A malicious code detection method based on behavior analysis

Abstract

The present application relates to the technical field of malware detection, in particular to a malicious code detection method based on behavior analysis, comprising the following steps: monitoring system event flow and process resource occupation data, using fixed time interval sampling to capture network packet arrival time interval, CPU occupation rate fluctuation, target file lock contention state and mouse cursor pixel position, calculating mutual information entropy between different event flows, and revealing hidden associations that cannot be perceived by traditional detection methods. This method is no longer limited to analyzing the isolated behavior of a single process, but captures the weak signals generated when malicious software uses hidden channels for communication or data leakage by quantifying the statistical dependence between seemingly unrelated events.

Description

Technical Field

[0001] This invention relates to the field of malware detection technology, and in particular to a malicious code detection method based on behavior analysis. Background Technology

[0002] The field of malware detection technology refers to a comprehensive set of techniques and methods for identifying, analyzing, and handling malware in computer systems or network environments. The core objective of this field is to protect the confidentiality, integrity, and availability of information assets, and to defend against various forms of malicious code attacks, including viruses, worms, Trojans, ransomware, spyware, and backdoors.

[0003] The shortcoming of existing technologies lies in their detection logic, which often focuses on isolated analysis of single processes or events, lacking in-depth insight into the interrelationships between cross-process and cross-event flows in the global behavior of the system. For example, traditional dynamic sandbox analysis mainly monitors the API call sequence, file operations, and network connections of a single process. If a malicious behavior is split into two or more cooperating processes and transmits information through indirect communication methods such as modulating CPU load and disk I / O latency, then monitoring any single process will hardly reveal its complete malicious intent. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a malicious code detection method based on behavior analysis.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a malicious code detection method based on behavior analysis, comprising the following steps:

[0006] The system monitors event streams and process resource usage data. It uses fixed time interval sampling to capture network packet arrival intervals, CPU usage fluctuations, target file lock contention status, and mouse cursor pixel positions. It also synchronously records the target process's CPU usage, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles. Then, by setting upper and lower thresholds, the captured continuous values ​​are converted into discrete symbols. All event streams and resource usage data are integrated into a timestamp-aligned matrix to establish a multi-dimensional system behavior sequence.

[0007] Based on the multidimensional system behavior sequence, any two discrete symbol sequences are selected. By statistically analyzing the probability of occurrence of a single symbol and the co-occurrence probability of symbol pairs, the independent entropy value and joint entropy value of each sequence are calculated. Then, the mutual information entropy value between the two sequences is obtained through entropy value addition and subtraction operations, and an correlation matrix is ​​constructed. Each mutual information entropy value in the correlation matrix is ​​compared with a preset covert channel baseline threshold. Event source pairs whose values ​​exceed the threshold are filtered out to obtain a set of highly correlated event sources.

[0008] Preferably, the method further includes:

[0009] Based on the set of highly correlated event sources and the multidimensional system behavior sequence, the resource consumption time series data of the correlated process within its life cycle is extracted. The mean and peak values ​​of the sequence are calculated as the metabolic rate. The time series is transformed to the frequency domain, the dominant frequency is identified as the metabolic rhythm, the ratio of resource application and release system call counts is calculated as the metabolic efficiency, and the variance of resource consumption values ​​is calculated as the metabolic burst. The four indicators of metabolic rate, metabolic rhythm, metabolic efficiency and metabolic burst are combined into a quantitative vector to generate the program resource metabolism profile.

[0010] Based on the program resource metabolism profile, the program resource metabolism profile is compared one by one with all the profiles in the pre-set benign application baseline profile library and malicious code family profile library. By calculating the cosine similarity value between the profile vector to be tested and each profile vector in the library, the profile in the library with the highest similarity value is selected, and the predefined benign and malicious labels are assigned to the program to be tested to obtain the malicious behavior judgment label.

[0011] Preferably, the steps for obtaining the multidimensional system behavior sequence are as follows:

[0012] The system monitors event streams and process resource usage data. By hooking into system kernel functions, it captures network packet arrival time intervals, CPU usage fluctuations, target file lock contention status, and mouse cursor pixel positions. Then, it queries process performance counters to synchronously record the target process's CPU usage, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles to obtain the raw time-series data stream.

[0013] Based on the original time-series data stream, two non-overlapping numerical intervals are preset as upper and lower thresholds for each data stream. Each value in the original time-series data stream is traversed, assigned to the corresponding numerical interval, and given a preset discrete symbol to obtain a discrete symbol matrix.

[0014] Based on the discrete symbol matrix, using timestamps as unique keys, discrete symbols from different sources are aggregated on the time axis to construct a new matrix, where each row represents a point in time and each column represents the symbol state of an event stream, thus establishing a multidimensional system behavior sequence.

[0015] Preferably, the steps for obtaining the set of highly relevant event sources are as follows:

[0016] Based on the multidimensional system behavior sequence, select any two discrete symbol sequences, calculate the independent entropy by counting the occurrence times of each symbol in each sequence, and then calculate the joint entropy by counting the co-occurrence times of symbol pairs in the two sequences. Then add the two independent entropies and subtract the joint entropy to obtain the mutual information entropy value between the two sequences, and establish a mutual information entropy numerical set.

[0017] Based on the mutual information entropy value set, a symmetric matrix is ​​constructed with the event stream identifier as the index. Each mutual information entropy value is filled into the corresponding row and column cell. Then, the cell value is compared with a single preset covert channel baseline threshold one by one. The cell coordinates that exceed the threshold are recorded to generate an anomaly association index.

[0018] Based on the abnormal correlation index and the multidimensional system behavior sequence, the coordinates in the abnormal correlation index are used to directly locate the event source combination with excessive values ​​in the correlation matrix, and the event source combination is output as a set to obtain a set of highly correlated event sources.

[0019] Preferably, the step of obtaining the program resource metabolism profile is as follows:

[0020] Based on the set of highly correlated event sources and the multidimensional system behavior sequence, process identifiers are extracted from the set of highly correlated event sources. The identifiers are then used to query and match in the multidimensional system behavior sequence to filter out resource consumption data rows that completely belong to the process and establish a resource consumption sequence for the target process.

[0021] Based on the resource consumption sequence of the target process, the average and maximum values ​​of the sequence values ​​are calculated as the metabolic rate. The sequence is subjected to Fourier transform and the peak frequency is extracted as the metabolic rhythm. The number of resource request and release function calls in the system log is queried and the ratio is calculated as the metabolic efficiency. The statistical variance of the sequence values ​​is calculated as the metabolic burst degree, and a set of metabolic characteristic indicators is generated.

[0022] Preferably, the step of obtaining the program resource metabolism profile further includes:

[0023] Based on the set of metabolic characteristic indicators, the four values ​​of calculated metabolic rate, metabolic rhythm, metabolic efficiency and metabolic burst are arranged in a fixed order and concatenated into a numerical vector with a fixed dimension to generate the metabolic profile of program resources.

[0024] Preferably, the step of obtaining the malicious behavior determination identifier is as follows:

[0025] Based on the program resource metabolism profile, the program resource metabolism profile is compared one by one with all the profiles in the pre-set benign application baseline profile library and malicious code family profile library. The dot product of the profile vector to be tested and each profile vector in the library is calculated, and then divided by the product of the magnitudes of the two vectors to obtain the cosine similarity value, thus obtaining a list of similarity values.

[0026] Preferably, the step of obtaining the malicious behavior determination identifier further includes:

[0027] Based on the list of similarity values, a traversal comparison operation is performed on all cosine similarity values ​​in the list to find and lock the maximum value. Then, the benign or malicious tags associated with the maximum value and stored in the image database are extracted to obtain the malicious behavior judgment identifier.

[0028] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0029] This invention monitors multi-dimensional system event streams and process resource usage data, including network packet arrival time intervals, CPU utilization fluctuations, target file lock contention states, and mouse cursor pixel positions, and calculates the mutual information entropy between different event streams. This reveals hidden correlations that traditional detection methods cannot detect. This approach goes beyond analyzing the isolated behavior of individual processes; instead, it captures weak signals generated when malware uses covert channels for communication or data leakage by quantifying the statistical dependencies between seemingly unrelated events. This ability to analyze cross-stream correlations overcomes the difficulty of traditional methods in detecting covert communication techniques disguised as legitimate system activities. Furthermore, after discovering suspicious correlations, the resource consumption lifecycle of the related processes is extracted and analyzed in a targeted manner. By constructing a program resource metabolism profile that includes metabolic rate, rhythm, efficiency, and burstiness, a deep profile of the program's internal behavioral patterns is achieved. This judgment from a macro lifecycle perspective is more robust to advanced threats that employ time-sharing and phased execution of malicious payloads compared to detection that relies solely on instantaneous behavior. It can effectively identify malicious patterns that are difficult to trigger alerts through single-point behavior, such as I / O bursts during the encryption phase of ransomware and periodic heartbeats of backdoor programs, thereby improving the detection accuracy and recall rate of advanced persistent threats and highly stealthy malware. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0032] Please see Figure 1 This invention provides a technical solution, a malicious code detection method based on behavior analysis, comprising the following steps:

[0033] The system monitors event streams and process resource usage data. It uses fixed time interval sampling to capture network packet arrival intervals, CPU usage fluctuations, target file lock contention status, and mouse cursor pixel positions. It also synchronously records the target process's CPU usage, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles. Then, by setting upper and lower thresholds, the captured continuous values ​​are converted into discrete symbols. All event streams and resource usage data are integrated into a timestamp-aligned matrix to establish a multi-dimensional system behavior sequence.

[0034] Based on multidimensional system behavior sequences, any two discrete symbol sequences are selected. By statistically analyzing the probability of occurrence of a single symbol and the co-occurrence probability of symbol pairs, the independent entropy value and joint entropy value of each sequence are calculated. Then, the mutual information entropy value between the two sequences is obtained by entropy value addition and subtraction operations, and an correlation matrix is ​​constructed. Each mutual information entropy value in the correlation matrix is ​​compared with a preset covert channel baseline threshold. Event source pairs whose values ​​exceed the threshold are filtered out to obtain a set of highly correlated event sources.

[0035] Based on a set of highly correlated event sources and a multidimensional system behavior sequence, resource consumption time series data of correlated processes within their lifecycle are extracted. The mean and peak values ​​of this sequence are calculated as metabolic rate. The time series is then transformed to the frequency domain, and the dominant frequency is identified as metabolic rhythm. The ratio of resource request to release system call counts is calculated as metabolic efficiency. The variance of resource consumption values ​​is calculated as metabolic burst. The four indicators of metabolic rate, metabolic rhythm, metabolic efficiency, and metabolic burst are combined into a quantitative vector to generate a program resource metabolism profile.

[0036] Based on the program resource metabolism profile, the program resource metabolism profile is compared one by one with all the profiles in the pre-set benign application baseline profile library and malicious code family profile library. By calculating the cosine similarity value between the profile vector to be tested and each profile vector in the library, the profile in the library with the highest similarity value is selected, and the predefined benign and malicious labels are assigned to the program to be tested to obtain the malicious behavior judgment label.

[0037] The steps for obtaining the behavior sequence of a multidimensional system are as follows:

[0038] The system monitors event streams and process resource usage data. By hooking into system kernel functions, it captures network packet arrival time intervals, CPU usage fluctuations, target file lock contention status, and mouse cursor pixel positions. Then, it queries process performance counters to synchronously record the target process's CPU usage, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles to obtain the raw time-series data stream.

[0039] Based on the original time-series data stream, two non-overlapping numerical intervals are preset as upper and lower thresholds for each data stream. Each value in the original time-series data stream is traversed, assigned to the corresponding numerical interval, and given a preset discrete symbol to obtain the discrete symbol matrix.

[0040] Based on the discrete symbol matrix, using timestamps as unique keys, discrete symbols from different sources are aggregated on the time axis to construct a new matrix, where each row represents a point in time and each column represents the symbol state of an event stream, thus establishing a multidimensional system behavior sequence.

[0041] Specifically, monitoring system event streams and process resource usage data involves using operating system APIs or custom drivers to hook into specific system kernel functions. For example, for network packet arrivals, functions related to low-level network stack data reception, such as `ndisMIndicateReceiveNetBufferLists` or lower-level socket operation functions, can be hooked to record the packet timestamps and sources accurate to milliseconds and calculate the time interval between adjacent packet arrivals. For CPU usage fluctuations, a fixed sampling frequency, such as every 100 milliseconds, is used to query system performance information (e.g., `NtQuerySystemIn`). Formation captures continuous readings of CPU usage percentages (either global CPU load or CPU time for a specific process) to reflect fluctuations. For contention states related to target file locks, it hooks file system operation-related kernel functions such as NtCreateFile, NtOpenFile, and NtLockFile to record locking attempts, successes, failures, and lock wait times for specific target files. For mouse cursor pixel positions, it hooks user-mode message handling functions or kernel-level input event handling functions such as NtUserGetCursorPos to record screen data at the same sampling interval (e.g., 100 milliseconds). Meanwhile, for the target process, by calling process performance counter APIs, such as PdhAddCounter and PdhCollectQueryData in the Windows environment, we synchronously query and record the process's detailed CPU usage (e.g., \Process(process_name)\%ProcessorTime), private working set memory size (e.g., \Process(process_name)\PrivateBytes), total I / O read / write bytes (including the sum or separate records of \Process(process_name)\IOReadBytes / sec and \Process(process_name)\IOWriteBytes / sec), network transmit / receive rate (distinguished by \Process(process_name)\IODataBytes / sec and in combination with network-related I / O operations, or by using more specialized network interface statistical counters), and the number of kernel object handles (e.g., \Process(process_name)\HandleCount). All of these captured and queried data are accompanied by precise timestamps to ensure the accuracy of subsequent alignment analysis, forming a set of raw numerical sequences containing the changes of various indicators over time, i.e., the raw time-series data stream.

[0042] Based on the raw time-series data stream, which includes nine raw numerical sequences such as network packet arrival time interval, CPU utilization fluctuation, target file lock contention state, mouse cursor pixel position, target process CPU utilization, private working set memory, I / O read / write byte count, network transmit / receive rate, and number of kernel object handles, two non-overlapping thresholds are set for each data stream item, namely the lower threshold. and upper limit threshold This divides continuous values ​​into three discrete states, such as 'low' (S1), 'medium' (S2), and 'high' (S3). The thresholds for these states are set as follows: For each type of data stream, such as the CPU utilization of the target process, first, a large amount of data on this item from known benign programs under normal operating conditions is collected to form a baseline dataset. The mean of this baseline dataset is then calculated. and standard deviation Then the lower threshold can be set to The upper limit threshold can be set as follows: ,in and These are coefficients adjusted based on experience, for example... and Taking the CPU utilization of the target process as an example, if the average value is obtained by analyzing benign programs... and standard deviation ,but , Therefore, when CPU utilization is less than 10%, the symbol 'S1_cpu' is assigned; when CPU utilization is between 10% (inclusive) and 30% (exclusive), the symbol 'S2_cpu' is assigned; and when CPU utilization is greater than or equal to 30%, the symbol 'S3_cpu' is assigned. The network packet arrival time interval is calculated, for example, by analyzing the average value obtained from benign applications. and standard deviation ,but , If the time interval is less than 40ms, it is assigned 'S1_int'; if it is between 40ms and 80ms, it is assigned 'S2_int'; if it is greater than or equal to 80ms, it is assigned 'S3_int', and so on. The other seven data streams (CPU utilization fluctuation, target file lock contention state, mouse cursor pixel position, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles) are also assigned using this method or a domain-knowledge-based fixed percentile method (such as the 25th percentile and 75th percentile). and A threshold is defined, and a corresponding discrete symbol is defined. Then, every value at each time point in the original time-series data stream is iterated over, and its value is compared with the corresponding data stream value. and Compare, if the value is less than If the value is greater than or equal to 1, then assign the sign S1. and less than If the value is greater than or equal to , then assign the sign S2. Then, the symbol S3 is assigned, thereby converting all continuous values ​​into corresponding discrete symbols, forming a symbol matrix, where each row corresponds to a timestamp and each column corresponds to a discrete symbol of a data stream, thus obtaining the discrete symbol matrix.

[0043] Based on the discrete symbol matrix obtained in the previous step, each row of this matrix is ​​naturally associated with a timestamp, and each column represents the discrete symbol state of a specific event stream or resource usage data. To construct a multidimensional system behavior sequence, the timestamp will be used as the primary key. Specifically, all rows in the discrete symbol matrix will be checked to ensure the uniqueness of each timestamp. If there are cases where some event streams have multiple records or missing records under the same nominal timestamp due to slight time asynchrony in data acquisition, time alignment processing is required. For example, a unified minimum time granularity (e.g., 100 milliseconds) can be defined to reconcile the original timestamps to these discrete time points. For symbols collected at the same time point from different event streams (such as symbols corresponding to network packet arrival time intervals, CPU usage fluctuations, target file lock contention states, mouse cursor pixels, etc.), this alignment will be applied. Discrete symbols (symbols corresponding to location, target process CPU utilization, private working set memory, I / O read / write bytes, network transmit / receive rate, and kernel object handle count) are arranged horizontally in the same row. The index of this row is the timestamp of the aggregation point. Each column corresponds to a specific event stream. For example, the first column is always the symbol for the time interval of network data packet arrival, the second column is the symbol for CPU utilization fluctuation, and so on. In this way, discrete symbols from all sources at all points in time are aggregated to construct a new matrix structure. Each row of this new matrix represents a snapshot of the overall behavior of the system at a specific point in time, consisting of multiple discrete symbols. Each column clearly shows the sequence of discrete symbols of a specific event stream changing over time, thus establishing a structured multidimensional system behavior sequence.

[0044] The steps to obtain the set of highly correlated event sources are as follows:

[0045] Based on the behavior sequence of a multidimensional system, any two discrete symbol sequences are selected. The independent entropy is calculated by counting the occurrence frequency of each symbol in each sequence, and the joint entropy is calculated by counting the co-occurrence frequency of symbol pairs in the two sequences. Then, the two independent entropies are added together and the joint entropy is subtracted to obtain the mutual information entropy value between the two sequences, and a mutual information entropy numerical set is established.

[0046] Based on the mutual information entropy value set, a symmetric matrix is ​​constructed with the event stream identifier as the index. Each mutual information entropy value is filled into the corresponding row and column cell. Then, the cell value is compared with a single preset covert channel baseline threshold one by one. The cell coordinates that exceed the threshold are recorded to generate an anomaly association index.

[0047] Based on the anomaly correlation index and multidimensional system behavior sequence, the coordinates in the anomaly correlation index are used to directly locate the event source combination with out-of-limit values ​​in the correlation matrix, and the event source combination is output as a set to obtain a set of highly correlated event sources.

[0048] Specifically, based on a multidimensional system behavior sequence, which is a matrix where each row represents a point in time and each column represents a discrete symbolic sequence of an event flow or resource indicator, any two distinct columns selected from this matrix, i.e., two discrete symbolic sequences, are denoted as sequences. and sequence First, calculate the independent entropy of each sequence, taking the sequence as an example. For example, count the number of occurrences of each distinct discrete symbol (e.g., 'S1', 'S2', 'S3') in the sequence, divide by the total length of the sequence (i.e., the total number of time points) to obtain the probability of occurrence of each symbol. Then the sequence The independent entropy is calculated as follows: The summation traversal sequence All different kinds of symbols in the sequence Perform the same operation to obtain its independent entropy. Next, calculate the joint entropy of the two sequences. Therefore, it is necessary to observe the sequence simultaneously. and sequence Pairs of symbols at each same point in time, for example, if at time point... ,sequence The symbol is ,sequence The symbol is Then they form a symbol pair. Statistically analyze each different symbol pair at all time points. The joint probability of each symbol pair is obtained by dividing the number of times they co-occur by the total length of the sequence. The joint entropy is then calculated as The summation iterates through all possible combinations of symbol pairs to obtain the independent entropy of the two sequences. and and their joint entropy Then, by adding the two independent entropies and then subtracting the joint entropy, the mutual information formula is applied. The mutual information entropy value between the two discrete symbol sequences is calculated. This process is repeated for all possible event flow pairs (column pairs) in the multidimensional system behavior sequence. All the calculated mutual information entropy values ​​are collected to form a mutual information entropy numerical set.

[0049] Based on the mutual information entropy set obtained in the previous step, and the unique identifiers of each event stream determined when constructing the multidimensional system behavior sequence (e.g., 'network interval symbol', 'CPU fluctuation symbol', 'file lock symbol', etc.), a symmetric square matrix is ​​first constructed using these event stream identifiers as row and column indices. The size of this square matrix is... ,in It is the total number of event streams for each cell in the matrix. Fill it into an event stream and event flow The mutual information entropy value between them, which is obtained from the mutual information entropy value set, due to mutual information Therefore, the matrix is ​​symmetric, with diagonal elements... The entropy representing the event stream itself is typically not used for comparison in this step. Next, a single covert channel baseline threshold is set, denoted as... The threshold is set based on the analysis of a large amount of known benign application behavior data. For example, collecting multidimensional system behavior sequences of 1,000 benign applications during runtime, calculating the mutual information entropy values ​​of all their event source pairs, forming a set containing tens of thousands of mutual information entropy values, and calculating the mean of this set. and standard deviation ,but It can be set to ,in It is a multiplier factor, for example, let's say it's 3. If the analysis shows... Bit, bits, then Alternatively, a statistical percentile can be used, such as the 99th percentile of the mutual information entropy value in a benign dataset. For example, if this value is 0.6 bits, then Set to 0.6 bits, then iterate through the mutual information entropy value of each off-diagonal cell in the constructed symmetric matrix, and compare it with the preset... (For example, 0.6 bits) Perform numerical comparisons, if the cell The mutual information entropy value in the middle is greater than Then record the index or identifier of this event stream. The indexes (or identifiers) of all these event stream pairs that exceed the threshold are collected to generate a list or set, which is the exception association index.

[0050] Based on the anomaly correlation index and multidimensional system behavior sequence (which includes event stream identification information) generated in the previous step, the coordinates of each pair of event source combinations exceeding the covert channel baseline threshold recorded in the anomaly correlation index (i.e., the index pairs of event streams) are directly used. For example, if the anomaly correlation index contains the coordinate pair (2, 5), and in the definition of the multidimensional system behavior sequence, column 2 corresponds to the event stream "CPU utilization fluctuation symbol" and column 5 corresponds to the event stream "target process CPU utilization symbol", then this means that there is an abnormally high correlation between the two event sources "CPU utilization fluctuation symbol" and "target process CPU utilization symbol". Information entropy values ​​indicate a strong statistical correlation between them. For each such coordinate pair in the abnormal correlation index, the corresponding specific event source name or identifier is searched. These identifier pairs, such as ("CPU utilization fluctuation symbol", "target process CPU utilization symbol"), ("network packet arrival time interval symbol", "target process network transmission and reception rate symbol"), are organized into a set. Each element in this set is a pair of two event source identifiers, representing a pair of event sources with an abnormally high correlation. This set containing all these event source combinations is the final set of highly correlated event sources.

[0051] The steps for obtaining the program resource metabolism profile are as follows:

[0052] Based on a set of highly correlated event sources and a multidimensional system behavior sequence, process identifiers are extracted from the set of highly correlated event sources. These identifiers are then used to query and match within the multidimensional system behavior sequence. Data rows of resource consumption that are completely attributed to the process are then filtered to establish a resource consumption sequence for the target process.

[0053] Based on the resource consumption sequence of the target process, the average and maximum values ​​of the sequence values ​​are calculated as the metabolic rate. The sequence is subjected to Fourier transform and the peak frequency is extracted as the metabolic rhythm. The number of resource request and release function calls in the system log is queried and the ratio is calculated as the metabolic efficiency. The statistical variance of the sequence values ​​is calculated as the metabolic burst degree, and a set of metabolic characteristic indicators is generated.

[0054] Based on a set of metabolic characteristic indicators, the four calculated values ​​of metabolic rate, metabolic rhythm, metabolic efficiency, and metabolic burst are arranged in a fixed order and concatenated into a numerical vector with a fixed dimension to generate a metabolic profile of program resources.

[0055] Specifically, based on a set of highly correlated event sources—consisting of event source pairs whose mutual information entropy values ​​exceed a preset covert channel baseline threshold—and combined with a multidimensional system behavior sequence—a matrix recording the discrete symbol states of each event stream using timestamps as keys—the process first parses out event sources directly related to process activity from the set of highly correlated event sources. For example, entries whose names contain identifiers such as "target process CPU utilization" or "target process private working set memory" are extracted. The corresponding process identifiers (PIDs) or process names are then extracted from these entries. If a process involves multiple highly correlated event source pairs, its PID or name is recorded once, forming a unique list of process identifiers to be analyzed. Next, for each process identifier in this list, the original data collected in the steps prior to constructing the multidimensional system behavior sequence is reviewed. The time-series data stream contains actual, continuous resource usage values ​​for each process, such as CPU utilization percentage, private working set memory bytes, I / O read / write bytes, network transmit / receive bytes, and kernel object handle count. Using the extracted process identifier as the query key, precise matching is performed on these raw time-series data streams to filter out resource usage data records that completely belong to the current target process at all time points. For example, if the target process PID is 1234, then CPU utilization, memory usage, and other data for PID 1234 at all timestamps are extracted. These filtered numerical data of multi-type resource usage changing over time for a specific process are organized into a set of time series, where each series represents the consumption of a specific resource, collectively constituting the target process resource consumption sequence.

[0056] Based on the target process resource consumption sequence, which contains records of the specific values ​​of various resources such as CPU utilization, private working set memory, and I / O read / write bytes changing over time during the target process's lifecycle, we first select one key resource consumption time series, such as the CPU utilization time series. The average value of all values ​​in this sequence is calculated and used as a primary indicator of metabolic rate. Simultaneously, the maximum value in the CPU utilization time series, i.e., the peak CPU utilization, is identified. These two values ​​(average CPU utilization and peak CPU utilization) together describe the resource consumption intensity of the process, with the average CPU utilization designated as the metabolic rate indicator. Then, for the same CPU utilization time series... Applying Fast Fourier Transform (FFT), the sequence is transformed from the time domain to the frequency domain, yielding its power or amplitude spectrum. From this spectrum, frequencies with the highest energy or amplitude, excluding the DC component (0Hz), are identified. These peak frequencies serve as the program's metabolic rhythm, reflecting the periodic characteristics of its resource consumption. For example, if CPU usage fluctuates significantly every 5 seconds, the metabolic rhythm is approximately 0.2Hz. Next, by querying detailed audit logs recorded at the operating system level or system call records captured by specialized API monitoring tools, the number of resource request-related system calls initiated by the target process within the observation period is counted. These include calls related to memory allocation (such as VirtualAlloc, HeapAlloc) and handle creation (such as CreateFile, CreateEvent), denoted as... It also counts the number of corresponding resource release system calls, such as calls related to memory release (e.g., VirtualFree, HeapFree) and handle closing (e.g., CloseHandle), and records them as follows. Calculate the ratio of the two, i.e., metabolic efficiency = (like If the value is 0, then metabolic efficiency can be defined as 1. Finally, for the selected CPU utilization time series... The statistical variance is calculated, and this variance value is used as the metabolic burst degree to measure the degree of fluctuation in resource consumption. The calculated metabolic rate (average CPU utilization), metabolic rhythm (peak frequency), metabolic efficiency (request release call ratio) and metabolic burst degree (CPU utilization variance) are summarized to generate a set of metabolic characteristic indicators.

[0057] Based on the metabolic feature index set generated in the previous step, this set contains four key values ​​describing the characteristics of program resource usage: metabolic rate (e.g., the average CPU utilization of the target process, such as 25%, or 0.25), metabolic rhythm (e.g., the dominant frequency of the CPU utilization time series, such as 0.5Hz), metabolic efficiency (e.g., the ratio of resource release calls to resource request calls, such as 65 releases / 100 requests = 0.65), and metabolic burst rate (e.g., the variance of the CPU utilization time series, such as 0.015). To form a standardized program resource metabolism profile, these four calculated values ​​are arranged in a predetermined, fixed order. For example, the agreed order is: first is metabolic rate, second is metabolic rhythm, third is metabolic efficiency, and fourth is metabolic burst rate. Then, these ordered values ​​are concatenated to form a numerical vector with a fixed dimension of four. Taking the example values ​​above, the generated numerical vector is... This four-dimensional numerical vector is the outline of the program resource metabolism of the target program.

[0058] The steps to obtain the malicious behavior identification mark are as follows:

[0059] Based on the program resource metabolism profile, the program resource metabolism profile is compared one by one with all the profiles in the pre-set benign application baseline profile library and malicious code family profile library. The dot product of the profile vector to be tested and each profile vector in the library is calculated, and then divided by the product of the magnitudes of the two vectors to obtain the cosine similarity value, and a list of similarity values ​​is obtained.

[0060] Based on the list of similarity values, perform a traversal comparison operation on all cosine similarity values ​​in the list, find and lock the maximum value, and then extract the benign or malicious tags that are bound to the maximum value and stored in the image database to obtain the malicious behavior judgment identifier.

[0061] Specifically, based on the program resource metabolism profile, which is a four-dimensional numerical vector representing the resource usage characteristics of the program under test, for example... Simultaneously, it utilizes a pre-built baseline profile library of benign applications and a profile library of malicious code families. The benign library contains a large number of program resource metabolism profiles of known harmless applications. each All are marked as "benign," while the malware database contains the program resource metabolism profiles of various known malware families. each All are marked as "malicious" and may include a family name. The construction process of these libraries involves processing a large number of sample programs through all the aforementioned steps (from data acquisition to profile generation), then storing the generated profiles and corresponding real labels in the library. Next, the program resource metabolism profile of the program under test is obtained. Each stored profile (denoted as) in the benign application baseline profile library and the malware family profile library ,in It can be any one or The comparison is performed one by one, and the method of comparison is to calculate the cosine similarity between them. The calculation formula is as follows: ,in, It is the dot product of two vectors. For example, for a four-dimensional vector, if and The dot product is ,and It is a vector The Euclidean norm (or modulus) is calculated as follows: Calculate in the same way This cosine similarity calculation is performed on each contour in the library, resulting in a series of similarity values, each corresponding to... The similarity to a specific contour in the library is calculated by collecting the calculated cosine similarity values ​​and their corresponding contour labels (including their benign / malignant labels) to obtain a list of similarity values.

[0062] Based on the similarity value list generated in the previous step, which contains the cosine similarity values ​​calculated between the resource metabolism profile of the program under test and all profiles in the image library, as well as the identifier of the corresponding profile in the library (including predefined "benign" or "malicious" labels), a complete traversal and comparison operation is performed on all cosine similarity values ​​in this list. During this traversal, a variable is set to store the currently encountered maximum similarity value, initialized to the first similarity value in the list (or a very small value, such as -1), and the label of the profile in the library associated with this maximum value is recorded. Subsequently, the remaining similarity values ​​in the list are checked one by one. If a similarity value is found to be greater than the currently recorded maximum similarity value, the maximum similarity value is updated. The similarity value is set to this larger value, and the associated label of the record is updated to the label of the contour in the library corresponding to this new maximum value. For example, if the list is [(0.85, 'benign_A'), (0.92, 'malicious_X'), (0.70, 'benign_B')], after traversal, the maximum similarity will be determined to be 0.92, and its associated label is 'malicious_X'. After the list is traversed, the maximum cosine similarity value in the entire list has been found and locked. Then, the benign or malicious label that is uniquely bound to this maximum similarity value and is pre-stored in the corresponding profile library (benign application baseline profile library or malicious code family profile library) is extracted. This label is used as the behavior judgment result of the current program under test to obtain the malicious behavior judgment identifier.

[0063] Finally, malicious code, especially advanced persistent threats (APTs), often exhibits stealth, coordination, and deception. Anomalies in a single metric (such as a persistently 100% CPU usage) are easily detected and evaded. However, the combination of metrics selected in this invention can capture subtle traces of malicious behavior from multiple dimensions. For example, the specific rhythm of network packet arrival intervals may expose its "heartbeat" communication with the command and control (C&C) server; the correlation between intermittent fluctuations in CPU usage and mouse cursor position can reveal its user-interaction-dependent triggering mechanism designed to evade sandbox detection; and abnormal contention for file locks is a typical characteristic of ransomware encrypting files.

[0064] The greatest advantage of this combination lies in detecting complex malicious code composed of multiple cooperating processes. Modern malware often adopts a modular design, distributing functions such as downloading, persistence, information theft, and data return to different processes. The behavior of a single process may seem harmless. However, by aligning the seemingly isolated process behaviors (such as the network reception rate of process A) with the behavior of another process (such as the disk writing and CPU encryption operation of process B) on the time axis and analyzing their mutual information, we can discover the strong correlation between them. This cross-process and cross-dimensional correlation analysis can effectively identify malicious process clusters that communicate or hand over tasks through covert channels, constructing a "program metabolism profile" that goes beyond the resource consumption of a single process, thereby determining the entire chain of malicious activities.

[0065] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A malicious code detection method based on behavior analysis, characterized in that, Includes the following steps: The system monitors event streams and process resource usage data. It uses fixed time interval sampling to capture network packet arrival intervals, CPU usage fluctuations, target file lock contention status, and mouse cursor pixel positions. It also synchronously records the target process's CPU usage, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles. Then, by setting upper and lower thresholds, the captured continuous values ​​are converted into discrete symbols. All event streams and resource usage data are integrated into a timestamp-aligned matrix to establish a multi-dimensional system behavior sequence. Based on the multidimensional system behavior sequence, any two discrete symbol sequences are selected. By statistically analyzing the probability of occurrence of a single symbol and the co-occurrence probability of symbol pairs, the independent entropy value and joint entropy value of each sequence are calculated. Then, the mutual information entropy value between the two sequences is obtained by entropy value addition and subtraction operations, and an correlation matrix is ​​constructed. Each mutual information entropy value in the correlation matrix is ​​compared with a preset covert channel baseline threshold. Event source pairs whose values ​​exceed the threshold are filtered out to obtain a set of highly correlated event sources. Based on the set of highly correlated event sources and the multidimensional system behavior sequence, the resource consumption time series data of the correlated process within its life cycle is extracted. The mean and peak values ​​of the sequence are calculated as the metabolic rate. The time series is transformed to the frequency domain, the dominant frequency is identified as the metabolic rhythm, the ratio of resource application and release system call counts is calculated as the metabolic efficiency, and the variance of resource consumption values ​​is calculated as the metabolic burst. The four indicators of metabolic rate, metabolic rhythm, metabolic efficiency and metabolic burst are combined into a quantitative vector to generate the program resource metabolism profile. Based on the program resource metabolism profile, the program resource metabolism profile is compared one by one with all the profiles in the pre-set benign application baseline profile library and malicious code family profile library. By calculating the cosine similarity value between the profile vector to be tested and each profile vector in the library, the profile in the library with the highest similarity value is selected, and the predefined benign and malicious labels are assigned to the program to be tested to obtain the malicious behavior judgment label.

2. The malicious code detection method based on behavior analysis according to claim 1, characterized in that, The steps for obtaining the multidimensional system behavior sequence are as follows: The system monitors event streams and process resource usage data. By hooking into system kernel functions, it captures network packet arrival time intervals, CPU usage fluctuations, target file lock contention status, and mouse cursor pixel positions. Then, it queries process performance counters to synchronously record the target process's CPU usage, private working set memory, I / O read / write bytes, network transmit / receive rate, and number of kernel object handles to obtain the raw time-series data stream. Based on the original time-series data stream, two non-overlapping numerical intervals are preset as upper and lower thresholds for each data stream. Each value in the original time-series data stream is traversed, assigned to the corresponding numerical interval, and given a preset discrete symbol to obtain a discrete symbol matrix. Based on the discrete symbol matrix, using timestamps as unique keys, discrete symbols from different sources are aggregated on the time axis to construct a new matrix, where each row represents a point in time and each column represents the symbol state of an event stream, thus establishing a multidimensional system behavior sequence.

3. The malicious code detection method based on behavior analysis according to claim 1, characterized in that, The steps for obtaining the set of highly correlated event sources are as follows: Based on the multidimensional system behavior sequence, select any two discrete symbol sequences, calculate the independent entropy by counting the occurrence times of each symbol in each sequence, and then calculate the joint entropy by counting the co-occurrence times of symbol pairs in the two sequences. Then add the two independent entropies and subtract the joint entropy to obtain the mutual information entropy value between the two sequences, and establish a mutual information entropy numerical set. Based on the mutual information entropy value set, a symmetric matrix is ​​constructed with the event stream identifier as the index. Each mutual information entropy value is filled into the corresponding row and column cell. Then, the cell value is compared with a single preset covert channel baseline threshold one by one. The cell coordinates that exceed the threshold are recorded to generate an anomaly association index. Based on the abnormal correlation index and the multidimensional system behavior sequence, the coordinates in the abnormal correlation index are used to directly locate the event source combination with excessive values ​​in the correlation matrix, and the event source combination is output as a set to obtain a set of highly correlated event sources.

4. The malicious code detection method based on behavior analysis according to claim 1, characterized in that, The steps for obtaining the program resource metabolism profile are as follows: Based on the set of highly correlated event sources and the multidimensional system behavior sequence, process identifiers are extracted from the set of highly correlated event sources. The identifiers are then used to query and match in the multidimensional system behavior sequence to filter out resource consumption data rows that completely belong to the process and establish a resource consumption sequence for the target process. Based on the resource consumption sequence of the target process, the average and maximum values ​​of the sequence values ​​are calculated as the metabolic rate. The sequence is subjected to Fourier transform and the peak frequency is extracted as the metabolic rhythm. The number of resource request and release function calls in the system log is queried and the ratio is calculated as the metabolic efficiency. The statistical variance of the sequence values ​​is calculated as the metabolic burst degree, and a set of metabolic characteristic indicators is generated.

5. The malicious code detection method based on behavior analysis according to claim 4, characterized in that, The process for obtaining the program resource metabolism profile also includes: Based on the set of metabolic characteristic indicators, the four values ​​of calculated metabolic rate, metabolic rhythm, metabolic efficiency and metabolic burst are arranged in a fixed order and concatenated into a numerical vector with a fixed dimension to generate the metabolic profile of program resources.

6. The malicious code detection method based on behavior analysis according to claim 1, characterized in that, The steps for obtaining the malicious behavior determination identifier are as follows: Based on the program resource metabolism profile, the program resource metabolism profile is compared one by one with all the profiles in the pre-set benign application baseline profile library and malicious code family profile library. The dot product of the profile vector to be tested and each profile vector in the library is calculated, and then divided by the product of the magnitudes of the two vectors to obtain the cosine similarity value, thus obtaining a list of similarity values.

7. The malicious code detection method based on behavior analysis according to claim 6, characterized in that, The step of obtaining the malicious behavior identification identifier also includes: Based on the list of similarity values, a traversal comparison operation is performed on all cosine similarity values ​​in the list to find and lock the maximum value. Then, the benign or malicious tags associated with the maximum value and stored in the image database are extracted to obtain the malicious behavior judgment identifier.

Images