TWI358639B - Malware detection system, data mining module, malw - Google Patents

Description

1358639

达达编号号: TW3715PA * IX, invention description: [Technical field of the invention] The present invention relates to a malware detection system, a data mining module and a malicious program detection module, and in particular to a use based on Data mining technology malware detection system, data mining module and malware detection module. [Prior Art] • In recent years, the evolution of malicious programs has been very rapid. The traditional anti-virus system removes the corresponding pattern (Pat tern) from the known malware and stores it in its database. Each program, including both malicious and non-malware, corresponds to a unique template. When a program to be tested is to be detected, the conventional anti-virus system is compared to the sample stored in the database for the sample corresponding to the program to be tested. When the traditional anti-virus system is identical to the version of the sample corresponding to the program to be tested, the traditional anti-virus system detects that the program is a known malware. ® However, malware often evolves into very different variants of malware at an extremely fast rate. The variant malware is very similar to the behavior of its malware, but the corresponding versions of the two are still different. For example, when a known malware A evolves into a new variant malware A', even if the variant malware A' is similar to the known malware A, and the conventional antivirus system has a known malware A The sample 'traditional anti-virus system still can't successfully detect the variant malware A'. In this way, the traditional anti-virus system can only detect known malicious programs, and cannot detect the evolution of known malicious programs. 6 1358639

A new variant of the third-generation TW3715PA that behaves like a known malware. As a result, traditional antivirus systems are unable to cope with the growing number of variants. When a new variant of the malware appears, the malicious program has already caused damage to the client's computer before the traditional antivirus system obtained the variant of the malware. SUMMARY OF THE INVENTION The present invention is directed to a malware detection system. The malware detection system of the present invention can detect variants of the same type but never seen by known malicious programs using only the characteristics of known malicious programs and known non-malicious programs. According to a first aspect of the present invention, a data mining module is provided for outputting a classification model based on a number of known malicious programs (Ma 1 ware) and a plurality of known non-malicious programs (Model) ). A program to be tested is classified into one of a malicious program and a non-malicious program according to a classification model. The data mining module includes a program database, a feature mining unit, a feature screening unit and a classification model training unit. The program library is used to store known malware and known non-malicious programs. The feature mining unit is used to extract N features to be screened from known malware and known non-malicious programs. The i-th to-be-screened feature is an interaction behavior between at least one of a known malicious program and a known non-malicious program and a file system. It is known that at least one of the malicious programs and the known non-malicious programs has the i-th to-be-screened feature. i is a positive integer less than or equal to N. The feature screening unit filters out several valid features from the N features to be filtered. Each valid feature is essentially a known malware and a known non-malicious 7 1358639 three-numbered: TW3715PA known malware and known non-malicious - the type = type training unit is used to validate the second Practice η class Wu ^. The program debt testing module includes a feature analyzing unit, a screening unit and a classifier. The feature analysis unit is used to levy the tomb. The preliminary feature is the second program of the program to be tested and the second feature of the slot screening unit. According to the effective feature, the program to be tested is classified into a malicious program by the preliminary::! feature. Aspects] 'Proposed-type data mining methods, one has: malicious programs and several known non-malicious programs, two types: two types are based on the classification model is one of _:: non-heart 4. Data mining methods include the wide-ranging and wide-ranging and non-malicious programs that extract a single positive == malware and a known non-malicious or equal positive integer. Pick up: by the interaction of Ν 订. 1 is a less than right-number reference, and several features are selected by a feature to be screened ===== According to the effective feature training, the classification model is obtained. According to the present invention (the first method, the method for measuring _ to be tested includes: first, the program of the test, the target, and the eight-hearted detection type is the program to be tested and 9 1358639

» Sanda number: TW3715PA f Less than one of the programs extracted. Each feature to be selected ρι to fn is an interaction behavior of at least one of all known malicious programs pm and all known non-malicious programs (9) with a file system. For example, several known malwares of all known malicious programs and several known non-malicious programs of all known non-malicious programs have a feature to be filtered FW, indicating the above-mentioned several known malicious programs Pm and The above several known non-malicious programs P b have the same interaction behavior with the file system. Since the malicious program and the non-malicious program use a dynamic link library (DLL) in a different manner, in the embodiment of the present invention, the feature mining unit 丨丨 2 extracts each known malicious private Pm and each It is known that the path of the dynamic link file used by the non-malicious program and the AppHcati〇n Program Interface (API) used by each program are to be selected as feature to be selected π to FN. In the embodiment of the present invention, the feature mining unit 112 is divided into four types by a program, that is, φ known as a bad thinking or a known non-malicious program. The first type of dynamic link file that is used directly by this program. The second type of dynamic link file used for this program is the route to the last layer of the link. The third type is the application interface used by the autumn type in the first layer of the dynamic link file. The fourth type is the application interface used by other dynamic link files in the first layer of the first move. To extract the interaction behavior of a program Fi 1 emon. exe and the file system of the Windows operating system (W i n d 〇 w s ) as the feature to be screened is 11 1358639

Sanda number: TW3715PA Example ' The first layer of dynamic link files used by Filemon.exe includes dynamic links such as C0MCTL32.DLL, KERNAL32.DLL and USER32.DLL. Therefore, the feature mining unit 112 extracts the above-mentioned first layer dynamic link file as a feature to be screened of Filemon.exe. The second layer of dynamic linking links may use the second layer of dynamic linking files, and the second layer of dynamic linking files may use the third layer of dynamic linking slots, and the rest of the conditions may be pushed to the last layer of dynamic linking slots. Features The mining unit 112 extracts the path of each dynamic link from the first layer to the dynamic link of the last layer as the feature to be screened for this program. For example, USER32.DLL in the first layer of dynamic link file uses dynamic link building such as the second layer dynamic link files GDI32.DLL, KERNAL32.DLL and MS IMG32·DLL. The KERNAL32.DLL in the second layer of the dynamic link building uses the last layer of dynamic link file NTDLL·DLL. Therefore, the feature mining unit 112 extracts the path formed by the USER32.DLL in the first layer dynamic link, the KERNAL32.DLL in the second layer dynamic link file, and the NTDLL.DLL in the last layer dynamic link file as F i 1 The feature of emon. exe to be filtered. The above is an example of extracting the dynamic link path used by USER32.DLL in the first layer dynamic link file. For other dynamic link slots in the first layer dynamic link file, such as C0MCTL32·DLL, the same is also extracted in the same manner. The dynamic link path used. The feature mining unit 112 also extracts the application interface used by Filemon, exe in the first layer dynamic link file, such as RtlFreeHeap, RtlAllocateHeap and RtlGetLastWin32Error 12 1358639.

Sanda number: TW3715PA, etc., as a feature to be filtered by Filemon.exe. The feature mining unit 112 extracts the application interfaces used by other dynamic links in the first layer dynamic link file, such as CsrAllocateCaptureBuffer, CsrAllocateMessagePointer and RtlSizeHeap, etc., as the to-be-screened feature of Filemon.exe. The feature mining unit 112 first extracts the features to be screened F1 to fn by each known malicious program Pm and each known non-malicious program Pb, first

The feature screening unit 113 filters out a plurality of effective features Fe from the features to be screened F1 to FN. ^Details of the action of the first feature screening unit 113. In the embodiment of the present invention, 'the number of features to be screened is large, and many features to be screened/month b are both features of known non-malicious programs and known non-malicious programs. Therefore, the first feature filtering unit 113 One by one determines whether each to be filtered = sign F1 to FN is a valid feature. Among them, the effective feature Fe system is mainly characterized by one of the known malicious programs and one of the known non-malicious programs. That is, the effective feature Fe is only one of the following two cases.筮 ^ ^ Standing. One case of spears is that the effective feature Fe is essentially the second one: the characteristics of thinking and private. The second case is that the effective feature Fe is essentially a feature of a known non-malicious program. For example, at 1 Π η η / Λ . 已知 a known malware Pm and 1050 known non-spoofed P b, like n xta ... ΟΟΛ d00 known malware Pm has to be filtered feature F1, there are 320 The known non-lL α , non-malicious program Pb also has the feature F1 to be filtered.

Thus, it is known that the probability of the appearance of the characteristic F1 to be screened by the snoring mop I Λ ^ , 〜 is equivalent to the probability that the known non-malicious program appears to be the remaining feature F1. Feature to be filtered F1 13 13^8639 Ξ达号: TW3715PA The degree of certainty of the features known to be malicious private is very low, and the feature to be screened Fi is the degree of certainty of the characteristics of known non-malicious programs. Very low. That is to say, the feature of the teacher selection F1 is not a feature of the substantive formula, nor is it mainly a known non-malicious process; ^ and some special features of the feature screening unit ιΐ3 remove the feature to be screened ^ Not as a valid feature pe. In addition, for example, there are 500 known malicious programs pm having the feature F2 to be filtered, and only 2 known non-malicious programs have the feature to be filtered, so that the known malware appears to be selected. The probability, in fact, is greater than the known non-malicious program. The selection feature is characterized by a known malware: The degree is very high, that is, the feature to be screened F2 is essentially a feature of the main alternative. Therefore, the first feature means that the feature F2 is an effective feature Fe. & 113 decided to wait similarly, for example, 'only 50 known Aachen character selection features F3, but there is a known non-evil with screening feature F3. In this way, it is known that the non-malicious program has a chance to wait for the yang, which is substantially greater than the probability of the known sub-sounds and the loyalty characteristics F3. (4) The feature selection feature F3 has a high degree of rent. That is, the feature of the # malicious program of the feature of the feature U ^ to be filtered. Therefore, the first feature is also known to determine that the feature to be screened F3 is the effective feature Fe. , *~ early 70113 so that the first feature screening unit 113 is in the symbol _ sign F1 to (four), the screening method is selected, and the known malware is identified by N knives 1358639

Sanda number: TW3715PA and the effective feature Fe of known non-malicious programs. In the embodiment of the present invention, the first feature screening unit 113 determines whether each feature to be selected is a valid feature according to a screening parameter corresponding to each feature to be selected. The screening parameter corresponding to a feature to be selected is related to the degree to which the feature to be screened is one of the characteristics of a known malware and one of the known non-malicious programs. For example, in the embodiment of the present invention, when it is determined whether the feature to be selected Fi in the features to be selected F1 to FN is a valid feature, the first feature screening unit 113 is based on a known malicious program having the feature Fi to be filtered. The number of non-malicious programs having the feature Fi to be filtered generates a screening parameter Pi (not shown) corresponding to the feature to be screened Fi. The screening parameter Pi is related to the feature to be screened, Fi, which is the degree of certainty of the features of the known malware and one of the known non-malicious programs. Where i is a positive integer. - If the screening parameter Pi is higher than a threshold, the degree of certainty of the feature to be filtered Fi is one of the known malicious programs and one of the known non-malicious programs. The degree of certainty of the feature to be screened is sufficiently high. The feature screening unit 113 determines that the feature to be screened Fi is a valid feature F e, which is mainly a feature of a known malicious program and one of the known non-malicious programs. In the embodiment of the present invention, the first feature screening unit 113 calculates the information gain of each feature to be filtered as the screening parameter corresponding to each feature to be selected. j Gain(S, Fi) = Info(S) - InfoFi (S) 15 1358639

The ternary number TW3715PA and the first formula are the information gains of the feature Fi to be screened in the embodiment of the present invention. Where S is the set of all known malware p m and all known non-malicious programs Pb. The first! The township is the above set (Entropy), and its mathematical description is shown in the second formula.

InMS) = -Yip.\〇g^p) y=1 2nd

The sub-JD / ί ' J system is equal to 1 or equal to 2. A is the ratio of all known malicious programs in all known...known non-malicious programs: 2 2 = the proportion of all known non-malicious programs among all known malicious and known non-malicious programs. Further, /♦# in the first formula is a mathematical description of the feature to be screened as shown in the third formula. ', 娜·- 3rd Formula In the 3rd formula, k is equal to 〇 or 卜 & is the set 3, the known malware with the feature F1 to be filtered and the known non-malicious program, = set. ~ is a collection of known malicious programs in the set s that do not have a feature to be _ and a known non-malicious program. Therefore, ^ is in; there are known evils and known non-malicious programs, the known evils with the features to be filtered, the proportion of 5 programs and known non-malicious programs; and (5) the privates 1, | 5| ° The ratio of known malware and known non-malicious programs (4) that do not have the feature to be selected in the malicious and known non-malware programs. In addition, the Qing in the third formula is a collection of smoke, its mathematics 1358639

The three-digit number··TW37丨5PA description is shown in the fourth formula. Wherein, the entropy of the set of known malware and known non-malicious programs having the feature Fi to be filtered; and the set of known malware and known non-malicious programs not having the feature Fi to be filtered entropy. 1 1〇§2(^7上·^) 4th formula /«=0 In the 4th formula, m is equal to 0 or 1. Wherein, for /«V·;), such as %. indicates the proportion of known malicious programs having the feature Fi to be filtered among all known malicious programs and known non-mali programs having the feature Fi to be filtered; Represents the proportion of known non-malicious programs with the feature Fi to be filtered among all known malicious programs and known non-mali programs with feature Fi to be filtered. Similarly, X&f;) is also obtained in the same way. For example, among 1000 known malware Pm and 1050 known non-malicious programs Pb, there are 300 known malware Pm with feature F1 to be filtered, and 320 known non-malicious programs Pb also have to be screened. Feature F1. A total of 620 programs in the 2050 programs have the feature Fi to be filtered, and 1430 programs do not have the feature Fi to be selected. 700 known malicious programs in 1000 known malware do not have the feature Fi to be filtered, and 730 known malware in 1050 known malware do not have to be screened.

Adt V · L LL r , 1000 , 1000 1050 , 1050, feature F 1 . Female mouth it匕, Info(S) = -(-log2-+-log2-) < JJ 2050 2 2050 2050 2 2050 r , 620 300, 300 320, 320, 1430, 700 , 700 730 , InfoFi (S) = (- log — + — log —) + (77^7 log + 77^7 log , and 730 ^2050 620 620 620 °620 2050 1430 1430 1430 1430 )). Such as 17 1358639

Sanda number: TW3715PA This is the information gain of the feature Fi to be filtered as its screening parameter Pi. 4 Since /_f, 〇s) is the entropy of the feature Fi to be filtered, when the entropy of the feature Fi to be screened is larger, the degree of data confusion of the feature Fi to be screened is higher. That is to say, the probability that a known malicious program has a feature to be filtered Fi is similar to the probability that a known non-malicious program has a feature to be screened Fi. Thus, the lower the information gain of the feature Fi to be screened. The feature to be screened Fi is a known malicious program. The degree of certainty of the feature is very low, and the degree of certainty that the feature to be screened Fi is known to be a non-malicious program is also low. Therefore, in the embodiment of the present invention, when the information gain of the feature to be screened Fi is lower than a threshold, the first feature screening unit 113 rejects the feature to be screened, Fi, and does not serve as the effective feature Fe. On the other hand, when the entropy of the feature to be screened Fi is larger, the probability that the known malicious program has a feature to be screened Fi is larger than the probability that a known non-malicious program appears to be screened for the feature Fi. Thus, the information φ gain of the feature Fi to be filtered is higher. Thus, for the feature Fi to be screened, only the following two cases will be established. The first case is that the feature to be screened Fi is a feature of a known malware that is very south. That is, the feature to be selected is mainly a feature of a known malware. The second case is that the feature to be screened Fi is a highly deterministic feature of a known non-malicious program, i.e., the feature to be screened Fi is essentially a feature of a known non-malicious program. Therefore, when the information gain of the feature to be screened Fi is higher than the threshold, the first feature screening unit 113 determines that the feature to be selected Fi is a valid feature.

Claims (1)

1358639 Sanda number: TW3715PA X. Patent application scope: 1. A data mining module for outputting a classification model based on a plurality of known malicious programs (Malware) and a plurality of known non-malicious programs. The data to be tested is classified into one of a malicious program and a non-malicious program according to the classification model. The data mining module includes: a program database for storing the known malicious programs and the known ones. a non-malicious program; a feature mining unit for extracting N features to be selected from the known malicious programs and the known non-malicious programs, and an i-th feature to be screened is Knowing at least one of the malware and the known non-malicious programs interacting with a file system, the known malware and the at least one of the known non-malicious programs having the i-th For the feature to be filtered, i is a positive integer less than or equal to N; a feature screening unit that filters a plurality of valid features from the N features to be selected, each of the effective features being substantially A feature to be known for one of the known malicious programs and one of the known non-malicious programs; and a classification model training unit for training the classification model based on the effective features. 2. The data mining module of claim 1, wherein, for the i-th feature to be screened, the feature screening unit is based on the known malicious programs having the i-th to-be-screened feature The number and the number of non-malicious programs having the i-th feature to be filtered are generated corresponding to the i-th 13 13^8639 three-number: TW3715PA to be filtered features - the i-th filter parameter is related to the i-th The _ selection feature is that the general teacher selection parameter is known to be one of the non-malware programs; = the degree 1 has the ith filter parameter higher than the threshold value, and the H system determines the ith number The feature to be screened is the s teacher selection unit. 3. In the material described in claim 2, the feature screening unit is further based on the known subgroups, and the number of non-malicious programs is generated. InfomaUcKi gain is used as a solidification: the characteristics of the selection feature. 4. The second number mentioned in item 1 of the patent application. In the middle, the classification model training unit is _ 枓 枓 木 木 木 , , 其 , , , , , , , , , , , , , , , , , , , , , , , l l l l l ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ model. . Plane (Hyper 5), as in the scope of the patent application, each of the effective features is a vector two lean mining module, and the feature screening unit performs a one-dimensional reduction operation on the effective features (Dimensi 〇n Reducti〇n), to reduce the vector dimension of each valid feature. 6. The data mining module described in claim 5, wherein 'the feature I is selected based on the principal component analysis operation ( Principle Component Analysis 'pCA) analyzes the principal components of the effective features and reduces the vector dimension of the effective features according to the results of the principal component analysis operation. 7. Data mining as described in item 1 of the patent scope Module, 27: TW3715PA dynamic relationship; - feature screening unit, Tian + Zhong Xi buckle ", think 4 king style and a plurality of known non-Ali and 々甘5 style features; and ^ According to these reference features, the reference-classification model is classified into a malicious program and a non-sub-sound according to the program-resolved program, and the classification module (4) is based on the effective features:; The malware described in the item is valid according to the:: the eigen is a vector, and the feature screening unit further reduces the vector dimension of each of the reference features. The group, wherein the evil levy bond model analysis result described in the thirteenth patent range, the temple sign screening unit further reduces the vector dimension of each of the reference features according to the principal components of the effective features. The group, the towel is as described in the patent application 帛12 item of the malicious program detection mode. The knife type is a support vector machine classifier (SVM aSSlfler), the classification model is a hyperplane. 16. The malicious program detection module described in claim 12, the complex φ, —, τ 'the known malicious programs and the known non-malicious program are stored in the program database, the malicious The program detection module further includes a malicious program notification display. Early, when the program to be tested is judged to be a malicious program, the private entity to be tested is stored in the program database as a new known malware. 17. The malware detection module 29 of claim 12: TW3715PA group 'where' the feature analysis unit extracts the preliminary features with a residual program. The meditation knife analysis method is composed of ^hai two standby group, Γφ, such as the malicious program debt test model described in item 12 of the patent scope. The parental feature is the dynamic link and application of the file. The behavior of the program interface.糸,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, 2. A malware detection system comprising: a data mining module comprising: a reading library for storing a plurality of known programs/hard numbers of known non-malicious programs; 1 (a)- a feature mining unit for extracting a feature from the known malware selection=programs, each of which is to be screened=ί: the interaction behavior of the system, the known evils and the It is known that non-malicious programs have at least one characteristic of -, Ν is a positive integer; /, system ~ has (four) to be screened - a first - feature screening unit 'by the two features to be screened two = _ effect The feature 'per effective feature system is essentially the second, the Γ and the known (four) meanings - the training has a categorical model training unit, a classification model; and 1 30 丄 达达号: TW3715PA 一赶' Π: Machine 5 Chuan training unit is trained according to the effective features to obtain the model, the denomination is a support vector machine to classify the program to be tested For the malicious process, the malware test described in item 20 of the patent in January -mother. The Haizheng characteristic is a vector, and the first feature screening single feature feature performs a one-dimensional reduction operation to reduce the vector dimension of each effective feature. In the case of the JL towel, the malicious program described in Item 24 of the monthly patent view, the red feature screening unit further reduces the vector dimension of each reference feature according to the effective features. For example, the malicious program price measurement system described in the S20 patent scope is the main program of the program, and the malware notification group 2 includes: the malicious program notification 2: ΐ=ί is determined to be a malicious program, and the program to be tested is stored. In the private shellfish library, as a new known malware. ^ μ Please refer to the malicious program mapping system described in item 2 () of the patent scope. The mother should initially rely on the behavior of the link building and the application interface. Each of the 峨= is ^known malware and the At least one of the known non-malicious programs - using the dynamic link slot and the dependent mode (4) behavior of the system of age. 28. The malicious program described in claim 2, wherein each known malicious program is a virus program or a worm program: one of a Trojan horse program and a back door program. 32 Π58639 i达号: TW3715PA 29. An nurturing mining method for outputting a classification model based on a plurality of known malicious programs and a plurality of known non-malicious programs, a program to be tested is classified according to the classification model One of the malware and non-malicious programs' mining methods include: (a) extracting N features to be selected from the known malicious programs and the known non-malicious programs. The teacher selection feature is an interaction behavior between the known malicious program and at least one of the known non-malicious programs and the slot system, i is a positive integer less than or equal to ^; the field (b) is The N features to be selected are selected into a plurality of valid features, and each of the valid features is substantially a feature of the known malicious programs and the known non-malicious programs; and (c) According to the axis effective remainder · job classification model. The data mining method described in Item 29 of Ij I, Item 11, in step (b), includes: the number of electricity, the corresponding features of the screening characteristics corresponding to the screening characteristics The number of the non-subsonic programs of the syllabary syllabus and the number of the non-subsequences of the first (four) non-four programs to be screened are corresponding to the first and second selection parameters, the i. The screening parameter is one of the characteristics of the '= sign, which is characterized by the known malicious programs and the certain touch-to-face frequency-authenticity; ^^(10)) is determined according to the N screening parameters. The no-signal is the valid feature. When the ith filter parameter is selected, the first feature to be selected is the valid feature. , Tan value, decision 33 1338639 Erda number: TW3715PA 31. As in the data mining method described in claim 30, 'in step (bl)' the first screening parameter is the i-th waiting Information gain of the teacher's characteristics. 32. For the data mining method described in claim 29, in step (c), based on the effective features, the support vector machine is trained to obtain a hyperplane as the classification model. In the branch (10) 33. As stated in the scope of the patent application Wherein after step (five), the method further comprises: ', method (b) performing a dimension reduction operation on the valid features to reduce the vector dimension of the parent effective feature. Descending 34: The information to be selected as described in claim 33 is the known malware and the knowledge is known: at least one of the broad forms uses this: the behavior of the interface with the application. A malicious program detection method, whether it is a malicious program, the malicious program detection method includes: ^ ^ Grab is (a) the test program extracts a plurality of preliminary feature step features The interaction between the program to be tested and the 'initial rKx^ file system; (1) after the plural financial rules, a plurality of reference features, the effective - the first-year temple recruiter selects the malicious program and a plurality of known non-Yalli ', only on the shell is mainly a plurality of already existing features; and the continuation program (c) reference-category model, according to the program classified as malware and non-malicious pots - the middle / feature will be just - The classification model 34 Sanda number: Ding W3 715PA is based on the training of these effective features. The method of detecting a malicious program as described in the patent stipulation S 35, wherein after the step (1), the method further comprises: reducing the vector dimension of each of the reference features according to the effective features. 7* The method for detecting the malicious program described in the patent scope & item is: a flat plane is a hyperplane, in step (4), according to the reference features, the support vector machine classification class One of the evil #programs and non-malicious programs. After the law, among them, the method, the method further includes: For the new known as a malicious program, the program to be tested is the second to the second结 舆 application; 介 = program using the construction system