KR20200129353A - method for generating similar malicious codes and method for improving malicious code detection performance using the same - Google Patents

Abstract

Disclosed is a method for effectively learning a malicious code detection machine learning model. Provided is the method for effectively learning a malicious code detection machine learning model by augmenting data used for machine learning using variational auto encoder-convolutional neural network (VAE-CNN) and utilizing the augmented data.

Description

Method for generating similar malicious codes and method for improving malicious code detection performance using the same}

The present invention relates to a method for effectively learning a malicious code detection machine learning model, wherein data used for machine learning is augmented using a VAE-CNN: Variational Auto Encoder-Convolutional Neural Network (VAE-CNN). Augmentation) and using this augmented data to effectively learn a malware detection machine learning model.

Malware is a program written for malicious purposes and refers to a program that negatively affects a computer or network by slowing down a computer or inducing a large amount of traffic to the network.

Malware detection technologies include traditional methods using signatures and methods using machine learning such as deep learning. Malware detection using signatures has a high accuracy rate, but has a disadvantage of low application rate. On the other hand, malware detection using deep learning shows good performance in all aspects of accuracy and application rate.

1 is a conceptual diagram illustrating a basic malicious code detection system using machine learning.

Malware detection based on machine learning is to train a learning model with a normal file and a file containing the malicious code, and then detect whether a suspicious file is malicious with the learned model.

In the learning stage, the learning model is optimized for detection of malicious code by learning the characteristic information of files (string, command, byte information, API call record, etc.) and label (normal/abnormal).

And, by using the model that has been trained in the detection stage, it distinguishes whether the input file is a normal file or a malicious code.

However, a large amount of malicious code data is required to use deep learning that has good performance in detecting malicious codes. This is because machine learning algorithms and learning data are the parts that greatly affect performance in most machine learning-based malware detection technologies.

However, unlike the ever-increasing malware, it is not easy to obtain malware data that can be used for actual machine learning, such as deep learning.

This is because it is possible to check if it is a malicious code only when it is directly infected with the malicious code, and this malicious code data is treated as a kind of asset and is not disclosed.

Therefore, due to the difficulty in securing a large amount of malicious code data, there is a limitation in the method of detecting malicious code using machine learning.

The above-described background technology is technical information possessed by the inventors for derivation of the present invention or acquired during the derivation process of the present invention, and is not necessarily known to be publicly known prior to filing the present invention.

The present invention is to solve the above-described problem, using a VAE-CNN: Variational Auto Encoder-Convolutional Neural Network, augmentation of data used for machine learning The purpose is to effectively learn a malicious code detection machine learning model by using.

In addition, an object of the present invention is to detect whether a suspicious file is malicious by using a machine learning model that has been learned by the above method.

As a means for solving the above problems, the present invention has an embodiment having the following characteristics.

The present invention is characterized by generating similar malicious code data belonging to a label of the original malicious code data from the original malicious code data already possessed by using a machine learning model.

The machine learning model is characterized by being a VAE-CNN (Variational Auto Encoder-Convolutional Neural Network).

The similar malicious code generation method includes the steps of extracting label and malicious code command sequence information from malicious code data already possessed; It characterized in that it comprises a.

)하고, 상기 유사 악성코드 데이터를 학습(

)하는 판별기 학습단계; 를 포함하는 것을 특징으로 한다. The method of generating the similar malicious code includes a machine learning step; Including, the machine learning step learns the original malicious code data to determine whether there is a malicious code in the input data (

), and learning the similar malicious code data (

) The discriminator learning step; It characterized in that it comprises a.

The machine learning step is characterized by learning a loss function of a VAE (Variational Auto Encoder).

In addition, the present invention is characterized in that a malicious code detection machine learning model is trained using the similar malicious code generated by the above-described similar malicious code generation method.

In addition, the computing device for detecting malicious code proposed by the present invention uses a machine learning model to generate similar malicious code data belonging to the label of the original malicious code data from the original malicious code data already possessed. Generation unit; It characterized in that it comprises a.

The machine learning model is characterized by being a VAE-CNN (Variational Auto Encoder-Convolutional Neural Network).

The VAE-CNN includes a discriminator, a decoder, and an encoder, and the discriminator simultaneously learns the original malicious code data and the similar malicious code generated by the similar malicious code generator, and the decoder learns to generate label control. It is characterized in that the generated data is passed to the discriminator.

The computing device may include a processor configured to train the discriminator, the decoder, and the encoder, or to enable other devices to learn the discriminator, the decoder, and the encoder; It characterized in that it comprises a.

The present invention can augment data used for machine learning by using a VAE-CNN: Variational Auto Encoder-Convolutional Neural Network.

In addition, the present invention can effectively train a malware detection machine learning model by using the augmented data.

In addition, the present invention can induce performance improvement of a machine learning-based malicious code detection technology by using a machine learning model that has been effectively learned by the above method.

1 is a conceptual diagram illustrating a basic malicious code detection system using machine learning.
2 is a diagram illustrating a method of detecting a malicious code using a conventional RNN machine learning model.
3 is a diagram illustrating a method of detecting a malicious code using a VAE-CNN machine learning model according to an embodiment of the present invention.
4 is a diagram of a VAE-CNN model according to an embodiment of the present invention.
5 is a block diagram of a computing device that detects malicious code according to an embodiment of the present invention.
6 is a block diagram of a VAE-CNN model according to an embodiment of the present invention.
7 is a diagram of an RNN-based malicious code detection model.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a method of detecting a malicious code using a conventional RNN machine learning model.

First, a machine learning model (RNN: Recurrent Neural Network) is trained with a file containing malicious code data (O) (S100). Then, whether the suspicious file is malicious is detected using the learned RNN model (S200).

In the machine learning model learning step (S100), the learning model is optimized for detection of malicious codes by learning the learning model with feature information (string, command, byte information, API call record, etc.) of files and labels (normal/abnormal).

In the detection step (S200), it is discriminated whether the input file is a normal file or a malicious code by using the model on which the training has been completed.

However, in order to use such deep learning, a large amount of malicious code data is required to train a machine learning model. However, it is not easy to obtain malicious code data necessary for learning. This is because it is possible to check if it is a malicious code only when it is directly infected with the malicious code, and this malicious code data is treated as a kind of asset and is not disclosed.

The present invention is a method for solving the above-described problem, using a VAE-CNN: Variational Auto Encoder-Convolutional Neural Network, to augment data used for machine learning and this augmented data. We would like to present a method to effectively learn a malware detection machine learning model by using.

In this specification, the malicious code data already held is referred to as original malicious code data (O, Original), and the data generated to augment the data is referred to as similar malicious code data (A, Augmentation). Similar malicious code data (A) was called similar malicious code data in the sense that it belongs to the label of the original malicious code data.

3 is a diagram illustrating a method of detecting a malicious code using a VAE-CNN machine learning model according to an embodiment of the present invention.

The method for improving malicious code detection performance of the present invention includes the steps of generating similar malicious code data and using the same to train a machine learning model (S100), and detecting a malicious code using a machine learning model (S200). Includes.

Step S100 includes extracting label and malicious code instruction sequence information (S110), training a machine learning model (S120), and generating similar malicious code data (A) (S130).

The present invention is a technology for generating similar malicious code data by using malicious code data already possessed.

Before describing the present invention, malicious code data is first defined and described.

The malicious code is a program, and the program can be expressed as bytes that appear consecutively, and the bytes that appear consecutively can be expressed as a sequence of instructions (OPCODE). Therefore, in the present invention, the command sequence is defined as malicious code data.

[Table 1] shows the structure of malicious code data already possessed.

File name Instruction length Label Malware instruction sequence 0000abecf335.vir.asm 200/400 abnormal PUSH, PUSH, PUSH,
CALL, CALL, CALL, RET,…

The malware data structure is composed of the file name, command length, label, and malicious code command sequence as shown in [Table 1]. However, only a label and a sequence of malicious code commands are sufficient to train a machine learning model for detecting malicious code data.

In step S110, label and malicious code instruction sequence information, which are information necessary to train the machine learning model, are extracted from the malicious code data (O).

[Table 2] is an example of label and malicious code command sequence information after removing unnecessary information such as file name and command length information from malicious code data (O).

0 PUSH MOV SUB PUSH PUSH LEA PUSH PUSH MOV CALL OR MOV LEA STOS STOS STOS STOS ADD PUSH STOS POP MOV CALL MOV TEST JE PUSH PUSH MOV CALL PUSH LEA PUSH PUSH CALL TEST JE LEA LEA MOV IN TEST JNE PUSH LEA SUB PUSH PUSH LEA PUSH CALL TEST JE OR LEA MOV REP LEA LEA CALL LEA PUSH CALL TEST JNE LEA PUSH CALL MOV TEST JE AND MOV LEA POP LEA RETN PUSH MOV SUB PUSH PUSH PUSH MOV OR PUSH LEA PUSH PUSH MOV CALL PUSH LEA PUSH PUSH MOV CALL ADD IN PUSH LEA PUSH PUSH CALL LEA PUSH CALL CMP JE MOV LEA PUSH PUSH PUSH CALL PUSH PUSH CALL TEST JS LEA PUSH LEA CALL TEST JE MOV CALL TEST JE MOV PUSH CALL ...

Since the actual malicious code command sequence has a very long length, the command length is limited to 400 by referring to the existing malicious code detection research. The label extracted in step S110 and the malicious code command sequence information are trained in a machine learning model. It is used for generating similar malicious code data (A).

Step S120 is a step of training a machine learning model. The present invention uses VAE-CNN (Variational Auto Encoder-Convolutional Neural Network) as a machine learning model.

Step S130 is a step of generating similar malicious code data (A). The generated similar malicious code data (A) is used to train the machine learning model (S120).

Step S200 is a step of detecting whether an input file (Unknown File) is a normal file or a malicious code by using the machine learning model on which the learning has been completed.

Here, the inputted file (Unknown File) may go through a step of extracting command sequence information before being input to the CNN model, which is a machine learning model that has been trained. This is to unify the structure of data used in machine learning models.

4 is a diagram of a VAE-CNN model according to an embodiment of the present invention.

The VAE-CNN model uses the VAE part in which the encoder and decoder are combined to generate similar malicious code data, and the malicious code data already possessed and the malicious code data generated by the VAE are applied to the actual malicious code detection, so that the VAE part is properly similar. It is composed of CNN, which is a discriminator to check whether malicious code data has been generated.

Malicious code data already possessed as shown in [Table 2] is input to the encoder. The entered malicious code data becomes a hidden expression z having a normal distribution as a prior probability. The hidden expression z generates similar malicious code data by using the <s> token, which means the start of malicious code data by a decoder, and label information (malware/normal file) of the original data.

[Table 3] is an example of similar malicious code data generated through the VAE.

0 SAHF LEA PUSH JNP MOV JNO OR JL SHL AAD CWD CALL OUT MUL DIV JB NOT AND ADC XCHG SAHF SUB WAIT LDS SUB JB AND OR JAE SUB NOT CMP CMP DEC SUB JNO XCHG OR LOCK SUB JE SUB ADC ADD SHL LEA POP LOCK LAHF RETN IN RCL AAD IN SCAS DEC ADD JA IN MOV SUB RCR NOP DAS MOV PUSH ADC DIV STC IN POP CLI CALL TEST IN IN JNE RCL PUSH CMP ADD LOCK JA DAS LES SHL DIV ADD PUSH ROR POP IN IN OUT POP TEST CALL DEC PUSH CMP LAHF PUSH ADD MOV POP LEA OUT POP ADD ADD JE CMP ADD PUSH SBB JP JO LEA SUB STOS LAHF DEC OR CMP JB OUT AND OUT MOV CMC PUSH AND POP MOV ADD IN XCHG JE POP SCAS SUB ADD JNE MOV TEST CMP OUT LOCK OR JNE POP...

In other words, the VAE model generates similar malicious code data using the input malicious code data.

The CNN part, which is a discriminator, uses the malicious code data already possessed and similar data created through the VAE to determine whether there is a malicious code.

)하고, 상기 유사 악성코드 데이터를 학습(

)한다. That is, the discriminator learns the original malicious code data to determine whether the received data is a malicious code (

), and learning the similar malicious code data (

)do.

When the learning model of the discriminator is expressed by an equation, it is as shown in Equations 1 to 3 below.

Equation 1 is to learn original malicious code data (O), Equation 2 is to learn similar malicious code data (A), Equation 3 is to learn original malicious code data (O) and similar malicious code data (A) It is an expression of the learning model as an equation.

는 empirical entropy로 판별기 확률이 1 or 0에 가깝게 만들어 주며,

는 밸런싱 파라미터이다.

Is empirical entropy, making the discriminator probability close to 1 or 0,

Is the balancing parameter.

The decoder and encoder learn a loss function of VAE (Variational Auto Encoder).

In addition, the decoder passes the generated data to the discriminator to learn to generate a label (normal program/malware) control and maximizes the P_Discriminator (label|command sequence).

In addition, the decoder compresses the generated data again by the encoder to minimize the L2 norm of the existing data by compressing the generated data again so that the data input through the encoder and the latent variable of the generated data have similar values.

When the learning model of the decoder is expressed by an equation, it is as shown in Equations 4 to 8

Equation 4 means VAE loss.

Referring to Equation 5, the decoder learns to determine the [non] normal generated data to the discriminator as [non] normal.

Referring to Equation 6, the decoder learns all words of the output layer using Gumbel softmax.

Referring to Equation 7, the decoder learns so that the latent variable of the generated data becomes the latent variable of the input data.

When the learning model of the encoder is expressed as an equation, it can be expressed as in Equation 4 described above.

The encoder learns only the VAE loss.

5 is a block diagram of a computing device that detects malicious code according to an embodiment of the present invention, and FIG. 6 is a block diagram of a VAE-CNN model according to an embodiment of the present invention.

A computing device that performs malicious code detection includes a malicious code analysis unit 510, a similar malicious code generation unit 520, and a malicious code detection unit 530.

The malicious code analysis unit 510 analyzes malicious code data already held and extracts label and malicious code command sequence information from the original malicious code data O.

The similar malicious code generation unit 520 generates similar malicious code data belonging to a label of the original malicious code data from the original malicious code data already possessed by using a machine learning model.

The similar malicious code generation unit 520 includes a discriminator 610, a decoder 620, and an encoder 630.

The machine learning model may be a VAE-CNN (Variational Auto Encoder-Convolutional Neural Network).

The discriminator 610 determines whether there is a malicious code by using malicious code data already possessed and similar data created through a VAE (Variational Auto Encoder).

The decoder 620 and the encoder 630 learn the loss function of the VAE.

7 is a diagram of an RNN-based malicious code detection model.

The malicious code detection model of FIG. 7 is a detection model for determining whether similar malicious code data generated through the VAE of FIG. 4 corresponding to the present invention actually works well with another malicious code detection algorithm.

The RNN-based malicious code detection model of FIG. 7 is a Recurrent Neural Network (RNN) model that determines whether a sequence of malicious code data is given as an input and the input data is a malicious code or a normal file, and corresponds to a machine learning algorithm. .

The data structure used in the experiment for the model of FIG. 7 has the same format as the data in [Table 1] and [Table 2], and statistical information is shown in [Table 4].

Training data Evaluation data Dictionary size Existing data 23,389 5,847 75 Data generated using VAE-CNN model 23,389 -

Experimental results for the model of Figure 7 are shown in [Table 5].

Instruction sequence length Detection rate False positives accuracy I'm after I'm after I'm after 200 90.53 91.42 6.31 5.89 90.05 92.83 400 90.12 90.81 8.53 6.86 90.80 92.00

In Table 5, "before" in the experiment result is a case of machine learning using only the malicious code data (O) already possessed, and "after" is the similar malicious code data (A) created through the VAE-CNN model of the present invention. This is the case of machine learning using the augmented data by augmenting the data used for machine learning.

In order to increase the reliability of the experimental results, evaluation was performed using K-fold cross validation. The K-fold cross-validation refers to dividing the data set into K sizes and then using K for each evaluation (the remaining K-1 for learning) to average, and the K value was 5 for the experiment.

In the experiment in which the generated data was added, a weight of 0.9 was assigned to the existing data when training a malicious code detection model, and a weight of 0.1 was assigned to the newly added malicious code-like data.

As shown in Table 5, it can be seen that the malicious code detection performance is improved in all aspects of detection rate, false detection rate, and accuracy. In addition, it can be seen that as the length of the instruction sequence increases, the performance decreases.

It should be understood that the embodiments described above are illustrative in all respects and not limiting. The scope of the present invention is indicated by the claims to be described later rather than the detailed description, and all changes or modified forms derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the claims of the present invention. .

510: Malware analysis unit
520: similar malicious code generation unit
530: Malware detection unit
610: discriminator
620: decoder
630: encoder

Claims (10)

A similar malicious code generation method for generating similar malicious code data belonging to a label of the original malicious code data from the original malicious code data already possessed by using a machine learning model.
The method according to claim 1,
The machine learning model is a similar malicious code generation method, characterized in that the VAE-CNN (Variational Auto Encoder-Convolutional Neural Network).
The method according to claim 1,
The similar malicious code generation method
Extracting label and malicious code instruction sequence information from malicious code data already possessed; A method of generating similar malicious code including a.
The method according to claim 1,
The method of generating the similar malicious code includes a machine learning step; Including,
The machine learning step
Learning the original malicious code data to determine whether there is a malicious code in the input data (

), and learning the similar malicious code data (

) The discriminator learning step; A method of generating similar malicious code including a.
The method of claim 4,
The machine learning step
A similar malicious code generation method, characterized in that it learns the loss function of VAE (Variational Auto Encoder).
6. The method of improving malicious code detection performance in which a malicious code detection machine learning model is trained using the similar malicious code generated by the method of generating a similar malicious code according to any one of claims 1 to 5.
A similar malicious code generator for generating similar malicious code data belonging to a label of the original malicious code data from the original malicious code data already possessed by using a machine learning model; Computing device for performing malicious code detection comprising a.
The method of claim 7
The machine learning model is a computing device that performs malicious coat detection, characterized in that the VAE-CNN (Variational Auto Encoder-Convolutional Neural Network).
The method of claim 8,
VAE-CNN includes a discriminator, a decoder, and an encoder,
The discriminator simultaneously learns the original malicious code data and the similar malicious code generated by the similar malicious code generator,
The decoder passes the generated data to the discriminator to learn label control generation.
The method of claim 9,
The computing device
Learning the discriminator, the decoder, and the encoder, or
A processor that assists other devices to learn the discriminator, the decoder, and the encoder; Computing device for performing malicious code detection comprising a.

Images