Malicious code homologous detection method and device based on code semantic knowledge graph, medium and program product
Patent Information
- Application Number
- CN202611121548.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-27
- Publication Date
- 2026-10-16
AI Technical Summary
[0004]然而，现有方案均存在明显局限性：基于代码特征比对的现有方案无法有效识别跨平台移植的恶意代码，因为不同平台的代码结构和指令集存在差异；对代码混淆敏感，检测能力有限；基于行为特征分析的方案缺乏语义层面的理解，难以识别代码功能相同但实现方式不同的恶意代码，需要沙箱环境支持，分析效率低；基于代码结构分析的方案缺乏有效的跨平台语义映射方法，难以建立不同平台代码之间的对应关系，对代码结构变化敏感，适应性差
[0033]本发明实施例提供的基于代码语义知识图谱的恶意代码同源检测方法、设备、介质及程序产品，方法包括：采集不同平台的恶意代码样本，抽取代码实体；根据各代码实体以及实体间的语义关系，构建代码语义知识图谱；基于跨平台语义映射规则，在图谱中属于不同平台且功能等价的节点之间建立等价关系；根据图嵌入算法计算图谱中各节点的语义向量表示，得到语义嵌入向量；对属于同一恶意代码样本的语义嵌入向量进行图级聚合，得到样本级语义表示；基于样本级语义表示、跨平台等价节点覆盖率及图结构匹配结果计算恶意代码样本之间的相似度；最后，利用样本之间的相似度，确定各恶意代码样本之间的同源关系。本发明有效提高了恶意代码同源检测的效率与准确性。
Smart Images
Figure CN122926425A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of computer malware detection technology, and in particular to methods, devices, media, and program products for detecting the same source of malicious code based on code semantic knowledge graphs. Background Technology
[0002] Malicious code homology analysis is a crucial component of cybersecurity threat attribution. By analyzing the homology relationships between different malicious code samples, attacker identities can be traced, attack organizations identified, and attack trends predicted. For a malicious code homology detection system, cross-platform homology detection is extremely important, helping security analysts understand attack sources, identify attack organizations, and develop protection strategies.
[0003] Existing methods for malware same-origin analysis include: 1. Same-origin detection methods based on code feature comparison, which compare the static features of the code (such as function names, strings, import tables, etc.); 2. Same-origin detection methods based on behavioral feature analysis, which determine same-origin by analyzing the runtime behavior characteristics of malware; 3. Same-origin detection methods based on code structure analysis, which determine same-origin by analyzing the structural features of the code, such as control flow graphs and call graphs.
[0004] However, existing solutions all have obvious limitations: existing solutions based on code feature comparison cannot effectively identify malicious code ported across platforms because the code structure and instruction sets of different platforms are different; they are sensitive to code obfuscation and have limited detection capabilities; solutions based on behavioral feature analysis lack semantic understanding, making it difficult to identify malicious code with the same code function but different implementation methods, requiring sandbox environment support and having low analysis efficiency; solutions based on code structure analysis lack effective cross-platform semantic mapping methods, making it difficult to establish correspondence between code on different platforms, and are sensitive to changes in code structure with poor adaptability.
[0005] Therefore, there is an urgent need to invent a new method for malware same-origin analysis to solve the problems of low efficiency and poor accuracy in malware same-origin detection in existing technologies. Summary of the Invention
[0006] In view of this, embodiments of the present invention provide a method, device, medium, and program product for detecting malicious code from the same source based on code semantic knowledge graphs, which at least partially solves the problems existing in the prior art.
[0007] Other features and advantages of the invention will become apparent from the following detailed description, or may be learned in part by practice of the invention.
[0008] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:
[0009] According to a first aspect of the present invention, a method for detecting the same origin of malicious code based on a code semantic knowledge graph is provided, the method comprising:
[0010] Collect malicious code samples from different platforms and extract the code entities from the malicious code samples;
[0011] Construct semantic relationships between various code entities;
[0012] Construct a code semantic knowledge graph based on each code entity and the semantic relationships between them;
[0013] Based on pre-built cross-platform semantic mapping rules, equivalent correspondences are established between nodes that belong to different platforms and are functionally equivalent in the code semantic knowledge graph;
[0014] Based on the graph embedding algorithm, the semantic vector representation of each node in the code semantic knowledge graph is calculated to obtain the semantic embedding vector corresponding to the node;
[0015] Graph-level aggregation is performed on the semantic embedding vectors corresponding to nodes belonging to the same malicious code sample to obtain sample-level semantic representation; based on the sample-level semantic representation, cross-platform equivalent node coverage, and graph structure matching results, the similarity between each malicious code sample is calculated.
[0016] By utilizing the similarity between various malicious code samples, the common origin relationship among them can be determined.
[0017] Furthermore, the code entities include function entities, API entities, variable entities, class entities, basic block entities, string or constant entities, and permission behavior entities.
[0018] Furthermore, the semantic relationships include call relationships, data flow relationships, control flow relationships, inheritance relationships, string reference relationships, access permission relationships, and data source sink relationships.
[0019] Furthermore, based on each code entity and the semantic relationships between them, a code semantic knowledge graph is constructed, including:
[0020] By treating each code entity as a node and the semantic relationships between code entities as edges, a code semantic knowledge graph is constructed.
[0021] Furthermore, the code semantic knowledge graph is stored in a graph database.
[0022] Furthermore, the cross-platform semantic mapping rules include API mapping, instruction mapping and structure mapping, permission semantic mapping and behavior semantic mapping; wherein, when establishing equivalent correspondence, the call relationship, data flow relationship and control flow relationship in the code semantic knowledge graph are preserved.
[0023] Furthermore, by utilizing the similarity between various malware samples, the common origin relationship among the malware samples is determined, including:
[0024] The comprehensive similarity between malicious code samples is obtained based on semantic similarity, structural similarity, and cross-platform equivalent node coverage.
[0025] Determine whether the overall similarity between malicious code samples is greater than or equal to a preset similarity threshold;
[0026] If the overall similarity between malicious code samples is greater than or equal to a preset similarity threshold, then the malicious code samples are considered to be from the same source.
[0027] If the overall similarity between malicious code samples is less than the preset similarity threshold, then the malicious code samples are not from the same source.
[0028] According to a second aspect of the present invention, a malicious code homology detection device based on code semantic knowledge graph is provided, the device comprising: a processor and a memory;
[0029] The memory is used to store one or more program instructions;
[0030] The processor is configured to run one or more program instructions to perform the steps of the malicious code homology detection method based on code semantic knowledge graph as described in any of the preceding claims.
[0031] According to a third aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the computer program implements the steps of the malicious code homology detection method based on code semantic knowledge graph as described in any of the preceding claims.
[0032] According to a fourth aspect of the present invention, a computer program product is provided, the computer program product comprising a computing program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to implement the steps of the malicious code homology detection method based on code semantic knowledge graph as described in any of the preceding claims.
[0033] This invention provides a method, device, medium, and program product for detecting the same source of malicious code based on a code semantic knowledge graph. The method includes: collecting malicious code samples from different platforms and extracting code entities; constructing a code semantic knowledge graph based on each code entity and the semantic relationships between entities; establishing equivalence relationships between functionally equivalent nodes belonging to different platforms in the graph based on cross-platform semantic mapping rules; calculating the semantic vector representation of each node in the graph using a graph embedding algorithm to obtain semantic embedding vectors; performing graph-level aggregation on the semantic embedding vectors belonging to the same malicious code sample to obtain a sample-level semantic representation; calculating the similarity between malicious code samples based on the sample-level semantic representation, cross-platform equivalence node coverage, and graph structure matching results; and finally, determining the same source relationship between the malicious code samples using the similarity between samples. This invention effectively improves the efficiency and accuracy of malicious code same source detection. Attached Figure Description
[0034] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.
[0035] Figure 1 This is a flowchart illustrating the malicious code homology detection method based on code semantic knowledge graph provided in an embodiment of the present invention. Detailed Implementation
[0036] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0037] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0038] Figure 1 A flowchart of a malicious code homology detection method based on code semantic knowledge graph according to an embodiment of the present invention is shown.
[0039] like Figure 1 As shown, the malicious code homology detection method based on code semantic knowledge graph according to the present invention may include steps S100, S200, S300, S400, S500, S600 and S700.
[0040] In step S100, malicious code samples from different platforms are collected, and the code entities of the malicious code samples are extracted.
[0041] Specifically, the above steps include:
[0042] Collect malicious code samples from different platforms (Windows, Linux, Android, etc.) and build a sample library.
[0043] The malicious code on each platform is analyzed, and the code entities of the malicious code samples are extracted. The code entities include function entities, API entities, variable entities, class entities, basic block entities, string or constant entities, and permission behavior entities.
[0044] The expression for extracting function entities is Entity_Func = {f | f = (name, params, return, body)}, which is used to extract information such as function name, parameters, and return value.
[0045] The expression for API entity extraction is Entity_API = {api | api = (name, module,params)}, which is used to extract system call and library function call information.
[0046] The expression for variable entity extraction is Entity_Var = {v | v = (name, type, scope,value)}, which is used to extract information about global and local variables.
[0047] Next, in step S200, the semantic relationships between the code entities are constructed.
[0048] Specifically, the semantic relationships mentioned above include call relationships, data flow relationships, control flow relationships, inheritance relationships, string reference relationships, access permission relationships, and data source sink relationships.
[0049] The construction expression for the calling relationship is Rel_Call = {(f1, f2) | f1 calls f2}, which is used to establish calling dependencies between functions.
[0050] The data flow relationship construction expression Rel_DataFlow = {(v1, v2) | v1 data is passed to v2} is used to establish data transfer between variables.
[0051] In step S300, a code semantic knowledge graph is constructed based on each code entity and the semantic relationships between them.
[0052] Specifically, the above steps include:
[0053] By treating each code entity as a node and the semantic relationships between code entities as edges, a code semantic knowledge graph is constructed, which is then stored in a graph database.
[0054] Furthermore, each node in the aforementioned code semantic knowledge graph records the sample identifier, platform identifier, entity type, normalized semantic label, and confidence level, while each edge records the relationship type, direction, source evidence, and relationship weight. This enables the differentiation between the semantic structure within a sample and the equivalent correspondence across samples during subsequent aggregation.
[0055] Preferably, the present invention further includes: platform-independent semantic unit extraction, which unifies API calls, permission operations, data sources / sinks, control dependencies, and key strings into unified semantic nodes.
[0056] In step S400, based on pre-built cross-platform semantic mapping rules, equivalent correspondences are established between nodes that belong to different platforms and are functionally equivalent in the code semantic knowledge graph.
[0057] Specifically, the aforementioned cross-platform semantic mapping rules include API mapping, instruction mapping and structure mapping, permission semantic mapping and behavior semantic mapping.
[0058] The cross-platform semantic mapping expression for APIs is Map_API = {(api_win, api_linux) | api_win is functionally equivalent to api_linux}, which is used to establish the functional correspondence between APIs on different platforms; the permission semantic mapping expression is Map_Perm = {(perm_a, perm_b) | perm_a and perm_b correspond to the same resource access semantics}, which is used to establish the functional correspondence between permissions, system calls, or access to sensitive resources on different platforms.
[0059] This invention employs a cross-platform semantic alignment algorithm that preserves relationships, enabling semantic alignment of code across different platforms rather than simply comparing names or byte characteristics. Specifically, when establishing equivalence correspondences, the adjacency call relationships, upstream and downstream data flow relationships, and control dependencies of equivalent nodes are simultaneously verified; if only the node names are similar but the upstream and downstream relationships are inconsistent, the confidence level of the equivalence correspondence is reduced.
[0060] In step S500, the semantic vector representation of each node in the code semantic knowledge graph is calculated according to the graph embedding algorithm to obtain the semantic embedding vector corresponding to the node.
[0061] Specifically, the expression for the above graph embedding calculation is Emb(v)=GNN(G,v), which uses a graph neural network to calculate entity embeddings and preserve semantic information. Further, the set of nodes V_S belonging to the same malicious code sample S is aggregated to obtain the sample-level semantic representation Emb(S)=Pool({Emb(v)|v belongs to V_S}), where Pool is an attention pooling, average pooling, or weighted pooling function, and the weights are jointly determined by node type, cross-platform equivalence confidence, and relevance of malicious behavior.
[0062] In step S600, the semantic embedding vectors corresponding to nodes belonging to the same malicious code sample are aggregated at the graph level to obtain the sample-level semantic representation; based on the sample-level semantic representation, cross-platform equivalent node coverage and graph structure matching results, the similarity between each malicious code sample is calculated.
[0063] Specifically, the aforementioned similarity includes semantic similarity, structural similarity, and cross-platform equivalent node coverage.
[0064] The expression for semantic similarity is Sim_Sem = cosine(Emb(S1),Emb(S2)), the expression for structural similarity is Sim_Struct = Graph_Edit_Distance(G1,G2), and the expression for cross-platform equivalent node coverage is Sim_Map = |M_eq| / min(|V_1|,|V_2|), where M_eq is the set of equivalent nodes between two sample graphs that satisfy the cross-platform semantic mapping rules and whose relation confidence reaches the threshold, and V_1 and V_2 are the node sets of the two sample graphs, respectively.
[0065] Finally, in step S700, the similarity between each malicious code sample is used to determine the common origin relationship between the malicious code samples.
[0066] Specifically, the above steps include:
[0067] The comprehensive similarity between malicious code samples is obtained based on the semantic similarity, structural similarity, and cross-platform equivalent node coverage. The expression for the comprehensive similarity is Sim_Total=α·Sim_Sem+β·Sim_Struct+γ·Sim_Map, where α, β, and γ are weight coefficients, and α+β+γ=1.
[0068] Finally, determine whether the overall similarity between malicious code samples is greater than or equal to a preset similarity threshold. If the overall similarity between malicious code samples is greater than or equal to the preset similarity threshold, and the path of evidence from the same source covers key functional nodes and cross-platform equivalent nodes, then the malicious code samples are from the same source. If the overall similarity between malicious code samples is less than the preset similarity threshold, or the similarity mainly comes from low-discrimination nodes such as general library functions and system framework code, then the malicious code samples are not from the same source.
[0069] The path of common-origin evidence can be represented as Evidence_Path={v_i->v_j | v_i and v_j are cross-platform equivalent nodes and their upstream and downstream relationships satisfy the relationship preservation condition}. When outputting the common-origin relationship, the comprehensive similarity, equivalent node coverage, key functional node hit status, and common-origin evidence path are also output simultaneously to facilitate review by security analysts.
[0070] In addition, this embodiment of the invention also provides a malicious code same-origin detection device based on code semantic knowledge graph. The device includes: a processor and a memory; the memory is used to store one or more program instructions; the processor is used to run one or more program instructions to perform the steps of the malicious code same-origin detection method based on code semantic knowledge graph as described above.
[0071] In addition, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the malicious code homology detection method based on code semantic knowledge graph as described above.
[0072] In addition, embodiments of the present invention also provide a computer program product, which includes computer program instructions that, when executed by a processor, implement the steps of the malicious code homology detection method based on code semantic knowledge graph as described above.
[0073] To address the shortcomings of existing technologies, this invention employs a code semantic knowledge graph construction method, modeling code entities and their semantic relationships as a graph structure to achieve a deep understanding of code semantics. It designs a relationship-preserving cross-platform semantic mapping algorithm to establish semantic correspondences between codes on different platforms, and verifies mapping confidence through adjacency relationships, upstream and downstream data flow relationships, and control dependencies, supporting cross-platform homology detection. Furthermore, it adopts a sample-level graph embedding similarity calculation method, using graph neural networks to calculate entity embeddings, sample-level semantic representations, and homology evidence paths, improving the accuracy and interpretability of homology determination.
[0074] Compared with existing technologies, the present invention has the following technical advantages:
[0075] The overall technology chain is complete: the scattered and publicly available graphs, homology analysis, and graph learning are limited to an overall technology chain that maintains the alignment of relationships;
[0076] Strong cross-platform adaptability: It mitigates the impact of differences in operating systems and instruction sets through platform-independent semantic units;
[0077] Good interpretability: It outputs the path of evidence from the same source, which is convenient for manual review and substantive examination rebuttal;
[0078] Reduced false positive rate: Introducing attack intent Figure 1 Consistency and negative sample constraints distinguish between different source codes with the same function;
[0079] It facilitates the supplementation of experimental data: quantitative proofs can be formed around homology confidence, evidence path coverage, and cross-platform sample sets.
[0080] In this embodiment of the invention, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in this embodiment of the invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in this embodiment of the invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor reads information from the storage medium and, in conjunction with its hardware, completes the steps of the above methods. The storage medium can be memory, for example, volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM).The storage media described in the embodiments of this invention are intended to include, but are not limited to, these and any other suitable types of memory. Those skilled in the art will recognize that the functions described in one or more of the above examples can be implemented using a combination of hardware and software. When applied software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium accessible to general-purpose or special-purpose computers. Although the invention has been described in detail above with general description and specific embodiments, modifications or improvements can be made to it, which will be apparent to those skilled in the art. Therefore, all such modifications or improvements made without departing from the spirit of the invention are within the scope of protection claimed by this invention.
[0081] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent changes, or alterations made by those skilled in the art using the disclosed technical content shall fall within the protection scope of the present invention.
Claims
1. A method for detecting the same origin of malicious code based on code semantic knowledge graphs, characterized in that, The method includes: Collect malicious code samples from different platforms and extract the code entities from the malicious code samples; Construct semantic relationships between various code entities; Construct a code semantic knowledge graph based on each code entity and the semantic relationships between them; Based on pre-built cross-platform semantic mapping rules, equivalent correspondences are established between nodes that belong to different platforms and are functionally equivalent in the code semantic knowledge graph; Based on the graph embedding algorithm, the semantic vector representation of each node in the code semantic knowledge graph is calculated to obtain the semantic embedding vector corresponding to the node; Graph-level aggregation is performed on the semantic embedding vectors corresponding to nodes belonging to the same malicious code sample to obtain sample-level semantic representation; based on the sample-level semantic representation, cross-platform equivalent node coverage, and graph structure matching results, the similarity between each malicious code sample is calculated. By utilizing the similarity between various malicious code samples, the common origin relationship among them can be determined.
2. The malicious code homology detection method based on code semantic knowledge graph according to claim 1, characterized in that, The code entities include function entities, API entities, variable entities, class entities, basic block entities, string or constant entities, and permission behavior entities.
3. The malicious code homology detection method based on code semantic knowledge graph according to claim 1, characterized in that, The semantic relationships include call relationships, data flow relationships, control flow relationships, inheritance relationships, string reference relationships, access permission relationships, and data source sink relationships.
4. The malicious code homology detection method based on code semantic knowledge graph according to claim 1, characterized in that, Based on each code entity and the semantic relationships between them, a code semantic knowledge graph is constructed, including: By treating each code entity as a node and the semantic relationships between code entities as edges, a code semantic knowledge graph is constructed.
5. The malicious code homology detection method based on code semantic knowledge graph according to claim 1, characterized in that, The code semantic knowledge graph is stored in a graph database.
6. The malicious code homology detection method based on code semantic knowledge graph according to claim 1, characterized in that, The cross-platform semantic mapping rules include API mapping, instruction mapping and structure mapping, permission semantic mapping and behavior semantic mapping; wherein, when establishing equivalent correspondence, the call relationship, data flow relationship and control flow relationship in the code semantic knowledge graph are preserved.
7. The malicious code homology detection method based on code semantic knowledge graph according to claim 1, characterized in that, By utilizing the similarity between various malware samples, the common origin relationship among them can be determined, including: The comprehensive similarity between malicious code samples is obtained based on semantic similarity, structural similarity, and cross-platform equivalent node coverage. Determine whether the overall similarity between malicious code samples is greater than or equal to a preset similarity threshold; If the overall similarity between malicious code samples is greater than or equal to a preset similarity threshold, then the malicious code samples are considered to be from the same source. If the overall similarity between malicious code samples is less than the preset similarity threshold, then the malicious code samples are not from the same source.
8. A malicious code homology detection device based on code semantic knowledge graph, characterized in that, The device includes: a processor and a memory; The memory is used to store one or more program instructions; The processor is configured to run one or more program instructions to perform the steps of the malicious code homology detection method based on code semantic knowledge graph as described in any one of claims 1 to 7.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the malicious code homology detection method based on code semantic knowledge graph as described in any one of claims 1 to 7.
10. A computer program product, characterized in that, The computer program product includes computer program instructions that, when executed by a processor, implement the steps of the malicious code homology detection method based on code semantic knowledge graph as described in any one of claims 1 to 7.