A dynamic detection method and system of malicious code based on double space embedding

Abstract

The application discloses a kind of dynamic detection method and system of malicious code based on double space embedding, applied to network security field, including obtaining and analyzing program running behavior event, extraction program interface identification and calling parameter;Interface identification is mapped to Euclidean space to obtain the first characteristic vector, calling parameter is mapped to hyperbolic space to obtain the second characteristic vector, and the comprehensive characteristic vector of behavior event is formed by fusion;According to the similarity degree of adjacent behavior event comprehensive characteristic vector, dynamically filter out multiple target behavior event sets associated with potential attack behavior;Based on each event set, the corresponding dynamic topology sequence is constructed, and the sequence is analyzed and processed, and the stage characteristic representation of each component element is extracted;According to stage characteristic representation, maliciousness determination and result output are completed.The dynamic detection method of malicious code based on double space embedding provided by the application can accurately detect multi-stage, high-concealment malicious code such as advanced persistent threat.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a dynamic detection method and system for malicious code based on dual-space embedding. Background Technology

[0002] With the continuous development of information technology, critical information infrastructure, especially control systems and data platforms in the power industry, has become a key target for cyberattacks. Attack methods are exhibiting a complex mix of advanced persistent threats, supply chain attacks, and ransomware, creating an unprecedented and urgent need for real-time, accurate threat detection technologies.

[0003] In existing technologies, malware detection methods primarily rely on fixed-time-window analysis. This involves first slicing runtime logs into segments of equal time intervals, and then independently analyzing or modeling the behavior within each time slice. However, since malware attacks are often a continuous process, this approach disrupts the natural continuity and semantic integrity of the attack over time, severing the intrinsic connection between early penetration actions and subsequent attack behaviors. This problem caused by the break in temporal context means that existing methods can only respond to local anomalies within a specific time window in actual deployments, significantly increasing the false negative rate for Advanced Persistent Threats (APTs). Furthermore, it makes it difficult for operations personnel to reconstruct a clear and complete attack chain during post-incident tracing. Summary of the Invention

[0004] This invention provides a dynamic detection method and system for malicious code based on dual-space embedding, which solves the technical problems of high false negative rate and difficulty in detecting multi-stage continuous attacks caused by the fragmentation of the temporal continuity of attack behavior in existing detection methods. It achieves the effect of accurate, real-time and correlational detection of highly concealed and continuously evolving malicious code.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a dynamic detection method for malicious code based on dual-space embedding, comprising: Acquire behavioral events of the program under test during its execution; Parse each of the aforementioned behavioral events to obtain the corresponding program interface identifier and call parameters; Each program interface identifier is mapped to Euclidean space to obtain a first feature vector, and each corresponding call parameter is mapped to hyperbolic space to obtain a second feature vector. By fusing the first feature vector and the corresponding second feature vector, a comprehensive feature vector for each of the behavioral events is obtained; Based on the similarity between adjacent behavioral events, a set of target behavioral events associated with each potential attack behavior is obtained from all the behavioral events, wherein the similarity is determined by the corresponding comprehensive feature vector; Based on each of the target behavior event sets, construct the corresponding dynamic topology sequence; Each of the aforementioned dynamic topology sequences is analyzed and processed to obtain the stage feature representation of each component element in the dynamic topology sequence; Based on the feature representations of each stage, the program to be detected is judged, and the judgment result of whether the program to be detected is malicious code is output.

[0006] As one preferred embodiment, the step of mapping each program interface identifier to Euclidean space to obtain a first feature vector includes: The program interface identifier is segmented to obtain a sub-word sequence; The word sequence is hashed and vectorized to obtain the first feature vector.

[0007] As one preferred embodiment, the step of mapping each of the corresponding calling parameters to hyperbolic space to obtain a second feature vector includes: The calling parameters are parsed to obtain a hierarchical sequence of path nodes; The path node sequence is input into the hyperbolic space embedding model to obtain the hyperbolic space vector corresponding to each node. The second eigenvector is obtained by averaging the hyperbolic space vectors of all the nodes.

[0008] As one preferred embodiment, the step of constructing a corresponding dynamic topology sequence based on each of the target behavior event sets includes: Based on the behavioral events of each target behavioral event set, a corresponding heterogeneous graph is constructed, wherein the heterogeneous graph has system security entities as nodes and interactions between the system security entities as edges; The heterogeneous graph is arranged according to the association order among the target behavior event sets to obtain the dynamic topology sequence.

[0009] As one preferred embodiment, the step of analyzing and processing each of the dynamic topology sequences to obtain the stage feature representation of each component element in the dynamic topology sequence includes: Identify the entity nodes shared between adjacent heterogeneous graphs in the dynamic topology sequence; The feature representation of the entity node is updated based on the node features of the entity node in the preceding heterogeneous graph and the connection relationship information in the current heterogeneous graph.

[0010] As one preferred embodiment, updating the feature representation of the entity node based on the node features of the entity node in the preceding heterogeneous graph and the connection relationship information in the current heterogeneous graph includes: A memory vector is assigned to the entity node, and the node features of the entity node in the preceding heterogeneous graph are used as the initial values ​​of the memory vector; The feature representation is updated based on the memory vector and the connection relationship information of the entity node in the current heterogeneous graph.

[0011] As one preferred embodiment, the determination of the program to be detected based on the feature representations of each stage includes: The stage feature representation is input into a classifier, which is a fully connected neural network. The determination result of the program to be detected is obtained based on the output of the classifier.

[0012] Another embodiment of the present invention provides a dynamic detection system for malicious code based on dual-space embedding, comprising: The behavior event acquisition module is used to acquire the behavior events of the program under test during its operation. The behavior event parsing module is used to parse each of the behavior events to obtain the corresponding program interface identifier and calling parameters; The feature mapping module is used to map each program interface identifier to Euclidean space to obtain a first feature vector, and to map each corresponding call parameter to hyperbolic space to obtain a second feature vector. The feature fusion module is used to fuse the first feature vector and the corresponding second feature vector to obtain a comprehensive feature vector for each of the behavioral events; An adaptive event filtering module is used to filter a set of target behavioral events associated with each potential attack behavior from all the behavioral events based on the similarity between adjacent behavioral events, wherein the similarity is determined by the corresponding comprehensive feature vector; A dynamic topology sequence construction module is used to construct corresponding dynamic topology sequences based on each of the target behavior event sets; The sequence analysis module is used to analyze and process each of the dynamic topology sequences to obtain the stage feature representation of each component element in the dynamic topology sequence. The determination module is used to determine the program to be detected based on the feature representations of each stage, and output the determination result of whether the program to be detected is malicious code.

[0013] Another embodiment of the present invention provides a dynamic detection device for malicious code based on dual-space embedding, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the dynamic detection method for malicious code based on dual-space embedding as described above.

[0014] In another embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, the dynamic detection method for malicious code based on dual-space embedding as described above is implemented.

[0015] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: (1) The dynamic detection method for malicious code based on dual-space embedding proposed in this invention generates a high-fidelity comprehensive feature vector by embedding and fusing dual-space features of the behavior time. Then, based on the similarity changes of adjacent events, it adaptively aggregates continuous behavior flows into semantically coherent target behavior event sets, where each set corresponds to a potential attack stage. Subsequently, a dynamic topological sequence is constructed based on each event set and cross-stage memory learning is performed, thereby completely preserving the temporal evolution logic of the attack chain. This method avoids the lack of attack behavior context caused by fixed window segmentation and significantly improves the detection rate and attack path integrity analysis capability for complex multi-stage attacks such as advanced persistent threats.

[0016] (2) This invention constructs a joint feature representation that simultaneously preserves semantic similarity and hierarchical structure information by mapping program interface identifiers and calling parameters to Euclidean and hyperbolic spaces and fusing them, thereby enhancing the model's robustness in identifying malicious code disguised by renaming, path obfuscation and other means; furthermore, by introducing memory units in the dynamic topology sequence to perform state tracking and incremental updates of cross-stage shared nodes, it realizes continuous perception and correlation analysis of attack modes such as long-term infiltration and slow penetration. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a dynamic detection method for malicious code based on dual-space embedding in one embodiment of the present invention. Figure 2 This is a schematic diagram of a dynamic detection system for malicious code based on dual-space embedding in one embodiment of the present invention; Figure 3 This is a structural block diagram of a dynamic detection device for malicious code based on dual-space embedding, according to one embodiment of the present invention.

[0018] Figure label: Among them, 11. Behavior event acquisition module, 12. Behavior event parsing module, 13. Feature mapping module, 14. Feature fusion module, 15. Adaptive event filtering module, 16. Dynamic topology sequence construction module, 17. Sequence analysis module, 18. Decision module, 21. Processor, 22. Memory. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0020] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0021] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. The terms "vertical," "horizontal," "left," "right," "upper," "lower," and similar expressions used herein are for illustrative purposes only and do not indicate or imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0022] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0023] One embodiment of the present invention provides a dynamic detection method for malicious code based on dual-space embedding. For details, please refer to [link to documentation]. Figure 1 , Figure 1 The diagram shown illustrates a dynamic detection method for malicious code based on dual-space embedding in one embodiment of the present invention, comprising steps S1 to S8: S1: Obtain behavioral events of the program under test during its execution; The ultimate harm of malicious code is manifested through a series of specific operations it performs on a controlled system. Static file analysis is easily bypassed by techniques such as packing and obfuscation. In this embodiment, by monitoring the actual operation of the program in a restricted environment (sandbox), its real and difficult-to-disguise dynamic behavioral fingerprints can be obtained. These behavioral events constitute the core data source for detection.

[0024] Specifically, the program to be tested is executed in an isolated dynamic sandbox environment (such as the Cuckoo Sandbox). The sandbox monitors the entire program execution process through system hooks, recording all API calls, file operations, registry accesses, and network communications in real time, and saving them as structured logs containing timestamps, process information, operation types, and detailed parameters. Then, the raw structured logs undergo key information extraction and normalization processing, extracting four core elements from each behavior record: process identifier, API name, call parameters, and timestamp. Each record thus constitutes an independent behavior event. The entire collection process continues until the program finishes running, obtaining a set of all behavior events generated by the program under test during its execution. These events form the basis for subsequent feature extraction, similarity calculation, and behavior aggregation.

[0025] S2: Parse each behavioral event to obtain the corresponding program interface identifier and call parameters; The behavior record extracted in step S1 still contains multiple pieces of information. It is necessary to separate the program interface identifier (usually an API function name) representing the "behavioral intent" and the call parameters representing the "operation object and context" from this composite information. These two are different in nature and require representation in entirely different mathematical spaces; mixing them will lead to information distortion.

[0026] Specifically, program interface identifiers are identified and extracted from the records of behavioral events. These identifiers typically explicitly indicate the names of system function calls, such as specific functions indicating memory operations or commands indicating process control. This identifier directly corresponds to the core action the code attempts to perform at runtime and is the primary basis for determining its behavioral category (e.g., stealing, destroying, hiding, propagating). Then, the supplementary information of the program interface identifier is parsed in a structured manner to obtain its call parameters. The parsing process is not simply extracting strings, but rather understanding the structure of the parameters based on the known semantics of the interface identifier. For example, when the interface identifier points to a file operation, the parameters will be parsed into a path structure with a clear parent-child hierarchy. The goal of the parsing is to transform unstructured text parameters into data structures that reflect their inherent logical relationships (e.g., containment, connection, and dependency relationships).

[0027] S3: Map each program interface identifier to Euclidean space to obtain the first feature vector, and map each corresponding call parameter to hyperbolic space to obtain the second feature vector; Program interface identifiers and call parameters have different data structures and semantic characteristics. The similarity of malicious API names is functional and semantic, while the inherent relationship of parameters such as file paths and registry paths is tree-like or hierarchical. If the same space is forcibly used to represent them, the natural relationship of the hierarchical structure will be distorted, or the subtle differences in semantics will be buried. Therefore, it is necessary to find appropriate spaces to represent them separately.

[0028] Preferably, in one embodiment of the present invention, mapping each program interface identifier to Euclidean space to obtain a first feature vector includes: The program interface identifier is segmented to obtain a sequence of sub-words; The word sequence is hashed and vectorized to obtain the first feature vector.

[0029] API names are compound words composed of English words or abbreviations with clear meanings. To capture their semantics, they are first segmented into sub-words, for example, WriteFile is split into ["Write", "File"]. This process transforms the name into a set of finer-grained semantic units. To avoid feature dimension explosion caused by the large number of API categories and to achieve generalization ability for newly emerging or rare API names, feature hashing is used. Feature hashing (also known as hashing trick) is a method in machine learning used to efficiently and consistently map high-dimensional, sparse categorical features (such as words in text or API sub-words) to a low-dimensional, dense vector space.

[0030] Specifically, a pre-defined hash function maps each subword to a specific index position in a fixed-size vector space (e.g., 128-dimensional). By accumulating at the corresponding position or using other methods, a fixed-dimensional, dense numerical vector, i.e., the first feature vector, is finally generated. This vector is located in Euclidean space, which makes the cosine distance between the vectors of APIs with similar functions relatively short, thus preserving the similarity of behavioral semantics in the vector space.

[0031] Preferably, in one embodiment of the present invention, mapping each corresponding calling parameter to hyperbolic space to obtain a second feature vector includes: The call parameters are parsed to obtain a hierarchical sequence of path nodes; Input the path node sequence into the hyperbolic space embedding model to obtain the hyperbolic space vector corresponding to each node; The second eigenvector is obtained by averaging the hyperbolic space vectors of all nodes.

[0032] For call parameters, especially file paths and registry paths with a clear hierarchical structure, hyperbolic space mapping is performed. Due to its negative curvature geometric properties, hyperbolic space can efficiently represent tree-like or hierarchical data with minimal distortion and dimensionality.

[0033] Specifically, a path string is first split according to a delimiter, resulting in a sequence of nodes from root to leaf. For uniform processing, a virtual common root node is added before all paths. Then, the Poincaré sphere model is used as the hyperbolic space embedding model. The Poincaré sphere model is an efficient representation of hyperbolic geometry, naturally matching tree-like hierarchical data. Through the negative curvature of space, it allows a large number of deep branch nodes to be accommodated near the center, thus enabling the expression of complex hierarchical structures with low-dimensional vectors without distortion. This solves the fundamental problem of dimensionality explosion or information distortion when representing tree-like data in Euclidean space.

[0034] This model optimizes and learns to map each unique path node to a point in hyperbolic space. For a complete path, its overall representation is obtained by calculating the Fréc-het mean (centroid in hyperbolic space) of the hyperbolic vectors of all nodes on the path; this mean vector is the second eigenvector of the parameter. This representation naturally preserves the hierarchical relationships between nodes: the distance between parent and child nodes in hyperbolic space, as well as the relationships between nodes at the same depth, are more intuitively preserved.

[0035] S4: Combine the first feature vector and the corresponding second feature vector to obtain the comprehensive feature vector of each behavioral event; Although dual-space mapping preserves the essence of heterogeneous information, subsequent processes require a unified and highly discriminative vector. Directly mixing vectors from different geometric spaces is ineffective. Therefore, a learnable alignment and fusion process is needed to project both into a common semantic subspace that is beneficial to the final detection task.

[0036] Specifically, the system acquires a pair of first feature vectors (Euclidean vectors) and second feature vectors (hyperbolic vectors). First, the hyperbolic vectors are mathematically transformed to approximately map to Euclidean space, enabling numerical operations with the first feature vector. Then, the two are concatenated to form an intermediate vector. This intermediate vector is input into a trainable projection module, typically a small fully connected neural network, such as a structure with two hidden layers. The number of neurons can be set to, for example, 64 and 16, respectively, using LeakyReLU as the activation function. Dropout with a ratio of 0.1 is introduced between layers to prevent overfitting. This projection module is trained end-to-end along with the subsequent detection model (including similarity calculation, graph neural network, and classifier). Training uses collected malicious code behavior log data, and the cross-entropy loss of the final malicious code classification task is used as the global optimization objective.

[0037] During training, the gradients from backpropagation simultaneously optimize the parameters of the projection module and other parts of the model. The sole objective of updating the parameters of the projection module is to learn how to transform the concatenated input vector so that its output composite feature vector can most effectively help the entire model complete the final classification task.

[0038] S5: Based on the similarity between adjacent behavioral events, a set of target behavioral events associated with each potential attack behavior is obtained from all behavioral events. The similarity is determined by the corresponding comprehensive feature vector. A complete malicious attack (such as an APT penetration) typically consists of a series of sub-actions that are sequential in time and logically step-by-step. Therefore, it is necessary to intelligently aggregate the event stream into multiple semantically complete "attack phases" based on the inherent coherence of the actions themselves in the feature space, rather than external clock scales, with each phase representing a relatively independent attack sub-target.

[0039] First, define the mixed similarity. Joint similarity between adjacent behavioral events u and v The similarity weights are calculated independently based on hyperbolic and Euclidean embeddings, with the weight coefficients (e.g., α=0.7, β=0.3) usually pre-set based on experimental results on the validation set or business experience (e.g., emphasizing API semantic similarity).

[0040] Suppose adjacent events and The eigenvectors in Euclidean space are respectively and Then the cosine similarity between the two is defined as: Let their eigenvectors in hyperbolic space be respectively and First, calculate the Poincaré distance: in, , , respectively, represent the magnitudes of the vectors in the Poincaré sphere model. Furthermore, distance is mapped to similarity using exponential decay: Here, γ is an adjustable hyperparameter used to control the sensitivity of similarity to distance.

[0041] After obtaining the similarity sequence of adjacent events, the system makes decisions based on a preset similarity threshold (e.g., 0.5). Specifically, the system starts with the first event in the behavioral event sequence, taking it as the starting event of the current attack phase. It then sequentially reads subsequent events, calculating the mixed similarity between each new event and the previous event. If the similarity is not lower than the threshold, the behavioral patterns of the two events are considered consistent, and the new event is assigned to the current phase. If the similarity is lower than the threshold, a significant shift in the behavioral pattern is considered, marking the end of the current attack phase and the beginning of a new phase. At this point, the system outputs the accumulated events as a target behavioral event set and begins constructing the next target behavioral event set starting from this new event. This process is repeated until the entire behavioral event sequence has been traversed.

[0042] S6: Construct the corresponding dynamic topology sequence based on each target behavior event set; Malicious attacks are essentially a series of interactions between system entities. Graphs are the most natural mathematical structure to depict the topology of such interactions. Constructing graph sequences can transform temporal attack chains into the evolution of spatial connection patterns, providing the model with relation-rich inputs.

[0043] Preferably, in one embodiment of the present invention, constructing a corresponding dynamic topology sequence based on each target behavior event set includes: Based on the behavioral events of each target behavioral event set, a corresponding heterogeneous graph is constructed. The heterogeneous graph uses system security entities as nodes and the interactions between system security entities as edges. The heterogeneous graph is arranged according to the association order between the target behavior event sets to obtain a dynamic topology sequence.

[0044] Specifically, for each target event set, a mapping is performed for each behavior event that has been parsed into a (subject, API, object, time) quadruple: the "subject" (usually a process) and "object" (such as a file, registry key, or network endpoint) are mapped to graph nodes, with the node type determined by the entity type. A directed edge is established between the subject node and the object node, with the edge type defined by the semantics of the API. After processing all events in an event set, a heterogeneous graph corresponding to that stage is generated, where nodes represent system security entities and edges represent interactions between entities. After completing the graph construction for all event sets, the corresponding heterogeneous graphs are arranged according to the order of the event sets in the original timeline, forming a dynamic topology sequence.

[0045] S7: Analyze and process each dynamic topology sequence to obtain the stage feature representation of each component element in the dynamic topology sequence; Since advanced attacks often reuse key entities (such as malicious processes and persistent files) across stages, analyzing each graph in isolation would sever these long-term dependencies. By introducing a memory mechanism, the model can track the state evolution of entities, thereby understanding the attacker's ongoing intent.

[0046] Preferably, in one embodiment of the present invention, each dynamic topology sequence is analyzed and processed to obtain a stage feature representation of each component element in the dynamic topology sequence. The analysis and processing includes: Identify shared entity nodes between adjacent heterogeneous graphs in a dynamic topology sequence; The feature representation of the entity node is updated based on the node features of the entity node in the preceding heterogeneous graph and the connection relationship information in the current heterogeneous graph.

[0047] Preferably, in one embodiment of the present invention, updating the feature representation of the entity node based on the node features of the entity node in the preceding heterogeneous graph and the connection relationship information in the current heterogeneous graph includes: Assign memory vectors to entity nodes and use the node features of the entity nodes in the preceding heterogeneous graph as the initial values ​​of the memory vectors; The feature representation is updated based on the memory vector and the connection information of entity nodes in the current heterogeneous graph.

[0048] Specifically, when processing the graph of the current stage, the system first identifies nodes that co-occur with the graph of the previous stage. These nodes represent key entities that continue to operate across stages. For each node, the system maintains a dedicated memory unit to store and update its feature state. If a node is appearing in the sequence for the first time, the system initializes its memory unit using its initial features (e.g., features extracted based on the behavioral event that first triggered the node).

[0049] If a node is shared across stages, the first step is to analyze its connectivity environment in the current stage graph. Graph neural network techniques (such as convolution) are used to aggregate information from its neighbors and edges, generating a contextual feature vector reflecting its current local behavior. Then, the historical feature vector stored in the node's memory unit, along with the current contextual feature vector obtained in the previous step, are input into a gated recurrent update unit. This unit fuses these two pieces of information, outputting an updated node feature vector that simultaneously reflects historical patterns and the latest behavior. The system calculates a dynamic weight to balance new information with old memories. This weight is automatically calculated based on the node's connectivity activity (such as changes in the number of edges) between the current and previous stages. Based on this weight, the system weighted and fused the updated node feature vector with the old feature vector in the memory unit, and writes the result back to the memory unit, completing the memory update. A higher weight indicates a greater focus on current new behavior, while a lower weight emphasizes preserving historical behavior patterns.

[0050] After completing the feature calculation and memory update of all nodes in a phase graph, the system integrates the features of all nodes in the graph through an aggregation function to generate a phase feature representation that represents the overall behavior pattern of that phase.

[0051] S8: Based on the feature representations at each stage, determine the program to be detected and output the result of whether the program to be detected is malicious code.

[0052] Preferably, in one embodiment of the present invention, the determination of the program to be detected is based on the feature representations of each stage, including: The stage feature representation is input into the classifier, which is a fully connected neural network. Based on the output of the classifier, the judgment result of the program to be detected is obtained.

[0053] Specifically, the feature representations of each stage are input into a classifier. In one embodiment of this invention, the classifier is a multilayer perceptron (MLP). The MLP contains at least one fully connected hidden layer and introduces nonlinearity using activation functions such as ReLU. The stage features can be concatenated or processed sequentially. The output layer of the MLP is set according to the task: for binary classification of malicious / benign, one output node is used in conjunction with the sigmoid function to output the probability of maliciousness; for multi-class classification of families, multiple output nodes are used in conjunction with the softmax function to output the family probability distribution. Finally, the system outputs a judgment result based on whether the output probability exceeds a preset threshold (e.g., 0.5) or the class with the highest probability.

[0054] When the final determination result is "malicious", the security system can immediately generate an alarm and link with devices such as endpoint protection or network firewalls to isolate, terminate or block the network communication of the malicious process, thereby achieving real-time containment of the attack.

[0055] Another embodiment of the present invention provides a dynamic detection system for malicious code based on dual-space embedding. For details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 The diagram shown illustrates a dynamic malware detection system based on dual-space embedding, according to one embodiment of the present invention, comprising: Behavior event acquisition module 11 is used to acquire behavior events of the program under test during its operation; The behavior event parsing module 12 is used to parse each behavior event and obtain the corresponding program interface identifier and call parameters; The feature mapping module 13 is used to map each program interface identifier to Euclidean space to obtain a first feature vector, and to map each corresponding call parameter to hyperbolic space to obtain a second feature vector; The feature fusion module 14 is used to fuse the first feature vector and the corresponding second feature vector to obtain the comprehensive feature vector of each behavioral event; The adaptive event filtering module 15 is used to filter out a set of target behavioral events associated with each potential attack behavior from all behavioral events based on the similarity between adjacent behavioral events. The similarity is determined by the corresponding comprehensive feature vector. The dynamic topology sequence construction module 16 is used to construct the corresponding dynamic topology sequence based on each target behavior event set; The sequence analysis module 17 is used to analyze and process each dynamic topology sequence to obtain the stage feature representation of each component element in the dynamic topology sequence. The judgment module 18 is used to judge the program to be detected based on the feature representation of each stage and output the judgment result of whether the program to be detected is malicious code.

[0056] See Figure 3 This is a structural block diagram of a dynamic detection device for malicious code based on dual-space embedding provided in an embodiment of the present invention. The dynamic detection device 20 for malicious code based on dual-space embedding provided in this embodiment includes a processor 21, a memory 22, and a computer program stored in the memory 22 and configured to be executed by the processor 21. When the processor 21 executes the computer program, it implements the steps described in the above embodiment of the dynamic detection method for malicious code based on dual-space embedding, for example... Figure 1The steps S1 to S8 described above; or, when the processor 21 executes the computer program, it implements the functions of each module in the above-described device embodiments, such as the behavior event acquisition module 11.

[0057] For example, the computer program can be divided into one or more modules, which are stored in the memory 22 and executed by the processor 21 to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in the device 20. For example, the computer program can be divided into a behavior event acquisition module 11, a behavior event parsing module 12, a feature mapping module 13, a feature fusion module 14, an adaptive event filtering module 15, a dynamic topology sequence construction module 16, a sequence analysis module 17, and a judgment module 18, with the specific functions of each module as follows: Behavior event acquisition module 11 is used to acquire behavior events of the program under test during its operation; The behavior event parsing module 12 is used to parse each behavior event and obtain the corresponding program interface identifier and call parameters; The feature mapping module 13 is used to map each program interface identifier to Euclidean space to obtain a first feature vector, and to map each corresponding call parameter to hyperbolic space to obtain a second feature vector; The feature fusion module 14 is used to fuse the first feature vector and the corresponding second feature vector to obtain the comprehensive feature vector of each behavioral event; The adaptive event filtering module 15 is used to filter out a set of target behavioral events associated with each potential attack behavior from all behavioral events based on the similarity between adjacent behavioral events. The similarity is determined by the corresponding comprehensive feature vector. The dynamic topology sequence construction module 16 is used to construct the corresponding dynamic topology sequence based on each target behavior event set; The sequence analysis module 17 is used to analyze and process each dynamic topology sequence to obtain the stage feature representation of each component element in the dynamic topology sequence. The judgment module 18 is used to judge the program to be detected based on the feature representation of each stage and output the judgment result of whether the program to be detected is malicious code.

[0058] The dynamic detection device 20 for malicious code based on dual-space embedding may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that the schematic diagram is merely an example of a dynamic detection device for malicious code based on dual-space embedding and does not constitute a limitation on the dynamic detection device 20 for malicious code based on dual-space embedding. It may include more or fewer components than illustrated, or combine certain components, or use different components. For example, the dynamic detection device 20 for malicious code based on dual-space embedding may also include input / output devices, network access devices, buses, etc.

[0059] The processor 21 can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 21 is the control center of the dual-space embedded malicious code dynamic detection device 20, connecting all parts of the device using various interfaces and lines.

[0060] The memory 22 can be used to store the computer programs and / or modules. The processor 21 implements various functions of the dynamic detection device 20 based on dual-space embedded malicious code by running or executing the computer programs and / or modules stored in the memory 22 and calling the data stored in the memory 22. The memory 22 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 22 may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0061] The module integrated into the dual-space embedded malicious code dynamic detection device 20, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0062] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0063] Accordingly, embodiments of the present invention provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform steps in the dynamic detection method for malicious code based on dual-space embedding as described in the above embodiments, for example... Figure 1 Steps S1 to S8 as described above.

[0064] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: (1) The present invention dynamically divides the attack stages based on the similarity of behavioral events in the joint feature space, realizes the semantic coherence modeling of continuous attack chains, avoids the loss of key attack context caused by manual segmentation, and thus significantly improves the correlation detection capability and attack source tracing integrity of long-term, multi-stage attacks such as APT.

[0065] (2) This invention models each attack phase as a heterogeneous graph and forms a time-series graph sequence. By introducing a cross-phase memory enhancement mechanism, incremental feature updates are performed on shared nodes instead of performing independent repeated calculations on each graph. This significantly reduces computational overhead while ensuring the capture of long-term dependencies, and achieves efficient and real-time dynamic behavior analysis.

[0066] (3) In the feature learning and aggregation stage, the present invention deeply integrates semantic, structural and temporal information, and focuses on key malicious behaviors through weighted methods such as attention mechanism, so that the model can effectively identify sparse but high threat attack signals, reduce false alarms caused by interference from benign system activities, and improve the credibility and availability of alarms.

[0067] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A dynamic detection method for malicious code based on dual-space embedding, characterized in that, include: Acquire behavioral events of the program under test during its execution; Parse each of the aforementioned behavioral events to obtain the corresponding program interface identifier and call parameters; Each program interface identifier is mapped to Euclidean space to obtain a first feature vector, and each corresponding call parameter is mapped to hyperbolic space to obtain a second feature vector. By fusing the first feature vector and the corresponding second feature vector, a comprehensive feature vector for each of the behavioral events is obtained; Based on the similarity between adjacent behavioral events, a set of target behavioral events associated with each potential attack behavior is obtained from all the behavioral events, wherein the similarity is determined by the corresponding comprehensive feature vector; Based on each of the target behavior event sets, construct the corresponding dynamic topology sequence; Each of the aforementioned dynamic topology sequences is analyzed and processed to obtain the stage feature representation of each component element in the dynamic topology sequence; Based on the feature representations of each stage, the program to be detected is judged, and the judgment result of whether the program to be detected is malicious code is output.

2. The dynamic detection method for malicious code based on dual-space embedding as described in claim 1, characterized in that, The step of mapping each program interface identifier to Euclidean space to obtain a first feature vector includes: The program interface identifier is segmented to obtain a sub-word sequence; The word sequence is hashed and vectorized to obtain the first feature vector.

3. The dynamic detection method for malicious code based on dual-space embedding as described in claim 1, characterized in that, The step of mapping each of the corresponding calling parameters to hyperbolic space to obtain a second feature vector includes: The calling parameters are parsed to obtain a hierarchical sequence of path nodes; The path node sequence is input into the hyperbolic space embedding model to obtain the hyperbolic space vector corresponding to each node. The second eigenvector is obtained by averaging the hyperbolic space vectors of all the nodes.

4. The dynamic detection method for malicious code based on dual-space embedding as described in claim 1, characterized in that, The construction of corresponding dynamic topology sequences based on each of the target behavior event sets includes: Based on the behavioral events of each target behavioral event set, a corresponding heterogeneous graph is constructed, wherein the heterogeneous graph has system security entities as nodes and interactions between the system security entities as edges; The heterogeneous graph is arranged according to the association order among the target behavior event sets to obtain the dynamic topology sequence.

5. The dynamic detection method for malicious code based on dual-space embedding as described in claim 4, characterized in that, The analysis and processing of each dynamic topology sequence to obtain the stage feature representation of each component element in the dynamic topology sequence includes: Identify the entity nodes shared between adjacent heterogeneous graphs in the dynamic topology sequence; The feature representation of the entity node is updated based on the node features of the entity node in the preceding heterogeneous graph and the connection relationship information in the current heterogeneous graph.

6. The dynamic detection method for malicious code based on dual-space embedding as described in claim 5, characterized in that, The step of updating the feature representation of the entity node based on the node features of the entity node in the preceding heterogeneous graph and the connection relationship information in the current heterogeneous graph includes: A memory vector is assigned to the entity node, and the node features of the entity node in the preceding heterogeneous graph are used as the initial values ​​of the memory vector; The feature representation is updated based on the memory vector and the connection relationship information of the entity node in the current heterogeneous graph.

7. The dynamic detection method for malicious code based on dual-space embedding as described in claim 1, characterized in that, The determination of the program to be detected based on the feature representations of each stage includes: The stage feature representation is input into a classifier, which is a fully connected neural network. The determination result of the program to be detected is obtained based on the output of the classifier.

8. A dynamic detection system for malicious code based on dual-space embedding, characterized in that, include: The behavior event acquisition module is used to acquire the behavior events of the program under test during its operation. The behavior event parsing module is used to parse each of the behavior events to obtain the corresponding program interface identifier and calling parameters; The feature mapping module is used to map each program interface identifier to Euclidean space to obtain a first feature vector, and to map each corresponding call parameter to hyperbolic space to obtain a second feature vector. The feature fusion module is used to fuse the first feature vector and the corresponding second feature vector to obtain a comprehensive feature vector for each of the behavioral events; An adaptive event filtering module is used to filter a set of target behavioral events associated with each potential attack behavior from all the behavioral events based on the similarity between adjacent behavioral events, wherein the similarity is determined by the corresponding comprehensive feature vector; A dynamic topology sequence construction module is used to construct corresponding dynamic topology sequences based on each of the target behavior event sets; The sequence analysis module is used to analyze and process each of the dynamic topology sequences to obtain the stage feature representation of each component element in the dynamic topology sequence. The determination module is used to determine the program to be detected based on the feature representations of each stage, and output the determination result of whether the program to be detected is malicious code.

9. A dynamic detection device for malicious code based on dual-space embedding, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the dynamic detection method for malicious code based on dual-space embedding as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the dynamic detection method for malicious code based on dual-space embedding as described in any one of claims 1 to 7.

Images