Dynamic malicious behavior identification method and device and storage medium
Patent Information
- Application Number
- CN202380100221.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-07
- Publication Date
- 2026-02-13
AI Technical Summary
In the OT environment, existing malware detection methods are difficult to update in a timely manner, and often rely on artificially preset boundary conditions, so it is impossible to effectively identify and classify malicious behavior under weak boundary conditions or unboundary conditions.
A dynamic malicious behavior recognition method is proposed. By obtaining predefined classification, identification round, infection threshold, correlation characteristics and association chain and other parameters, the infection value of the behavior to be classified is calculated, and the classification is judged based on the infection value, and the parameters are adjusted to Optimize detection.
The behavior classification based on the infection model is realized, and malicious behavior can be accurately identified without clear boundary conditions, improving the accuracy and reliability of malicious behavior detection and classification in the OT environment.
Smart Images
Figure CN121532985A_ABST
Abstract
Description
A dynamic malicious behavior identification method, device and storage medium Technical Field
[0001] The present invention relates to the fields of pattern recognition and network security, and in particular to a method, device and storage medium for dynamic malicious behavior recognition. Background Art
[0002] Cybersecurity is becoming increasingly important in our daily lives. Security solutions such as firewalls, antivirus software, and intrusion detection systems are used to prevent attacks. However, in OT (operational technology) environments, these solutions can sometimes be ineffective. In some cases, the same strategies used in IT environments cannot be applied to OT environments.
[0003] Take malware detection as an example. While antivirus software is still available, in many OT environments, it is not always updated. In some extreme cases, it is impossible to set up antivirus software to protect the high availability of the system.
[0004] Summary of the Invention
[0005] To achieve the above objectives, the present invention proposes a dynamic malicious behavior identification method, device and storage medium to more effectively classify behaviors.
[0006] A method for identifying dynamic malicious behavior is provided in an embodiment of the present invention, including:
[0007] The infection parameter acquisition step acquires at least two predefined categories, identification rounds, infection thresholds, at least one associated feature, and the associated chain corresponding to each associated feature, infection intensity, and infection rate of two predefined behaviors; wherein at least one of the at least two categories is an infection category; the behavior acquisition step acquires behaviors pre-labeled as infection categories and behaviors to be classified; the infection value evaluation step calculates the infection value of each behavior to be classified in each identification round based on the behaviors labeled as infection categories, the at least one associated feature, and the associated chain, infection intensity, and infection rate corresponding to each associated feature; the behavior classification step classifies the behavior to be classified into the infection category if the infection value of the behavior to be classified is greater than the infection threshold in each identification round; and the parameter adjustment step adjusts the category, identification rounds, infection thresholds, associated features, associated chains, infection intensity, and / or infection rate based on the classification results of the behavior classification step. This achieves the judgment of the inherent logical relationship between different behaviors based on the infection model, thereby not only relying on manually preset boundary conditions for detection, but also achieving the detection and classification of malicious behaviors under weak boundary conditions or no boundary conditions.
[0008] In one embodiment, the method further includes: the association features being features shared by both the behavior categorized as infection-related and the behavior to be categorized; and the association chain being a list of nodes of corresponding association features, wherein each node represents a different level of similarity between the association features of the behavior to be categorized and the association features of the corresponding behavior categorized as infection-related. This further optimizes the grouping of components, comprehensively analyzing and determining the infection relevance of behaviors based on the correlation of association features, thereby accurately determining the behavior's classification.
[0009] In one embodiment, the method further includes calculating the sum of the characteristic infection values of all associated features of the element to be classified as the infection value of the element to be classified; wherein, when the node value of the associated chain corresponding to the associated feature is less than or equal to the corresponding infection intensity, the characteristic infection value of the associated feature is the infection rate of the associated feature; otherwise, it is 0. By defining the associated chain, the correlation degree of different features and their impact on the correlation degree of behavior are clarified, and the correlation degree of behavior is judged from multiple levels from detailed to macroscopic.
[0010] An information system classification device for an infection model proposed in an embodiment of the present invention includes:
[0011] The infection parameter acquisition module is configured to: obtain at least two pre-defined classifications, identification rounds, infection thresholds, at least one associated feature and the associated chain, infection intensity and infection rate corresponding to each associated feature; wherein, the at least two classifications include at least one infection classification; the behavior acquisition module is configured to: obtain behaviors that are pre-labeled as infection classifications and behaviors to be classified; the infection value evaluation module is configured to: in each identification round, calculate the infection value of each behavior to be classified based on the behavior labeled as infection classification and the at least one associated feature and the associated chain, infection intensity and infection rate corresponding to each associated feature; the behavior classification module is configured to: in each identification round, if the infection value of the behavior to be classified is greater than the infection threshold, classify the behavior to be classified into the infection classification; the parameter adjustment module is configured to: adjust the classification, identification rounds, infection thresholds, associated features, associated chains, infection intensity and / or infection rate based on the classification results of the behavior classification step. It realizes the judgment of the internal logical relationship between different behaviors based on the infection model, and thus not only relies on artificially preset boundary conditions for classification, but also realizes clear behavior classification under weak boundary conditions or no boundary conditions.
[0012] An electronic device proposed in an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, wherein the memory is used to store instructions, and when the instructions are executed by the at least one processor, the processor executes the method described above.
[0013] An embodiment of the present invention provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the method described in any of the above embodiments is executed.
[0014] A computer program product provided in an embodiment of the present invention includes a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] The following drawings are only intended to illustrate and explain the present invention, and do not limit the scope of the present invention.
[0016] FIG1 is a flow chart of a dynamic malicious behavior identification method 100 according to an embodiment of the present invention.
[0017] FIG2 is a schematic structural diagram of a dynamic malicious behavior identification device 200 according to an embodiment of the present invention.
[0018] Figure 3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention.
[0019] The following are the descriptions of the reference numerals: DETAILED DESCRIPTION
[0020] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.
[0021] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.
[0022] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular and may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and actions specifically identified, and these steps and actions do not constitute an exclusive list. A method or apparatus may also include other steps or actions.
[0023] There are many malware detection methods and solutions available, such as advanced firewalls, intrusion prevention systems, intrusion detection systems, and traditional antivirus software. Most of these methods use blacklists, which try to identify malware by listing known characteristics or signatures, but there are always new and unknown malware. Sometimes false positives occur, affecting the availability of OT systems. Another way to detect malware is to use whitelists. This method identifies all actions or software outside of a predefined whitelist as malicious. For example, many firewalls have a default deny policy, and if you do not add a rule to the policy to allow traffic to pass, all traffic will be rejected by the firewall. This can be used in environments where most communications and software do not change for a long time, such as OT environments. However, it is difficult to get a clear view of all the actions of known software. Availability is also affected when unknown actions are blocked by whitelisted software.
[0024] In an OT environment, malicious behavior can be performed by malicious users, hackers, or malware within the system. Even actions that don't directly harm the system can be considered malicious. For example, creating a normal file, creating an index, or opening a text file. These actions are interrelated, and it's necessary to identify all of them to gain a complete picture and uncover more malicious behavior.
[0025] Therefore, in order to provide a more optimized dynamic malicious behavior identification method, in an embodiment of the present invention, at least two predefined classifications, identification rounds, infection thresholds, at least one associated feature and the associated chain corresponding to each associated feature, infection intensity and infection rate are obtained; wherein, at least one infection classification is included; behaviors that are pre-labeled as infection classifications and behaviors to be classified are obtained; in each identification round, based on the behaviors labeled as infection classifications and the at least one associated feature and the associated chain corresponding to each associated feature, infection intensity and infection rate, the infection value of each behavior to be classified is calculated; if the infection value of the behavior to be classified is greater than the infection threshold, the behavior to be classified is classified into the infection classification. The technical solution in the embodiment of the present invention can judge the logical relationship between behaviors and detect behaviors that do not have clear boundary conditions.
[0026] FIG1 is a flow chart of a method 100 for identifying dynamic malicious behavior according to an embodiment of the present invention. As shown in FIG1 , the method 100 may include:
[0027] Infection parameter acquisition step S101, at least two predefined categories, identification rounds, infection thresholds, at least one correlation feature and the correlation chain corresponding to each correlation feature, infection intensity, and infection rate are acquired. At least one of the at least two categories is an infection category.
[0028] In the behavior acquisition step S102 , behaviors that are pre-labeled as infection categories and behaviors to be classified are acquired.
[0029] Among them, any category can be defined as an infection category, and the user can use it in combination to classify the categories that need to be identified and distinguished into infection categories. The identification round is defined as the round of performing calculations and classifications. The infection threshold is set so that when the infection value of a behavior exceeds the infection threshold, the behavior can be judged as an infection category. The association feature is a feature shared by all behaviors, and the association chain is a series of nodes contained in a correlation feature, and different nodes represent the degree of correlation with the association feature. The infection intensity is defined as when the correlation feature of the behavior to be classified meets the correlation feature of the behavior marked as the infection category and the value of the node in the association chain meets the infection intensity, then the association feature can be considered to be infected. It can be considered that when the similarity between the association feature of the behavior to be classified and the association feature of the infection category meets the first node, the higher the similarity, the lower the similarity of the second node and subsequent nodes.
[0030] Specifically, behaviors pre-classified as infected and behaviors awaiting classification can be obtained from two sources: first, from logs of operating systems, applications, and security software; second, from logs collected by firewalls, intrusion prevention systems, and intrusion detection systems, or through deep packet inspection.
[0031] Specifically, in OT environments, software and processes typically remain unchanged for a long time. Therefore, behaviors that have been pre-classified as infected can be obtained through whitelisting, and any behavior outside the whitelist will be considered malicious.
[0032] Specifically, the association feature can be a temporal or spatial relationship. The association chain can be the similarity of temporal or spatial relationships, such as the execution time difference of the behavior, the sameness or similarity of the code, author, signature, IP address and / or file format.
[0033] Table 1
[0034] Specifically, as shown in Table 1, File1 and File2 are elements that have been pre-labeled as infected, File3-5 are elements to be classified, and file creator, create time, size, path, extension and signature are selected as associated features.
[0035] The association chain can be:
[0036] Node 1: Same creator -> Node 2: creators have same prefix or suffix -> Node 3: same number of characters of creator name
[0037] Node 1: Time difference in 1 minute -> Node 2: Time difference in 10 minutes -> Node 3: Time difference in 60 minutes
[0038] Node 1: File size difference in 1K -> Node 2: File size difference in 1M -> Node 3: File size difference in 1G
[0039] Node 1: Same dir -> Node 2: Same string in path -> Node 3: Same hard drive
[0040] Node 1: Same extension->Node 2 extension have same prefix or suffix->Node 3: same number of characters of extension.
[0041] Infection value evaluation step S103, in each identification round, the infection value of each behavior to be classified is calculated based on the behavior labeled as infection classification and the at least one associated feature and the associated chain, infection intensity and infection rate corresponding to each associated feature.
[0042] Specifically, the infection intensity is selected as 2, the infection threshold is selected as 2, the identification round is selected as 2, and the infection rate is shown in Table 2.
[0043] Table 2
[0044] Specifically, the sum of the characteristic infection values of all associated features of the element to be classified is calculated as the infection value of the element to be classified. When the node value of the associated chain corresponding to the associated feature is less than or equal to the corresponding infection intensity, the characteristic infection value of the associated feature is the infection rate of the associated feature; otherwise, it is 0.
[0045] Specifically, the infection value calculation formula is: Among them, Sn is the infection value of the element, rn is the infection rate of the nth associated feature, f(cn ) is a Boolean value, which is 1 when the value of the node of the association chain that the association feature of the element to be classified meets is less than or equal to the preset infection intensity 2, otherwise it is 0.
[0046] Specifically, in the first round of identification, the infection values of File3-5 are shown in Table 3.
[0047] Table 3
[0048] In the behavior classification step S104 , in each recognition round, if it is determined that the infection value of the behavior to be classified is greater than the infection threshold, the behavior to be classified is classified into the infection category.
[0049] Specifically, the infection value of File4 is 2.8, which is greater than the preset infection threshold of 2, and File4 is classified as infected.
[0050] Specifically, in the second round of identification, the infection values of File3 and 5 are shown in Table 4.
[0051] Table 4
[0052] The parameter adjustment step S105 is to adjust the classification, identification round, infection threshold, association feature, association chain, infection intensity and / or infection rate based on the classification result of the behavior classification step.
[0053] Specifically, the selection of associated features can be adjusted based on the infection classification results, features that can better reflect the relevance of malicious behavior can be selected, and infection intensity and infection threshold can be optimized to improve the accuracy of detection and classification.
[0054] Specifically, the detection ends after completing the preset rounds.
[0055] Furthermore, infection classification can also be a classification of non-malicious behaviors. In this case, more related actions belonging to the whitelist can be found by detecting harmless behaviors as infection classifications.
[0056] FIG2 is a schematic diagram of the structure of a dynamic malicious behavior identification device 200 according to an embodiment of the present invention. As shown in FIG2 , the device 200 may include:
[0057] The infection parameter acquisition module 201 is configured to obtain at least two predefined categories, an identification round, an infection threshold, at least one correlation feature and a correlation chain corresponding to each correlation feature, an infection intensity, and an infection rate. The at least two categories include at least one infection category.
[0058] The behavior acquisition module 202 is configured to acquire behaviors that are pre-classified as infection-related behaviors and behaviors to be classified.
[0059] Among them, any category can be defined as an infection category, and the user can use it in combination to classify the categories that need to be identified and distinguished into infection categories. The identification round is defined as the round of performing calculations and classifications. The infection threshold is set so that when the infection value of a behavior exceeds the infection threshold, the behavior can be judged as an infection category. The association feature is a feature shared by all behaviors, and the association chain is a series of nodes contained in a correlation feature, and different nodes represent the degree of correlation with the association feature. The infection intensity is defined as when the correlation feature of the behavior to be classified meets the correlation feature of the behavior marked as the infection category and the value of the node in the association chain meets the infection intensity, then the association feature can be considered to be infected. It can be considered that when the similarity between the association feature of the behavior to be classified and the association feature of the infection category meets the first node, the higher the similarity, the lower the similarity of the second node and subsequent nodes.
[0060] Specifically, behaviors pre-classified as infected and behaviors awaiting classification can be obtained from two sources: first, from logs of operating systems, applications, and security software; second, from logs collected by firewalls, intrusion prevention systems, and intrusion detection systems, or through deep packet inspection.
[0061] Specifically, in OT environments, software and processes typically remain unchanged for a long time. Therefore, behaviors that have been pre-classified as infected can be obtained through whitelisting, and any behavior outside the whitelist will be considered malicious.
[0062] Specifically, the association feature can be a temporal or spatial relationship. The association chain can be the similarity of temporal or spatial relationships, such as the execution time difference of the behavior, the sameness or similarity of the code, author, signature, IP address and / or file format.
[0063] The infection value evaluation module 203 is configured to: in each identification round, calculate the infection value of each behavior to be classified based on the behavior labeled as infection classification and the at least one associated feature and the associated chain, infection intensity and infection rate corresponding to each associated feature.
[0064] Specifically, the infection value of the behavior is the sum of the characteristic infection values of all the associated features of the behavior. If the node value of the associated chain corresponding to the associated feature is less than or equal to the corresponding infection intensity, the characteristic infection value of the associated feature is the infection rate of the associated feature; otherwise, it is 0.
[0065] The behavior classification module 204 is configured to: in each recognition round, if it is determined that the infection value of the behavior to be classified is greater than the infection threshold, classify the behavior to be classified into the infection category.
[0066] The parameter adjustment module 205 is configured to adjust the classification, identification round, infection threshold, association feature, association chain, infection intensity and / or infection rate based on the classification result of the behavior classification step.
[0067] Specifically, the detection ends after completing the preset rounds.
[0068] Furthermore, infection classification can also be a classification of non-malicious behaviors. In this case, more related actions belonging to the whitelist can be found by detecting harmless behaviors as infection classifications.
[0069] The present invention also provides an electronic device 300. Figure 3 is a schematic diagram of electronic device 300 according to an embodiment of the present invention. As shown in Figure 3, electronic device 300 includes a processor 310 and a memory 320. Memory 320 stores instructions, wherein the instructions, when executed by processor 310, implement method 100 as described above. The present invention also provides a computer-readable storage medium having computer instructions stored thereon, which, when executed, implement the method as described above.
[0070] The present invention further provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, the method described above is executed.
[0071] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned method when executed by a processor.
[0072] Some aspects of the methods and apparatus of the present invention may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present invention may be embodied as computer products in one or more computer-readable media, the product including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).
[0073] Flowcharts are used herein to illustrate the operations performed by the methods according to the embodiments of the present application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the various steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.
[0074] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.
[0075] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.
Claims
1. A method (100) for identifying dynamic malicious behavior, characterized in that: include: Infection parameter acquisition step (S101), acquiring at least two categories of predefined behaviors, identification rounds, infection thresholds, at least one correlation feature and a correlation chain corresponding to each correlation feature, infection intensity and infection rate; wherein at least one of the at least two categories is an infection category; Behavior acquisition step (S102), acquiring behaviors that are pre-labeled as infection categories and behaviors to be classified; Infection value evaluation step (S103), in each identification round, based on the behavior marked as infection classification and the at least one associated feature and the associated chain, infection intensity and infection rate corresponding to each associated feature, calculating the infection value of each behavior to be classified; Behavior classification step (S104), in each recognition round, if it is determined that the infection value of the behavior to be classified is greater than the infection threshold, then the behavior to be classified is classified into the infection category; The parameter adjustment step (S105) is to adjust the classification, identification round, infection threshold, association feature, association chain, infection intensity and / or infection rate based on the classification result of the behavior classification step.
2. The method according to claim 1, characterized in that: The associated features are features that both the behavior marked as infection classification and the behavior to be classified have; The association chain is a node list of corresponding association features, wherein each node represents a different level of similarity between the association feature of the behavior to be classified and the association feature of the corresponding behavior calibrated as an infection classification.
3. The method according to claim 2, characterized in that The infection value evaluation step further comprises: Calculate the sum of the characteristic infection values of all associated characteristics of the element to be classified as the infection value of the element to be classified; When the node value of the association chain corresponding to the association feature that the association feature meets is less than or equal to the corresponding infection intensity, the characteristic infection value of the association feature is the infection rate of the association feature; otherwise, it is 0.
4. [Corrected 09.10.2023 according to Rule 26] A dynamic malicious behavior identification device (200), characterized in that: include: The infection parameter acquisition module (201) is configured to: acquire at least two categories of predefined behaviors, an identification round, an infection threshold, at least one correlation feature and a correlation chain corresponding to each correlation feature, an infection intensity and an infection rate; wherein at least one of the at least two categories is an infection category; The behavior acquisition module (202) is configured to: acquire behaviors that are pre-labeled as infection categories and behaviors to be classified; The infection value evaluation module (203) is configured to: in each identification round, calculate the infection value of each behavior to be classified based on the behavior marked as infection classification and the at least one associated feature and the associated chain, infection intensity and infection rate corresponding to each associated feature; The behavior classification module (204) is configured to: in each recognition round, if it is determined that the infection value of the behavior to be classified is greater than the infection threshold, then classify the behavior to be classified into the infection category; The parameter adjustment module (205) is configured to adjust the classification, identification round, infection threshold, association feature, association chain, infection intensity and / or infection rate based on the classification result of the behavior classification module.
5. The device according to claim 4, characterized in that The associated features are features that both the behavior marked as infection classification and the behavior to be classified have; The association chain is a node list of corresponding association features, wherein each node represents different levels of infection similarity between the association feature of the behavior to be classified and the association feature of the corresponding behavior marked as infection classification.
6. The device according to claim 5, characterized in that The infection value assessment module is further configured to: Calculate the sum of the characteristic infection values of all associated characteristics of the element to be classified as the infection value of the element to be classified; When the node value of the association chain corresponding to the association feature that the association feature meets is less than or equal to the corresponding infection intensity, the characteristic infection value of the association feature is the infection rate of the association feature; otherwise, it is 0.
7. An electronic device (300), comprising: at least one processor (301); as well as A memory (302) coupled to the at least one processor (301), the memory (302) being used to store instructions, which, when executed by the at least one processor (301), causes the processor (301) to execute the method according to any one of claims 1 to 3.
8. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed, execute the method according to any one of claims 1 to 3.
9. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 3 when being executed by a processor.