Malicious code detection method and system based on semantic analysis

Abstract

The invention provides a malicious code detection method and system based on semantic analysis, and the method comprises the steps: determining a space where a suspicious code is located based on a monitoring behavior record of security software in a terminal, extracting a target code in the space, and reducing a subsequent malicious code detection interval range; based on the semantic feature extraction model and the text semantic classification model, generating a word sequence containing semantic information corresponding to the target code, and correcting the word sequence; analyzing the corrected word sequence based on a deep text classification model to obtain global text semantics of the target code so as to calibrate malicious code snippets in the target code, and performing code change operation on the space based on distribution characteristics of the malicious code snippets to obtain the target code. And meanwhile, global recognition is performed on the codes by utilizing a semantic feature extraction model and a text semantic classification model, efficient and accurate analysis of code semantics is considered, semantic information of the codes is comprehensively extracted, malicious code components are recognized and positioned in massive codes, and the working accuracy and reliability of security software are improved.

Description

Technical Field

[0001] This invention relates to the field of code data processing, and more particularly to a method and system for detecting malicious code based on semantic analysis. Background Technology

[0002] Fast-Text models are widely used in simple text recognition and classification scenarios due to their high versatility and low computational resource requirements. However, their simple network structure prevents them from capturing word order features, hindering accurate recognition of long and complex texts. Bi-LSTM (Bidirectional Long Short-Term Memory) models can perform forward and backward recognition of text, extracting word order features. However, they require significant resources to achieve full-text semantic recognition of long and complex texts, increasing resource and time costs. Security software primarily determines whether a terminal has been compromised by detecting malicious code. Therefore, security software demands high accuracy and timeliness in malicious code detection. While traditional static detection models like Fast-Text can ensure timely detection, they are prone to false positives or missed detections. Especially with target code, they struggle to fully extract semantic information, failing to identify and locate malicious code components within massive amounts of target code, thus reducing the accuracy and reliability of security software. Summary of the Invention

[0003] The purpose of this invention is to provide a malicious code detection method and system based on semantic analysis. Based on the monitoring behavior records of security software within the terminal, the method determines the space where suspicious code resides and extracts the target code within that space, effectively narrowing down the subsequent malicious code detection range. Based on a semantic feature extraction model and a text semantic classification model, it generates a word sequence containing semantic information corresponding to the target code and corrects the word sequence to ensure it has correct contextual logic. Based on a deep text classification model, it analyzes the corrected word sequence to obtain the global text semantics of the target code, thereby identifying malicious code fragments. Based on the distribution characteristics of the malicious code fragments, it performs code modification operations on the space. Simultaneously, it utilizes the semantic feature extraction model and the text semantic classification model to perform global identification of the target code, balancing efficient and accurate semantic analysis. This fully and comprehensively extracts the semantic information of the target code, identifying and locating malicious code components in massive amounts of target code, thus improving the accuracy and reliability of security software.

[0004] This invention is achieved through the following technical solution:

[0005] Semantic analysis-based malware detection methods include:

[0006] Based on the monitoring behavior records of the security software within the terminal, the location of suspicious code within the terminal is determined; the space is searched to extract the target code within the space;

[0007] Based on the semantic feature extraction model and the text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated; the word sequence is corrected based on the word order logic information of the word sequence.

[0008] The corrected word sequence is analyzed based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it; based on the distribution characteristics of the malicious code fragments, code modification operations are performed on the space.

[0009] Optionally, based on the monitoring behavior records of the security software within the terminal, the location of suspicious code within the terminal is determined; the space is searched to extract the target code within the space, including:

[0010] Based on the time distribution information of the active status of the security software in the terminal, the active behavior log portion is extracted from the software operation log; the active behavior log portion is filtered by associated behavior type to obtain the monitoring behavior record of the security software.

[0011] The monitoring behavior records are analyzed to obtain the monitoring behavior characteristics of the security software for external code data; based on the monitoring behavior characteristics, the location of suspicious code within the terminal is determined.

[0012] Based on the code change records of the space, determine the type information and change time information of all code in the space; based on the type information and the change time information, search and extract the target code within the space.

[0013] Optionally, based on a semantic feature extraction model and a text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated; based on the word order logic information of the word sequence, the word sequence is corrected, including:

[0014] The target code is analyzed based on a semantic feature extraction model to obtain all word vectors corresponding to the target code; forward and backward analysis of the target code is performed based on a text semantic classification model to obtain all word vectors and word order features corresponding to the target code.

[0015] All word vectors generated by the semantic feature extraction model and all word vectors generated by the text semantic classification model are compared and corrected to obtain all valid word vectors corresponding to the target code; based on the word order features and all valid word vectors, a word sequence containing semantic information corresponding to the target code is generated.

[0016] Based on the word order logic information of the word sequence, identify the word order logic abnormal segments within the word sequence; and correct the word sequence based on the context of the word order logic abnormal segments.

[0017] Optionally, the corrected word sequence is analyzed based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it; based on the distribution characteristics of the malicious code fragments, code modification operations are performed on the space, including:

[0018] Based on a deep text classification model, deep text classification analysis is performed on the corrected word sequence to obtain the global text semantics of the target code; semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics, thereby identifying the malicious code fragments of the target code;

[0019] Based on the distribution location characteristics and redundancy characteristics of the malicious code fragments in the target code, all malicious code fragments in the space are subject to targeted deletion and / or targeted correction.

[0020] Optionally, based on the distribution location characteristics and redundancy characteristics of the malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments within the space, including:

[0021] The distribution location features of the target code are retrieved, wherein the distribution location features include the total number of lines of the target code, the starting line number of the malicious code segment, the ending line number of the malicious code segment, the line number difference from the nearest execution entry point, and the number of key function calls within the segment;

[0022] The location criticality parameter corresponding to the target code is set using the distribution location characteristics of the target code;

[0023] The location criticality parameter is obtained using the following formula:

[0024]

[0025] Where P represents the location criticality parameter; X and Y represent the start and end line numbers of the malicious code segment; H represents the total number of lines of the target code; C represents the line number difference from the nearest execution entry point; N g This represents the number of critical function calls within the normalized segment;

[0026] The distribution redundancy features of the target code are retrieved, wherein the distribution redundancy features include the number of times identical malicious code segments appear in the global code and the average semantic similarity between the target code and other malicious code segments;

[0027] The redundancy level parameter is obtained by utilizing the distribution redundancy characteristics of the target code;

[0028] The redundancy parameter is obtained using the following formula:

[0029]

[0030] Where Q represents the redundancy parameter; M g S represents the number of times identical malicious code fragments appear in the global code after normalization; S represents the average semantic similarity between the target code and other malicious code fragments; S r This indicates a preset similarity reference value;

[0031] The severity parameters of the malicious code fragment are obtained using the location criticality parameter and the redundancy parameter.

[0032] The severity parameter of the malicious code fragment is obtained using the following formula:

[0033]

[0034] Where K represents the severity parameter of the malicious code fragment; P represents the location criticality parameter; and Q represents the redundancy parameter.

[0035] Semantic analysis-based malware detection systems include:

[0036] The code space identification module is used to determine the location of suspicious code within the terminal based on the monitoring behavior records of the security software within the terminal.

[0037] The code search module is used to search the space and extract the target code within the space;

[0038] The word sequence generation module is used to generate a word sequence containing semantic information corresponding to the target code based on the semantic feature extraction model and the text semantic classification model.

[0039] A word sequence correction module is used to correct the word sequence based on the word order logic information of the word sequence;

[0040] The malicious code fragment identification module is used to analyze the corrected word sequence based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying the malicious code fragments within it.

[0041] The code modification operation module is used to perform code modification operations on the space based on the distribution characteristics of the malicious code fragments.

[0042] Optionally, the code space identification module is used to determine the location of suspicious code within the terminal based on the monitoring behavior records of the security software within the terminal, including:

[0043] Based on the time distribution information of the active status of the security software in the terminal, the active behavior log portion is extracted from the software operation log; the active behavior log portion is filtered by associated behavior type to obtain the monitoring behavior record of the security software.

[0044] The monitoring behavior records are analyzed to obtain the monitoring behavior characteristics of the security software for external code data; based on the monitoring behavior characteristics, the location of suspicious code within the terminal is determined.

[0045] The code search module is used to search the space and extract target code within the space, including:

[0046] Based on the code change records of the space, determine the type information and change time information of all code in the space; based on the type information and the change time information, search and extract the target code within the space.

[0047] Optionally, the word sequence generation module is used to generate a word sequence containing semantic information corresponding to the target code based on a semantic feature extraction model and a text semantic classification model, including:

[0048] The target code is analyzed based on a semantic feature extraction model to obtain all word vectors corresponding to the target code; forward and backward analysis of the target code is performed based on a text semantic classification model to obtain all word vectors and word order features corresponding to the target code.

[0049] All word vectors generated by the semantic feature extraction model and all word vectors generated by the text semantic classification model are compared and corrected to obtain all valid word vectors corresponding to the target code; based on the word order features and all valid word vectors, a word sequence containing semantic information corresponding to the target code is generated.

[0050] The word sequence correction module is used to correct the word sequence based on the word order logic information of the word sequence, including:

[0051] Based on the word order logic information of the word sequence, identify the word order logic abnormal segments within the word sequence; and correct the word sequence based on the context of the word order logic abnormal segments.

[0052] Optionally, the malicious code fragment identification module is used to analyze the corrected word sequence based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments therein, including:

[0053] Based on a deep text classification model, deep text classification analysis is performed on the corrected word sequence to obtain the global text semantics of the target code; semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics, thereby identifying the malicious code fragments of the target code;

[0054] The code modification operation module is used to perform code modification operations on the space based on the distribution characteristics of the malicious code fragment, including:

[0055] Based on the distribution location characteristics and redundancy characteristics of the malicious code fragments in the target code, all malicious code fragments in the space are subject to targeted deletion and / or targeted correction.

[0056] Optionally, based on the distribution location characteristics and redundancy characteristics of the malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments within the space, including:

[0057] The distribution location features of the target code are retrieved, wherein the distribution location features include the total number of lines of the target code, the starting line number of the malicious code segment, the ending line number of the malicious code segment, the line number difference from the nearest execution entry point, and the number of key function calls within the segment;

[0058] The location criticality parameter corresponding to the target code is set using the distribution location characteristics of the target code;

[0059] The location criticality parameter is obtained using the following formula:

[0060]

[0061] Where P represents the location criticality parameter; X and Y represent the start and end line numbers of the malicious code segment; H represents the total number of lines of the target code; C represents the line number difference from the nearest execution entry point; N g This represents the number of critical function calls within the normalized segment;

[0062] The distribution redundancy features of the target code are retrieved, wherein the distribution redundancy features include the number of times identical malicious code segments appear in the global code and the average semantic similarity between the target code and other malicious code segments;

[0063] The redundancy level parameter is obtained by utilizing the distribution redundancy characteristics of the target code;

[0064] The redundancy parameter is obtained using the following formula:

[0065]

[0066] Where Q represents the redundancy parameter; M g S represents the number of times identical malicious code fragments appear in the global code after normalization; S represents the average semantic similarity between the target code and other malicious code fragments; S r This indicates a preset similarity reference value;

[0067] The severity parameters of the malicious code fragment are obtained using the location criticality parameter and the redundancy parameter.

[0068] The severity parameter of the malicious code fragment is obtained using the following formula:

[0069]

[0070] Where K represents the severity parameter of the malicious code fragment; P represents the location criticality parameter; and Q represents the redundancy parameter.

[0071] Compared with the prior art, the present invention has the following beneficial effects:

[0072] The semantic analysis-based malicious code detection method and system provided in this application determine the location of suspicious code based on the monitoring behavior records of security software within the terminal, and extract the target code within the space, effectively narrowing the subsequent malicious code detection range. Based on a semantic feature extraction model and a text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated, and the word sequence is corrected to ensure that the word sequence has correct contextual logic. Based on a deep text classification model, the corrected word sequence is analyzed to obtain the global text semantics of the target code, thereby identifying malicious code fragments. Based on the distribution characteristics of malicious code fragments, code modification operations are performed in the space. At the same time, the semantic feature extraction model and the text semantic classification model are used to perform global identification of the target code, taking into account both efficient and accurate analysis of code semantics, fully and comprehensively extracting the semantic information of the target code, identifying and locating malicious code components in massive amounts of target code, and improving the accuracy and reliability of security software. Attached Figure Description

[0073] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0074] Figure 1 This is a flowchart illustrating the semantic analysis-based malicious code detection method provided by the present invention.

[0075] Figure 2 This is a schematic diagram of the structure of the malicious code detection system based on semantic analysis provided by the present invention. Detailed Implementation

[0076] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, it should be noted that, for ease of description, only the parts relevant to this application are shown in the accompanying drawings, not the entire structure. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application.

[0077] The terms “comprising” and “having”, and any variations thereof, used in this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0078] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0079] Please see Figure 1 As shown, an embodiment of this application provides a malicious code detection method based on semantic analysis. This malicious code detection method based on semantic analysis includes:

[0080] Based on the monitoring behavior records of the security software in the terminal, the location of suspicious code in the terminal is determined; the space is searched to extract the target code inside the space;

[0081] Based on the semantic feature extraction model and the text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated; based on the word order logical information of the word sequence, the word sequence is corrected.

[0082] The corrected word sequence is analyzed using a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments. Based on the distribution characteristics of the malicious code fragments, code modification operations are performed on the space.

[0083] The target code can be, for example, JavaScript code; the semantic feature extraction model can be, for example, the Fast-Text model; the text semantic classification model can be, for example, the Bi-LSTM model; and the deep text classification model can be, for example, the DPCNN model.

[0084] The beneficial effects of the above embodiments are as follows: This semantic analysis-based malicious code detection method determines the space where suspicious code is located based on the monitoring behavior records of security software within the terminal, and extracts the target code within the space, effectively narrowing the subsequent malicious code detection range; based on the semantic feature extraction model and the text semantic classification model, it generates a word sequence containing semantic information corresponding to the target code, and corrects the word sequence to ensure that the word sequence has correct contextual logic; based on the deep text classification model, it analyzes the corrected word sequence to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it, and based on the distribution characteristics of malicious code fragments, it performs code modification operations on the space; at the same time, it uses the semantic feature extraction model and the text semantic classification model to perform global identification of the target code, taking into account both efficient and accurate analysis of code semantics, fully and comprehensively extracting the semantic information of the target code, identifying and locating malicious code components in massive amounts of target code, and improving the accuracy and reliability of the security software.

[0085] In another embodiment, based on the monitoring behavior records of the security software within the terminal, the location of suspicious code within the terminal is determined; the space is searched to extract the target code within the space, including:

[0086] Based on the time distribution information of the active state of the security software in the terminal, the active behavior log is extracted from the software operation log; the active behavior log is filtered by related behavior types to obtain the monitoring behavior records of the security software.

[0087] Analyze the monitoring behavior records to obtain the monitoring behavior characteristics of the security software for external code data; based on the monitoring behavior characteristics, determine the location of suspicious code within the terminal;

[0088] Based on the code change records of the space, determine the type information and change time information of all code within the space; based on the type information and change time information, search and extract the target code within the space.

[0089] The beneficial effects of the above embodiments are that security software installed inside computers and other terminals can inspect the code input into the terminal during interactions with the outside world, determine whether the code contains malicious code fragments, and promptly handle any malicious code fragments to ensure the security of terminal operation. Security software typically embeds corresponding semantic recognition models to traverse and search for code within the terminal. Regardless of the semantic recognition model used, the security software consumes the terminal's own computing and memory resources. To avoid excessive consumption of these resources by installed software, which could affect the normal operation of the terminal, pre-screening of the code within the terminal is necessary to remove target code that clearly does not contain malicious code. This effectively reduces the amount of target code that the security software needs to process. Therefore, based on the distribution information of the duration intervals during which the security software is active in the foreground within the terminal, the software operation logs are filtered to extract the active behavior log portion corresponding to the aforementioned duration intervals. This active behavior log portion contains the corresponding work behaviors performed by the security software during its foreground active state. The active behavior logs are then filtered by associated behavior types to determine the behavior records of the security software during foreground and background monitoring of the terminal. Since the security software only initiates monitoring behavior in the foreground or background when it detects suspicious code within the terminal, extracting the monitoring behavior records of the security software can accurately determine the storage space of the suspicious code detected by the security software within the terminal. This facilitates subsequent target code screening only for the corresponding storage space, reducing the workload of target code screening. Furthermore, during the operation of the terminal, the corresponding storage space will continuously undergo code writing and deletion operations, and the storage space will simultaneously contain multiple different types of code, not just the target code. In order to accurately filter the target code that has changed within a predetermined time range from the storage space, based on the code change records in the storage space, the type information of all code in the storage space and the time range information of the change are determined. In this way, the target code that has changed within the predetermined time range is searched and extracted from the storage space, and this is used as the valid target code. This can effectively reduce the workload of subsequent semantic recognition of the target code.

[0090] In another embodiment, based on a semantic feature extraction model and a text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated; based on the word order logic information of the word sequence, the word sequence is corrected, including:

[0091] The target code is analyzed based on a semantic feature extraction model to obtain all word vectors corresponding to the target code; forward and backward analysis of the target code is performed based on a text semantic classification model to obtain all word vectors and word order features corresponding to the target code.

[0092] All word vectors generated by the semantic feature extraction model and all word vectors generated by the text semantic classification model are compared and corrected to obtain all valid word vectors corresponding to the target code; based on word order features and all valid word vectors, a word sequence containing semantic information corresponding to the target code is generated.

[0093] Based on the word order logic information of the word sequence, identify the word order logic abnormal segments within the word sequence; based on the context of the word order logic abnormal segments, correct the word sequence.

[0094] The beneficial effects of the above embodiments are that the semantic feature extraction model can quickly identify the word vectors of text but cannot identify the word order features of text, while the text semantic classification model can perform forward and backward recognition of text and extract the word order features of text. Considering the text semantic recognition characteristics of the semantic feature extraction model and the text semantic classification model, in order to balance the fast and accurate recognition of the target code, the semantic feature extraction model is used to analyze the target code to obtain all the word vectors corresponding to the target code, and the text semantic classification model is used to perform forward and backward analysis of the target code to obtain all the word vectors and word order features corresponding to the target code. In this way, the word vectors of the target code can be identified by different models, which facilitates subsequent comparison and correction based on the word vectors identified by the above two models, thereby improving the reliability of the word vectors. Among them, the analysis of the target code by the semantic feature extraction model and the text semantic classification model is a conventional technical means in this field, and will not be described in detail here. Furthermore, the word vectors obtained by processing the target code using semantic feature extraction models and text semantic classification models are not entirely identical; local differences exist between them. By comparing the word vectors obtained from the two models, the credibility of each word vector in the differing local word vector parts is determined, and the local word vector parts with higher credibility are used as the final word vector parts, thus obtaining all valid word vectors corresponding to the target code. Then, based on word order features, all valid word vectors are sorted to generate a word sequence containing semantic information corresponding to the target code, ensuring that the generated word sequence can accurately reflect the global word vector distribution of the target code. Additionally, based on the word order logic information of the word sequence, anomalous segments within the word order logic are identified. These anomalous segments can be, but are not limited to, segments where the logical order of word vectors is reversed. Then, based on the context of these anomalous segments, the word sequence is corrected, for example, by adjusting the order of word vectors with reversed logical order within these segments.

[0095] In another embodiment, the corrected word sequence is analyzed based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it; based on the distribution characteristics of the malicious code fragments, code modification operations are performed on the space, including:

[0096] Based on a deep text classification model, deep text classification analysis is performed on the corrected word sequence to obtain the global text semantics of the target code; semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics, thereby identifying malicious code fragments in the target code;

[0097] Based on the distribution location characteristics and redundancy characteristics of malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments in the space.

[0098] The beneficial effects of the above embodiments are that the Deep Pyramid Convolutional Neural Network (DPCNN) model, as a deep text classification convolutional neural network model that is widely effective at the word level, can perform deep text classification analysis on word sequences composed of multiple word vectors. By performing deep text classification analysis on the corrected word sequences through the deep text classification model, the global text semantics of the target code are obtained. The global text semantics obtained in this way can accurately and comprehensively reflect the overall text semantic content of the target code. Then, semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics. The semantically abnormal intervals may include, but are not limited to, intervals containing predetermined text words or intervals with repeated text semantics within the global text semantics. Based on the position of the aforementioned semantically abnormal intervals within the global text semantics, the corresponding code segments within the target code are marked as malicious code segments. Furthermore, based on the distribution location and redundancy characteristics of malicious code fragments within the target code (such as the length of code fragments that repeatedly appear within the target code), targeted deletion and / or targeted correction can be performed on all malicious code fragments in the space (for example, replacing the corresponding malicious code fragments with normal code fragments of the same length based on the length of code fragments that repeatedly appear within the target code). This effectively removes malicious code fragments from within the target code, improves the accuracy and reliability of the security software, and ensures the normal operation of the terminal.

[0099] In another embodiment, based on the distribution location characteristics and distribution redundancy characteristics of the malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments within the space, including:

[0100] The distribution location features of the target code are retrieved, wherein the distribution location features include the total number of lines of the target code, the starting line number of the malicious code segment, the ending line number of the malicious code segment, the line number difference from the nearest execution entry point, and the number of key function calls within the segment;

[0101] The location criticality parameter corresponding to the target code is set using the distribution location characteristics of the target code;

[0102] The location criticality parameter is obtained using the following formula:

[0103]

[0104] Where P represents the location criticality parameter; X and Y represent the start and end line numbers of the malicious code segment; H represents the total number of lines of the target code; C represents the line number difference from the nearest execution entry point; N g This represents the number of critical function calls within the normalized segment;

[0105] The distribution redundancy features of the target code are retrieved, wherein the distribution redundancy features include the number of times identical malicious code segments appear in the global code and the average semantic similarity between the target code and other malicious code segments;

[0106] The redundancy level parameter is obtained by utilizing the distribution redundancy characteristics of the target code;

[0107] The redundancy parameter is obtained using the following formula:

[0108]

[0109] Where Q represents the redundancy parameter; M g S represents the number of times identical malicious code fragments appear in the global code after normalization; S represents the average semantic similarity between the target code and other malicious code fragments; S r This indicates a preset similarity reference value;

[0110] The severity parameters of the malicious code fragment are obtained using the location criticality parameter and the redundancy parameter.

[0111] The severity parameter of the malicious code fragment is obtained using the following formula:

[0112]

[0113] Where K represents the severity parameter of the malicious code fragment; P represents the location criticality parameter; and Q represents the redundancy parameter.

[0114] The beneficial effects of the above embodiments are that, by integrating two-dimensional parameters—location criticality and redundancy—an objective severity assessment standard is established, avoiding subjective or general judgments on the harm of malicious code segments. Based on quantified severity parameters, targeted deletion or correction operations can be precisely performed on malicious code segments of different harm levels, avoiding over-processing (mistakenly deleting normal code) or under-processing (missing high-risk malicious segments). By focusing on malicious code segments near the execution entry point and those with high correlation to key functions through location criticality parameters, it ensures that malicious segments with the greatest impact on the core execution logic of the code are given priority. Combined with distributed redundancy characteristics, high-frequency repetitive and semantically similar malicious code segments are effectively controlled, reducing the cumulative impact of redundant malicious segments. Using quantified parameters to guide processing actions avoids indiscriminate processing, ensuring the normal functional integrity of the target code to the greatest extent while accurately removing or correcting malicious code.

[0115] Please see Figure 2 As shown, an embodiment of this application provides a semantic analysis-based malware detection system. This semantic analysis-based malware detection system includes:

[0116] The code space identification module is used to determine the location of suspicious code within the terminal based on the monitoring behavior records of the security software within the terminal.

[0117] The code search module is used to search the space and extract the target code within the space;

[0118] The word sequence generation module is used to generate word sequences containing semantic information corresponding to the target code, based on the semantic feature extraction model and the text semantic classification model.

[0119] The word sequence correction module is used to correct word sequences based on their word order logic information.

[0120] The malicious code fragment identification module is used to analyze the corrected word sequence based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying the malicious code fragments within it.

[0121] The code modification operation module is used to perform code modification operations on the space based on the distribution characteristics of malicious code fragments.

[0122] The beneficial effects of the above embodiments are as follows: This semantic analysis-based malicious code detection system determines the space where suspicious code is located based on the monitoring behavior records of security software within the terminal, and extracts the target code within the space, effectively narrowing the subsequent malicious code detection range; based on the semantic feature extraction model and the text semantic classification model, it generates a word sequence containing semantic information corresponding to the target code, and corrects the word sequence to ensure that the word sequence has correct contextual logic; based on the deep text classification model, it analyzes the corrected word sequence to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it, and performing code modification operations on the space based on the distribution characteristics of malicious code fragments. At the same time, it uses the semantic feature extraction model and the text semantic classification model to perform global identification of the target code, taking into account both efficient and accurate analysis of code semantics, fully and comprehensively extracting the semantic information of the target code, identifying and locating malicious code components in massive amounts of target code, and improving the accuracy and reliability of the security software.

[0123] In another embodiment, the code space identification module is used to determine the space where suspicious code is located within the terminal based on the monitoring behavior records of the security software within the terminal, including:

[0124] Based on the time distribution information of the active state of the security software in the terminal, the active behavior log is extracted from the software operation log; the active behavior log is filtered by related behavior types to obtain the monitoring behavior records of the security software.

[0125] Analyze the monitoring behavior records to obtain the monitoring behavior characteristics of the security software for external code data; based on the monitoring behavior characteristics, determine the location of suspicious code within the terminal;

[0126] The code search module is used to search the space and extract target code within the space, including:

[0127] Based on the code change records of the space, determine the type information and change time information of all code within the space; based on the type information and change time information, search and extract the target code within the space.

[0128] The beneficial effects of the above embodiments are that security software installed inside computers and other terminals can inspect the code input into the terminal during interactions with the outside world, determine whether the code contains malicious code fragments, and promptly handle any malicious code fragments to ensure the security of terminal operation. Security software typically embeds corresponding semantic recognition models to traverse and search for code within the terminal. Regardless of the semantic recognition model used, the security software consumes the terminal's own computing and memory resources. To avoid excessive consumption of these resources by installed software, which could affect the normal operation of the terminal, pre-screening of the code within the terminal is necessary to remove target code that clearly does not contain malicious code. This effectively reduces the amount of target code that the security software needs to process. Therefore, based on the distribution information of the duration intervals during which the security software is active in the foreground within the terminal, the software operation logs are filtered to extract the active behavior log portion corresponding to the aforementioned duration intervals. This active behavior log portion contains the corresponding work behaviors performed by the security software during its foreground active state. The active behavior logs are then filtered by associated behavior types to determine the behavior records of the security software during foreground and background monitoring of the terminal. Since the security software only initiates monitoring behavior in the foreground or background when it detects suspicious code within the terminal, extracting the monitoring behavior records of the security software can accurately determine the storage space of the suspicious code detected by the security software within the terminal. This facilitates subsequent target code screening only for the corresponding storage space, reducing the workload of target code screening. Furthermore, during the operation of the terminal, the corresponding storage space will continuously undergo code writing and deletion operations, and the storage space will simultaneously contain multiple different types of code, not just the target code. In order to accurately filter the target code that has changed within a predetermined time range from the storage space, based on the code change records in the storage space, the type information of all code in the storage space and the time range information of the change are determined. In this way, the target code that has changed within the predetermined time range is searched and extracted from the storage space, and this is used as the valid target code. This can effectively reduce the workload of subsequent semantic recognition of the target code.

[0129] In another embodiment, the word sequence generation module is used to generate a word sequence containing semantic information corresponding to the target code based on a semantic feature extraction model and a text semantic classification model, including:

[0130] The target code is analyzed based on a semantic feature extraction model to obtain all word vectors corresponding to the target code; forward and backward analysis of the target code is performed based on a text semantic classification model to obtain all word vectors and word order features corresponding to the target code.

[0131] All word vectors generated by the semantic feature extraction model and all word vectors generated by the text semantic classification model are compared and corrected to obtain all valid word vectors corresponding to the target code; based on word order features and all valid word vectors, a word sequence containing semantic information corresponding to the target code is generated.

[0132] The word sequence correction module is used to correct word sequences based on their word order logic information, including:

[0133] Based on the word order logic information of the word sequence, identify the word order logic abnormal segments within the word sequence; based on the context of the word order logic abnormal segments, correct the word sequence.

[0134] The beneficial effects of the above embodiments are that the semantic feature extraction model can quickly identify the word vectors of text but cannot identify the word order features of text, while the text semantic classification model can perform forward and backward recognition of text and extract the word order features of text. Considering the text semantic recognition characteristics of the semantic feature extraction model and the text semantic classification model, in order to balance the fast and accurate recognition of the target code, the semantic feature extraction model is used to analyze the target code to obtain all the word vectors corresponding to the target code, and the text semantic classification model is used to perform forward and backward analysis of the target code to obtain all the word vectors and word order features corresponding to the target code. In this way, the word vectors of the target code can be identified by different models, which facilitates subsequent comparison and correction based on the word vectors identified by the above two models, thereby improving the reliability of the word vectors. Among them, the analysis of the target code by the semantic feature extraction model and the text semantic classification model is a conventional technical means in this field, and will not be described in detail here. Furthermore, the word vectors obtained by processing the target code using semantic feature extraction models and text semantic classification models are not entirely identical; local differences exist between them. By comparing the word vectors obtained from the two models, the credibility of each word vector in the differing local word vector parts is determined, and the local word vector parts with higher credibility are used as the final word vector parts, thus obtaining all valid word vectors corresponding to the target code. Then, based on word order features, all valid word vectors are sorted to generate a word sequence containing semantic information corresponding to the target code, ensuring that the generated word sequence can accurately reflect the global word vector distribution of the target code. Additionally, based on the word order logic information of the word sequence, anomalous segments within the word order logic are identified. These anomalous segments can be, but are not limited to, segments where the logical order of word vectors is reversed. Then, based on the context of these anomalous segments, the word sequence is corrected, for example, by adjusting the order of word vectors with reversed logical order within these segments.

[0135] In another embodiment, the malicious code fragment identification module is used to analyze the corrected word sequence based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments therein, including:

[0136] Based on a deep text classification model, deep text classification analysis is performed on the corrected word sequence to obtain the global text semantics of the target code; semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics, thereby identifying malicious code fragments in the target code;

[0137] The code modification operation module is used to perform code modification operations on the space based on the distribution characteristics of malicious code fragments, including:

[0138] Based on the distribution location characteristics and redundancy characteristics of malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments in the space.

[0139] The beneficial effects of the above embodiments are that the Deep Pyramid Convolutional Neural Network (DPCNN) model, as a deep text classification convolutional neural network model that is widely effective at the word level, can perform deep text classification analysis on word sequences composed of multiple word vectors. By performing deep text classification analysis on the corrected word sequences through the deep text classification model, the global text semantics of the target code are obtained. The global text semantics obtained in this way can accurately and comprehensively reflect the overall text semantic content of the target code. Then, semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics. The semantically abnormal intervals may include, but are not limited to, intervals containing predetermined text words or intervals with repeated text semantics within the global text semantics. Based on the position of the aforementioned semantically abnormal intervals within the global text semantics, the corresponding code segments within the target code are marked as malicious code segments. Furthermore, based on the distribution location and redundancy characteristics of malicious code fragments within the target code (such as the length of code fragments that repeatedly appear within the target code), targeted deletion and / or targeted correction can be performed on all malicious code fragments in the space (for example, replacing the corresponding malicious code fragments with normal code fragments of the same length based on the length of code fragments that repeatedly appear within the target code). This effectively removes malicious code fragments from within the target code, improves the accuracy and reliability of the security software, and ensures the normal operation of the terminal.

[0140] In another embodiment, based on the distribution location characteristics and distribution redundancy characteristics of the malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments within the space, including:

[0141] The distribution location features of the target code are retrieved, wherein the distribution location features include the total number of lines of the target code, the starting line number of the malicious code segment, the ending line number of the malicious code segment, the line number difference from the nearest execution entry point, and the number of key function calls within the segment;

[0142] The location criticality parameter corresponding to the target code is set using the distribution location characteristics of the target code;

[0143] The location criticality parameter is obtained using the following formula:

[0144]

[0145] Where P represents the location criticality parameter; X and Y represent the start and end line numbers of the malicious code segment; H represents the total number of lines of the target code; C represents the line number difference from the nearest execution entry point; N g This represents the number of critical function calls within the normalized segment;

[0146] The distribution redundancy features of the target code are retrieved, wherein the distribution redundancy features include the number of times identical malicious code segments appear in the global code and the average semantic similarity between the target code and other malicious code segments;

[0147] The redundancy level parameter is obtained by utilizing the distribution redundancy characteristics of the target code;

[0148] The redundancy parameter is obtained using the following formula:

[0149]

[0150] Where Q represents the redundancy parameter; M g S represents the number of times identical malicious code fragments appear in the global code after normalization; S represents the average semantic similarity between the target code and other malicious code fragments; S r This indicates a preset similarity reference value;

[0151] The severity parameters of the malicious code fragment are obtained using the location criticality parameter and the redundancy parameter.

[0152] The severity parameter of the malicious code fragment is obtained using the following formula:

[0153]

[0154] Where K represents the severity parameter of the malicious code fragment; P represents the location criticality parameter; and Q represents the redundancy parameter.

[0155] The beneficial effects of the above embodiments are that, by integrating two-dimensional parameters—location criticality and redundancy—an objective severity assessment standard is established, avoiding subjective or general judgments on the harm of malicious code segments. Based on quantified severity parameters, targeted deletion or correction operations can be precisely performed on malicious code segments of different harm levels, avoiding over-processing (mistakenly deleting normal code) or under-processing (missing high-risk malicious segments). By focusing on malicious code segments near the execution entry point and those with high correlation to key functions through location criticality parameters, it ensures that malicious segments with the greatest impact on the core execution logic of the code are given priority. Combined with distributed redundancy characteristics, high-frequency repetitive and semantically similar malicious code segments are effectively controlled, reducing the cumulative impact of redundant malicious segments. Using quantified parameters to guide processing actions avoids indiscriminate processing, ensuring the normal functional integrity of the target code to the greatest extent while accurately removing or correcting malicious code.

[0156] In summary, this semantic analysis-based malware detection method and system uses the monitoring behavior records of security software within the terminal to determine the space where suspicious code resides and extracts the target code within that space, effectively narrowing down the subsequent malware detection range. Based on a semantic feature extraction model and a text semantic classification model, it generates word sequences containing semantic information corresponding to the target code and corrects these word sequences to ensure they have correct contextual logic. A deep text classification model is used to analyze the corrected word sequences, obtaining the global text semantics of the target code. This identifies malicious code fragments within the target code and performs code modification operations based on the distribution characteristics of these malicious code fragments. Simultaneously, the semantic feature extraction model and text semantic classification model are used for global identification of the target code, balancing efficient and accurate semantic analysis. This comprehensive extraction of semantic information from the target code allows for the identification and location of malicious code components within massive amounts of target code, improving the accuracy and reliability of security software.

[0157] The above is only one specific embodiment of the present invention, and any improvements made based on the concept of the present invention shall be considered within the scope of protection of the present invention.

Claims

1. A malicious code detection method based on semantic analysis, characterized in that, include: Based on the monitoring behavior records of the security software within the terminal, the location of suspicious code within the terminal is determined; The space is searched to extract the target code within it; Based on the semantic feature extraction model and the text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated; the word sequence is corrected based on the word order logic information of the word sequence. The corrected word sequence is analyzed based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it; based on the distribution characteristics of the malicious code fragments, code modification operations are performed on the space.

2. The malicious code detection method based on semantic analysis as described in claim 1, characterized in that: Based on the monitoring behavior records of the security software within the terminal, the location of suspicious code within the terminal is determined; Searching the space and extracting the target code within the space includes: Based on the time distribution information of the active status of the security software in the terminal, the active behavior log portion is extracted from the software operation log; the active behavior log portion is filtered by associated behavior type to obtain the monitoring behavior record of the security software. The monitoring behavior records are analyzed to obtain the monitoring behavior characteristics of the security software for external code data; based on the monitoring behavior characteristics, the location of suspicious code within the terminal is determined. Based on the code change records of the space, determine the type information and change time information of all code in the space; based on the type information and the change time information, search and extract the target code within the space.

3. The malicious code detection method based on semantic analysis as described in claim 1, characterized in that: Based on the semantic feature extraction model and the text semantic classification model, a word sequence containing semantic information corresponding to the target code is generated; Based on the word order logic information of the word sequence, the word sequence is corrected, including: The target code is analyzed based on a semantic feature extraction model to obtain all word vectors corresponding to the target code; forward and backward analysis of the target code is performed based on a text semantic classification model to obtain all word vectors and word order features corresponding to the target code. All word vectors generated by the semantic feature extraction model and all word vectors generated by the text semantic classification model are compared and corrected to obtain all valid word vectors corresponding to the target code; based on the word order features and all valid word vectors, a word sequence containing semantic information corresponding to the target code is generated. Based on the word order logic information of the word sequence, identify the word order logic abnormal segments within the word sequence; and correct the word sequence based on the context of the word order logic abnormal segments.

4. The malicious code detection method based on semantic analysis as described in claim 1, characterized in that: The corrected word sequence is analyzed based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying malicious code fragments within it. Based on the distribution characteristics of the malicious code fragments, code modification operations are performed on the space, including: Based on a deep text classification model, the corrected word sequence is subjected to deep text classification analysis to obtain the global text semantics of the target code; Semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics, thereby identifying malicious code fragments in the target code; Based on the distribution location characteristics and redundancy characteristics of the malicious code fragments in the target code, all malicious code fragments in the space are subject to targeted deletion and / or targeted correction.

5. The malicious code detection method based on semantic analysis as described in claim 4, characterized in that: Based on the distribution location and redundancy characteristics of the malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments within the space, including: The distribution location features of the target code are retrieved, wherein the distribution location features include the total number of lines of the target code, the starting line number of the malicious code segment, the ending line number of the malicious code segment, the line number difference from the nearest execution entry point, and the number of key function calls within the segment; The location criticality parameter corresponding to the target code is set using the distribution location characteristics of the target code; The location criticality parameter is obtained using the following formula: Where P represents the location criticality parameter; X and Y represent the start and end line numbers of the malicious code segment; H represents the total number of lines of the target code; C represents the line number difference from the nearest execution entry point; N g This represents the number of critical function calls within the normalized segment; The distribution redundancy features of the target code are retrieved, wherein the distribution redundancy features include the number of times identical malicious code segments appear in the global code and the average semantic similarity between the target code and other malicious code segments; The redundancy level parameter is obtained by utilizing the distribution redundancy characteristics of the target code; The redundancy parameter is obtained using the following formula: Where Q represents the redundancy parameter; M g S represents the number of times identical malicious code fragments appear in the global code after normalization; S represents the average semantic similarity between the target code and other malicious code fragments; S r This indicates a preset similarity reference value; The severity parameters of the malicious code fragment are obtained using the location criticality parameter and the redundancy parameter. The severity parameter of the malicious code fragment is obtained using the following formula: Where K represents the severity parameter of the malicious code fragment; P represents the location criticality parameter; and Q represents the redundancy parameter.

6. A malicious code detection system based on semantic analysis, characterized in that, include: The code space identification module is used to determine the location of suspicious code within the terminal based on the monitoring behavior records of the security software within the terminal. The code search module is used to search the space and extract the target code within the space; The word sequence generation module is used to generate a word sequence containing semantic information corresponding to the target code based on the semantic feature extraction model and the text semantic classification model. A word sequence correction module is used to correct the word sequence based on the word order logic information of the word sequence; The malicious code fragment identification module is used to analyze the corrected word sequence based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying the malicious code fragments within it. The code modification operation module is used to perform code modification operations on the space based on the distribution characteristics of the malicious code fragments.

7. The malicious code detection system based on semantic analysis as described in claim 6, characterized in that: The code space identification module is used to determine the location of suspicious code within the terminal based on the monitoring behavior records of the security software within the terminal, including: Based on the time distribution information of the active status of the security software in the terminal, the active behavior log portion is extracted from the software operation log; the active behavior log portion is filtered by associated behavior type to obtain the monitoring behavior record of the security software. The monitoring behavior records are analyzed to obtain the monitoring behavior characteristics of the security software for external code data; based on the monitoring behavior characteristics, the location of suspicious code within the terminal is determined. The code search module is used to search the space and extract target code within the space, including: Based on the code change records of the space, determine the type information and change time information of all code in the space; based on the type information and the change time information, search and extract the target code within the space.

8. The malicious code detection system based on semantic analysis as described in claim 6, characterized in that: The word sequence generation module is used to generate a word sequence containing semantic information corresponding to the target code based on a semantic feature extraction model and a text semantic classification model, including: The target code is analyzed based on a semantic feature extraction model to obtain all word vectors corresponding to the target code; forward and backward analysis of the target code is performed based on a text semantic classification model to obtain all word vectors and word order features corresponding to the target code. All word vectors generated by the semantic feature extraction model and all word vectors generated by the text semantic classification model are compared and corrected to obtain all valid word vectors corresponding to the target code; based on the word order features and all valid word vectors, a word sequence containing semantic information corresponding to the target code is generated. The word sequence correction module is used to correct the word sequence based on the word order logic information of the word sequence, including: Based on the word order logic information of the word sequence, identify the word order logic abnormal segments within the word sequence; and correct the word sequence based on the context of the word order logic abnormal segments.

9. The malicious code detection system based on semantic analysis as described in claim 6, characterized in that: The malicious code fragment identification module is used to analyze the corrected word sequence based on a deep text classification model to obtain the global text semantics of the target code, thereby identifying the malicious code fragments within it, including: Based on a deep text classification model, deep text classification analysis is performed on the corrected word sequence to obtain the global text semantics of the target code; semantic content recognition is performed on the global text semantics to determine the semantically abnormal intervals within the global text semantics, thereby identifying the malicious code fragments of the target code; The code modification operation module is used to perform code modification operations on the space based on the distribution characteristics of the malicious code fragment, including: Based on the distribution location characteristics and redundancy characteristics of the malicious code fragments in the target code, all malicious code fragments in the space are subject to targeted deletion and / or targeted correction.

10. The malicious code detection system based on semantic analysis as described in claim 9, characterized in that: Based on the distribution location and redundancy characteristics of the malicious code fragments in the target code, targeted deletion and / or targeted correction are performed on all malicious code fragments within the space, including: The distribution location features of the target code are retrieved, wherein the distribution location features include the total number of lines of the target code, the starting line number of the malicious code segment, the ending line number of the malicious code segment, the line number difference from the nearest execution entry point, and the number of key function calls within the segment; The location criticality parameter corresponding to the target code is set using the distribution location characteristics of the target code; The location criticality parameter is obtained using the following formula: Where P represents the location criticality parameter; X and Y represent the start and end line numbers of the malicious code segment; H represents the total number of lines of the target code; C represents the line number difference from the nearest execution entry point; N g This represents the number of critical function calls within the normalized segment; The distribution redundancy features of the target code are retrieved, wherein the distribution redundancy features include the number of times identical malicious code segments appear in the global code and the average semantic similarity between the target code and other malicious code segments; The redundancy level parameter is obtained by utilizing the distribution redundancy characteristics of the target code; The redundancy parameter is obtained using the following formula: Where Q represents the redundancy parameter; M g S represents the number of times identical malicious code fragments appear in the global code after normalization; S represents the average semantic similarity between the target code and other malicious code fragments; S r This indicates a preset similarity reference value; The severity parameters of the malicious code fragment are obtained using the location criticality parameter and the redundancy parameter. The severity parameter of the malicious code fragment is obtained using the following formula: Where K represents the severity parameter of the malicious code fragment; P represents the location criticality parameter; and Q represents the redundancy parameter.

Images