KR20200067044A - Method and apparatus for detecting malicious file - Google Patents

Abstract

Provided are an apparatus and a method for detecting a malicious file. The method for detecting a malicious file comprises the steps of: extracting feature data from feature data sequences of files collected on a network; and determining whether the file is a normal file or a malicious file by inputting the feature data into a deep learning model based on machine learning performed by inputting the feature data of a previously known normal file and a malicious file.

Description

Method and device for detecting malicious files{METHOD AND APPARATUS FOR DETECTING MALICIOUS FILE}

The present description relates to a method and apparatus for detecting a malicious file using characteristic data of the file.

Recently, many studies have been conducted to detect malicious files (or malicious software, malware, etc.) that may adversely affect a computer by using machine learning or deep learning techniques. To detect malicious files using machine learning or deep learning techniques, artificial intelligence models are trained based on feature data extracted from malicious files. At this time, if there are many types of feature data, for efficiency of machine learning, the analyst must manually select some kinds of feature data.

One embodiment provides a method for detecting a malicious file based on feature data extracted from the file.

Another embodiment provides an apparatus for detecting a malicious file based on feature data extracted from the file.

According to one embodiment, a method for detecting malicious files in a network is provided. The malicious file detection method is based on machine learning performed by extracting feature data from a feature data sequence of files collected on a network, and using feature data as input to previously known normal files and feature data of malicious files. And inputting the deep learning model to determine whether the file is a normal file or a malicious file.

In the malicious file detection method, the feature data sequence is a system call sequence of the file, and the feature data may be a part of the system call sequence.

Extracting feature data from the malicious file detection method includes: assigning a weight to each system call included in the system call sequence through the attention mechanism, and selecting important system calls from the system call sequence in the order of weighting It may include steps.

In the malicious file detection method, the deep learning model may be a long short term memory (LSTM) network.

In the malicious file detection method, the deep learning model may be a Skip-Connected Long Short Term Memory (LSTM) network.

According to another embodiment, a malicious file detection device is provided. The malicious file detection apparatus includes a processor, a memory, and a network interface, and the processor executes a program stored in the memory to extract feature data from a feature data sequence of files collected on the network through the network interface, and The feature data is input to a deep learning model based on machine learning, which is performed by inputting feature data of known normal files and malicious files as inputs to determine whether the file is a normal file or a malicious file.

In the malicious file detection apparatus, the feature data sequence is a system call sequence of a file, and the feature data may be a part of the system call sequence.

When performing the step of extracting feature data from the malicious file detection device, the processor assigns weights to each system call included in the system call sequence through the attention mechanism, and is important in the system call sequence in the order of the highest weight. The step of selecting a system call may be performed.

In the malicious file detection apparatus, the deep learning model may be a long short term memory (LSTM) network.

In the malicious file detection apparatus, the deep learning model may be a skip-connected long short term memory (LSTM) network.

By performing deep learning using a predetermined number of feature data in a high weight order, computing resources of the malicious file detection device are saved, and the detection speed of the malicious file can be improved. In addition, the detection rate of malicious files may be improved by using only feature data determined through the attention mechanism.

1 is a flowchart illustrating a malicious file detection method according to an embodiment.
2 is a conceptual diagram showing a deep learning model of a malicious file detection method according to an embodiment.
3 is a block diagram showing a malicious file detection device according to an embodiment.

Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art to which the present invention pertains may easily practice. However, the present description can be implemented in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly describe the present description in the drawings, parts irrelevant to the description are omitted, and like reference numerals are assigned to similar parts throughout the specification.

1 is a flowchart illustrating a malicious file detection method according to an embodiment, and FIG. 2 is a conceptual diagram showing a deep learning model of a malicious file detection method according to an embodiment.

The malicious file detection apparatus according to an embodiment first calculates the weight of the feature data sequence of the file in order to extract the feature data (S110). The feature data sequence of the file may be a system call sequence. Referring to FIG. 1, the malicious file detection apparatus calculates the weight of each system call in the file system call sequence { S ₁ , S ₂ ,..., S _n }, and makes important system calls according to the size of the weight. It can be extracted as feature data. For example, a system call sequence of a file may be collected as follows through a malicious code analysis utility based on dynamic analysis (eg, Kuku sandbox).

{LoadLibrary, LoadCursor, RegisterClass, GetThreadLocal, strcmp, GlobalAlloc, GlobalFree, FindResource, LoadResource, VirtualProtect}

Referring to the above, the length of the file's system call sequence is 10. And malicious files can have a longer system call sequence. According to an embodiment, even if the length of the system call sequence is the same, the detection rate may be improved when the system call sequence determined to have a high weight through the attention mechanism is used for the detection of the malicious file. The attention mechanism is described in detail below.

The apparatus for detecting malicious files according to an embodiment may extract a critical system call from a system call sequence of known normal files and malicious files, and perform machine learning using the extracted critical system call as an input. Thereafter, the apparatus for detecting malicious files may determine whether the file is a normal file or a malicious file by inputting feature data of a file collected on a network into a deep learning model generated based on a result of machine learning.

At this time, the malicious file detection apparatus according to an embodiment may extract feature data from the feature data sequence of the file based on the attention mechanism. Attention mechanism is a deep learning model of the Recurrent Neural Network (RNN) family, which is a method for deep learning model to focus on an important part of input source (i.e., feature data sequence) (i.e., feature data). . The malicious file detection apparatus according to an embodiment, as an input of machine learning using an attention mechanism, extracts feature data of a feature data sequence of a file, performs machine learning using the extracted feature data as an input, and machine learning By using the deep learning model generated as a result, it is possible to determine whether the file is malicious. Referring to FIG. 2, the apparatus for detecting a malicious file according to an embodiment, if a system call sequence of a file is provided as input {X ₁ , X ₂ , X ₃ , ..., X _T }, whether the file is normal or malicious The result of recognition is output as Y _t .

Thereafter, the apparatus for detecting malicious files may determine feature data by selecting k critical system calls from the system call sequence in the order of the highest weight (S120) (k<n). In FIG. 1, the weight for each system call X _i in the system call sequence is {a(t,1), a(t,2), a(t,3), ..., a(t,T)} and therefore the weight W _i is a (t, i) corresponding to the system call X _i. At this time, the column vector composed of system call and weight is as follows.

{(S ₁ ,W ₁ ),(S ₂ ,W ₂ ),...,(S _n ,W _n )}

And the new system call sequence composed of important system calls is as follows.

{(S ₁ ',W ₁ '),(S ₂ ',W ₂ '),...,(S _k ',W _k ')}

Then, the malicious file detection apparatus according to an embodiment determines whether the file is malicious by inputting a new system call sequence composed of important system calls into a deep learning model (S130). At this time, the deep learning model is generated based on machine learning performed by inputting characteristic data of known and malicious files in advance. The deep learning model according to an embodiment may be a Long Short Term Memory (LSTM) network for solving the Problem of Long-Term Dependencies. Alternatively, the deep learning model according to an embodiment may be a skip-connected LSTM network that adds/modifies/deletes connections between RNN cells.

When deep learning is performed using a predetermined number of feature data having a high weight determined through the attention mechanism as described above, computing resource of the malicious file detection device is saved and malicious file detection compared to when the entire feature data sequence is used The speed of detection of malicious files on the device can also be improved. In addition, the malicious file detection apparatus according to an embodiment may improve the detection rate of the malicious file by using only feature data determined through the attention mechanism.

3 is a block diagram showing a malicious file detection device according to an embodiment.

The apparatus for detecting malicious files according to an embodiment may be implemented as a computer system, for example, a computer-readable medium. Referring to FIG. 6, the computer system 300 includes a processor 310, a memory 330, a storage device 340, an input interface device 350, and an output interface device 360 that communicates through the bus 320. ). Computer system 300 may also include a communication device 370 coupled to the network. The processor 310 may be a central processing unit (CPU) or a semiconductor device that executes instructions stored in the memory 330 or the storage device 340. The memory 330 and the storage device 340 may include various types of volatile or nonvolatile storage media. For example, the memory may include read only memory (ROM) and random access memory (RAM).

In the embodiments of the present disclosure, the memory may be located inside or outside the processor, and the memory may be connected to the processor through various known means. Memory is a volatile or non-volatile storage medium of various types, and for example, the memory may include read-only memory (ROM) or random access memory (RAM).

Although the embodiments have been described in detail above, the scope of rights is not limited to this, and various modifications and improvements of those skilled in the art using the basic concepts defined in the following claims also belong to the scope of rights.

Claims (10)

As a method for detecting malicious files on the network,
Extracting feature data from a feature data sequence of files collected on the network, and
Step of determining whether the file is a normal file or a malicious file by inputting the feature data into a deep learning model based on machine learning performed by inputting the feature data of known normal files and malicious files as input.
Malicious file detection method comprising a. In claim 1,
The feature data sequence is a system call sequence of the file, and the feature data is a partial system call of the system call sequence, a malicious file detection method. In claim 2,
The step of extracting the feature data,
Weighting each system call included in the system call sequence through the attention mechanism; and
Selecting an important system call from the system call sequence in order of the weighting order
Including, malicious file detection method. In claim 1,
The deep learning model is a Long Short Term Memory (LSTM) network, a method for detecting malicious files. In claim 1,
The deep learning model is a Skip-Connected Long Short Term Memory (LSTM) network, a method for detecting malicious files. As a malicious file detection device,
Includes a processor, memory, and network interface,
The processor executes a program stored in the memory,
Extracting feature data from a feature data sequence of files collected on the network through the network interface, and
Step of determining whether the file is a normal file or a malicious file by inputting the feature data into a deep learning model based on machine learning performed by inputting the feature data of known normal files and malicious files as input.
Malicious file detection device that performs. In claim 6,
The feature data sequence is a system call sequence of the file, and the feature data is a partial system call in the system call sequence, a malicious file detection device. In claim 7,
When the processor performs the step of extracting the feature data,
Weighting each system call included in the system call sequence through the attention mechanism; and
Selecting an important system call from the system call sequence in order of the weighting order
A device for detecting malicious files. In claim 6,
The deep learning model is a Long Short Term Memory (LSTM) network, a malicious file detection device. In claim 6,
The deep learning model is a Skip-Connected Long Short Term Memory (LSTM) network, a malicious file detection device.

Images