Unicode confusion command attack detection system and method based on dual-granularity feature coupling model
By combining a dual-granularity feature coupling model and a random forest classifier, the problem of detecting Unicode spacing modifier character obfuscation attacks is solved, achieving accurate identification and efficient classification of malicious commands.
Patent Information
- Application Number
- CN202511328403.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-17
- Publication Date
- 2025-12-12
AI Technical Summary
Existing technologies are unable to effectively identify and detect Unicode spacing modifier character obfuscation attacks, causing traditional detection methods to fail and making it impossible to accurately distinguish between normal and malicious commands.
A detection system based on a dual-granularity feature coupling model is adopted. Through data preprocessing, character-level obfuscation feature extraction, word-level semantic feature extraction, and dual-granularity feature coupling, a hybrid feature vector is formed, which is then combined with a random forest classifier to determine malicious commands.
It achieves accurate identification of Unicode spacing modifier character obfuscation attacks, improves detection accuracy and noise resistance, and adapts to scenarios with small sample sizes and high-dimensional features.
Smart Images
Figure CN121125251A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the technical field of network security, and particularly relates to a Unicode obfuscated command attack detection system and method based on a double-granularity feature coupling model. BACKGROUND
[0002] With the increasing prevalence of advanced persistent threat (APT) attacks and the continuous evolution of attack techniques, malicious exploitation of operating system command lines has become a key entry point and main threat carrier for such attacks. APT attackers usually have sufficient resources and patience, and can deeply study the security protection mechanisms of target systems (including detection methods based on signatures, rules and behavior analysis), and develop highly customized evasion techniques. In this context, by carefully planting and obfuscating malicious instructions or scripts in the command line, remote command execution, privilege escalation, persistent residence and data theft, etc. have become one of the core tactics of APT organizations. In order to effectively bypass existing security detection, attackers widely use various obfuscation techniques to disguise malicious commands. Common traditional obfuscation methods include: string replacement, case obfuscation, dynamic splicing and Base64 encoding, etc. For traditional obfuscation techniques, there are currently various detection methods:
[0003] 1. Pattern matching based on rule engine: direct matching and identification by predefining specific string patterns, regular expressions or logical rules of malicious commands.
[0004] 2. Statistical feature-based machine learning: extract statistical features such as command length, parameter number, entropy value, sensitive API call frequency, etc. from command line samples, train classification models (such as SVM, decision tree, random forest) to distinguish normal and malicious commands.
[0005] 3. Deep learning-based semantic understanding: use deep learning models (such as CNN, RNN, Transformer) with strong feature extraction and sequence modeling capabilities to learn the context semantics, structural patterns and behavior logic of commands and parameters, which can effectively identify highly obfuscated, encoded and encrypted malicious commands.
[0006] However, the emergence of Unicode spacing modifier character obfuscation attacks breaks the existing detection logic - attackers replace key characters (such as replacing the letter a in the registry operation command reg add HKLM\Software\DDE add with modifier , forming a syntactically legal but binary code abnormal , resulting in the failure of existing detection methods. Pattern matching methods cannot dynamically adapt to unpredefined variant forms; machine learning methods are not sensitive to character-level micro-disturbances such as single-character Unicode replacement; although deep learning methods have strong modeling capabilities for context semantics, their Tokenizer is usually based on character or subword units, which will treat Unicode space modifier characters as independent special characters or rare symbols, thus breaking the combination relationship with adjacent characters and destroying the semantic coherence of the original command. Therefore, existing solutions are difficult to cope with Unicode space modifier-induced cross-layer failure due to the lack of coordination between character-level encoding anomaly detection and anti-confusion semantic modeling. SUMMARY
[0007] The problem to be solved by the present application is the accurate identification of obfuscated malicious commands, and a Unicode obfuscated command attack detection system and method based on a dual-granularity feature coupling model are proposed.
[0008] To achieve the above-mentioned purpose, the present application realizes the following technical scheme:
[0009] A Unicode obfuscated command attack detection system based on a dual-granularity feature coupling model, comprising a data preprocessing module, a standardization module, a character-level obfuscated feature extraction module, a word-level semantic feature extraction module, a dual-granularity feature coupling module, and a malicious command determination module.
[0010] The data preprocessing module, the standardization module, the character-level obfuscated feature extraction module, the word-level semantic feature extraction module, the dual-granularity feature coupling module, and the malicious command determination module are connected in sequence.
[0011] The data preprocessing module is used to clean the command line data and perform command line text normalization operations.
[0012] The standardization module is used to replace specific patterns with general placeholders and perform tokenization operations.
[0013] The character-level obfuscated feature extraction module is used to extract character-level features of command keywords.
[0014] The word-level semantic feature extraction module is used to extract word-level features of command names, key parameters, and their logical relationships.
[0015] The dual-granularity feature coupling module is used to fuse character-level feature vectors and word-level semantic feature vectors to form a hybrid feature vector.
[0016] The malicious command determination module is used to input the hybrid feature vector into a pre-trained random forest classifier, and the random forest classifier outputs a binary classification result based on the hybrid feature vector.
[0017] The application discloses a Unicode obfuscated command attack detection method based on a dual-granularity feature coupling model.
[0018] S1. A data preprocessing module performs command line data preprocessing operation on an operating system command line to obtain standard format command line data;
[0019] S2. A standardization module uses a regular expression to match the standard format command line data obtained in step S1, replaces the same syntax mode with a general placeholder, and obtains a token sequence after word segmentation according to spaces;
[0020] S3. A character-level obfuscated feature extraction module extracts the decimal Unicode code point sequence of a command keyword in the token sequence after word segmentation obtained in step S2 to obtain a character-level feature vector;
[0021] S4. A word-level semantic feature extraction module extracts a command name, a key parameter and a logical relationship thereof in the token sequence after word segmentation obtained in step S2 to generate a word-level feature vector;
[0022] S5. A dual-granularity feature coupling module fuses the character-level feature vector obtained in step S3 and the word-level feature vector obtained in step S4 to form a hybrid feature vector;
[0023] S6. An evil command determination module inputs the hybrid feature vector obtained in step S5 into a pre-trained random forest classifier to output a binary classification result.
[0024] Further, the command line data preprocessing operation in step S1 includes quotation mark repair, space and separator standardization processing and path processing, and the specific implementation method comprises the following steps.
[0025] S1.1. Quotation mark repair: interference quotation marks at non-parameter boundaries are located and deleted through a pre-defined regular expression mode; the number of double quotation marks in the operating system command line is subjected to odd-even check, and if the statistical result is odd, a double quotation mark is automatically completed at the end to realize symmetric closure of the quotation marks; and repeated quotation marks appearing continuously are compressed into a single quotation mark;
[0026] S1.2. Space and separator standardization processing: a plurality of spaces appearing continuously in the operating system command line after the processing in step S1.1 are compressed into a single space through regular replacement; a situation that a separator is missing between an alphabetic numeral character and a quotation mark is identified, and a space is inserted at the corresponding position to ensure that the alphabetic numeral character and the quotation mark are clearly separated;
[0027] S1.3. Path processing: performing slash normalization processing on the operating system command line processed in step S1.2, compressing multiple backslashes appearing continuously into a single backslash; then performing escape symbol restoration processing, converting the escape symbol into the corresponding normal character, to obtain the standard format command line data.
[0028] Further, the method for matching the standard format command line data obtained in step S1 in step S2 is that for the IP address parameter, marking the IP address as <ip>; for file path parameters, by regular generalization path markers as <path>; for URL parameters, compress to <url>Tags; digital parameters are reserved to avoid key behavior semantics loss.
[0029] Further, the specific implementation method of step S3 includes the following steps:
[0030] S3.1. In the word-level semantic feature extraction module, two types of word tables are preset, including a predefined operation word library and a predefined command option library. The semantic words in the predefined operation word library include registry entry addition add, configuration saving save, entry deletion delete, and configuration loading load. The predefined command option library includes / s silent, / urlcache URL cache, / split split, / renew refresh, / create create, / change change, and / quiet quiet. The words in the two types of word tables are captured through a regular expression engine, and then the regular expression is used to capture the root key identifier to obtain the positioned key words;
[0031] S3.2. Decimal code point conversion: the positioned key words obtained in step S3.1 are converted into character-level feature sequences, and Unicode code point conversion is performed on operation types, key options, and root key identifiers respectively to generate decimal sequences of characters, including operation type sequences, key option sequences, and root key identifier sequences. The conversion process preserves Unicode spacing modifier character confusion features, and returns an empty sequence for null values;
[0032] S3.3. Generate character-level feature vector: concatenate the operation type sequence, the key option sequence, and the root key identifier sequence in sequence for the character-level feature sequence obtained in step S3.2. When the total length of the sequence exceeds 44, the sequence is retained for the first 44 code points. When the total length is less than 44, the sequence is filled with zeros at the end. A fixed-dimension digital sequence is obtained as a character-level feature vector.
[0033] Further, the specific implementation method of step S4 is to locate the core semantic units in the token sequence after tokenization, extract the command name, extract the registry path last item name and the key value name after / v parameter for the registry type command, and construct the global one-hot encoding space of the command name, the last item name, and the key value name. Generate a word-level feature vector.
[0034] Further, the expression of the fusion process of step S5 is:
[0035]
[0036] wherein, represents the character-level feature vector; represents the word-level feature vector; represents a vector concatenation operation; is a hybrid feature vector.
[0037] Further, the specific implementation method of step S6 includes the following steps:
[0038] S6.1. Pre-training random forest classifier: combine the mixed feature vector with the corresponding label into a training sample set, train a random forest classifier based on the training sample set, the random forest classifier is composed of multiple decision trees, each decision tree makes decisions independently based on different feature subsets of the mixed feature vector, when inputting a sample to be classified , each decision tree outputs a classification result , wherein represents the th decision tree, and . The final output result of the random forest classifier is obtained by aggregating the results of all decision trees, and the calculation formula is as follows:
[0039]
[0040] wherein, represents the majority vote operation, is the number of decision trees in the forest;
[0041] S6.2. Input the mixed feature vector obtained in step S5 into the pre-trained random forest classifier obtained in step S6.1, and output a binary classification result, wherein output 0 is benign data and output 1 is malicious data.
[0042] The beneficial effects of the present application are:
[0043] The Unicode obfuscated command attack detection system based on the double-granularity feature coupling model, which is the first to target the Unicode spacing modifier character obfuscation attack scene, accurately captures the Unicode spacing modifier character through character-level obfuscation feature modeling. The present application solves the problem of failure of existing technology to detect Unicode spacing modifier character obfuscation by fusing the mixed feature vector formed by the character-level obfuscation feature and the word-level semantic feature. The present application realizes double-granularity feature coupling by fusing the mixed feature vector formed by the character-level obfuscation feature and the word-level semantic feature, the character-level obfuscation feature modeling technology effectively solves the problem of insensitivity to Unicode spacing modifier character obfuscation, and the word-level semantic feature makes up for the defect of losing context semantics of pure character model, and the two complement each other. The present application uses a random forest classifier to process the mixed feature vector, fully utilizes the advantages of ensemble learning and feature selection mechanism, enhances the anti-noise ability of the model while ensuring the real-time of classification, and is especially suitable for small sample high-dimensional feature scene. BRIEF DESCRIPTION OF DRAWINGS
[0044] Figure 1 A structure schematic diagram of a Unicode obfuscated command attack detection system based on a dual-granularity feature coupling model according to the present application;
[0045] Figure 2 A flowchart of a Unicode obfuscated command attack detection method based on a dual-granularity feature coupling model according to the present application;
[0046] Figure 3 A structure framework diagram of a Unicode obfuscated command attack detection method based on a dual-granularity feature coupling model according to the present application. DETAILED DESCRIPTION
[0047] In order to make the objects, technical solutions, and advantages of the present application clearer, the present application is further described in detail below in combination with the drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application, that is, the specific embodiments described are only a part of the embodiments of the present application, but not all the specific embodiments. The components of the specific embodiments of the present application described and shown in the drawings herein can be arranged and designed in various different configurations, and the present application can also have other embodiments.
[0048] Therefore, the detailed description of the specific embodiments of the present application provided below in the drawings is not intended to limit the scope of the claimed present application, but only represents selected specific embodiments of the present application. Based on the specific embodiments of the present application, all other specific embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0049] In order to further understand the inventive content, characteristics, and effects of the present application, the following specific embodiments are exemplified, and the drawings are combined Figure 1 -Appendix Figure 3 The detailed description is as follows:
[0050] Example 1:
[0051] A Unicode obfuscated command attack detection system based on a dual-granularity feature coupling model comprises a data preprocessing module, a standardization module, a character-level obfuscated feature extraction module, a word-level semantic feature extraction module, a dual-granularity feature coupling module, and a malicious command determination module.
[0052] The data preprocessing module, the standardization module, the character-level obfuscated feature extraction module, the word-level semantic feature extraction module, the dual-granularity feature coupling module, and the malicious command determination module are connected in sequence.
[0053] The data preprocessing module is used to clean the command line data and perform command line text normalization operation.
[0054] The standardization module is used to replace specific patterns with general placeholders and perform word segmentation operations;
[0055] The character-level confusion feature extraction module is used to extract character-level features of command keywords;
[0056] The word-level semantic feature extraction module is used to extract word-level features of command names, key parameters, and their logical relationships;
[0057] The dual-granularity feature coupling module is used to fuse character-level feature vectors and word-level semantic feature vectors to form hybrid feature vectors;
[0058] The malicious command judgment module is used to input the hybrid feature vector into a pre-trained random forest classifier, and the random forest classifier outputs a binary classification result based on the hybrid feature vector.
[0059] Embodiment 2:
[0060] A Unicode obfuscated command attack detection method based on a dual-granularity feature coupling model, relying on the Unicode obfuscated command attack detection system based on a dual-granularity feature coupling model described in Embodiment 1, includes the following steps:
[0061] S1. The data preprocessing module performs command line data preprocessing operations on the operating system command line to obtain standardized format command line data;
[0062] Further, the command line data preprocessing operation of step S1 includes quote repair, space and separator normalization processing, and path processing, and the specific implementation method includes the following steps:
[0063] S1.1. Quote repair: locate and delete interfering quotes at non-parameter boundaries through predefined regular expression patterns; perform odd-even check on the number of double quotes in the operating system command line, and if the result is odd, automatically complete a double quote at the end to achieve symmetric closure of the quotes; compress repeated quotes that appear consecutively into a single quote;
[0064] Further, through the regular expression r'([^=\s\"\'])[\"\']([^=\s\"\'])', the reg "addHKLM is repaired to reg add HKLM;
[0065] S1.2. Space and separator normalization processing: compress multiple spaces appearing consecutively in the operating system command line processed in step S1.1 into a single space through regular replacement; identify cases where separators are missing between alphanumeric characters and quotes, and insert spaces at the corresponding positions to ensure clear separation between alphanumeric characters and quotes;
[0066] Further, the continuous redundant spaces are compressed by re.sub(r'\s{2,}','', cmd); the separating spaces are inserted between the alphanumeric and the quotation mark by regular expressions r'([a-zA-Z0-9])(["\'])' and r'(["\'])([a-zA-Z0-9])', for example, reg "hklm" → reg "hklm";
[0067] S1.3. Path processing: performing the slash normalization processing on the operating system command line processed in step S1.2, compressing the multiple backslashes appearing continuously into a single backslash; then performing the escape symbol restoration processing, converting the escape symbol into the corresponding normal character, to obtain the standardized format command line data;
[0068] Further, the continuous redundant backslashes are compressed into a single backslash by re.sub(r'\\+', r'\\', cmd), for example, C:\\\\Windows\\\\System32 is normalized to C:\\Windows\\System32;
[0069] S2. The standardized module uses the regular expression to match the standardized format command line data obtained in step S1, replaces the same syntax pattern with a general placeholder, and obtains the token sequence after tokenization according to the space;
[0070] Further, the method for matching the standardized format command line data obtained in step S1 in step S2 is that for the IP address parameter, the IP address is marked as <ip>; for file path parameters, by regular generalization path markers as <path>; for URL parameters, compress to <url>Tags; numeric parameters are preserved to avoid loss of key behavioral semantics.
[0071] Further, for IP address parameters (such as 192.168.1.1 or 10.0.0.1), the re.sub(r'\b(?:\d{1,3}\.){3}\d{1,3}\b', ' <ip>', cmd) to uniformly mark IP addresses as <ip>; For file path parameters (such as C:\Windows\System32\cmd.exe);
[0072] By regular Generalize paths to <path>form;
[0073] re.sub(r'https?: / / \S+', 'http: / / www.example.com / loader', url) # replace with example.com <url>', cmd) is compressed as <url>Tags; digital parameters (such as port number 8080 or retry number 3) are retained to avoid loss of key behavior semantics.
[0074] The structured semantic generalization replacement is performed on the command line by a predefined regular rule, a regular expression is used to accurately match parameters with a unified syntax pattern but variable content, and the parameters are replaced by standardized semantic tags to eliminate non-essential differences, thereby significantly improving the generalization ability of the detection model.
[0075] S3. The character-level confusion feature extraction module extracts the decimal Unicode code point sequence of the command keywords in the token sequence obtained in step S2, to obtain a character-level feature vector.
[0076] Further, the specific implementation method of step S3 includes the following steps:
[0077] S3.1. In the word-level semantic feature extraction module, two types of word tables are preset, including a predefined operation word library and a predefined command option library. The semantic words in the predefined operation word library include add (registry item addition), save (configuration saving), delete (item deletion), and load (configuration loading). The predefined command option library includes / s (silent), / urlcache (URL cache), / split (split), / renew (refresh), / create (create), / change (change), and / quiet (quiet). Regular expression engines are used to capture the words in the two types of word tables, and regular expressions are used to capture the root key identifiers to obtain the positioned keywords.
[0078] Further, two types of word tables are preset in the command line character-level feature extraction module: one is a predefined operation word library for identifying operation verbs with high-risk semantics, and the other is a predefined command option library for identifying options highly related to important behavior semantics. The predefined operation word library includes but is not limited to add (registry item addition), save (configuration saving), delete (item deletion), load (configuration loading), and other high-risk semantic words. Examples of the predefined command option library include / s, / urlcache, / split, / renew, / create, / change, and / quiet, which are closely related to remote enumeration, cache operation, split / rewrite, and silent execution behavior semantics. Regular expression engines are used to capture the words in the above word libraries. For command inputs determined to be of the registry type, based on the context grammar characteristics unique to the registry path, structured regular expression rules are used to further capture the root key identifiers.
[0079] Further, the bidirectional scanning algorithm is used for forward matching command verbs and backward verifying parameter structures; regular expressions (HKLM | HKCU | HKCR | HKU) are used to capture root key identifiers;
[0080] S3.2. Decoding point conversion: converting the positioned keywords obtained in step S3.1 into a character-level feature sequence, performing Unicode code point conversion on operation types, key options, and root key identifiers respectively, generating decimal sequences of characters, including operation type sequences, key option sequences, and root key identifier sequences, and the conversion process preserves Unicode spacing modifier character confusion features, and returns an empty sequence for null values;
[0081] For example: Different from add→[97, 100, 100];
[0082] S3.3. Generating a character-level feature vector: concatenating the operation type sequence, the key option sequence, and the root key identifier sequence in sequence for the character-level feature sequence obtained in step S3.2, setting the total length of the sequence to more than 44, and retaining the first 44 code points of the sequence, and filling the end of the sequence with zeros when the total length is less than 44, to obtain a fixed-dimension numerical sequence as a character-level feature vector.
[0083] Further, the operation type sequence and the root key identifier sequence are concatenated in sequence to ensure that the operation type occupies the core position at the front of the vector;
[0084] S4. The word-level semantic feature extraction module extracts the command name, key parameters, and their logical relationships in the token sequence obtained in step S2 to generate a word-level feature vector;
[0085] Further, the specific implementation method of step S4 is to locate the core semantic units in the token sequence after tokenization, extract the command name, extract the last item name of the registry path and the key value name after the / v parameter for registry type commands, construct a global one-hot encoding space for the command name, the last item name, and the key value name, and generate a word-level feature vector.
[0086] Further, taking the registry command as an example, first locate the core semantic units in the registry command, accurately extract the last item name of the registry path (such as Run in \Windows\Run) and the key value name after the / v parameter (such as tpid in / v tpid), and construct a global one-hot encoding space for the last item name and the key value name.
[0087] S5. The dual-granularity feature coupling module fuses the character-level feature vector obtained in step S3 and the word-level feature vector obtained in step S4 to form a hybrid feature vector;
[0088] Furthermore, the expression for the fusion process in step S5 is as follows:
[0089]
[0090] in, Represents character-level feature vectors; Represents word-level feature vectors; This represents a vector concatenation operation; It is a mixed feature vector.
[0091] S6. The malicious command determination module inputs the mixed feature vector obtained in step S5 into the pre-trained random forest classifier and outputs the binary classification result.
[0092] Furthermore, the specific implementation method of step S6 includes the following steps:
[0093] S6.1. Pre-trained Random Forest Classifier: The mixed feature vector and its corresponding label are combined into a training sample set. A random forest classifier is trained based on the training sample set. The random forest classifier consists of multiple decision trees, and each decision tree makes independent decisions based on different feature subsets of the mixed feature vector. When an input sample to be classified is provided... At that time, each decision tree outputs a classification result. ,in Indicates the first A decision tree, and The final output of the random forest classifier is obtained by aggregating the results of all decision trees, and its calculation formula is as follows:
[0094]
[0095] in, This indicates the majority vote operation. The number of decision trees in the forest;
[0096] S6.2. Input the mixed feature vector obtained in step S5 into the pre-trained random forest classifier obtained in step S6.1, and output the binary classification result, where output 0 is benign data and output 1 is malicious data.
[0097] Experimental analysis was conducted on the method proposed in this invention:
[0098] The malicious data of the application mainly comes from the attack techniques based on system tools disclosed in the MITRE ATT&CK framework. The command samples cover multiple attack scenarios such as authority maintenance, credential acquisition, persistence, defense avoidance, information collection and horizontal movement. Compared with the conventional tools in the system directory, the registry command has a more complex syntax structure and higher operation sensitivity, and its parameters are often directly related to system configuration, authority control and security policy, so it is more frequent and dangerous in the attacker's command line utilization. For the registry command, the application sorts out all the technical items related to the registry operation in the MITRE ATT&CK framework, and generates the original registry operation data representing malicious behavior by performing the corresponding add and save operations. In the confusion process, the operation type, option and parameter value of the command line are replaced according to the pre-defined interval modifier mapping rule. The interval modifier mapping rule is shown in Table 1.
[0099] Table 1:
[0100]
[0101] Let the target keyword be denoted as , where represents the character length of the keyword, is the character, and satisfies . For each character position in the target keyword, define the corresponding character option set . If the character does not exist in the pre-defined interval modifier mapping rule table , then , that is, the original character is retained at this position; if the character exists in the interval modifier mapping rule table , then , where represents the mapping modifier form of the character . All character option sets defined in the above manner can construct the Cartesian product , which is represented as:
[0102]
[0103] Each -tuple in the Cartesian product represents a combination of selecting a specific character from each character position, and by performing a sequential concatenation operation on the elements in the tuple, a keyword confusion string variant Finally, by systematically enumerating all combinations in the above Cartesian product, a complete set of obfuscated string variants is formed, i.e.,
[0104]
[0105] where the total size of the variant set satisfies:
[0106]
[0107] The algorithm finally outputs a complete set of all possible obfuscated string variants of the target keyword .
[0108] The benign data of the application mainly comes from the safe operation of the regular program and the registry command in the Windows system directory. Among them, the system directory part covers the built-in tools in the System32 and SysWOW64 directories, and these programs are widely called in system management and network configuration scenarios, and their regular calling mode can be directly used as benign samples. For registry type commands, the add (registry item addition) and save (configuration saving) operations with security semantics are limited to collect, covering HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER two common root keys, while excluding delete, query and other operations that may introduce attack features. In order to enhance the robustness of the detection model, the benign samples are uniformly subjected to the same obfuscation method as the malicious samples after collection.
[0109] The final data set contains 22347 command lines, covering benign and malicious categories, and is specially designed for Windows command line scenarios. The registry commands in it have structural vulnerability, and minor character variation will cause functional abnormalities, and malicious registry commands often lead to persistent attacks.
[0110] In order to objectively evaluate the performance of the method proposed in the application, the application evaluates the Unicode obfuscated command attack detection method based on the dual-granularity feature coupling model according to the classification accuracy. The accuracy is the proportion of the number of correctly predicted samples to the total number of samples, and it is often used to evaluate the performance of classification tasks. The formula is as follows:
[0111]
[0112] Among them, represents the number of correctly identified malicious commands (correct classification of positive examples), represents the number of correctly identified benign commands (correct classification of negative examples), represents; the number of benign commands misjudged as malicious (false positives), represents the number of malicious commands misjudged as benign (false negatives)
[0113] The present application carries out experiments according to the steps described in the specific implementation method, and the test results obtained are shown in Table 2, and the method is represented as DGCD-UOC, and the measurement of the results is the accuracy (%);
[0114] Table 2:
[0115]
[0116] The working principle of the present application is to clean up the command line data, perform command line text normalization operation, and obtain standardized format command line data. Regular expressions are used to match and replace specific patterns with general placeholders, and token sequences are obtained after tokenization according to spaces. The command keywords are located, and the decimal Unicode code point sequence of the command keywords is extracted as the character-level feature. The command name, key parameters and their logical relationship are extracted to generate a semantic feature vector as the word-level feature. The character-level feature vector and the word-level semantic feature vector are fused to form a hybrid feature vector. The data set is divided into a training set and a test set, the hybrid feature vector and the corresponding label are combined into a training sample set, and a machine learning model is trained based on the training sample set. The trained model can determine all input command lines, and the classifier outputs a binary classification result based on the hybrid feature vector.
[0117] Compared with general obfuscated malicious command detection, the present application is the first to target Unicode spacing modifier character obfuscation attack scenarios, and accurately captures Unicode spacing modifier characters through character-level obfuscation feature modeling. The present application couples double-granularity features by fusing character-level obfuscation features and word-level semantic features to form a hybrid feature vector, solving the problem of failure of existing technology to detect Unicode spacing modifier characters. The effect of the present application in obfuscated malicious command detection is better than that of traditional methods.
[0118] It should be noted that the relational terms, such as "first" and "second", and the like, are used solely to distinguish one entity or action from another entity or action, without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without more limitations, an element defined by the phrase "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.
[0119] Although the present application has been described with reference to the specific embodiments thereof, it should be understood by those skilled in the art that various changes can be made and equivalents can be substituted for elements thereof without departing from the scope of the present application. In particular, various features and aspects of the present application can be used individually or in any combination depending on the specific application and implementation. Therefore, it is expressly intended that the specific embodiments of the present application both as set forth and including any equivalents thereof should not limit the present application or scope of the claims herein, but rather the overall scope of pertaining solely to the methods and the articles of manufacture specifically recited in the following claims.< / url> < / url> < / path> < / ip> < / ip> < / url> < / path> < / ip> < / url> < / path> < / ip>
Claims
1. A Unicode obfuscation command attack detection system based on a dual-granularity feature coupling model, characterized in that, It includes a data preprocessing module, a standardization module, a character-level obfuscation feature extraction module, a word-level semantic feature extraction module, a dual-granularity feature coupling module, and a malicious command detection module; The data preprocessing module, standardization module, character-level obfuscation feature extraction module, word-level semantic feature extraction module, dual-granularity feature coupling module, and malicious command determination module are connected in sequence; The data preprocessing module is used to clean the command line data and perform command line text normalization operations. The standardization module is used to replace specific patterns with general placeholders and perform word segmentation. The character-level obfuscation feature extraction module is used to extract character-level features of command keywords; The word-level semantic feature extraction module is used to extract word-level features of command names, key parameters, and their logical relationships; The dual-granularity feature coupling module is used to fuse character-level feature vectors and word-level semantic feature vectors to form a hybrid feature vector. The malicious command determination module is used to input the mixed feature vector into a pre-trained random forest classifier, and the random forest classifier outputs a binary classification result based on the mixed feature vector.
2. A method for detecting Unicode obfuscation command attacks based on a dual-granularity feature coupling model, implemented using the Unicode obfuscation command attack detection system based on a dual-granularity feature coupling model as described in claim 1, characterized in that... Includes the following steps: S1. The data preprocessing module performs command-line data preprocessing operations on the operating system command line to obtain command-line data in a standardized format; S2. The standardization module uses regular expressions to match the standardized command line data obtained in step S1, replaces the same syntax patterns with common placeholders, and segments the data by spaces to obtain the token sequence after segmentation. S3. The character-level obfuscation feature extraction module extracts the decimal Unicode code point sequence of the command keywords in the token sequence after word segmentation obtained in step S2, and obtains the character-level feature vector; S4. The word-level semantic feature extraction module extracts the command name, key parameters and their logical relationships from the token sequence after word segmentation obtained in step S2, and generates word-level feature vectors; S5. The dual-granularity feature coupling module fuses the character-level feature vector obtained in step S3 with the word-level feature vector obtained in step S4 to form a hybrid feature vector; S6. The malicious command determination module inputs the mixed feature vector obtained in step S5 into the pre-trained random forest classifier and outputs the binary classification result.
3. The Unicode obfuscation command attack detection method based on a dual-granularity feature coupling model according to claim 2, characterized in that, Step S1, the command-line data preprocessing operations, include quotation mark repair, space and delimiter normalization, and path processing. The specific implementation method includes the following steps: S1.
1. Quotation Mark Repair: Locates and deletes interfering quotation marks at non-parameter boundaries using predefined regular expression patterns; performs parity checks on the number of double quotation marks in the operating system command line, and automatically adds a double quotation mark at the end if the result is odd to achieve symmetrical quotation mark closure; compresses consecutively occurring duplicate quotation marks into a single quotation mark. S1.
2. Space and delimiter normalization: Multiple consecutive spaces in the operating system command line after step S1.1 are compressed into a single space using regular expression replacement; missing delimiters between alphanumeric characters and quotation marks are identified, and spaces are inserted at the corresponding positions to ensure clear separation between alphanumeric characters and quotation marks; S1.
3. Path processing: Perform forward slash normalization processing on the operating system command line after step S1.2, compressing multiple consecutive backslashes into a single backslash; then restore the escape characters, converting them into their corresponding ordinary characters to obtain the standardized command line data.
4. The Unicode obfuscation command attack detection method based on a dual-granularity feature coupling model according to claim 3, characterized in that, In step S2, the method for matching the standardized command-line data obtained in step S1 is as follows: for the IP address parameter, mark the IP address as... <ip>For the file path parameter, the path is generalized using regular expressions as follows: <path>For URL parameters, compress them into... <url> Label;< / url> < / path> < / ip> Numeric parameters are preserved to avoid loss of semantics for critical behaviors.
5. The Unicode obfuscation command attack detection method based on a dual-granularity feature coupling model according to claim 4, characterized in that, The specific implementation method of step S3 includes the following steps: S3.
1. In the word-level semantic feature extraction module, two types of word lists are preset, including a predefined operation word list and a predefined command option word list. The semantic words in the predefined operation word list include add for registry entries, save for configuration, delete for entries, and load for configuration. The predefined command option word list includes / s (silent), / urlcache (URL cache), / split (split), / renew (refresh), / create (create), / change (change), and / quiet (silent). The words in the two word lists are captured by the regular expression engine, and then the root key identifier is captured by the regular expression to obtain the located keywords. S3.
2. Decimal code point conversion: Convert the located keywords obtained in step S3.1 into character-level feature sequences. Perform Unicode code point conversion on the operation type, key option, and root key identifier respectively to generate a decimal sequence of characters, including the operation type sequence, key option sequence, and root key identifier sequence. The conversion process preserves the Unicode spacing modification character obfuscation features and returns an empty sequence for empty values. S3.
3. Generate character-level feature vector: For the character-level feature sequence obtained in step S3.2, concatenate the operation type sequence, key option sequence, and root key identifier sequence in sequence. If the total length of the sequence exceeds 44, retain the first 44 code points. If the total length is less than 44, pad the end of the sequence with zeros to obtain a fixed-dimensional numeric sequence as the character-level feature vector.
6. The Unicode obfuscation command attack detection method based on a dual-granularity feature coupling model according to claim 5, characterized in that, The specific implementation method of step S4 is to locate the core semantic unit in the token sequence after word segmentation, extract the command name, extract the last-level item name of the registry path and the key value name after the / v parameter for registry type commands, construct a global one-hot encoding space for command name, last-level item name and key value name, and generate word-level feature vector.
7. The Unicode obfuscation command attack detection method based on a dual-granularity feature coupling model according to claim 6, characterized in that, The expression for the fusion process in step S5 is: in, Represents character-level feature vectors; Represents word-level feature vectors; This represents a vector concatenation operation; It is a mixed feature vector.
8. The method for detecting Unicode obfuscation command attacks based on a dual-granularity feature coupling model according to claim 7, characterized in that, The specific implementation method of step S6 includes the following steps: S6.
1. Pre-trained Random Forest Classifier: The mixed feature vector and its corresponding label are combined into a training sample set. A random forest classifier is trained based on the training sample set. The random forest classifier consists of multiple decision trees, and each decision tree makes independent decisions based on different feature subsets of the mixed feature vector. When an input sample to be classified is provided... At that time, each decision tree outputs a classification result. ,in Indicates the first A decision tree, and The final output of the random forest classifier is obtained by aggregating the results of all decision trees, and its calculation formula is as follows: in, This indicates the majority vote operation. The number of decision trees in the forest; S6.
2. Input the mixed feature vector obtained in step S5 into the pre-trained random forest classifier obtained in step S6.1, and output the binary classification result, where output 0 is benign data and output 1 is malicious data.