Malicious sample static analysis method and device, electronic equipment and storage medium

Abstract

The present application provides a kind of malicious sample static analysis method, device, electronic equipment and storage medium, the method is used for malicious sample static analysis system, system includes: deterministic pipeline, big model and contract, contract includes the data contract in upper layer and the behavior contract in lower layer, data contract is intelligent index, behavior contract is analysis plan, deterministic pipeline is used to execute deterministic calculation, big model is used to execute semantic analysis, deterministic pipeline and big model are decoupled by data contract and behavior contract, and the intelligent index and analysis plan under output directory are used as interface between the two, method includes: receiving sample to be analyzed, by deterministic pipeline, pre-analysis is executed to sample to be analyzed, tool chain routing, post-processing and behavior enhancement, output structured product set;Big model is based on intelligent index and analysis plan, executes semantic analysis to structured product set, and outputs analysis report.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, electronic device, and storage medium for static analysis of malicious samples. Background Technology

[0002] Static malware analysis refers to the process of directly analyzing the file's structure, metadata, code bytes, and characteristic information without running malicious samples to determine whether the file is malicious, extract threat indices (IOCs), and analyze potential capabilities. It is a fundamental method of malware analysis.

[0003] In existing technologies, there are three main approaches to automated exploration of static malware analysis: Option 1: All-in-one solution for the entire large model.

[0004] This approach directly submits binary samples or their decompiled products to a large model for analysis, which has serious technical flaws: the large model cannot directly read the binary data; the decompiled product has a large number of functions, and direct injection will cause the context window to overflow; the analysis process relies on the probabilistic reasoning of the large model and is not reproducible; and the sample may contain embedded hint injection attacks that interfere with the large model's judgment.

[0005] Option 2: Pure rule detection scheme.

[0006] This solution uses feature signatures or pattern matching (such as YARA and Snort rules) to detect malicious samples. The technical problems are: it can only match known features and cannot detect unknown threats and zero-day samples; it cannot understand behavioral semantics; and it cannot generate human-readable analysis reports, thus limiting its practicality.

[0007] Option 3: Decompiler script plus manual analysis.

[0008] In this approach, the analyst uses a decompiler script to export the artifacts, and then manually reads and writes reports function by function. The technical problems are: it relies heavily on the analyst's experience, is slow, is difficult to scale, and the disordered organization of the artifacts leads to a lot of time being wasted on low-value functions.

[0009] Analysis reveals that each of the three approaches suffers from different technical problems: directly processing binary data using a large model presents issues of non-reproducibility and context overflow; pure rule-based detection can only match known features and cannot understand behavioral semantics; and decompiler scripts combined with manual analysis are slow, experience-dependent, and difficult to scale. It is evident that existing static analysis methods cannot meet practical needs. Therefore, there is an urgent need to provide a static analysis solution for malicious samples that can address at least one of the above technical problems. Summary of the Invention

[0010] This invention provides a method, apparatus, electronic device, and storage medium for static analysis of malicious samples. By decoupling the deterministic pipeline from the semantic analysis of the large model through a contract, and by implementing static analysis of malicious samples in a two-stage manner, it can achieve the dual advantages of deterministic reproducibility and semantic understanding.

[0011] On one hand, embodiments of the present invention provide a method for static analysis of malicious samples. The method is used in a static analysis system for malicious samples, the system comprising: a deterministic pipeline, a large model, and contracts. The contracts include a data contract at an upper layer and a behavioral contract at a lower layer. The data contract is an intelligent index, and the behavioral contract is an analysis plan. The deterministic pipeline is used to perform deterministic computation, and the large model is used to perform semantic analysis. The deterministic pipeline and the large model are decoupled through the data contract and the behavioral contract, and the two are interfaced through the intelligent index and analysis plan in the output directory. The method includes: Receive the sample to be analyzed, and perform pre-analysis, toolchain routing, post-processing and behavior enhancement on the sample through the deterministic pipeline, and output a set of structured products; The large model performs semantic analysis on the structured product set based on the intelligent index and the analysis plan, and outputs an analysis report.

[0012] Optionally, pre-analysis is performed on the sample to be analyzed, including: performing format recognition, compiler detection, packer detection, and toolchain routing decision on the sample to be analyzed; The format recognition includes: using a magic number-first recognition mechanism, combined with file type library completion and content sniffing script for recognition; The compiler detection includes: based on the order-sensitive decision chain, using the main recognition engine to perform recognition, and enabling old heuristic rules to fall back as a fallback for unmatched scenarios; The packing detection includes: multi-dimensional detection performed by fusing feature signature matching, section name feature verification, and high entropy value analysis of data; The routing decision includes: selecting a toolchain based on a decision tree model.

[0013] Optionally, the toolchain is executed on the sample to be analyzed, including: The routing decision-making toolchain includes: Native binary sample scheduling IDA or Ghidra; .NET invokes a dedicated decompiler; After the PyInstaller packager performs unpacking, it then connects to the native binary analysis pipeline. The compressed file is unpacked and its internal contents are recursively analyzed. Sniffing and parsing the execution content of script-type samples; The installation package performs static resource extraction; The decompiler runs in batch mode, exporting raw artifacts segmented by function granularity. These raw artifacts include: source code, import table, string table, and call graph.

[0014] Optionally, post-processing is performed on the sample to be analyzed, including: A smart index, analysis plan, auxiliary products, and product summary are generated for the sample to be analyzed. The intelligent index includes: sample identity, behavior score, key functions, critical paths, imported API classification, suspicious string highlighting, and full function directory; The analysis plan includes: a two-phase process, a hierarchical access control system, a security statement, and definition of report sections; The auxiliary products include: command distribution skeleton and candidate trap indicators.

[0015] Optionally, behavioral enhancements are performed on the sample to be analyzed, including: Based on the sample to be analyzed, multiple behavioral slices are generated, and evidence graphs, graph query lists, and readiness signals are output. Each step is independently fault-tolerant, and an empty slice is output when it fails, so that the process can be executed continuously. The multiple behavioral slices include: command distribution, decoder, shellcode, persistence, file corruption, C2, protocol, and configuration.

[0016] Optionally, the large model performs semantic analysis on the structured product set based on the intelligent index and the analysis plan, and outputs a static analysis report, including the following four stages: triage, deep analysis, analysis report generation, and rendering; The triage process includes the following three sub-steps: Sub-step 1: Scan the metadata and global data, read the summary, readiness signals, smart index, import table, and string table, identify APIs related to process injection, network, persistence, and anti-debugging, and dynamically parse API tags; Sub-step 2: Shallow code analysis of the critical path, including decompiling the entry function of the critical path, reading the six categories of behavior classification functions one by one, decompiling the top few high-scoring functions, and calling the critical segments of the graph; Sub-step 3: Classify and determine the case, and output a triage report; if the case is determined to be malicious or gray, then proceed to in-depth analysis; if the case is determined to be benign, then terminate the process early after obtaining the triage report. The depth analysis includes the following three sub-steps: Sub-step 1: In-depth code analysis of the critical path, including decompiling all critical functions, importing cross-references, and creating a complete call graph; Sub-step two: Supplementary analysis, reading the remaining key functions, string cross-references, and exported tables; Sub-step 3: Generate a report, which shall at least contain the analysis conclusions; The analysis report generation includes: Fill out the analysis report chapter by chapter according to the report template of the analysis plan. The chapters include: basic sample information, classification and determination, black-and-white qualitative and family identification, behavior flowchart, malicious function code analysis, landing files and system traces, network communication and command and control, anti-analysis and persistence, compromise indicators, summary and disposal suggestions. The rendering includes: Render the analysis report as a self-contained hypertext format, including inline behavioral flowcharts.

[0017] Optionally, the method further includes: constraining the behavior of the large model when analyzing malware based on an active hunting protocol to counteract the large model's tendency to arrive at hallucinatory denial conclusions; The active hunting protocol includes at least one of the following rules: Rule 1: Deterministic products are the starting point of the pursuit, not the final conclusion. Behavioral slice products serve as seeds for further pursuit by the larger model and cannot be directly used as the final judgment. Rule 2: An empty slice or a state of no discovery does not mean that evidence is missing. An undiscovered behavior slice only means that the evidence has not been recovered in the deterministic layer, and does not mean that the sample does not contain that behavior. Rule 3: A negative conclusion must be supported by a coverage proof. Before writing a negative conclusion, the corresponding behavioral domain of the large model must be in an inapplicable or exhausted static state in the coverage matrix; otherwise, the judgment must be suspended or dynamic data collection must be recommended. Rule 4: When there is positive evidence in the evidence ledger, the report must list it and must not make a gray judgment.

[0018] Optionally, the reading order of the large model is as follows: First, read the enhancement layer artifacts, then read the wide source code. The enhancement layer artifacts include: readiness signals, analysis briefings, command and control slices, graph summaries, and graph query lists.

[0019] Optionally, the report chapter definitions are designed as a single source of truth: the chapter structure is defined in one place and can be read jointly by integrity verification, planning guidance, and analyzer system prompts to eliminate definition drift; If a report section is malicious or grayed out, it will carry a depth indicator and a form-specific prompt to make the same set of section identifiers adaptable to multiple file forms. Among them, the behavior flowchart prompt for script form uses line numbers plus commands, and the malicious function prompt for compressed package form analyzes each internal file name and references its respective subdirectories. Changing the template means changing the contract: Maintaining the chapter definition block format, supporting report structure customization and automatic validation, so that the unified template can adapt to multiple forms and maintain contract consistency.

[0020] Optionally, the method further includes: during the analysis process, when decrypted products, unpacked files, or deobfuscated products appear, the large model can recursively call the deterministic pipeline for reanalysis based on a pre-set upper limit of depth layers, so as to close the recursive analysis loop.

[0021] Optionally, the large model is equipped with a fixed type of graph query interface to support fixed type graph queries and does not support open structured query language, so that the large model can locate behavioral evidence according to a predefined hunting path. The fixed type of graph query includes: command control path query, indirect call query, command dispatcher query, and decoder query.

[0022] On the other hand, embodiments of the present invention provide a static analysis device for malicious samples, the device comprising: The receiving module is used to receive the samples to be analyzed. A deterministic pipeline is used to perform pre-analysis, toolchain routing, post-processing, and behavior enhancement on the sample to be analyzed, and output a set of structured products; The large model is used to perform semantic analysis on the structured product set based on the intelligent index and the analysis plan, and output an analysis report.

[0023] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are connected; Memory, used to store computer programs; A processor is used to invoke a computer program stored in memory to perform any of the above methods.

[0024] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs any of the methods described above.

[0025] This invention provides a method, apparatus, electronic device, and storage medium for static analysis of malicious samples. The method is used in a static analysis system for malicious samples. The system includes a deterministic pipeline, a large model, and contracts. The contracts include a data contract at the upper layer and a behavioral contract at the lower layer. The data contract is an intelligent index, and the behavioral contract is an analysis plan. The deterministic pipeline performs deterministic computation, and the large model performs semantic analysis. The deterministic pipeline and the large model are decoupled through the data contract and the behavioral contract, and their interface is the intelligent index and analysis plan in the output directory. The method includes: receiving a sample to be analyzed; performing pre-analysis, toolchain routing, post-processing, and behavioral enhancement on the sample through the deterministic pipeline, outputting a set of structured products; and performing semantic analysis on the set of structured products based on the intelligent index and the analysis plan, and outputting an analysis report. This scheme decouples the deterministic pipeline from the semantic analysis of the large model through contracts, and implements static analysis of malicious samples through a two-stage approach, achieving both deterministic reproducibility and semantic understanding. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0027] Figure 1 A flowchart of a method for static analysis of malicious samples provided in an embodiment of the present invention; Figure 2 The overall architecture diagram of an end-to-end malicious sample static analysis scheme provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a scheme architecture for decoupling through contract provided in an embodiment of the present invention; Figure 4 A four-step execution flowchart of a deterministic pipeline is provided for embodiments of the present invention; Figure 5 A flowchart of a four-stage analysis of a large language model is provided for embodiments of the present invention. Figure 6 This invention provides an active hunting protocol coverage state constraint process. Figure 7 This is a block diagram of a static analysis device for malicious samples provided in an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0029] The terms "first," "second," etc., used in this invention are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and that the objects distinguished by "first," "second," etc., are generally of the same class.

[0030] The following is a brief explanation of the proper nouns and terms used in this patent application: The Active Hunt Protocol is a set of rules used to constrain the behavior of large language models in analyzing malware. Its core principle is to define behavioral slices produced by deterministic pipelines as "hunting seeds" rather than "final conclusions." Its four hard rules are: deterministic outputs are the starting point of the hunt, not the conclusion; empty slices do not equate to missing evidence; negative conclusions must correspond to exhaustive static or inapplicable states in the coverage matrix; and positive evidence must be reported and cannot be gray-judged. This protocol transforms "proving nothing" from a subjective judgment by the large model to an objective verification that requires the presentation of exhaustive states, thus combating the illusionary negative conclusions of the large model.

[0031] The contract is the interface agreement between the deterministic pipeline (zero-scale model) and the semantic analysis of the large language model (the latter half). It consists of an intelligent index (data contract, describing "which deliverables are readable") and an analysis plan (behavioral contract, describing "which files to read and which chapters to write in what order"). The two phases are decoupled through the contract and can evolve independently—when new deliverables are added to the pipeline, the plan automatically guides the large model to read them; when the large model is replaced, the deliverables do not need to be regenerated.

[0032] The technical solution of this patent application will be explained and illustrated through specific embodiments below.

[0033] One embodiment of this patent application provides a method for static analysis of malicious samples, such as... Figure 1As shown, the method is used in a malicious sample static analysis system. The system includes a deterministic pipeline, a large model, and contracts. The contracts include a data contract at the upper layer and a behavioral contract at the lower layer. The data contract is an intelligent index, and the behavioral contract is an analysis plan. The deterministic pipeline is used to perform deterministic computation, and the large model is used to perform semantic analysis. The deterministic pipeline and the large model are decoupled through the data contract and the behavioral contract, and the two are interfaced through the intelligent index and analysis plan in the output directory. The method includes the following steps 101-102: Step 101: Receive the sample to be analyzed, and perform pre-analysis, toolchain routing, post-processing and behavior enhancement on the sample through the deterministic pipeline to output a set of structured products; Step 102: The large model performs semantic analysis on the structured product set based on the intelligent index and the analysis plan, and outputs an analysis report.

[0034] Optionally, pre-analysis is performed on the sample to be analyzed, including: performing format recognition, compiler detection, packer detection, and toolchain routing decision on the sample to be analyzed; The format recognition includes: using a magic number-first recognition mechanism, combined with file type library completion and content sniffing script for recognition; The compiler detection includes: based on the order-sensitive decision chain, using the main recognition engine to perform recognition, and enabling old heuristic rules to fall back as a fallback for unmatched scenarios; The packing detection includes: multi-dimensional detection performed by fusing feature signature matching, section name feature verification, and high entropy value analysis of data; The routing decision includes: selecting a toolchain based on a decision tree model.

[0035] The data contract describes which artifacts are readable, while the behavior contract describes the order in which files are read and which chapters are written. The deterministic pipeline and the large model are decoupled from the analysis plan through intelligent indexes in the output directory, allowing them to evolve independently. When a new artifact is added to the pipeline, the plan automatically guides the large model to read it; when the large model is replaced, the artifacts do not need to be regenerated.

[0036] Optionally, the toolchain is executed on the sample to be analyzed, including: The routing decision-making toolchain includes: Native binary sample scheduling IDA or Ghidra; .NET invokes a dedicated decompiler; After the PyInstaller packager performs unpacking, it then connects to the native binary analysis pipeline. The compressed file is unpacked and its internal contents are recursively analyzed. Sniffing and parsing the execution content of script-type samples; The installation package performs static resource extraction; The decompiler runs in batch mode, exporting raw artifacts segmented by function granularity. These raw artifacts include: source code, import table, string table, and call graph.

[0037] Optionally, post-processing is performed on the sample to be analyzed, including: A smart index, analysis plan, auxiliary products, and product summary are generated for the sample to be analyzed. The intelligent index includes: sample identity, behavior score, key functions, critical paths, imported API classification, suspicious string highlighting, and full function directory; The analysis plan includes: a two-phase process, a hierarchical access control system, a security statement, and definition of report sections; The auxiliary products include: command distribution skeleton and candidate trap indicators.

[0038] Optionally, behavioral enhancements are performed on the sample to be analyzed, including: Based on the sample to be analyzed, multiple behavioral slices are generated, and evidence graphs, graph query lists, and readiness signals are output. Each step is independently fault-tolerant, and an empty slice is output when it fails, so that the process can be executed continuously. The multiple behavioral slices include: command distribution, decoder, shellcode, persistence, file corruption, C2, protocol, and configuration.

[0039] Optionally, the large model performs semantic analysis on the structured product set based on the intelligent index and the analysis plan, and outputs a static analysis report, including the following four stages: triage, deep analysis, analysis report generation, and rendering; The triage process includes the following three sub-steps: Sub-step 1: Scan the metadata and global data, read the summary, readiness signals, smart index, import table, and string table, identify APIs related to process injection, network, persistence, and anti-debugging, and dynamically parse API tags; Sub-step 2: Shallow code analysis of the critical path, including decompiling the entry function of the critical path, reading the six categories of behavior classification functions one by one, decompiling the top few high-scoring functions, and calling the critical segments of the graph; Sub-step 3: Classify and determine the case, and output a triage report; if the case is determined to be malicious or gray, then proceed to in-depth analysis; if the case is determined to be benign, then terminate the process early after obtaining the triage report. The depth analysis includes the following three sub-steps: Sub-step 1: In-depth code analysis of the critical path, including decompiling all critical functions, importing cross-references, and creating a complete call graph; Sub-step two: Supplementary analysis, reading the remaining key functions, string cross-references, and exported tables; Sub-step 3: Generate a report, which shall at least contain the analysis conclusions; The analysis report generation includes: Fill out the analysis report chapter by chapter according to the report template of the analysis plan. The chapters include: basic sample information, classification and determination, black-and-white qualitative and family identification, behavior flowchart, malicious function code analysis, landing files and system traces, network communication and command and control, anti-analysis and persistence, compromise indicators, summary and disposal suggestions. The rendering includes: Render the analysis report as a self-contained hypertext format, including inline behavioral flowcharts.

[0040] Optionally, the method further includes: constraining the behavior of the large model when analyzing malware based on an active hunting protocol to counteract the large model's tendency to arrive at hallucinatory denial conclusions; The active hunting protocol includes at least one of the following rules: Rule 1: Deterministic products are the starting point of the pursuit, not the final conclusion. Behavioral slice products serve as seeds for further pursuit by the larger model and cannot be directly used as the final judgment. Rule 2: An empty slice or a state of no discovery does not mean that evidence is missing. An undiscovered behavior slice only means that the evidence has not been recovered in the deterministic layer, and does not mean that the sample does not contain that behavior. Rule 3: A negative conclusion must be supported by a coverage proof. Before writing a negative conclusion, the corresponding behavioral domain of the large model must be in an inapplicable or exhausted static state in the coverage matrix; otherwise, the judgment must be suspended or dynamic data collection must be recommended. Rule 4: When there is positive evidence in the evidence ledger, the report must list it and must not make a gray judgment.

[0041] Optionally, the reading order of the large model is as follows: First, read the enhancement layer artifacts, then read the wide source code. The enhancement layer artifacts include: readiness signals, analysis briefings, command and control slices, graph summaries, and graph query lists.

[0042] Optionally, the report chapter definitions are designed as a single source of truth: the chapter structure is defined in one place and can be read jointly by integrity verification, planning guidance, and analyzer system prompts to eliminate definition drift; If a report section is malicious or grayed out, it will carry a depth indicator and a form-specific prompt to make the same set of section identifiers adaptable to multiple file forms. Among them, the behavior flowchart prompt for script form uses line numbers plus commands, and the malicious function prompt for compressed package form analyzes each internal file name and references its respective subdirectories. Changing the template means changing the contract: Maintaining the chapter definition block format, supporting report structure customization and automatic validation, so that the unified template can adapt to multiple forms and maintain contract consistency.

[0043] Optionally, the method further includes: during the analysis process, when decrypted products, unpacked files, or deobfuscated products appear, the large model can recursively call the deterministic pipeline for reanalysis based on a pre-set upper limit of depth layers, so as to close the recursive analysis loop.

[0044] Optionally, the large model is equipped with a fixed type of graph query interface to support fixed type graph queries and does not support open structured query language, so that the large model can locate behavioral evidence according to a predefined hunting path. The fixed type of graph query includes: command control path query, indirect call query, command dispatcher query, and decoder query.

[0045] Figure 2 This is a diagram illustrating the overall architecture of an end-to-end static analysis scheme for malicious samples, provided in an embodiment of the present invention. Upon receiving an unknown binary sample, the first half, executed by a deterministic pipeline (zero-scale model), performs pre-analysis, toolchain routing, decompilation and export, post-processing, and behavior enhancement, producing a structured product set. The second half, executed by a large model (also known as a proxy), reads and writes the analysis plan file by file and chapter by chapter, producing a complete static analysis report. The two stages (first and second half) are interfaced through an intelligent index (data contract) and an analysis plan (behavioral contract) in the output directory.

[0046] The core innovation of this solution architecture lies in decoupling.

[0047] Specifically, the deterministic pipeline handles deterministic computations (such as format recognition, decompilation, behavior scoring, behavior slice recovery, and defect index scanning), while the large model handles semantically-understanding judgments (such as family recognition, behavior flowcharts, code comments, classification, and report writing). After being decoupled through a contract, the two can evolve independently. When a new pipeline artifact is added, the plan automatically guides the agent to read it. When the agent replaces the large model, the artifact does not need to be regenerated. The specific decoupling architecture is as follows: Figure 3 As shown.

[0048] The first half of the solution employs a deterministic toolchain pipeline with zero large model calls (referred to as: deterministic pipeline). The specific implementation process is as follows: Figure 4 As shown, it includes the following four steps: Step 1: Pre-analysis.

[0049] The pre-analysis of the sample to be analyzed includes: format recognition, compiler detection, packer detection and toolchain decision-making. Specifically, the format recognition includes: using a magic number-first recognition mechanism, combined with file type library completion and content sniffing script for recognition; The compiler detection includes: based on the order-sensitive decision chain, using the main recognition engine to perform recognition, and enabling old heuristic rules to fall back as a fallback for unmatched scenarios; The packing detection includes: multi-dimensional detection performed by fusing feature signature matching, section name feature verification, and high entropy value analysis of data; The routing decision includes: selecting a toolchain based on a decision tree model.

[0050] Step 2: Toolchain execution.

[0051] The toolchain for executing analysis on the sample includes: The routing decision-making toolchain includes: Native binary sample scheduling IDA or Ghidra; .NET invokes a dedicated decompiler; After the PyInstaller packager performs unpacking, it then connects to the native binary analysis pipeline. The compressed file is unpacked and its internal contents are recursively analyzed. Sniffing and parsing the execution content of script-type samples; The installation package performs static resource extraction; The decompiler runs in batch mode, exporting raw artifacts split by function. These raw artifacts include: source code, import table, string table, and call graph.

[0052] Step 3: Post-processing.

[0053] Post-processing is performed on the samples to be analyzed, including: Based on the sample to be analyzed, an intelligent index, analysis plan, auxiliary products, and product summary are generated. The intelligent index includes: sample identity, behavior score, key functions, critical paths, imported API classification, highlighting of suspicious strings, and a full function directory; The analysis plan includes: a two-phase process, a hierarchical access control system, a security statement, and definition of report sections; The auxiliary products include: command distribution skeleton and candidate trap indicators.

[0054] Step 4: Behavioral reinforcement.

[0055] Behavioral enhancements are performed on the sample to be analyzed, including: Based on the sample to be analyzed, multiple behavioral slices are generated, and evidence graphs, graph query lists, and readiness signals are output. Each step is independently fault-tolerant, and an empty slice is output when it fails, so that the process can be executed continuously. The multiple behavioral slices include: command distribution, decoder, shellcode, persistence, file corruption, C2, protocol, and configuration.

[0056] Through the above implementation steps, the entire process of the solution is made deterministic and reproducible, and the output serves as the input for the second half.

[0057] The latter half involves semantic analysis and report writing driven by a large model (or agent). Specifically, this latter half is executed by the large model in four phases according to the analysis plan, as follows: Figure 5 As shown.

[0058] Phase 1: Triage.

[0059] The triage stage can be divided into three sub-steps: Sub-step 1: Metadata and global scan, reading digests, readiness signals, smart indexes, import tables, and string tables, with a focus on identifying APIs and dynamically parsed API tags such as process injection, network, persistence, and anti-debugging; Sub-step 2: Shallow code analysis of the critical path, including decompiling the entry function of the critical path, the behavior classification function (reading through the six categories one by one), decompiling the top few high-scoring functions, and the key segments of the call graph; Sub-step 3: Classification and judgment, outputting triage report. Malicious or gray areas enter the deep stage, while benign cases are terminated early and only the triage report is completed.

[0060] Phase Two: In-depth Analysis.

[0061] The in-depth analysis phase consists of three sub-steps: Sub-step 1: In-depth code analysis of the critical path, including decompiling all critical functions, importing cross-references, and creating a complete call graph; Sub-step two: Supplementary analysis, reading the remaining key functions, string cross-references, and exported tables; Sub-step 3: Generate a report. The generated report should include at least the analysis conclusions.

[0062] Phase 3: Analysis report generation.

[0063] Fill out the analysis report chapter by chapter according to the report template of the analysis plan. The chapters include basic sample information, classification and determination, black-and-white qualitative analysis and family identification, behavior flowchart, malicious function code analysis, landing files and system traces, network communication and command and control, anti-analysis and persistence, compromise indicators, summary and disposal recommendations.

[0064] Phase Four, Rendering. Render the analysis report as a self-contained hypertext format, including inline behavioral flowcharts.

[0065] It should be noted that the proposed solution uses a two-stage orchestration process to prevent benign samples from entering deep analysis in order to save computational power for large models, while only malicious and gray samples undergo the complete deep analysis process.

[0066] One of the core innovations of this application is the use of an active hunting protocol to constrain the behavior of large models when analyzing malware, combating their tendency to negate conclusions through illusion. The specific constraint process is as follows: Figure 6 As shown.

[0067] The active hunting protocol may include at least one of the following rules: Rule 1: Deterministic products are the starting point for the pursuit, not the final conclusion. Behavioral slices and other products are only seeds for further pursuit by the larger model and cannot be directly used as the final judgment.

[0068] Rule 2: An empty slice or an undiscovered state does not equate to missing evidence. An undiscovered behavior slice only indicates that the deterministic layer has not recovered evidence, not that the sample does not contain that behavior. For example, it could be that the hash table uses an unknown algorithm, the stack string uses an unknown encoding, or the configuration only appears after dynamic decryption.

[0069] Rule 3: Negative conclusions must be supported by coverage proof. Before writing negative conclusions such as "no command control found" or "no network failure indicators" in a large model, the corresponding behavioral domain must be in an inapplicable or exhausted static state in the coverage matrix; otherwise, the judgment must be suspended or dynamic collection must be recommended.

[0070] Rule 4: Positive evidence must be reported and cannot be neutralized. When positive evidence exists in the evidence ledger (such as a restored command and control address), it must be reported and neutralized.

[0071] By adopting this proactive tracking protocol, the "proof of nothing" is transformed from a subjective judgment of the large model into an objective verification that requires the presentation of an exhaustive state. This allows the negative conclusion of the large model to be verified by mechanical gates, significantly reducing the risk of false negatives.

[0072] In this embodiment, a forced optimization is made to the reading order of the large model (i.e., the agent): the large model is required to read the readiness signal, analysis briefing, command and control slice, graph summary and graph query list and other enhancement layer products first, and then read the wide source code (such as the complete call graph).

[0073] The rationale for forcibly optimizing the reading order of large models is as follows: because the information density of wide source code is low and multiple searches are required to locate evidence, skipping the enhancement layer and directly searching the wide source code would cause the tool calls to escalate several times. The enhancement layer product is a high-density evidence anchor point that has been extracted from the deterministic pipeline. By adopting the optimized reading order (reading the enhancement layer first, then reading the wide source code), the large model can quickly obtain the skeleton and the extracted anchor points, effectively reducing illusions and invalid searches.

[0074] This invention designs the report chapter definition as a single source of truth: the chapter structure is defined in one place and read jointly by integrity verification, plan guidance, and analyzer system prompts, effectively eliminating definition drift. Chapters are marked with depth indicators (only for malicious or gray-area requirements) and form-specific prompts, allowing the same set of chapter identifiers to adapt to various file forms. For example, in script form, behavior flowchart prompts use line numbers followed by commands, rather than function addresses; in compressed file form, malicious function prompts are analyzed one by one according to internal filenames and references to their respective subdirectories.

[0075] Changing the template means changing the contract: As long as the chapter definition block format is maintained, the report structure can be customized and automatically validated. This design allows a unified template to adapt to various formats while maintaining contract consistency.

[0076] This invention supports a recursive analysis closed loop: during the analysis process, when decrypted products, unpacked files, or deobfuscated products appear, the agent can recursively call the deterministic pipeline to re-analyze them, setting a depth limit (e.g., five to ten layers) to prevent infinite recursion.

[0077] For example, if encrypted configurations are discovered during analysis, the agent can first read the code, determine the decryption chain (reverse order, add Base64, and then compression), chain-call data decryption tools to extract the command control configurations, and then recursively analyze the decrypted data. Similarly, if a compressed package contains an executable file, the deterministic pipeline automatically unpacks it and recursively analyzes the internal files. This closed loop forms an evidence chain of "analysis to decryption to re-analysis," covering multiple layers of obfuscated samples.

[0078] The embodiments of this invention provide fixed-type graph query interfaces for large models (such as command control path query, indirect call query, command dispatcher query, decoder query, etc., about twenty query families), rather than an open structured query language.

[0079] The large model uses a fixed-type graph query interface, which has the following technical advantages: Firstly, it can effectively prevent injection.

[0080] It supports fixed query types, does not accept arbitrary query statements, and the injection instructions embedded in the sample cannot be effective through the query interface; Secondly, focus on the chain of evidence.

[0081] Fixed query types guide large models to shift from "reading code" to "tracking evidence," locating behavioral evidence according to predefined tracking paths.

[0082] In the following embodiments, the technical solution of this application will be described in detail by taking the analysis of a sample suspected of being a remote access Trojan.

[0083] Users issue analysis commands to the agent, and the agent loads the workflow commands.

[0084] The first half: The deterministic pipeline pre-analyzes the sample as a native PE, routes it to the IDA toolchain for decompilation, and then generates a smart index (high behavior score, critical path from the entry point to several high-scoring functions, dynamic API restored, import classification including process injection and network), analysis plan (including security statement, activation access control, two-stage steps, report section), behavior slice (command control slice restored a host port, command distribution slice has skeleton), evidence graph and readiness signal.

[0085] The second half: The agent first reads the readiness report and briefing to understand the product quality, then reads the key functions and critical paths in the intelligent index, and performs triage according to plan—discovering process injection APIs, command control strings, and dynamic API parsing, determining it to be a malicious remote access Trojan, and proceeding to in-depth analysis. In in-depth analysis, evidence is tracing according to the active hunting protocol execution graph (command control source to sink path, command dispatcher, indirect calls, decoder), reading the full set of key functions for decompilation and cross-reference, decrypting the configuration and recursively analyzing the decrypted output, constructing a coverage matrix and evidence ledger (command control domain has positive evidence). Finally, a report is written chapter by chapter according to the report template (sample information, judgment, family identification, behavior flowchart, code analysis, landing files, network command control, anti-analysis, vulnerability indicators, summary), and rendered as a self-contained hypertext.

[0086] The entire process is governed by an active pursuit protocol: if the command and control domain has positive evidence, it must be reported and cannot be gray-judged; if a domain lacks evidence, a negative conclusion can only be written when the coverage matrix is ​​in an exhaustive static state. The final output is a static analysis report with anchored evidence, a clear behavioral flow, and complete trap indicators.

[0087] The end-to-end static analysis scheme for malicious samples proposed in this invention, based on the decoupling of deterministic pipeline and large-model semantic analysis, divides the analysis process into two main stages: the first half is a deterministic toolchain pipeline with zero large-model calls (triage stage zero), responsible for converting unknown binary samples into a set of structured outputs (including intelligent indexes and analysis plans); the second half is large-model-driven semantic analysis and report writing (triage stages one to four), where the large model (agent) reads files one by one, writes chapters one by one according to the analysis plan, and finally produces a complete static analysis report. The two stages are decoupled through the intelligent index (data contract) and analysis plan (behavioral contract) in the output directory.

[0088] This solution achieves a human-machine division of labor architecture of "reproducible preprocessing and auditable semantic judgment" through structured contracts, introduces an active hunting protocol to constrain the negative conclusions of the large model with deterministic coverage state, introduces triage and diversion to terminate benign samples in advance to save computing power, and enables the same toolchain to produce unified contracts for multiple file forms, realizing large-scale, reproducible and constrained end-to-end analysis of malicious samples.

[0089] Compared with the prior art, the embodiments of the present invention have at least the following beneficial effects: 1. Reproducible and auditable.

[0090] The deterministic pipeline features a zero-large-scale model, pure algorithms, and reproducibility, with independently auditable outputs. Semantic determination is executed by the large-scale model according to plan and is constrained by an active stalking protocol, making the analysis process verifiable. Compared to the unreproducible nature of the full-scale model approach and the lack of semantics in the pure rule-based approach, this approach achieves both deterministic reproducibility and semantic understanding.

[0091] 2. Reduced risk of underreporting.

[0092] The proactive hunting protocol uses state constraints to constrain the negative conclusions of large models, requiring that negative conclusions such as "no command and control found" must correspond to exhaustive static states, and that positive evidence must be reported and not gray-judged, which significantly reduces the underreporting caused by the illusionary negative conclusions of large models.

[0093] 3. Saves computing power.

[0094] Triage and triage prevent benign samples from entering in-depth analysis, thus avoiding wasting large model computing power on benign samples; forced reading order optimization significantly reduces the number of tool calls.

[0095] 4. Unified processing of multiple formats.

[0096] The report chapters feature unique prompts for a single source of truth and specific formats, enabling the same toolchain and templates to adapt to various file formats and reducing agent complexity.

[0097] 5. Multi-layer obfuscation and overlay.

[0098] The recursive analysis loop allows the decrypted, unpacked, and deobfuscated products to be reanalyzed, forming a chain of evidence across multiple obfuscation layers.

[0099] The solutions proposed in this invention enable large-scale, reproducible, and constrained end-to-end static analysis of malicious samples, balancing efficiency, accuracy, and auditability.

[0100] On the other hand, embodiments of the present invention provide a static analysis device for malicious samples, such as... Figure 7 As shown, the device includes: Receiver module 201 is used to receive the sample to be analyzed; The deterministic pipeline 202 is used to perform pre-analysis, toolchain routing, post-processing, and behavior enhancement on the sample to be analyzed, and output a set of structured products. The large model 203 is used to perform semantic analysis on the structured product set based on the intelligent index and the analysis plan, and output an analysis report.

[0101] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are connected; Memory, used to store computer programs; A processor is used to invoke a computer program stored in memory to perform any of the above methods.

[0102] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs any of the methods described above.

[0103] This invention provides a method, apparatus, electronic device, and storage medium for static analysis of malicious samples. The method is used in a static analysis system for malicious samples. The system includes a deterministic pipeline, a large model, and contracts. The contracts include a data contract at the upper layer and a behavioral contract at the lower layer. The data contract is an intelligent index, and the behavioral contract is an analysis plan. The deterministic pipeline performs deterministic computation, and the large model performs semantic analysis. The deterministic pipeline and the large model are decoupled through the data contract and the behavioral contract, and their interface is the intelligent index and analysis plan in the output directory. The method includes: receiving a sample to be analyzed; performing pre-analysis, toolchain routing, post-processing, and behavioral enhancement on the sample through the deterministic pipeline, outputting a set of structured products; and performing semantic analysis on the set of structured products based on the intelligent index and the analysis plan, and outputting an analysis report. This scheme decouples the deterministic pipeline from the semantic analysis of the large model through contracts, and implements static analysis of malicious samples through a two-stage approach, achieving both deterministic reproducibility and semantic understanding.

[0104] It should be noted that the content of the method embodiments and system embodiments provided in this patent application corresponds one-to-one with each other. The content involved in any embodiment can be referenced or combined with other embodiments to form part of that embodiment. For ease of description, this patent application focuses on explaining the method embodiments. The description of the relevant technical features and solutions of the device, system, electronic device, and computer-readable storage medium embodiments can be referred to the relevant content in the method embodiments.

[0105] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, systems, electronic devices, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0106] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0108] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A static analysis method for malicious samples, characterized in that, The method is used in a malicious sample static analysis system. The system includes a deterministic pipeline, a large model, and contracts. The contracts include a data contract at the upper layer and a behavioral contract at the lower layer. The data contract is an intelligent index, and the behavioral contract is an analysis plan. The deterministic pipeline performs deterministic computation, and the large model performs semantic analysis. The deterministic pipeline and the large model are decoupled through the data contract and the behavioral contract, and their interface is the intelligent index and analysis plan in the output directory. The method includes: Receive the sample to be analyzed, and perform pre-analysis, toolchain routing, post-processing and behavior enhancement on the sample through the deterministic pipeline, and output a set of structured products; The large model performs semantic analysis on the structured product set based on the intelligent index and the analysis plan, and outputs an analysis report.

2. The method according to claim 1, characterized in that, Pre-analysis is performed on the sample to be analyzed, including: format recognition, compiler detection, packer detection, and toolchain routing decision. The format recognition includes: using a magic number-first recognition mechanism, combined with file type library completion and content sniffing script for recognition; The compiler detection includes: based on the order-sensitive decision chain, using the main recognition engine to perform recognition, and enabling old heuristic rules to fall back as a fallback for unmatched scenarios; The packing detection includes: multi-dimensional detection performed by fusing feature signature matching, section name feature verification, and high entropy value analysis of data; The routing decision includes: selecting a toolchain based on a decision tree model; and / or, Execute the toolchain route for the sample to be analyzed, including: The routing decision-making toolchain includes: Native binary sample scheduling IDA or Ghidra; .NET invokes a dedicated decompiler; After the PyInstaller packager performs unpacking, it then connects to the native binary analysis pipeline. The compressed file is unpacked and its internal contents are recursively analyzed. Sniffing and parsing the execution content of script-type samples; The installation package performs static resource extraction; The decompiler runs in batch mode, exporting raw artifacts segmented at the function level. These artifacts include: source code, import tables, string tables, call graphs; and / or, Post-processing is performed on the sample to be analyzed, including: A smart index, analysis plan, auxiliary products, and product summary are generated for the sample to be analyzed. The intelligent index includes: sample identity, behavior score, key functions, critical paths, imported API classification, suspicious string highlighting, and full function directory; The analysis plan includes: a two-phase process, a hierarchical access control system, a security statement, and definition of report sections; The auxiliary products include: a command distribution skeleton, candidate failure indicators; and / or, Behavioral enhancements are performed on the sample to be analyzed, including: Based on the sample to be analyzed, multiple behavioral slices are generated, and evidence graphs, graph query lists, and readiness signals are output. Each step is independently fault-tolerant, and an empty slice is output when it fails, so that the process can be executed continuously. The multiple behavioral slices include: command distribution, decoder, shellcode, persistence, file corruption, C2, protocol, and configuration.

3. The method according to claim 1, characterized in that, The large model, based on the intelligent index and the analysis plan, performs semantic analysis on the structured product set and outputs a static analysis report, including the following four stages: triage, in-depth analysis, analysis report generation, and rendering. The triage process includes the following three sub-steps: Sub-step 1: Scan the metadata and global data, read the summary, readiness signals, smart index, import table, and string table, identify APIs related to process injection, network, persistence, and anti-debugging, and dynamically parse API tags; Sub-step 2: Shallow code analysis of the critical path, including decompiling the entry function of the critical path, reading the six categories of behavior classification functions one by one, decompiling the top few high-scoring functions, and calling the critical segments of the graph; Sub-step 3: Classify and determine the case, and output a triage report; if the case is determined to be malicious or gray, then proceed to in-depth analysis; if the case is determined to be benign, then terminate the process early after obtaining the triage report. The depth analysis includes the following three sub-steps: Sub-step 1: In-depth code analysis of the critical path, including decompiling all critical functions, importing cross-references, and creating a complete call graph; Sub-step two: Supplementary analysis, reading the remaining key functions, string cross-references, and exported tables; Sub-step 3: Generate a report, which shall at least contain the analysis conclusions; The analysis report generation includes: Fill out the analysis report chapter by chapter according to the report template of the analysis plan. The chapters include: basic sample information, classification and determination, black-and-white qualitative and family identification, behavior flowchart, malicious function code analysis, landing files and system traces, network communication and command and control, anti-analysis and persistence, compromise indicators, summary and disposal suggestions. The rendering includes: Render the analysis report as a self-contained hypertext format, including inline behavioral flowcharts.

4. The method according to claim 1, characterized in that, The method further includes: constraining the behavior of the large model when analyzing malware based on an active hunting protocol to counteract the large model's tendency to arrive at hallucinatory denial conclusions; The active hunting protocol includes at least one of the following rules: Rule 1: Deterministic products are the starting point of the pursuit, not the final conclusion. Behavioral slice products serve as seeds for further pursuit by the larger model and cannot be directly used as the final judgment. Rule 2: An empty slice or a state of no discovery does not mean that evidence is missing. An undiscovered behavior slice only means that the evidence has not been recovered in the deterministic layer, and does not mean that the sample does not contain that behavior. Rule 3: A negative conclusion must be supported by a coverage proof. Before writing a negative conclusion, the corresponding behavioral domain of the large model must be in an inapplicable or exhausted static state in the coverage matrix; otherwise, the judgment must be suspended or dynamic data collection must be recommended. Rule 4: When there is positive evidence in the evidence ledger, the report must list it and must not make a gray judgment.

5. The method according to claim 1, characterized in that, The reading order of the large model is as follows: First, read the enhancement layer artifacts, then read the wide source code. The enhancement layer artifacts include: readiness signals, analysis briefings, command and control slices, graph summaries, and graph query lists.

6. The method according to claim 1, characterized in that: The report chapter definitions are designed as a single source of truth: the chapter structure is defined in one place, which can be read by integrity verification, planning guidance, and analyzer system prompts to eliminate definition drift; If a report section is malicious or grayed out, it will carry a depth indicator and a form-specific prompt to make the same set of section identifiers adaptable to multiple file forms. Among them, the behavior flowchart prompt for script form uses line numbers plus commands, and the malicious function prompt for compressed package form analyzes each internal file name and references its respective subdirectories. Changing the template means changing the contract: Maintaining the chapter definition block format, supporting report structure customization and automatic validation, so that the unified template can adapt to multiple forms and maintain contract consistency.

7. The method according to claim 1, characterized in that, The method further includes: During the analysis, when decrypted, unpacked, or deobfuscated products appear, the large model can recursively call the deterministic pipeline for reanalysis based on a pre-set depth upper limit, thus closing the recursive analysis loop; and / or, The large model is equipped with fixed-type graph query interfaces to support fixed-type graph queries and does not support open structured query languages, so that the large model can locate behavioral evidence according to predefined hunting paths. The fixed-type graph queries include: command control path query, indirect call query, command dispatcher query, and decoder query.

8. A static analysis device for malicious samples, characterized in that, The device includes: The receiving module is used to receive the samples to be analyzed. A deterministic pipeline is used to perform pre-analysis, toolchain routing, post-processing, and behavior enhancement on the sample to be analyzed, and output a set of structured products; The large model is used to perform semantic analysis on the structured product set based on the intelligent index and the analysis plan, and output an analysis report.

9. An electronic device, characterized in that, include: Memory and processor, and the connection between memory and processor; Memory, used to store computer programs; A processor for invoking a computer program stored in memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-7.

Images