Conversion device, conversion method, and conversion program

Abstract

To accurately and efficiently identify the behavior of malware. [Solution] The conversion device 10 of the embodiment has an API analysis unit 151 and a macro name selection unit 152. The API analysis unit 151 extracts candidate macro names corresponding to immediate values ​​given as arguments to APIs using a language model, based on lines containing APIs extracted from the decompiled code. The macro name selection unit 152 selects a macro name corresponding to an immediate value from among the candidate macro names.

Description

Technical Field

[0001] The present invention relates to a conversion device, a conversion method, and a conversion program.

Background Art

[0002] In order to identify the behavior of malware, it is important to understand the behavior of the API (Application Programming Interface) functions of the decompiled code. At that time, it is useful to identify the macro name corresponding to the immediate value passed as an argument to the API. Conventionally, a DB capable of resolving the macro name corresponding to the immediate value has been published (for example, see Non-Patent Document 1).

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in conventional techniques, it may be difficult to accurately and efficiently identify the behavior of malware.

[0005] According to the aforementioned DB, the immediate value can be uniquely narrowed down from the macro name. On the other hand, especially when the number of digits of the immediate value is small, there may be a large number of target candidates for the macro name corresponding to the immediate value. For this reason, in conventional techniques, forward lookup to identify the immediate value from the macro name is possible, but reverse lookup to identify the macro name from the immediate value may not be possible. As a result, it becomes difficult to identify the behavior of the API function.

[0006] Therefore, the present invention aims to accurately and efficiently identify the behavior of malware. [Means for solving the problem]

[0007] To solve the aforementioned problems, the conversion device of the present invention is characterized by comprising: an API analysis unit that extracts candidate macro names corresponding to immediate values ​​given as arguments to an API based on a line containing an API extracted from decompiled code, using a language model; and a macro name selection unit that selects a macro name corresponding to the immediate value from among the candidate macro names. [Effects of the Invention]

[0008] According to the present invention, the behavior of malware can be identified accurately and efficiently. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 shows an example of the configuration of the conversion device according to the first embodiment. [Figure 2] Figure 2 shows an example of the API call portion of the decompiled code. [Figure 3] Figure 3 shows an example of an API definition. [Figure 4] Figure 4 shows an example of a macro definition. [Figure 5] Figure 5 shows the processing flow of the conversion device. [Figure 6] Figure 6 shows an example of a prompt. [Figure 7] Figure 7 shows an example of decompiled code. [Figure 8] Figure 8 shows an example of the output results of LLM. [Figure 9] Figure 9 shows an example of a prompt. [Figure 10] Figure 10 shows an example of the output results of LLM. [Figure 11] Figure 11 shows an example of the output results of LLM. [Figure 12] FIG. 12 is a diagram showing the processing flow of the conversion device. [Figure 13] FIG. 13 is a diagram showing an example of a prompt. [Figure 14] FIG. 14 is a diagram showing an example of the output result of the LLM. [Figure 15] FIG. 15 is a diagram showing the processing flow of the conversion device. [Figure 16] FIG. 16 is a diagram showing an example of a prompt. [Figure 17] FIG. 17 is a diagram showing an example of the output result of the LLM. [Figure 18] FIG. 18 is a flowchart showing the flow of processing of the conversion device. [Figure 19] FIG. 19 is a diagram showing a configuration example of a computer that executes a conversion program. <00​​​​​​​​​​​​​​​​​​​​​​

[0014] Decompilation in the first embodiment may be performed using an existing decompiler. For example, IDA Pro (reference URL: https: / / hex-rays.com / decompiler) and Ghidra (reference URL: https: / / ghidra-sre.org / ) are known as decompilers.

[0015] As shown in Figure 1, the conversion device 10 includes a communication unit 11, an input unit 12, an output unit 13, a storage unit 14, and a control unit 15.

[0016] The communication unit 11 is a module for data communication with other devices. The communication unit 11 is, for example, a NIC (Network Interface Card). The input unit 12 is an interface connected to input devices such as a mouse and a keyboard. The output unit 13 is an interface connected to output devices such as a speaker and a display.

[0017] The memory unit 14 stores data, programs, etc., that are referenced when the control unit 15 performs various processes. The memory unit 14 is implemented by semiconductor memory elements such as RAM (Random Access Memory) and flash memory, or by storage devices such as hard disks and optical discs. The memory unit 14 stores macro name DB141 and model information 142.

[0018] Macro name DB141 is a database that associates immediate values ​​with macro names. Macro name DB141 may be the database described in Non-Patent Document 1. Macro name DB141 is a database obtained by expanding macro names.

[0019] Model information 142 consists of parameters of the language model. For example, if the language model is a neural network, then model information 142 consists of parameters such as weights and biases. The language model in the first embodiment is an LLM. Furthermore, the LLMs described below are constructed based on model information 142.

[0020] Note that the macro name DB141 and model information 142 may be stored in a device outside the conversion device 10.

[0021] The control unit 15 is responsible for controlling the entire conversion device 10. The functions of the control unit 15 are realized, for example, by the CPU (Central Processing Unit) executing a program stored in the memory unit 14. The control unit 15 includes an API analysis unit 151, a macro name selection unit 152, and a macro name calculation unit 153.

[0022] The API analysis unit 151 extracts candidate macro names corresponding to immediate values ​​given as arguments to the API, based on the lines containing the API extracted from the decompiled code, using a language model. In doing so, the API analysis unit 151 analyzes the decompiled code using LLM and obtains information about the API and the immediate values ​​given as arguments to the API.

[0023] The macro name selection unit 152 selects a macro name that corresponds to an immediate value from among the candidate macro names based on the information obtained by the API analysis unit 151.

[0024] The macro name selection unit 152 can obtain the macro name by searching the macro name DB 141. The search of the macro name DB 141 may be performed using an existing tool (for example, idaMagnum, a plugin for IDA Pro (reference URL: https: / / github.com / lucasg / idamagnum)).

[0025] The macro name calculation unit 153 calculates and selects a combination of macro names when a single immediate value is composed of multiple macro names.

[0026] The following describes in detail the processing of the API analysis unit 151, the macro name selection unit 152, and the macro name calculation unit 153. First, the decompiled code and API will be explained using Figure 2. Figure 2 is a diagram showing an example of the API call portion of the decompiled code.

[0027] Figure 2 shows a portion of the decompiled code. "SHGetSpecialFolderPathA" is the API name. "HWND" is the argument type. "0x0", "7", and "0" are arguments given as immediate values.

[0028] Furthermore, the API "SHGetSpecialFolderPathA" is defined by its provider, Microsoft, as shown in Figure 3. Figure 3 is an example of the API definition. "HWND", "LPSTR", "int", and "BOOL" are the argument types. "hwnd", "pszPath", "csidl", and "fCreate" are argument names.

[0029] Figure 4 shows an example of a macro definition. The macro name DB141 stores macro definitions like those shown in Figure 4. A macro definition is a mapping between a macro name and an immediate value.

[0030] The macro names shown in Figure 4 have the macro prefix "CSIDL_". For example, "CSIDL_CONTROLS" is a macro name. The macro name "CSIDL_CONTROLS" is associated with the immediate value "0x0003". The macro name "CSIDL_CONTROLS" is also accompanied by the description "My Computer\Control Panel".

[0031] Figure 5 shows the processing flow of the conversion device. As shown in Figure 5, the API analysis unit 151 uses LLM to obtain API information from the decompiled code and performs analysis (step S11).

[0032] Here, V is a given immediate value. M is a macro name. Note that M is not shown in Figure 5, but will be shown later in Figure 12. m is a candidate macro name. v is a candidate immediate value for m. p is a macro prefix. Note that m1, m2, ..., mN represent N (N>1) candidate macro names.

[0033] For example, in step S11, the API analysis unit 151 inputs a prompt as shown in Figure 6 to the LLM, along with the decompiled code shown in Figure 7 (which is substituted for "code" in Figure 6). Figure 6 is an example of a prompt. Figure 7 is an example of decompiled code. Note that the API analysis unit 151 can automatically generate prompts.

[0034] The API analysis unit 151 then obtains the results shown in Figure 8. Figure 8 is a diagram showing an example of the LLM output. In Figure 8, the rows containing Windows APIs are shown in JSON format.

[0035] Furthermore, the API analysis unit 151 analyzes the arguments related to the immediate values ​​of each API shown in Figure 8 by inputting prompts as shown in Figure 9 to the LLM.

[0036] At this time, the API analysis unit 151 causes the LLM to search the macro name DB141 and obtains information containing a single candidate macro name "argument,V,m" or information containing multiple candidate macro names "argument,V,m1,m2,...mN".

[0037] Figure 10 shows an example of information containing multiple candidate macro names. Figure 10 is a diagram showing an example of LLM output. In Figure 10, multiple macro names, "HTTP_QUERY_STATUS_CODE" and "HTTP_QUERY_FLAG_NUMBER", correspond to a single immediate value 2. Figure 11 shows an example of information containing a single candidate macro name. Figure 11 is a diagram showing an example of LLM output.

[0038] In Figures 10 and 11, "API_Name" is the name of the API. "Argument_Number" is the argument number. "Argument_Name" is the argument name. "Immediate_Value" is the immediate value. "Microsoft_Defined_Name" is the candidate macro name.

[0039] For example, Figure 10 shows that the second argument of the API "HttpQueryInfoW" has the argument name "dwInfoLevel", its immediate value is "0x20000005", and that there are multiple macro names for a single immediate value, with the candidate macro name being "HTTP_QUERY_STATUS_CODE | HTTP_QUERY_FLAG_NUMBER".

[0040] For example, Figure 11 shows that the fourth argument of the API "VirtualAllocEx" has the argument name "flAllocationType", its immediate value is "0x1000", and the candidate macro name is "MEM_COMMIT".

[0041] For example, Figure 11 shows that the fifth argument of the API "VirtualAllocEx" has the argument name "flProtect", an immediate value of "4", and a candidate macro name "PAGE_READWRITE".

[0042] Furthermore, the genre indicated in the candidate macro name can be identified by its prefix. Since prefixes are semantically likely to be used consecutively with the target API, type, and argument, it is presumed that prefix-based determination is highly compatible with LLM, which relies on the probability of consecutive words appearing.

[0043] In this way, the API analysis unit 151 extracts lines containing APIs by inputting a prompt to the language model that specifies the extraction of lines containing APIs from the decompiled code, and uses the language model to extract candidate macro names corresponding to the immediate values ​​given as arguments to the APIs in the extracted lines.

[0044] Using Figure 12, we will explain the processing when the API analysis unit 151 obtains information "argument,V,m" containing a single candidate macro name. Figure 12 is a diagram showing the processing flow of the conversion device.

[0045] As shown in Figure 12, when the API analysis unit 151 obtains information "argument,V,m" containing a single candidate macro name, and there is only one combination of immediate value V and candidate macro name m in the macro name DB 141 (step S21: n=1), the macro name selection unit 152 selects the existing macro name as the macro name corresponding to the immediate value V.

[0046] If multiple combinations of immediate value V and candidate macro name m exist in macro name DB141, or if none exist (step S21: n != 1), the macro name selection unit 152 generates a prefix candidate p from the candidate macro name m (step S22).

[0047] For example, the macro name selection unit 152 obtains prefix candidates by deleting the part of the candidate macro name m that precedes the underscore. For example, from the candidate macro name "AA_BB_CC_DD", the prefix candidate "AA_BB_CC_" is obtained.

[0048] The macro name selection unit 152 determines that there is no solution, i.e., no macro name corresponding to the immediate value V, if no combination of a macro name containing the generated prefix candidate as a prefix and the immediate value V exists in the macro name DB 141 (step S23: n=0).

[0049] The macro name selection unit 152 selects the existing macro name as the macro name corresponding to the immediate value V if there is only one combination in the macro name DB 141 that includes the generated prefix candidate as a prefix and the immediate value V (step S23: n=1).

[0050] If there are multiple combinations of macro names containing the generated prefix candidates as prefixes and immediate values ​​V in the macro name DB141 (step S23: n>1), the macro name selection unit 152 performs macro name selection using LLM (step S24).

[0051] In macro name selection using LLM, the macro name selection unit 152 inputs a prompt as shown in Figure 13 into LLM, and selects a macro name based on the API name and argument information. Figure 13 shows an example of a prompt. The macro name selection unit 152 can automatically generate prompts.

[0052] Figure 14 shows an example of the LLM output. In this case, as shown in Figure 14, "WM_HOTKEY" is selected as the macro name corresponding to the second argument of the API "PostMessageA", which has an immediate value of "0x312".

[0053] In this way, the macro name selection unit 152 selects a macro name corresponding to an immediate value by inputting a prompt to the language model that specifies selecting a macro name corresponding to an immediate value from among multiple macro name candidates extracted by the API analysis unit 151 based on the information about the arguments.

[0054] Using Figure 15, we will explain the processing when the API analysis unit 151 obtains information containing multiple candidate macro names, namely "argument, V, m1, m2, ... mN". Figure 15 is a diagram showing the processing flow of the conversion device.

[0055] As shown in Figure 15, the macro name selection unit 152 obtains a corresponding candidate immediate value for each of the multiple (N) candidate macro names by searching the macro name DB 141 or by using the same macro name selection method as in Figure 12 using LLM (step S31). For example, candidate immediate value v1 corresponds to candidate macro name m1.

[0056] The macro name selection unit 152 determines whether the sum of the acquired candidate immediate values ​​(v1 + v2 + ... vN) is equal to the immediate value V (step S32). If the sum of the candidate immediate values ​​is equal to the immediate value V (step S32: Yes), the macro name selection unit 152 selects multiple candidate macro names m1, m2, ... mN as macro names M1, M2, ... MN corresponding to the immediate value V.

[0057] If the sum of the candidate immediate values ​​is not equal to the immediate value V (step S32: No), the macro name selection unit 152 generates prefix candidates p1, p2, ... pN from each of the multiple candidate macro names m1, m2, ... mN (step S33).

[0058] Furthermore, at this time, the macro name selection unit 152 can generate multiple prefix candidates from a single candidate macro name. For example, the macro name selection unit 152 obtains one or more prefix candidates by deleting the part of the candidate macro name before the underscore once or multiple times. For example, from the candidate macro name "AA_BB_CC_DD", the first prefix candidate "AA_BB_CC_", the second prefix candidate "AA_BB_", and the third prefix candidate "AA_" are obtained.

[0059] The macro name calculation unit 153 retrieves macro names containing the generated prefix candidate as a prefix from the macro name DB 141 (step S34). The macro name calculation unit 153 calculates combinations of multiple macro names containing the generated prefix candidate as a prefix using LLM (step S35). However, the condition that the sum of the immediate values ​​of the combinations is equal to the immediate value V is satisfied.

[0060] The macro name calculation unit 153 inputs prompts like those shown in Figure 16 into the LLM and calculates combinations of multiple macro names. Figure 16 shows an example of a prompt. The macro name calculation unit 153 can automatically create prompts.

[0061] In the example in Figure 16, possible prefixes include, for example, "HTTP_QUERY_FLAG_", "HTTP_QUERY_", and "HTTP_QUERY_CONTENT_". The prompt also has a condition that the sum of the immediate values ​​corresponding to the macro names included in the combination must be "0x20000005".

[0062] Figure 17 shows an example of the output of LLM. As shown in Figure 17, LLM obtains a combination of the macro name "HTTP_QUERY_FLAG_NUMBER" with an immediate value of "0x20000000" and the macro name "HTTP_QUERY_CONTENT_LENGTH" with an immediate value of "0x00000005".

[0063] In this way, the macro name calculation unit 153 selects a combination by inputting a prompt to the language model that specifies selecting a combination of macro names extracted by the API analysis unit 151 based on the argument information, such that the sum of the immediate values ​​corresponding to the macro names is equal to the immediate value given as an argument to the API.

[0064] [Processing according to the first embodiment] Figure 18 illustrates the processing flow of the conversion device. Figure 18 is a flowchart showing the processing flow of the conversion device.

[0065] As shown in Figure 18, first, the conversion device 10 extracts API lines from the decompiled code (step S101). For example, the conversion device 10 inputs the prompt shown in Figure 6 into the LLM along with the decompiled code to extract API lines.

[0066] Next, the conversion device 10 analyzes the arguments associated with the immediate values ​​in the API row (step S102). For example, the conversion device 10 inputs the prompt shown in Figure 9 into the LLM and performs the analysis.

[0067] Next, if the conversion device 10 obtains information containing a single candidate macro name through analysis, it selects a macro name based on the analysis results (step S103). For example, the conversion device 10 inputs the prompt shown in Figure 13 into the LLM to perform the selection.

[0068] Furthermore, if the conversion device 10 obtains information containing multiple candidate macro names through analysis, it calculates a combination of macro names that satisfies the conditions (step S104). For example, the conversion device 10 inputs the prompt shown in Figure 16 into the LLM to perform the calculation.

[0069] [Effects of the first embodiment] As explained above, the API analysis unit 151 extracts candidate macro names corresponding to immediate values ​​given as arguments to the API using a language model, based on the lines containing the API extracted from the decompiled code. The macro name selection unit 152 selects a macro name corresponding to the immediate value from among the candidate macro names.

[0070] In this way, the conversion device 10 can reduce manual operation and accurately analyze the decompiled code and select macro names by utilizing a language model. As a result, according to the first embodiment, the behavior of malware can be identified accurately and efficiently.

[0071] The API analysis unit 151 extracts lines containing APIs from the decompiled code by inputting a prompt to the language model that specifies the extraction of lines containing APIs. The language model then extracts candidate macro names corresponding to the immediate values ​​given as arguments to the APIs in the extracted lines. This allows the conversion device 10 to easily perform the process of analyzing the decompiled code and extracting lines containing APIs.

[0072] The macro name selection unit 152 selects a macro name corresponding to an immediate value by inputting a prompt to the language model that instructs the selection of a macro name corresponding to an immediate value from among multiple macro name candidates extracted by the API analysis unit 151, based on the information regarding the arguments. This allows the conversion device 10 to efficiently select a macro name even when there are multiple candidate macro names.

[0073] The macro name calculation unit 153 selects a combination of macro names based on the argument information by inputting a prompt to the language model that specifies selecting a combination of multiple macro names extracted by the API analysis unit 151 such that the sum of the immediate values ​​corresponding to the multiple macro names is equal to the immediate value given as an argument to the API. This allows the conversion device 10 to easily perform macro name selection involving calculations.

[0074] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, all or any part of the processing functions performed by each device can be realized by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0075] Furthermore, among the processes described in the embodiments described above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0076] [program] The aforementioned conversion device 10 can be implemented by installing a program (conversion program) as packaged software or online software on a desired computer. For example, by having the computer run the above program, the computer can function as the conversion device 10. The term "computer" here includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), as well as terminals such as PDA (Personal Digital Assistant).

[0077] Figure 19 shows an example configuration of a computer running a conversion program. Computer 1000 has, for example, memory 1010 and a CPU 1020. Computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0078] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM (Random Access Memory) 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0079] The hard disk drive 1090 stores, for example, the OS 1091, application program 1092, program module 1093, and program data 1094. That is, the program that defines each process executed by the conversion device 10 is implemented as a program module 1093 in which executable code for a computer is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing a process similar to the functional configuration in the conversion device 10 is stored in the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0080] Furthermore, the data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes them.

[0081] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070. [Explanation of Symbols]

[0082] 10 Conversion device 11 Communications Department 12 Input section 13 Output section 14 Storage section 15 Control Unit 141 Macro Name DB 142 Model Information 151 API analysis department 152 Macro Name Selection Section 153 Macro Name Calculation Unit

Claims

1. An API analysis unit extracts candidate macro names corresponding to immediate values ​​given as arguments to the API, based on lines containing APIs extracted from the decompiled code, using a language model. A macro name selection unit selects a macro name corresponding to the aforementioned immediate value from among the candidate macro names, A conversion device characterized by having the following features.

2. The API analysis unit extracts lines containing APIs by inputting a prompt to the language model that instructs it to extract lines containing APIs from the decompiled code, and uses the language model to extract candidate macro names corresponding to the immediate values ​​given as arguments to the APIs in the extracted lines. The conversion device according to feature 1.

3. The macro name selection unit selects the macro name corresponding to the immediate value by inputting a prompt to the language model that specifies selecting the macro name corresponding to the immediate value from among a plurality of macro name candidates extracted by the API analysis unit based on the information regarding the argument. The conversion device according to feature 1.

4. A macro name calculation unit selects a combination by inputting a prompt to the language model that specifies selecting a combination of macro names extracted by the API analysis unit based on the information regarding the arguments, such that the sum of the immediate values ​​corresponding to the macro names is equal to the immediate value given as an argument to the API. The conversion device according to claim 1, further comprising the following:

5. A conversion method performed by a computer, An API analysis step is performed by extracting lines containing APIs from the decompiled code, and using a language model, extracting candidate macro names corresponding to immediate values ​​given as arguments to the APIs. A macro name selection step in which a macro name corresponding to the aforementioned immediate value is selected from among the candidate macro names, A conversion method characterized by including [a specific component].

6. An API analysis step involves extracting candidate macro names corresponding to immediate values ​​given as arguments to the API, based on lines containing APIs extracted from the decompiled code, using a language model. A macro name selection step in which a macro name corresponding to the aforementioned immediate value is selected from among the candidate macro names, A conversion program characterized by having a computer execute it.

Images