Malicious code detection method and system based on generative artificial intelligence

Abstract

The embodiment of the specification discloses a malicious code detection method and system based on generative artificial intelligence. The malicious code detection method comprises the following steps: obtaining code data to be detected; determining suspicious code from the code data; accessing a pre-trained generative AI large model, which is used to convert the suspicious code into readable plaintext code; accessing a malicious code recognition model trained by malicious code and non-malicious code, which is used to detect the malicious code of the readable plaintext code to obtain first detection data corresponding to the readable plaintext code; performing sandbox environment simulation detection on the readable plaintext code to obtain second detection data corresponding to the readable plaintext code; and obtaining malicious code detection data corresponding to the suspicious code according to the first detection data and the second detection data. The embodiment of the specification effectively improves the malicious code detection accuracy.

Description

Technical Field

[0001] This specification relates to the field of cybersecurity technology, specifically to methods and systems for detecting malicious code based on generative artificial intelligence. Background Technology

[0002] With the rapid development of information technology, cybersecurity threats are intensifying. Malicious attackers inject malicious JavaScript code into web pages, such as cross-site scripting attacks and phishing scams, to execute malicious behaviors using users' browsers, posing serious security risks to individuals and businesses. As attack methods become more diverse and covert, malicious code on web pages is becoming increasingly difficult for traditional security systems to identify and defend against in a timely manner, posing a continuous threat to user privacy and cybersecurity.

[0003] Current mainstream malware detection methods include static feature matching and machine learning. Static feature matching preprocesses potentially malicious text on web pages and then uses configured regular expressions or dictionaries to search the text; a successful match indicates malicious code. However, this method cannot detect malware that has undergone complex processing. Machine learning, on the other hand, directly applies machine learning to suspicious code, learning its features without fully understanding the code itself. This results in low detection accuracy and a large number of false negatives and false negatives. Therefore, there is an urgent need for a malware detection method based on generative artificial intelligence that can improve detection accuracy. Summary of the Invention

[0004] This specification provides a method and system for detecting malicious code based on generative artificial intelligence, the technical solution of which is as follows:

[0005] In a first aspect, embodiments of this specification provide a malicious code detection method based on generative artificial intelligence, comprising: acquiring code data to be detected; identifying suspicious code from the code data, wherein the suspicious code is a code fragment that meets at least one characteristic: encrypted code, encoded code, or code formed by string concatenation; accessing a pre-trained generative AI large model, wherein the generative AI large model is used to convert the suspicious code into readable plaintext code; accessing a malicious code recognition model trained from malicious code and non-malicious code, wherein the malicious code recognition model is used to detect malicious code on the readable plaintext code, thereby obtaining first detection data corresponding to the readable plaintext code; performing sandbox environment simulation detection on the readable plaintext code, thereby obtaining second detection data corresponding to the readable plaintext code; and obtaining malicious code detection data corresponding to the suspicious code based on the first detection data and the second detection data.

[0006] Secondly, embodiments of this specification provide a malicious code detection system based on generative artificial intelligence, comprising: a data acquisition module for acquiring code data to be detected; a code acquisition module for identifying suspicious code from the code data, wherein the suspicious code is a code fragment that meets at least one characteristic: encrypted code, encoded code, or code formed by string concatenation; a code conversion module for connecting to a pre-trained generative AI large model, wherein the generative AI large model is used to convert the suspicious code into readable plaintext code; a first detection module for connecting to a malicious code recognition model trained from malicious code and non-malicious code, wherein the malicious code recognition model is used to perform malicious code detection on the readable plaintext code to obtain first detection data corresponding to the readable plaintext code; a second detection module for performing sandbox environment simulation detection on the readable plaintext code to obtain second detection data corresponding to the readable plaintext code; and a judgment module for obtaining malicious code detection data corresponding to the suspicious code based on the first detection data and the second detection data.

[0007] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0008] The embodiments of this specification can detect suspicious code that has undergone complex processing such as encryption, encoding, or string concatenation. Furthermore, a generative AI model can be used to convert the suspicious code into readable plaintext code. A pre-trained malware detection model is then used to detect malware in the readable plaintext code, yielding first detection data. The embodiments of this specification can also perform sandbox environment simulation detection on the readable plaintext code to obtain second detection data. Finally, based on the first and second detection data, a comprehensive analysis is conducted to derive malware detection data corresponding to the suspicious code, thereby enhancing the malware identification rate and detection accuracy. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is one of the application scenario diagrams of a malicious code detection method based on generative artificial intelligence provided in this manual.

[0011] Figure 2 This is the second application scenario diagram of a malicious code detection method based on generative artificial intelligence provided in this manual.

[0012] Figure 3This is a flowchart illustrating a malicious code detection method based on generative artificial intelligence provided in this manual.

[0013] Figure 4 This is a flowchart illustrating the process of converting suspicious code into readable plaintext code, as provided in this manual.

[0014] Figure 5 This is a flowchart illustrating the process for determining malicious code detection data provided in this manual.

[0015] Figure 6 This is a schematic diagram of the structure of a malicious code detection system based on generative artificial intelligence, as provided in this specification.

[0016] Figure 7 This is a schematic diagram of the structure of an electronic device provided in this specification. Detailed Implementation

[0017] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings.

[0018] The terms "first," "second," etc., in the description, claims, and accompanying drawings are used to distinguish different objects and not to describe a particular order. Furthermore, the term "comprising" and any variations thereof are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0019] The malicious code detection method based on generative artificial intelligence provided in several embodiments of this specification can be implemented by the malicious code detection system based on generative artificial intelligence provided in the embodiments of this invention.

[0020] Before this specification elaborates on the malicious code detection method based on generative artificial intelligence in conjunction with one or more embodiments, it first introduces the application scenarios of this malicious code detection method based on generative artificial intelligence.

[0021] Please see Figure 1 and Figure 2 , Figure 1 and Figure 2This is a schematic diagram illustrating an application scenario of the malicious code detection method based on generative artificial intelligence provided in this embodiment of the invention. In this embodiment, the malicious code detection system 100 based on generative artificial intelligence may include a webpage malicious code detection device 110 and a potential infection terminal 120, etc. The webpage malicious code detection device 110 and the potential infection terminal 120 can be communicatively connected.

[0022] In this embodiment, the potential infection endpoint 120 refers to a device that may be compromised by hackers and have malicious code implanted, such as a server, client, cloud, or IoT device. The malicious code on the server side can be a malicious program implanted by hackers through vulnerabilities (such as SQL injection or file upload vulnerabilities) into a web server or backend system; the malicious code on the client side can be a malicious script or program running on the user's terminal (such as a browser or application); the malicious code on the cloud side can be a malicious script targeting cloud services, such as abusing cloud functions or launching container escape attacks; and the malicious code on IoT devices can be a malicious program implanted using weak passwords, firmware vulnerabilities, or unauthorized access.

[0023] In this embodiment, the webpage malicious code detection device 110 includes, but is not limited to, servers, network hardware devices, or terminal proxy modules. The webpage malicious code detection device 110 can obtain suspicious code by intercepting webpage traffic in real time (server mode) or detecting local browser behavior (terminal mode), and can also use generative AI models to detect malicious code.

[0024] In this embodiment, when the webpage malicious code detection device 110 is a server, the server can be a single server or a server cluster composed of multiple servers, with multiple servers implementing the malicious code detection method of this application. When the webpage malicious code detection device 110 is a terminal, the terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer (PC), etc. The terminal includes a central processing unit (CPU), a graphics processing unit (GPU), memory, storage devices, a network communication module, sensors, a display screen, a battery and power management module, etc.

[0025] In this embodiment, the webpage malicious code detection device 110 may include: a data acquisition module for acquiring code data to be detected; a code acquisition module for identifying suspicious code from the code data, wherein the suspicious code is a code fragment that meets at least one characteristic: encrypted code, encoded code, or code formed by string concatenation; a code conversion module for accessing a pre-trained generative AI model, wherein the generative AI model is used to convert the suspicious code into readable plaintext code; a first detection module for accessing a malicious code recognition model trained from malicious code and non-malicious code, wherein the malicious code recognition model is used to perform malicious code detection on the readable plaintext code to obtain first detection data corresponding to the readable plaintext code; a second detection module for performing sandbox environment simulation detection on the readable plaintext code to obtain second detection data corresponding to the readable plaintext code; and a judgment module for obtaining malicious code detection data corresponding to the suspicious code based on the first detection data and the second detection data.

[0026] It should be noted that, Figure 1 and Figure 2 The schematic diagram of the malicious code detection system based on generative artificial intelligence shown is merely an example. The malicious code detection system and scenario based on generative artificial intelligence described in this embodiment are for the purpose of more clearly illustrating the technical solutions of this embodiment and do not constitute a limitation on the technical solutions provided by this embodiment. As those skilled in the art will know, with the evolution of malicious code detection systems based on generative artificial intelligence and the emergence of new scenarios, the technical solutions provided by this embodiment are also applicable to similar technical problems.

[0027] Please see Figure 3 , Figure 3 This is a flowchart illustrating a malicious code detection method based on generative artificial intelligence provided in an embodiment of the present invention. This malicious code detection method based on generative artificial intelligence can be... Figure 1 The webpage malware detection device 110 shown is used for execution. The webpage malware detection device 110 can be a server, etc. This malware detection method based on generative artificial intelligence may include at least the following steps:

[0028] 200. Obtain the code data to be detected.

[0029] In this embodiment, the code data to be detected can be the code data obtained by the webpage malware detection device 110 from the potentially infected terminal 120. The code data may include page data, etc.

[0030] In some embodiments, obtaining the code data to be detected includes: requesting a specified webpage from a server through a client that supports the HTTP protocol, wherein the client supports several browsers or client programs that support the HTTP protocol; crawling the webpage corresponding to a specified target through web crawling technology, wherein the specified target includes, but is not limited to, a website, a domain name, or a subdomain; and capturing the content of HTTP requests and responses from network devices through traffic collection, and obtaining webpage data in the HTTP protocol.

[0031] 210. Identify suspicious code from code data. Suspicious code is a code fragment that meets at least one of the following characteristics: encrypted code, encoded code, or code formed by string concatenation.

[0032] In this embodiment, malicious code refers to programs or code fragments used to damage, steal data, or illegally control systems. Suspicious code can be data that may be identified as malicious code. Encrypted code can be XOR, AES encrypted code, etc.; encoded code can be Base64 encoded or Unicode encoded code, etc.

[0033] In some embodiments, the characteristics of suspicious code may also include at least: code loaded in segments, code executed using an interpreter, fileless code residing in memory, and anti-debugging or anti-virtual machine code.

[0034] In this embodiment, the code loaded in segments can be code stored in blocks (such as scattered in the registry, multiple files, or network requests). The segmented code is decrypted or assembled into complete modules as needed during runtime. Code executed using an interpreter can be dynamically generated scripts that rely on the system's built-in interpreter (such as PowerShell or Python). Fileless code residing in memory can be directly injected into legitimate processes (such as explorer.exe) or loaded into memory via reflection. Anti-debugging or anti-virtual machine code can be code that detects and checks debugging environments such as debuggers, virtual machines, or sandboxes, and executes malicious logic only after confirming security. This embodiment can detect suspicious code that has undergone complex processing such as encryption, encoding, or string concatenation, improving the identification rate of malicious code.

[0035] In some embodiments, after identifying suspicious code from the code data, the method further includes preprocessing the suspicious code. The preprocessing includes: removing irrelevant data from the suspicious code, where irrelevant data includes at least advertising code, comments, and whitespace characters; completing the code statements corresponding to the suspicious code; and merging the segmented loading code corresponding to the suspicious code.

[0036] 220. Access a pre-trained generative AI large model, which is used to convert suspicious code into readable plaintext code.

[0037] In some embodiments, please refer to Figure 4 , Figure 4 This is a flowchart illustrating the process of converting suspicious code into readable plaintext code, as provided in an embodiment of the present invention. A pre-trained generative AI model is used to convert suspicious code into readable plaintext code, including:

[0038] 300. The suspicious code is parsed using a syntax parser, and an abstract syntax tree corresponding to the suspicious code is generated;

[0039] 310. Traverse the abstract syntax tree to determine the scope, reference relationships, and value passing paths of variables, and establish a symbol table;

[0040] 320. Identify data dependencies and control dependencies in suspicious code based on the symbol table;

[0041] 330. Determine the value propagation path between variables based on data dependencies, identify value dependency logic across statements, and obtain data dependency analysis results;

[0042] 340. Based on the control dependency relationship, mark the statement execution conditions, establish the branch jump constraint relationship, and obtain the control dependency analysis results;

[0043] 350. Suspicious intermediate code representation based on the logical consistency between data dependency analysis results and control dependency analysis results;

[0044] 360. Based on a generative AI model, semantic reconstruction is performed on the intermediate representation of suspicious code, and the readable plaintext code corresponding to the suspicious code is output.

[0045] In this embodiment, the abstract syntax tree (API) can be a tree-structured representation of the code. Each node of the API corresponds to a syntax element in the suspected code. Syntax elements can include at least variable declarations, function calls, or loop statements. The symbol table can be a data table composed of variable names, scopes, reference relationships, and value passing paths. Scope can be the effective range of a variable, such as global scope, function scope, or block scope. Reference relationships can be the definition and usage locations of variables. Value passing paths can be the paths through which the values ​​of variables are passed or modified; for example, if x is initially 10 and is subsequently updated to 20, the path of value change is recorded.

[0046] In this embodiment, the value propagation chain between variables is determined based on data dependencies, and the value dependency logic across statements is identified to obtain data dependency analysis results. This can include: tracing back the source of variable assignment to establish a data flow graph from the variable usage location to the definition location; if the variable's value depends on conditional branches or loop operations, it is marked as a dynamic data dependency; for data dependencies across function calls, correlation analysis is performed through the mapping relationship between function parameters and return values; and uninitialized or redundant variables are identified by combining the value change paths in the symbol table.

[0047] In this embodiment, the control dependency analysis results are obtained by marking the execution conditions of the statements according to the control dependency relationship, establishing the constraint relationship of branch jump, and obtaining the control dependency analysis results. This may include: extracting the control conditions of conditional statements, loop statements, and jump statements; performing dominance relationship analysis on the basic blocks in the control flow graph to determine the constraint logic of the execution path; if a statement is executed only when a certain condition is met, it is marked as a strong control dependency; and reconstructing the original task semantics based on the control dependency relationship for the obfuscated multi-branch logic.

[0048] In this embodiment, after performing logical consistency verification based on the data dependency analysis results and control dependency analysis results, the system further generates an intermediate representation of suspicious code. Specifically, this embodiment can analyze how variables are defined, used, and transmitted through data dependency analysis, such as whether sensitive data flows to dangerous functions; it can analyze the logical dependencies of code execution paths through control dependency analysis, such as whether a certain piece of code is triggered only under specific conditions; then, this embodiment cross-checks the logical consistency of the data dependency analysis results and control dependency analysis results, finding that they both point to the same suspicious behavior; finally, this embodiment can further determine the logically consistent intermediate representation of suspicious code, that is, convert the code into a standardized abstract structure (such as a control flow graph, SSA form, etc.) and mark the risk points within it.

[0049] In this embodiment, the intermediate representation of suspicious code can be an intermediate form that marks potentially malicious or abnormal logic after the suspicious code has been abstracted and structured. That is, dangerous patterns in the code are identified through program analysis techniques (such as data flow and control flow analysis) and presented in a standardized intermediate language (IR) form for easy automated detection.

[0050] In this embodiment, the generative AI large-scale model is a deep learning model trained on large-scale data. The generative AI large-scale model used in this embodiment can be a large-scale model product operated by a third party, such as Deepseek, ChatGPT, Wenxin Yiyan, Tongyi Qianwen, etc., or it can be a self-trained large-scale model, such as a model trained based on Llama3, etc.

[0051] 230. Access a malicious code recognition model trained from malicious code and non-malicious code. The malicious code recognition model is used to detect malicious code in readable plaintext code and obtain the first detection data corresponding to the readable plaintext code.

[0052] In this embodiment, the first detection data can be the result of determining that the readable plaintext code is malicious code, or the result of determining that the readable plaintext code is not malicious code.

[0053] In some embodiments, before accessing the malicious code recognition model trained from malicious code and non-malicious code, the process includes: obtaining a code sample library, which includes a malicious code dataset and a non-malicious code dataset; and training the malicious code recognition model based on the malicious code dataset and the non-malicious code dataset to obtain a trained malicious code recognition model.

[0054] In this embodiment, the malicious code identification model can be a classification model such as SVM or random forest, or a deep learning model trained on large-scale data, such as a large model based on the Transformer architecture.

[0055] 240. Perform sandbox environment simulation testing on the readable plaintext code to obtain the second test data corresponding to the readable plaintext code.

[0056] In this embodiment, the second detection data can be the result of determining that the readable plaintext code is malicious code, or the result of determining that the readable plaintext code is not malicious code.

[0057] In some embodiments, the sandbox environment is an independent operating environment separated from the host system resources based on hardware virtualization or operating system-level isolation; performing sandbox environment simulation detection on readable plaintext code to obtain second detection data corresponding to the readable plaintext code includes: injecting readable plaintext code into the sandbox environment, executing the readable plaintext code in the sandbox environment, detecting the running behavior of the readable plaintext code in the sandbox environment, and obtaining second detection data corresponding to the readable plaintext code.

[0058] In some embodiments, detecting the runtime behavior of readable plaintext code in a sandbox environment includes: detecting sensitive operations of the readable plaintext code in the sandbox environment, including but not limited to accessing the DOM, reading and writing local storage, or listening to user input events; detecting network activities of the readable plaintext code in the sandbox environment, including but not limited to initiating cross-domain HTTP requests, WebSocket connections, or dynamically loading external resources; and detecting the probing behavior of the readable plaintext code in the sandbox environment that actively probes the runtime environment, including but not limited to querying developer tools, virtual machines, or sandbox features.

[0059] 250. Based on the first detection data and the second detection data, obtain the malicious code detection data corresponding to the suspicious code.

[0060] In some embodiments, please refer to Figure 5 , Figure 5 This is a flowchart illustrating the process of determining malicious code detection data provided in an embodiment of the present invention. The malicious code detection data corresponding to the suspicious code is obtained based on the first detection data and the second detection data, including:

[0061] 400. When the first detection data and the second detection data are consistent, the malicious code detection data corresponding to the suspicious code is: the first detection data or the second detection data;

[0062] 410. When the first detection data and the second detection data are inconsistent, the malicious code detection data corresponding to the suspicious code is: the suspicious code is malicious code;

[0063] 420. Feed back the malicious code detection data corresponding to the suspicious code to the malicious code identification model in order to optimize the malicious code identification model.

[0064] In this embodiment, the generative AI model can semantically reconstruct the intermediate representation of suspicious code, outputting readable plaintext code corresponding to the suspicious code. Then, a trained malware detection model can be used to detect malware in the readable plaintext code, obtaining the first detection data corresponding to the readable plaintext code. Next, this embodiment injects the readable plaintext code into a sandbox environment, obtaining the second detection data corresponding to the readable plaintext code. This embodiment improves the malware detection rate by performing secondary detection on the readable plaintext code through the malware detection model and the sandbox environment. Furthermore, when the first detection data and the second detection data are inconsistent, it indicates that the malware has been identified by the malware detection model or the sandbox environment, and the suspicious code can be determined to be malware. The malware detection data corresponding to the suspicious code is further fed back to the malware detection model to optimize the malware detection model, thereby improving the malware detection accuracy.

[0065] The embodiments of this specification can detect suspicious code that has undergone complex processing such as encryption, encoding, or string concatenation. Furthermore, a generative AI model can be used to convert the suspicious code into readable plaintext code. A pre-trained malware detection model is then used to detect malware in the readable plaintext code, yielding first detection data. The embodiments of this specification can also perform sandbox environment simulation detection on the readable plaintext code to obtain second detection data. Finally, based on the first and second detection data, a comprehensive analysis is conducted to derive malware detection data corresponding to the suspicious code, thereby enhancing the malware identification rate and detection accuracy.

[0066] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0067] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a malicious code detection system based on generative artificial intelligence, provided as an embodiment of this specification.

[0068] like Figure 6 As shown, the malicious code detection system based on generative artificial intelligence may include at least a data acquisition module 500, a code acquisition module 510, a code conversion module 520, a first detection module 530, a second detection module 540, and a judgment module 550, wherein:

[0069] The data acquisition module 500 is used to acquire the code data to be detected.

[0070] The code acquisition module 510 is used to identify suspicious code from code data. Suspicious code is a code fragment that meets at least one of the following characteristics: encrypted code, encoded code, or code formed by string concatenation.

[0071] The code conversion module 520 is used to connect to a pre-trained generative AI model, which is used to convert suspicious code into readable plaintext code.

[0072] The first detection module 530 is used to access a malicious code recognition model trained from malicious code and non-malicious code. The malicious code recognition model is used to detect malicious code in readable plaintext code and obtain the first detection data corresponding to the readable plaintext code.

[0073] The second detection module 540 is used to perform sandbox environment simulation detection on readable plaintext code to obtain the second detection data corresponding to the readable plaintext code;

[0074] The judgment module 550 is used to obtain malicious code detection data corresponding to the suspicious code based on the first detection data and the second detection data.

[0075] In some embodiments, the code data includes page data. The data acquisition module 500 includes a data acquisition submodule, which is used to: request a specified webpage from the server through a client that supports the HTTP protocol, wherein the client supports several browsers or client programs that support the HTTP protocol; crawl the webpage corresponding to the specified target through web crawling technology, wherein the specified target includes but is not limited to websites, domain names, and subdomains; and capture the content of HTTP requests and responses from network devices through traffic collection, and obtain webpage data in the HTTP protocol.

[0076] In some embodiments, the characteristics of the suspicious code also include at least the following: code loaded in segments, code executed using an interpreter, fileless code residing in memory, and anti-debugging or anti-virtual machine code.

[0077] In some embodiments, the malicious code detection system may further include a preprocessing module, which is used to: remove irrelevant data from suspicious code, the irrelevant data including at least advertising code, comments, and whitespace characters; complete the code statements corresponding to the suspicious code; and merge the segmented loading code corresponding to the suspicious code.

[0078] In some embodiments, the code conversion module 520 includes a conversion submodule, which is used to: parse the suspicious code using a syntax parser and generate an abstract syntax tree corresponding to the suspicious code, where each node of the abstract syntax tree corresponds to a syntax element in the suspicious code, and the syntax element includes at least variable declarations, function calls, or loop statements; traverse the abstract syntax tree to determine the scope, reference relationships, and value passing paths of variables, and establish a symbol table; identify data dependencies and control dependencies in the suspicious code based on the symbol table; determine the value propagation links between variables based on data dependencies and identify cross-statement value dependency logic to obtain data dependency analysis results; mark statement execution conditions based on control dependencies, establish branch jump constraints, and obtain control dependency analysis results; obtain an intermediate representation of the suspicious code that is logically consistent with the data dependency analysis results and control dependency analysis results; and perform semantic reconstruction on the intermediate representation of the suspicious code based on a generative AI model to output readable plaintext code corresponding to the suspicious code.

[0079] In some embodiments, the malicious code detection system may further include a training module, which is used for:

[0080] Obtain a code sample library, which includes malicious code datasets and non-malicious code datasets; train a malicious code recognition model based on the malicious code datasets and non-malicious code datasets to obtain a trained malicious code recognition model.

[0081] In some embodiments, the sandbox environment is an independent operating environment separated from the host system resources based on hardware virtualization or operating system-level isolation; the second detection module 540 includes a second detection submodule, which is used to: inject readable plaintext code into the sandbox environment, execute the readable plaintext code in the sandbox environment, detect the running behavior of the readable plaintext code in the sandbox environment, and obtain the second detection data corresponding to the readable plaintext code.

[0082] In some embodiments, the second detection submodule includes a behavior detection module, which is used to: detect sensitive operations of readable plaintext code in a sandbox environment, including but not limited to accessing the DOM, reading and writing local storage, or listening to user input events; detect network activities of readable plaintext code in a sandbox environment, including but not limited to initiating cross-domain HTTP requests, WebSocket connections, or dynamically loading external resources; and detect probing behaviors of readable plaintext code in a sandbox environment that actively probe the runtime environment, including but not limited to querying developer tools, virtual machines, or sandbox features.

[0083] In some embodiments, the determination module 550 includes a determination submodule, which is configured to: when the first detection data is consistent with the second detection data, the malicious code detection data corresponding to the suspicious code is: the first detection data or the second detection data; when the first detection data is inconsistent with the second detection data, the malicious code detection data corresponding to the suspicious code is: the suspicious code is malicious code; and feed the malicious code detection data corresponding to the suspicious code back to the malicious code recognition model to optimize the malicious code recognition model.

[0084] Based on the generative artificial intelligence-based malicious code detection system described in several embodiments of this specification, it is understood that these embodiments can detect suspicious code that has undergone complex processing such as encryption, encoding, or string concatenation. Furthermore, they can convert suspicious code into readable plaintext code using a generative AI model, and then further detect malicious code on the readable plaintext code based on a pre-trained malicious code recognition model, obtaining first detection data corresponding to the readable plaintext code. These embodiments can also perform sandbox environment simulation detection on the readable plaintext code to obtain second detection data corresponding to the readable plaintext code. Finally, based on a comprehensive analysis of the first and second detection data, malicious code detection data corresponding to the suspicious code is derived, thereby enhancing the malicious code identification rate and detection accuracy.

[0085] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiment of the malicious code detection system based on generative artificial intelligence is relatively simple in description because it is fundamentally similar to the embodiment of the malicious code detection method based on generative artificial intelligence; relevant parts can be referred to the description of the method embodiment.

[0086] Please see Figure 7 The diagram shown is a structural schematic of an electronic device based on a start-up control device provided in an embodiment of this specification.

[0087] like Figure 7 As shown, the electronic device 600 may include at least one processor 610, at least one network interface 640, a user interface 630, a memory 650, and at least one communication bus 620.

[0088] The communication bus 620 can be used to realize the connection and communication of the above components.

[0089] The user interface 630 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0090] The network interface 640 may include, but is not limited to, Bluetooth modules, NFC modules, ZigBee modules, and UWB modules.

[0091] The processor 610 may include one or more processing cores. The processor 610 connects to various parts within the electronic device 600 using various interfaces and lines. It performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 650, and by calling data stored in the memory 650. Optionally, the processor 610 may be implemented using at least one hardware form selected from DSP, FPGA, and PLA. The processor 610 may integrate one or more combinations of CPU and GPU. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display on the screen.

[0092] The memory 650 may include RAM or ROM. Optionally, the memory 650 may include a non-transitory computer-readable medium. The memory 650 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 650 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 650 may also be at least one storage device located remotely from the aforementioned processor 610. The memory 650, as a computer storage medium, may include an operating system, a communication module, a user interface module, and a generative artificial intelligence-based malicious code detection application. The processor 610 may be used to call the generative artificial intelligence-based malicious code detection application stored in the memory 950 regarding the malicious code detection device, and execute the steps of generative artificial intelligence-based malicious code detection mentioned in the foregoing embodiments.

[0093] This specification also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform the above-described instructions. Figures 3-5 One or more steps in the illustrated embodiment. If the constituent modules of the above-described electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium.

[0094] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this specification is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., Digital Versatile Discs (DVDs)), or semiconductor media (e.g., Solid State Disks (SSDs)).

[0095] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks. Unless otherwise specified, the technical features of this embodiment and its implementation can be combined arbitrarily.

[0096] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this application.

Claims

1. A method of malicious code detection based on generative artificial intelligence, characterized by, The method comprises the following steps: acquiring code data to be detected; determining suspicious code from the code data, the suspicious code being a code segment meeting at least one feature: encrypted code, encoded code, and code spliced by strings; accessing a pre-trained generative AI large model for converting the suspicious code into readable plaintext code; accessing a malicious code identification model trained by malicious code and non-malicious code, the model being used for malicious code detection on the readable plaintext code to obtain first detection data corresponding to the readable plaintext code; performing sandbox environment simulation detection on the readable plaintext code to obtain second detection data corresponding to the readable plaintext code; obtaining malicious code detection data corresponding to the suspicious code according to the first detection data and the second detection data; The step of accessing a pre-trained generative AI large model for converting the suspicious code into readable plaintext code comprises the following steps: parsing the suspicious code by a syntax parser to generate an abstract syntax tree corresponding to the suspicious code, each node of the abstract syntax tree corresponding to a syntax element in the suspicious code, the syntax element at least including variable declaration, function call, or loop statement; traversing the abstract syntax tree to determine the scope, reference relationship, and value transmission path of the variable, and establishing a symbol table; identifying data dependency and control dependency in the suspicious code according to the symbol table; determining the value propagation link between variables according to the data dependency, and identifying cross-statement value dependency logic to obtain data dependency analysis results; labeling statement execution conditions according to the control dependency to establish constraint relationships of branch jumps to obtain control dependency analysis results; obtaining suspicious code intermediate representation with consistent logic based on the data dependency analysis results and the control dependency analysis results; based on the generative AI model, reconstructing the semantics of the suspicious code intermediate representation, and outputting readable plaintext code corresponding to the suspicious code.

2. The generative artificial intelligence-based malicious code detection method of claim 1, wherein, The code data includes page data, and the step of acquiring code data to be detected comprises the following steps: requesting a specified web page from a server through a client supporting HTTP protocol, the client supporting several browsers or client programs supporting HTTP protocol; scraping the web page corresponding to a specified target through web crawler technology, the specified target including but not limited to website, domain name, and subdomain name; through traffic collection, capturing the content of HTTP requests and responses from network devices, and obtaining web page data in HTTP protocol.

3. The generative artificial intelligence-based malicious code detection method of claim 1, wherein, The suspicious code also meets at least one of the following features: segmented loading code, code executed by an interpreter, memory-resident fileless code, anti-debugging or anti-virtual machine code.

4. The generative artificial intelligence-based malicious code detection method of claim 1, wherein, After determining the suspicious code from the code data, the method further comprises pre-processing the suspicious code, the pre-processing comprising: removing irrelevant data in the suspicious code, the irrelevant data at least including advertising code, comments, and white space characters; completing the code statements corresponding to the suspicious code; merging the segmented loading code corresponding to the suspicious code.

5. The generative artificial intelligence-based malicious code detection method of claim 1, wherein, The access includes: Obtaining a code sample library, the code sample library including a malicious code dataset and a non-malicious code dataset; Based on the malicious code dataset and the non-malicious code dataset, training a malicious code identification model to obtain a trained malicious code identification model.

6. The generative artificial intelligence-based malicious code detection method of claim 1, wherein, The sandbox environment is an independent running environment separated from the host system resources based on hardware virtualization or operating system level isolation; the sandbox environment simulation detection of the readable plaintext code includes: Injecting the readable plaintext code into the sandbox environment, executing the readable plaintext code in the sandbox environment, detecting the running behavior of the readable plaintext code in the sandbox environment, and obtaining the second detection data corresponding to the readable plaintext code.

7. The generative artificial intelligence-based malicious code detection method of claim 6, wherein, The detection of the running behavior of the readable plaintext code in the sandbox environment includes: Detecting sensitive operations of the readable plaintext code in the sandbox environment, the sensitive operations including but not limited to accessing DOM, reading and writing local storage, or listening to user input events; Detecting network activities of the readable plaintext code in the sandbox environment, the network activities including but not limited to initiating cross-domain HTTP requests, WebSocket connections, or dynamically loading external resources; Detecting the detection behavior of the readable plaintext code in the sandbox environment, the detection behavior including but not limited to querying developer tools, virtual machines, or sandbox features.

8. The generative artificial intelligence-based malicious code detection method of claim 1, wherein, The malicious code detection data corresponding to the suspicious code is obtained according to the first detection data and the second detection data, including: When the first detection data and the second detection data are consistent, the malicious code detection data corresponding to the suspicious code is the first detection data or the second detection data; When the first detection data and the second detection data are inconsistent, the malicious code detection data corresponding to the suspicious code is that the suspicious code is malicious code; The malicious code detection data corresponding to the suspicious code is fed back to the malicious code identification model to optimize the malicious code identification model.

9. A system for malicious code detection based on generative artificial intelligence, characterized by, Including: A data acquisition module for acquiring code data to be detected; A code acquisition module for determining suspicious code from the code data, the suspicious code being a code segment meeting at least one feature: encrypted code, encoded code, or code concatenated by strings; A code conversion module for accessing a pre-trained generative AI large model, the generative AI large model being used to convert the suspicious code into readable plaintext code; A first detection module for accessing a malicious code identification model trained by malicious code and non-malicious code, the malicious code identification model being used to detect malicious code for the readable plaintext code to obtain first detection data corresponding to the readable plaintext code; A second detection module for performing sandbox environment simulation detection on the readable plaintext code to obtain second detection data corresponding to the readable plaintext code; A determination module configured to obtain malicious code detection data corresponding to the suspicious code according to the first detection data and the second detection data; The access pre-trained generative AI large model is used for converting the suspicious code into readable plaintext code, and the method comprises the following steps: The suspicious code is parsed by a syntax parser, and an abstract syntax tree corresponding to the suspicious code is generated, each node of the abstract syntax tree corresponding to a syntax element in the suspicious code, the syntax element at least including variable declaration, function call or loop statement; The abstract syntax tree is traversed to determine the scope, reference relationship and value transmission path of the variable, and a symbol table is established; According to the symbol table, the data dependency relationship and the control dependency relationship in the suspicious code are identified; According to the data dependency relationship, the value propagation link between variables is determined, and the value dependent logic across statements is identified to obtain a data dependency analysis result; According to the control dependency relationship, the statement execution condition is marked, the constraint relationship of branch jump is established, and a control dependency analysis result is obtained; Based on the data dependency analysis result and the control dependency analysis result, a suspicious code intermediate representation with consistent logic is obtained; Based on the generative AI model, the suspicious code intermediate representation is semantically reconstructed, and the readable plaintext code corresponding to the suspicious code is output.

Images