface call sequence corresponding to each of the malware samples, encode the sample interface call sequence corresponding to each of the malware samples based on the time-series gene encoding technology to obtain the sample gene sequence of each of the malware samples, and construct the malware gene library using the multiple sample gene sequences corresponding to the multiple malware samples; The sample time-domain signal of each malware sample is obtained, and the sample time-domain signal of each malware sample is transformed by the Fourier transform algorithm to obtain the sample frequency-domain data of each malware sample. The malware sample frequency-domain database is constructed using the multiple sample frequency-domain data corresponding to the multiple malware samples. The sample time-domain signal is used to describe the processor utilization rate sequence and memory utilization rate sequence of the corresponding malware sample within a preset time period.

3. The method according to claim 2, characterized in that, The method further includes: Periodically acquire incremental malware samples and use a first-in-first-out algorithm to update the malware sample library with the incremental malware samples; Obtain the incremental sample interface call sequence corresponding to the incremental malware sample, encode the incremental sample interface call sequence based on the time-series gene encoding technology to obtain the incremental sample gene sequence of the incremental malware sample, and update the incremental sample gene sequence to the malware gene library. The incremental sample time-domain signal of the incremental malware sample is obtained, and the incremental sample time-domain signal of the incremental malware sample is transformed by the Fourier transform algorithm to obtain the incremental sample frequency-domain data of the incremental malware sample, and the incremental sample frequency-domain data is updated to the malware sample frequency-domain database.

4. The method according to claim 1, characterized in that, The process of continuously simulating user behavior during the operation of the software under test includes: The software to be tested is placed in a preset testing environment and run; In the detection environment, the pointer component is controlled to move a first preset number of pixels every first time interval, and a second preset number of random characters are input every second time interval to complete the continuous simulation of user behavior.

5. The method according to claim 1, characterized in that, The process involves collecting the interface call sequences of the software under test during its operation, encoding these sequences using time-series gene coding technology, and obtaining the software gene sequence of the software under test, including: Collect multiple interface functions called by the software under test during its operation, and construct the interface call sequence using the multiple interface functions; Based on the time-series gene coding technology, the coding symbol corresponding to each interface function is queried in the preset gene coding rules to obtain multiple coding symbols corresponding to the multiple interface functions; The multiple encoded symbols are arranged into a sequence, and the resulting sequence is used as the software gene sequence of the software to be tested.

6. The method according to claim 1, characterized in that, The step of matching the software gene sequence with sample gene sequences included in a pre-constructed malware gene library includes: Using dynamic programming and sliding window algorithms, the sequence similarity between the software gene sequence and each sample gene sequence included in the malware gene library is calculated to obtain multiple sequence similarities; The multiple sequence similarities are compared with a preset sequence similarity threshold to complete the matching of the software gene sequence with the malware gene library.

7. The method according to claim 6, characterized in that, The step of calculating the sequence similarity between the software gene sequence and each sample gene sequence included in the malware gene library using dynamic programming and sliding window algorithms includes: Using the dynamic programming algorithm, a sliding window is constructed; For each of the sample gene sequences, the sliding window is placed at the beginning of the software gene sequence and the sample gene sequence; Within the current sliding window, the number of matching characters between the software gene sequence and the sample gene sequence is counted, and the gene fragment similarity of the sliding window at the current position is calculated using the number of matching characters; According to a preset sliding distance, the sliding window is controlled to move on the software gene sequence and the sample gene sequence, and the gene fragment similarity of the sliding window at the current position is recalculated until every character in the software gene sequence and the sample gene sequence is traversed to obtain multiple gene fragment similarities; The maximum gene fragment similarity is extracted from the multiple gene fragment similarities, and the maximum gene fragment similarity is used as the sequence similarity between the software gene sequence and the currently processed sample gene sequence.

8. The method according to claim 6, characterized in that, The method further includes: When the comparison determines that there is no specified sequence similarity greater than the sequence similarity threshold among the plurality of sequence similarities, it is determined that there is no sample gene sequence in the malware gene library that is similar to the software gene sequence; When comparison determines that there is a specified sequence similarity greater than the sequence similarity threshold among the plurality of sequence similarities, the software to be detected is determined to be malicious software.

9. The method according to claim 1, characterized in that, The acquisition of the software frequency domain data of the software to be detected includes: A preset time period and a preset sampling rate are determined, and the processor usage rate and memory usage rate of the software to be tested are collected within the preset time period according to the preset sampling rate; The collected processor utilization rates are organized into processor utilization time-domain signals, and the collected memory utilization rates are organized into memory utilization time-domain signals. The processor time-domain signal and the memory time-domain signal are windowed using the Hanning window function, and the windowed processor time-domain signal and the memory time-domain signal are converted using the Fourier transform algorithm. The converted processor time-domain signal and the memory time-domain signal are used as the software frequency domain data of the software to be tested.

10. The method according to claim 1, characterized in that, The step of matching the software frequency domain data with the sample frequency domain data included in the pre-built malicious sample frequency domain database includes: Calculate the frequency domain similarity between the software frequency domain data and each of the sample frequency domain data to obtain multiple frequency domain similarities, including memory amplitude spectrum similarity, memory coherence similarity, processor amplitude spectrum similarity, and processor coherence similarity; The multiple frequency domain similarities are compared with a preset frequency domain similarity threshold to complete the matching of the software frequency domain data with the malicious sample frequency domain database.

11. The method according to claim 10, characterized in that, The calculation of the frequency domain similarity between the software frequency domain data and each sample frequency domain data includes: For each of the sample frequency domain data, extract the sample memory usage time domain signal and the sample processor usage time domain signal from the sample frequency domain data, and extract the memory usage time domain signal and the processor usage time domain signal from the software frequency domain data; The amplitude spectrum similarity is obtained by calculating the sample memory occupancy time-domain signal and the memory occupancy time-domain signal using the amplitude difference index formula, and the processor amplitude spectrum similarity is obtained by calculating the sample processor occupancy time-domain signal and the processor occupancy time-domain signal using the amplitude difference index formula. Based on the sample memory usage time-domain signal and the memory usage time-domain signal, calculate the memory usage cross-power spectral density; and based on the sample processor usage time-domain signal and the processor usage time-domain signal, calculate the processor usage cross-power spectral density. The memory occupancy power spectral density and processor occupancy power spectral density of the software to be detected are obtained. The memory occupancy cross power spectral density and the memory occupancy power spectral density are calculated using the coherence similarity formula to obtain the memory coherence similarity. The processor cross power spectral density and the processor power spectral density are calculated using the coherence similarity formula to obtain the processor coherence similarity. The memory amplitude spectrum similarity, the memory coherence similarity, the processor amplitude spectrum similarity, and the processor coherence similarity are used as the frequency domain similarity between the software frequency domain data and the currently processed sample frequency domain data.

12. The method according to claim 10, characterized in that, The step of comparing the multiple frequency domain similarities with a preset frequency domain similarity threshold to complete the matching of the software frequency domain data with the malicious sample frequency domain database includes: When the comparison determines that there is a specified frequency domain similarity among the multiple frequency domain similarities where each of the included similarities is greater than the frequency domain similarity threshold, it is determined that there is sample frequency domain data in the malicious sample frequency domain database that is similar to the software frequency domain data, and it is determined that the software to be detected is non-malicious software; When the comparison determines that there is no specified frequency domain similarity among the multiple frequency domain similarities where each of the included similarities is greater than the frequency domain similarity threshold, it is determined that there is no sample frequency domain data similar to the software frequency domain data in the malicious sample frequency domain database, and the software to be detected is determined to be non-malicious.

13. A malware detection device, characterized in that, include: The simulation module is used to run the software under test and continuously simulate user behavior during the operation of the software under test. The encoding module is used to collect the interface call sequence of the software under test during operation, and encode the interface call sequence based on time-series gene encoding technology to obtain the software gene sequence of the software under test. The acquisition module is used to match the software gene sequence with the sample gene sequences included in a pre-constructed malware gene library. If the matching determines that there is no sample gene sequence in the malware gene library that is similar to the software gene sequence, the software frequency domain data of the software to be detected is acquired. The matching module is used to match the software frequency domain data with sample frequency domain data included in a pre-built malicious sample frequency domain database. If the matching determines that there are sample frequency domain data in the malicious sample frequency domain database that are similar to the software frequency domain data, the software to be detected is determined to be malicious software.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 12.

15. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 12.

Images