CN116644422A - Malicious code detection method based on malicious block labeling and image processing - Google Patents

Abstract

The invention discloses a malicious code detection method based on malicious block marking and image processing, which belongs to the field of malicious code detection, including: (S1) dividing the binary file of the malicious code to be detected into a plurality of basic blocks, and detecting each basic block Whether the block is a malicious block, mark the location of the malicious block in the binary file; the malicious block is a basic block related to malicious functions; (S2) convert the binary file into a grayscale image, and improve the grayscale image corresponding to the malicious block Local contrast of part of the image to obtain the target grayscale image; (S3) input the target grayscale image to the trained malicious code classification model to predict the probability that the malicious code belongs to each family category, and determine the family category with the highest probability as malicious The family category the code belongs to. The invention can enhance the degree of influence of malicious function-related content in malicious codes on classification results, thereby improving the accuracy of malicious code classification.

Description

A Malicious Code Detection Method Based on Malicious Block Annotation and Image Processing

technical field

The invention belongs to the field of malicious code detection, and more specifically relates to a malicious code detection method based on malicious block marking and image processing.

Background technique

The network security industry has been committed to preventing malicious code attacks. Attackers can use malicious codes to infect victim devices to achieve the purpose of destroying the confidentiality and integrity of user and enterprise data resources. Therefore, it is necessary to accurately detect malicious codes and take corresponding measures , which is very important for ensuring network security.

Traditionally, malware detection or classification is performed through signature-based or heuristic methods. The signature-based method deploys signatures for different malware families and variants as prototypes, and allows the corresponding classification of newly discovered malware files to determine the corresponding family category. According to the characteristics of the malicious code of this type of family, Take corresponding countermeasures. In the past few years, Nataraj et al. have introduced a static malware analysis technique called malware visualization, where malware visualization is a technique that represents the content of a malware binary in some form as an image , specifically, the raw bytes of the malware binary are read as 8-bit unsigned integers and stored into a vector, which is reshaped into a matrix that can then be visualized as a grayscale image.

The malware analysis method for malware visualization described above effectively solves the problem of malware classification. However, since the malicious function of the entire malware is embedded in other non-malicious functions, that is to say, a considerable part of the malware has nothing to do with the malicious function, so the grayscale image converted from the entire malware binary file is directly processed When classifying, content irrelevant to malicious functions will affect the result of the entire classification, and the final classification accuracy cannot be guaranteed.

Contents of the invention

Aiming at the defects and improvement needs of the prior art, the present invention provides a malicious code detection method based on malicious block annotation and image processing. Improve the accuracy of malicious code classification, and facilitate the correct recognition and analysis of unknown malicious codes.

In order to achieve the above object, according to one aspect of the present invention, a malicious code detection method based on malicious block annotation and image processing is provided, including the following steps:

(S1) Divide the binary file of the malicious code to be detected into a plurality of basic blocks, and detect whether each basic block is a malicious block, and mark the position of the malicious block in the binary file; the malicious block is a basic block related to malicious functions ;

(S2) converting the binary file into a grayscale image, and improving the local contrast of the part of the image corresponding to the malicious block in the grayscale image to obtain the target grayscale image;

(S3) Input the target grayscale image into the trained malicious code classification model to predict the probability that the malicious code belongs to each family category, and determine the family category with the highest probability as the family category to which the malicious code belongs;

Wherein, the malicious code classification model is a neural network model, which is used to predict the probability that the malicious code corresponding to the input grayscale image belongs to each family category.

Further, in the step (S1), for any basic block, whether it is detected as a malicious block, the methods include:

Extract code features of basic blocks and convert them into feature vectors; code features include structural features, arithmetic instruction features, transfer instruction features and API call features;

The feature vector is input to the trained malicious block detection model, and the feature vector is extracted and reconstructed by the malicious block detection module to obtain the reconstructed feature;

If the difference between the reconstructed feature and the feature vector output by the malicious block detection module is greater than a preset threshold, it is determined that the basic block is a malicious block; otherwise, it is determined that the basic block is not a malicious block;

Among them, the malicious block detection model is a neural network model, which is used to extract and reconstruct the features of the input basic blocks, and its training methods include:

Collect binary files irrelevant to malicious functions, divide them into basic blocks and extract the code features of the basic blocks as benign samples to obtain a benign sample set;

Initialize the malicious block detection model, aim at minimizing the reconstruction loss, and use the benign sample set to train it. After the training, the trained malicious block detection model is obtained.

Further, the structural features include: the number of children and intermediate values of the basic block; the arithmetic instruction feature includes the basic mathematics, displacement instructions and the number of logical operations contained in the basic block; the transfer instruction feature includes stack operations, register operations and port operations in the basic block The number of operations; API call features include the number of calls to APIs related to dll, process, service, and system information in the basic block.

Further, the malicious block detection model is an autoencoder model.

Further, in step (S2), the local contrast of the part of the image corresponding to the malicious block in the grayscale image is improved by using a limited contrast adaptive histogram equalization algorithm.

Further, the malicious code classification model is a Vision Transformer model.

Further, in step (S2), the binary file is converted into a grayscale image, including:

Convert each 8 bits as a unit into an unsigned integer in code order, and store the value in an unsigned integer vector;

Convert the unsigned integer vector to a matrix, treat each element in the matrix as a pixel, and use the value of the element as the gray value of the corresponding pixel to obtain a gray image.

According to yet another aspect of the present invention, a computer-readable storage medium is provided, including: a stored computer program; when the computer program is executed by a processor, it controls the device where the computer-readable storage medium is located to execute the malicious block marking provided by the present invention Malicious code detection method for image processing.

Generally speaking, through the above technical solutions conceived by the present invention, the following beneficial effects can be obtained:

(1) The present invention divides the binary file of the malicious code to be detected into basic blocks, detects the malicious block therein, that is, the basic block related to the malicious function, and marks the position of the basic block in the entire binary file, realizing malicious Block positioning, in the subsequent classification based on visualization technology, based on the position labeling results of the malicious block, image processing will be performed on the part of the image corresponding to the malicious block in the grayscale image converted from the binary file to improve the local contrast of the part of the image. Based on this processing, the weight of malicious block-related content on the classification result can be effectively increased, the influence of malicious function-independent content on the classification result can be weakened, and the accuracy of malicious code detection can be effectively improved.

(2) In the preferred solution of the present invention, the neural network model is used as the malicious block detection model, which is used for feature extraction and reconstruction of the input basic blocks, and can realize the function of anomaly detection. For benign basic blocks, the difference between the input and output of the model is small, but for malicious blocks, the difference between the input and output of the model is relatively large. Based on this, the present invention can accurately complete the binary code. Block judgment and positioning.

(3) In the preferred solution of the present invention, when detecting malicious blocks, the code features of the extracted basic blocks include structural features, arithmetic instruction features, transfer instruction features and API call features, wherein the structural features include: basic The number of descendants and intermediate values of the block; the characteristics of arithmetic instructions include the number of basic mathematics, displacement instructions and logical operations contained in the basic block; the characteristics of transfer instructions include the number of stack operations, register operations and port operations in the basic block; API call characteristics include The number of API calls related to dll, process, service, and system information in the basic block, these features can comprehensively and accurately reflect the functions realized by the basic block, the present invention uses these features as the input of the malicious block detection model, and can accurately identify the basic Whether the function of the block is a malicious function, so as to accurately complete the detection of malicious blocks.

(4) In the preferred solution of the present invention, the local contrast of the part of the image corresponding to the malicious block in the grayscale image is improved by using the Contrast Limited Adaptive Histogram Equalization (CLAHE) algorithm, which can be used in While improving local contrast, it reduces the problem of noise amplification.

(5) In the preferred solution of the present invention, specifically use the Vision Transformer model to realize the malicious code classification model, which will divide the input image into many sub-blocks and form these sub-blocks into a linear embedding sequence, and then these linear embedding sequences It is used as the input of Transformer to simulate the input of phrase sequence in the field of NLP. Based on this model, the present invention has a better classification effect on the grayscale images converted from malicious code binary files.

Description of drawings

Fig. 1 is a flowchart of a malicious code detection method based on malicious block annotation and image processing provided by an embodiment of the present invention;

Fig. 2 is a schematic diagram from image generation, image processing to model training and model verification proposed by the embodiment of the present invention provided by the embodiment of the present invention;

FIG. 3 is a schematic diagram of a malicious block detection model provided by an embodiment of the present invention;

Fig. 4 is an implementation process diagram of applying limited contrast adaptive histogram equalization to grayscale images provided by an embodiment of the present invention;

Fig. 5 is a schematic diagram of a bilinear interpolation method provided by an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not constitute a conflict with each other.

In the present invention, the terms "first", "second" and the like (if any) in the present invention and drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

In order to solve the technical problem that the classification result of the existing malicious code detection method is interfered by malicious function irrelevant content and the classification accuracy is low, the present invention provides a malicious code detection method based on malicious block annotation and image processing. The idea is to locate and mark the malicious block in the malicious code binary file to be detected, and perform image processing on the part of the image corresponding to the malicious block in the grayscale image converted from the binary file to improve the local contrast, thereby improving the malicious function. The importance of relevant content to classification results weakens the influence of malicious function irrelevant content and improves classification accuracy.

The following are examples.

Example 1:

A malicious code detection method based on malicious block annotation and image processing, as shown in Figure 1 and Figure 2, includes the following steps:

(S1) Divide the binary file of the malicious code to be detected into a plurality of basic blocks, and detect whether each basic block is a malicious block, and mark the position of the malicious block in the binary file; the malicious block is a basic block related to malicious functions .

A basic block, a sequence of instructions executed sequentially, consists of only one input and one output. In this embodiment, by dividing the binary file into basic blocks and judging whether the basic blocks are related to malicious functions, the location and labeling of malicious blocks can be effectively realized.

Optionally, in the step (S1) of the present embodiment, for any basic block, whether it is detected as a malicious block, the methods include:

Extract code features of basic blocks and convert them into feature vectors; code features include structural features, arithmetic instruction features, transfer instruction features and API call features;

The feature vector is input to the trained malicious block detection model, and the feature vector is extracted and reconstructed by the malicious block detection module to obtain the reconstructed feature;

If the difference between the reconstructed feature and the feature vector output by the malicious block detection module is greater than a preset threshold, it is determined that the basic block is a malicious block; otherwise, it is determined that the basic block is not a malicious block;

Among them, the malicious block detection model is a neural network model, which is used to extract and reconstruct the features of the input basic blocks, and its training methods include:

Collect binary files irrelevant to malicious functions, divide them into basic blocks and extract the code features of the basic blocks as benign samples to obtain a benign sample set;

Initialize the malicious block detection model, aim at minimizing the reconstruction loss, and use the benign sample set to train it. After the training, the trained malicious block detection model is obtained.

Since the malicious block detection model extracts and reconstructs the features of the input basic blocks, it can realize the function of anomaly detection, and this embodiment uses benign samples that have nothing to do with malicious functions to train it. block, the difference between the input and output of the model is small, and for the malicious block, the difference between the input and output of the model will be relatively large, based on this, the judgment and location of the malicious block in the binary code can be accurately completed; optionally, this embodiment Among them, the U-Net model is selected to realize the malicious block detection model. The U-Net model is an autoencoder (AutoEncoder) model, and the autoencoder is a type of artificial neural network used in semi-supervised learning and unsupervised learning. The function is to learn the representation of the input information by taking the input information as the learning target;

The structure of the U-Net model is shown in Figure 3. The model includes an encoder g and a decoder f. When we input an x, we can get an output x′ after passing through the entire neural network, namely:

f(g(x))=x'

The autoencoder uses the reconstruction loss x′-x as the loss, and continuously learns to make the gap between x and x′ gradually smaller. Therefore, after learning with a large number of benign samples, for benign basic blocks, the gap between x and x′ is small, and the gap for malicious basic blocks will be large, so the possible malicious basic blocks can be effectively detected based on this.

It is easy to understand that in order to ensure the training effect of the model, this embodiment will collect a large number of binary files that have nothing to do with malicious functions to make benign samples for training the malicious block detection model; after the malicious block detection model is trained, it will also use the implementation The malicious code basic block of the malicious function makes a malicious sample, and tests the training effect of the trained model to ensure that the detection accuracy of the detection model meets the requirements, as shown in Figure 2; in addition, in some other embodiments of the present invention, The malicious block detection model can also be implemented based on other models that can perform feature extraction and reconstruction.

In order to accurately identify whether the function implemented by the basic block is a malicious function, in this embodiment, among the code features of the extracted basic block, the structural features specifically include: the number of children of the basic block and the intermediate value; the arithmetic instruction features specifically include the basic block The number of basic mathematics, displacement instructions, and logic operations included; the characteristics of transfer instructions include the number of stack operations, register operations, and port operations in the basic block; the characteristics of API calls include APIs related to dll, process, service, and system information in the basic block number of calls. The 12 features of the above four categories considered in this embodiment can fully and accurately reflect the functions realized by the basic block. This embodiment uses these features as the input of the malicious block detection model, and can accurately identify whether the function of the basic block is It is a malicious function, so as to accurately complete the detection of malicious blocks. In practical applications, the code features of basic blocks can be extracted directly by using the BinaryNinja tool.

After step (S1), the present embodiment can accurately complete the positioning and labeling of malicious blocks in the binary file. On this basis, the present embodiment also includes steps:

(S2) Convert the binary file into a grayscale image, and increase the local contrast of a part of the image corresponding to the malicious block in the grayscale image to obtain a target grayscale image.

In this embodiment, the specific way to convert the binary file into a grayscale image is as follows:

Convert each 8 bits as a unit into an unsigned integer in code order, and store the value in an unsigned integer vector;

Convert the unsigned integer vector to a matrix, treat each element in the matrix as a pixel, and use the value of the element as the gray value of the corresponding pixel to obtain a gray image.

It is easy to understand that in the grayscale conversion process, each pixel corresponds to an 8-bit unsigned integer value ranging from 0 to 255, which corresponds to the grayscale value of the pixel, 0 to 255, where 0 corresponds to black, and 255 Corresponds to white.

According to the labeling result of step (S1), the part of the image corresponding to the malicious block in the converted grayscale image can be located, and the local contrast of the part of the image can be improved by means of image processing. As a preferred embodiment, In this embodiment, the local contrast of the part of the image corresponding to the malicious block in the grayscale image is improved by using Contrast Limited Adaptive Histogram Equalization (CLAHE), which can reduce noise amplification while improving the local contrast. Problem; The process of improving local contrast based on CLAHE is shown in Figure 4, including the following steps:

(S21) According to the position of the malicious block in the image, get a local regular image, and determine that the local image is divided into non-overlapping sub-blocks of equal size;

(S22) Calculate the sub-block histogram according to the image;

(S23) Calculate clipLimit according to the sub-block histogram provided in the sub-operation S22;

(S24) Intercept the pixels exceeding the clipLimit value in the grayscale histogram of each sub-block image, and evenly redistribute the intercepted pixels to each grayscale;

(S25) Using a bilinear interpolation method to realize pixel gray value reconstruction, and finally realize histogram equalization.

As shown in FIG. 5 , the abscissa of each pixel in the grayscale image represents the current pixel value, and the ordinate represents the transformed pixel value. After the image is divided into blocks according to the above method, the gray scale transformation functions used in the equalization of each sub-block are different. Including the following steps:

1) Firstly, according to the pixel value, the entire graphics area can be divided into three types of areas A, B, and C, which represent the four-corner area, the edge area and the central area respectively.

2) Judge the pixels in the image one by one to determine which type of area they belong to. Pixels in different regions are processed in different ways.

3) If the pixel belongs to the A-type area, no interpolation operation should be performed on the pixel, and the gray-scale transformation function is directly applied for gray-scale transformation:

where cdf(x) represents the cumulative distribution value of the pixel value x in the submap. cdf _min and cdf _max represent the minimum and maximum values in the cumulative distribution of sub-image pixels, respectively. L represents the total number of gray levels, usually 256;

4) If the pixel belongs to the B-type area, the transformation function corresponding to the A-type area adjacent to the pixel is marked as and /> And take two points M and N belonging to two A-type areas, so that MN and the pixel point are on the same horizontal line. The pixels of points M and N are marked as x ₁ and x ₂ respectively, then the pixel points are applied with linear interpolation transformation:

5) If the pixel point belongs to the C-type area, refer to the point P in Figure 4, and for the point P, apply bilinear interpolation transformation:

After image processing by CLAHE, methods such as equidistant scaling and sampling are applied to unify the size of the image.

After the above steps (S2), the malicious code binary file is converted into a grayscale image, and the local contrast of the part of the image corresponding to the malicious block is effectively improved. Based on this, this embodiment further includes:

(S3) Input the target grayscale image into the trained malicious code classification model to predict the probability that the malicious code belongs to each family category, and determine the family category with the highest probability as the family category to which the malicious code belongs; wherein, the malicious code classification model is a neural network model used to predict the probability that the malicious code corresponding to the input grayscale image belongs to each family category;

As a preferred implementation manner, in this embodiment, the malicious code classification model is a VisionTransformer model.

Transformer is an end-to-end NLP model proposed by the Google team in 2017. This model abandons the traditional RNN sequential structure and uses a self-attention mechanism to enable the model to parallelize training and grasp global information. Vision Transformer can be regarded as a graphical version of Transformer. With as little modification as possible, the standard Transformer model is directly transferred to the image field to become a Vision Transformer model. The Vision Transformer model will divide the input image into many sub-blocks and divide these sub-blocks Blocks form a linear embedding sequence, and then these linear embedding sequences are used as the input of the Transformer to simulate the input of the phrase sequence in the NLP field. Under the application scenario of this embodiment, based on this model, for the grayscale of the malicious code binary file conversion The graph has a better classification effect.

It should be noted that, if the classification accuracy meets the requirements, other image classification models can also be used.

In general, this embodiment locates the malicious block in the malicious code binary file, and then improves the local contrast of the malicious block in the image, which can effectively improve the classification accuracy.

Example 2:

A computer-readable storage medium, comprising: a stored computer program; when the computer program is executed by a processor, the device where the computer-readable storage medium is located is controlled to execute the malicious code detection method based on malicious block annotation and image processing provided in Embodiment 1 above .

It is easy for those skilled in the art to understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, All should be included within the protection scope of the present invention.

Claims (8)

1. A malicious code detection method based on malicious block annotation and image processing, characterized in that, comprising the steps: (S1) Divide the binary file of the malicious code to be detected into a plurality of basic blocks, and detect whether each basic block is a malicious block, and mark the position of the malicious block in the binary file; the malicious block is a malicious function related basic blocks; (S2) converting the binary file into a grayscale image, and increasing the local contrast of a part of the image corresponding to the malicious block in the grayscale image to obtain a target grayscale image; (S3) Input the target grayscale image into the trained malicious code classification model to predict the probability that the malicious code belongs to each family category, and determine the family category with the highest probability as the family category to which the malicious code belongs; Wherein, the malicious code classification model is a neural network model, which is used to predict the probability that the malicious code corresponding to the input grayscale image belongs to each family category. 2. the malicious code detection method based on malicious block labeling and image processing as claimed in claim 1, is characterized in that, in described step (S1), for any basic block, detects whether it is malicious block, its mode comprises : Extracting the code feature of the basic block, and turning it into a feature vector; the code feature includes a structural feature, an arithmetic instruction feature, a transfer instruction feature and an API call feature; The feature vector is input into the trained malicious block detection model, and the feature vector is extracted and reconstructed by the malicious block detection module to obtain the reconstructed feature; If the difference between the reconstructed feature output by the malicious block detection module and the feature vector is greater than a preset threshold, it is determined that the basic block is a malicious block; otherwise, it is determined that the basic block is not a malicious block; Wherein, the malicious block detection model is a neural network model, which is used for feature extraction and reconstruction of the input basic blocks, and its training methods include: Collect binary files irrelevant to malicious functions, divide them into basic blocks and extract the code features of the basic blocks as benign samples to obtain a benign sample set; Initialize the malicious block detection model, aim at minimizing the reconstruction loss, use the benign sample set to train it, and obtain the trained malicious block detection model after the training. 3. the malicious code detection method based on malicious block labeling and image processing as claimed in claim 2, is characterized in that, described structural feature comprises: the descendant number of basic block and intermediate value; Described arithmetic instruction feature comprises basic block The number of basic mathematics, displacement instructions and logic operations included; the characteristics of the transfer instruction include the number of stack operations, register operations and port operations in the basic block; the characteristics of the API call include dll, process, service, and system information in the basic block. The number of API calls. 4. The malicious code detection method based on malicious block annotation and image processing as claimed in claim 3, wherein the malicious block detection model is an autoencoder model. 5. The malicious code detection method based on malicious block labeling and image processing according to any one of claims 1 to 4, characterized in that, in the step (S2), the adaptive histogram equalization algorithm is improved by limiting the contrast The local contrast of the part of the image corresponding to the malicious block in the grayscale image. 6. The malicious code detection method based on malicious block labeling and image processing according to any one of claims 1 to 4, wherein the malicious code classification model is a Vision Transformer model. 7. The malicious code detection method based on malicious block annotation and image processing according to any one of claims 1 to 4, wherein in the step (S2), the binary file is converted into a grayscale image, include: Convert each 8 bits as a unit into an unsigned integer in code order, and store the value in an unsigned integer vector; Converting the unsigned integer vector into a matrix, using each element in the matrix as a pixel, and using the value of the element as the gray value of the corresponding pixel to obtain the gray image. 8. A computer-readable storage medium, comprising: a stored computer program; when the computer program is executed by a processor, it controls the device where the computer-readable storage medium is located to perform any one of claims 1-7 The malicious code detection method based on malicious block annotation and image processing.