CN102984140B - Malicious software feature fusion analytical method and system based on shared behavior segments - Google Patents

Abstract

The invention discloses a malware feature fusion analysis method and system based on behavior segment sharing, the method steps are as follows: deploy nodes for collecting and analyzing malware, establish a distributed hash table module; collect malware samples and divide them into fragment sets, Statistical local statistical characteristics; share to the distributed hash table module, gather the global characteristics of the behavior fragments and return them to the source node; the source node calculates the set of candidate neighbor nodes and performs similar operations on the behavior characteristics of the remote nodes of the set of candidate neighbor nodes to construct behavior characteristics Adjacency diagram; generate and fuse a fusion tree based on the behavior feature adjacency graph, and output the root behavior feature; the device includes multiple nodes, and the nodes include a behavior feature segmentation module, a distributed hash table module, a behavior fragment collaborative sharing module, and a neighbor Behavior feature discovery module and behavior feature gradual fusion module. The invention has the advantages of high analysis accuracy, strong analysis performance and good expandability.

Description

Malware feature fusion analysis method and system based on behavior fragment sharing

technical field

The invention relates to the technical field of computer network security, in particular to a malware feature fusion analysis method and system based on behavior segment sharing.

Background technique

According to the definition of terms in the Internet Security Threat Report of the National Internet Emergency Center, malware refers to programs that are installed and executed in information systems without authorization to achieve improper purposes. Malicious software mainly includes: 1) Trojan horse (Trojan Horse), malicious software with the main goal of stealing user personal information, and even remotely controlling the user's computer. 2) Bots, malicious software used to build large-scale attack platforms. According to the communication protocol used, bots can be further divided into: IRC (Internet Relay Chat) bots, HTTP (Hypertext Transfer Protocol) bots, P2P (peer-to-peer) bots, etc. 3) Worms refer to malicious software that can self-replicate and spread widely, with the main purpose of occupying system and network resources. 4) Viruses, which spread by infecting computer files, with the main purpose of destroying or tampering with user data and affecting the normal operation of information systems.

The detection and analysis of malware is becoming more and more difficult, mainly in the following three aspects. 1) The number of malicious software is huge and exponentially increasing. Symantec’s series of Internet Security Threat Reports (Symantec Internet Security Threat Report) pointed out that the current malicious software is huge and exponentially growing. Symantec’s 2011 total 400 million new malware samples discovered, an average of 1.1 million per day. Such huge malware samples bring great challenges to how to correctly identify, classify, and describe malware for malware detection systems. 2) The behavior of malware shows a stronger diversity. Through technologies such as message encryption, changing transmission channels, and polymorphism, different samples of the same malware show different behaviors, and it is difficult to correctly identify the observed malware samples. effective analysis. 3) Malware samples are widely distributed in space and have high concealment, so the number of samples of the same malware that can be observed in a single LAN or enterprise network is very limited. Due to the diversity of malware behaviors, the essential characteristics of malware cannot be obtained when the number of samples is limited, and the analysis accuracy cannot be guaranteed. Therefore, the malware analysis system generally adopts the distributed collection method to cover enough malware samples. Symantec researchers wrote a short paper (Benchmarking Computer Security Using WINE) at the top network security conference SP'11 (IEEE Symposium on Security and Privacy 2011), pointing out that the company has deployed 240,000 malware collection nodes around the world.

The U.S. Department of Defense defines information fusion as: Information fusion is the process of combining data and information to estimate or predict the state of an entity. The fusion of malicious software analysis results among the analysis nodes distributed in different parts of the network researched by the present invention is an application of information fusion in network security, and is a special type of information fusion.

At present, malware attacks use a variety of complex attack methods, such as multi-source distributed attacks and springboard attacks that distribute multiple samples across the network. At the same time, malware is widely dispersed and its behavior is hidden. characteristics or a comprehensive understanding of its attack attempts. Therefore, the fusion of distributed information to accurately understand the essential characteristics of malware and the global attack view has become a hotspot in network security research. Early research focused on fusing the alarm information of commercial intrusion detection systems (IDS, Intrusion Detection System) to discover multi-step complex attacks, reduce the false alarm rate of intrusion detection systems and improve detection coverage. The patent "Real-time data fusion method of large-scale distributed intrusion detection system" (patent number: 03137444.1) proposes a hierarchical alarm fusion architecture, and uses three steps of "clustering-merging-association" to realize the gradual alarming Fusion, clustering is to calculate the dissimilarity between alarms output by intrusion detection components (such as IDS, firewall, virus detection software, etc.), aggregate multiple alarms with small dissimilarity into one or more alarm clusters, and merge is Turn an alarm cluster into an intermediate alarm that contains various representative information in the alarm cluster. Association is to use association rules to associate multiple intermediate alarms into a high-level alarm, and finally provide security managers with concise and comprehensive alarms. At present, researchers generally use information fusion to detect and analyze malware. Scholar GuofeiGu et al. published a paper "BotMiner: Clustering analysis of network traffic for protocol-and "structure-independent botnet detection" integrates malicious behaviors (scanning, sending spam, binary code download, etc.) The set of hosts that synchronize content is the host of the same botnet. Scholar Roberto Perdisci published a paper "Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces" at NSDI'10 (USENIX Symposium on Networked System Design and Implementation 2010), the top international conference on network systems. The collection node collects various malware samples based on HTTP communication, and then adopts a centralized method to analyze the similarity between the HTTP behaviors of these malware samples on the centralized server, because the generated URL features integrate the characteristics of various deformed samples distributed all over the network. Behavioral features, so this URL feature accurately captures the essential features of the HTTP behavior of this type of malware. It can be found that the existing malware detection and analysis systems using information fusion generally adopt a centralized or hierarchical structure. The centralized structure processes all malware samples on the centralized server. Although the hierarchical structure handles some functions in the middle layer, The final analysis results are sent to the centralized management node. The number of malicious software is huge and exponentially increasing. Both the centralized server and the centralized management node in the centralized and hierarchical structures have computing bottlenecks.

For this reason, some studies adopt fully distributed structure for information fusion detection and malware analysis, but most of them can only deal with simple or specific malware. Scholar Min Cai et al. published the paper "WormShield: Fast Worm SignatureGeneration with Distributed Fingerprint Aggregation" in IEEE Transactions on Dependable and Secure Computing 2007, proposing to deploy multiple detection nodes on the edge network, and each detection node monitors its responsible All incoming and outgoing traffic of the edge network is filtered out from the traffic and submitted to other detection nodes for fusion, but it can only detect and extract monomorphic worms whose behavior does not change during the propagation process, because only Only the traffic of the same type of monomorphic worms will have the same sufficiently long traffic fragments, and it is meaningful to count the system-wide characteristics of the traffic fragments. The behaviors of malware using complex technologies such as message encryption, changing transmission channels, and polymorphism show complex diversity. The behaviors of the same type of malware samples vary greatly, and there is no long enough identical behavior between different samples. Behavioral sequence. Therefore, it is difficult for existing fully distributed analysis techniques to mine signatures from polymorphic malware behaviors.

To sum up, in order to integrate malware network behaviors to extract signatures, there are computing and communication bottlenecks in centralized servers or centralized management nodes in existing centralized and hierarchical malware analysis systems, while existing fully distributed Malware analysis technology can only detect and extract monomorphic malware whose behavior does not change during the propagation process, and cannot deal with malware that uses complex technologies such as message encryption, changing propagation channels, and polymorphism.

Distributed Hash Table (DHT, Distributed Hash Table) is usually used for distributed data storage and retrieval, and has the characteristics of decentralization, reliability and good scalability. In the DHT network, each node is responsible for a small range of routing processing and storage of some data objects (data). The basic principle of DHT is to represent each data resource object as a data resource object index entry (Key, Node) pair, Key is called a keyword, which is the resource object description information (such as resource name, resource number, resource content, etc.) Hash value, Node is the descriptive information (such as IP address, name, etc.) of the node that actually stores the resource object. All data resource object index entries (that is, all (Key,Node) pairs) form a resource object index hash table. As long as the Key value of the target resource object is input, the storage can be found from the resource object index hash table. The node address or other descriptive information of the resource object. The main function of DHT is to distribute the resource index hash table, divide it into many small pieces (local hash table), and then assign each local hash table to a participating node in the system according to specific rules In this way, each node is responsible for maintaining a local hash table.

Contents of the invention

The technical problem to be solved by the present invention is to provide a malware feature fusion analysis method and system based on behavior fragment sharing with high analysis accuracy, strong analysis performance and good scalability.

In order to solve the problems of the technologies described above, the technical solution adopted in the present invention is:

A malware feature fusion analysis method based on behavior fragment sharing, the implementation steps are as follows:

1) Deploy geographically dispersed nodes in the network, each node is responsible for the collection and analysis of malware samples in a network area, and establish a distributed hash table module for building a distributed hash table in the node;

2) Each node collects a malware sample and divides it into a fixed-length behavior segment set, and counts the number of local malware samples with each behavior segment behavior in the behavior segment set locally to obtain the local statistical characteristics of the behavior segment set;

3) Each node publishes and shares the set of behavior fragments and their local statistical characteristics to the distributed hash table, gathers the same behavior fragments from different nodes through the nodes of the distributed hash table and gathers the global characteristics of the behavior fragments statistically, so The global characteristics of the behavior fragments include a triplet set of behavior fragments, source node addresses, and the number of local malware samples that have the behavior of the behavior fragments locally on the source node, and return the behavior fragment collections with global characteristics to the shared behavior fragment collections and its source node for local statistical properties;

4) The source node calculates a set of candidate neighbor nodes with similar behavior features according to the behavior features of the malware formed by the behavior fragments of the malware and its global characteristics, and sends the source behavior features corresponding to the malware to the remote nodes in the set of candidate neighbor nodes , the remote node in the candidate neighbor node set compares the received source behavior feature with the local destination behavior feature to judge whether the destination behavior feature is the neighbor behavior feature of the source behavior feature, and returns the judgment result to the source node as the neighbor relationship of the behavior feature. The source node constructs a behavior feature adjacency graph according to the behavior feature neighbor relationship returned by the remote node;

5) On the basis of the feature adjacency graph, a distributed minimum spanning tree algorithm that preferentially selects edges with large weights is used to generate the maximum similarity tree of behavioral features on the adjacency graph as a fusion tree according to the associated edge data structure of behavioral features To realize the distributed generation of the fusion tree, the behavioral features in the fusion tree are fused, and the fusion order of the behavioral features in the fusion tree is determined based on the behavioral feature maximum similarity tree so that the most similar behavioral features are preferentially fused, The root behavior feature of the fusion tree is output as the fusion analysis result of the malware feature.

As a further improvement of the malware feature fusion analysis method based on behavior fragment sharing of the present invention:

The detailed steps of described step 2) are as follows:

2.1) The behavior of the malware sample is regarded as a sequentially executed behavior sequence, and a fixed-length continuous behavior subsequence is selected from the sequentially executed behavior sequence as a set of fixed-length behavior fragments obtained by segmentation; or according to the behavior sequence of the malware sample Establishing a behavior dependency graph based on the dependency relationship between the behavior operation data, selecting and obtaining a behavior dependency subgraph with a fixed number of vertices from the behavior dependency graph as a set of fixed-length behavior fragments obtained by segmentation;

2.2) Counting the number of local malware samples with the behavior of each behavior segment in the behavior segment set to obtain and output the local statistical characteristics of the behavior segment set.

The detailed steps of described step 3) are as follows:

3.1) Each node calls the distributed hash table module to obtain the key value of the behavior segment, encapsulates the behavior segment and its local statistical characteristics into a distributed hash table message, and then combines the key value and the distributed The hash table message is sent to the distributed hash table module; the distributed hash table module searches for the collection and analysis node responsible for the keyword value according to the keyword value, and routes the distributed hash table message to the node responsible for the keyword value. value node for storage;

3.2) Different nodes are responsible for different behavior fragments, gather the same behavior fragments of different nodes to the same node through the distributed hash table module and record the source node address of the published behavior fragment, and the behavior stored by the node through the distributed hash table module Fragment and its local statistical characteristics, according to the behavior fragment and its source node, the source node locally has the local malicious software sample number of described behavior fragment behavior to carry out statistical global characteristic, the global characteristic of described behavior fragment comprises behavior fragment, source node address, The source node locally has a ternary pair set of the number of local malware samples with the behavior fragment behavior; then the behavior fragment set with global characteristics is sent to the source node address, and the source node corresponding to the source node address receives A collection of behavior fragments.

The detailed steps of described step 4) are as follows:

4.1) The source node obtains the behavior characteristics of each local malware according to the behavior fragments and global characteristics of the malware, calculates the behavior fragment sharing degree between the behavior characteristics and other remote nodes according to formula (1), and divides the All the remote nodes whose fragment sharing degree is greater than the preset sharing degree threshold are used as a set of candidate neighbor nodes with similar behavioral characteristics;

${\mathrm{<span\; class="notranslate">\; share</span>}}_{\mathrm{<span\; class="notranslate">\; tj</span>}}<span\; class="notranslate">\; =</span>\underset{{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; FragSet</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{\underset{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; FragStatSet</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; log</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; log</span>}\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&le;</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

In formula (1), FragStatSet is a set of ternary pairs representing the global characteristics of behavior fragments, N is the number of nodes, M _i is the number of local behavior characteristics of node i, and the behavior fragment set of behavior characteristic t is FragSet _t , the behavior characteristic The number of local samples of t is Num _t , (Frag _s , Node _s , Num _s ) is the ternary pair in FragStatSet _where the behavior fragment is Frag _s , the source node is Node s and the number of local samples is Num _s , and F _s is the behavior Fragment is the frequency of Frag _s in normal program behavior, Node _j is the remote node; Share _tj (1≤t≤M _i ,1≤j≤N, j≠i) is the relationship between behavioral feature t and remote node Node _j The sharing degree of behavior fragments among them;

4.2) The source node sends the behavior characteristics of the local malware as the source behavior characteristics to all remote nodes in the candidate neighbor node set;

4.3) The remote nodes in the candidate neighbor node set will receive the common behavior of the source behavior feature and the local destination behavior feature to form the fusion behavior feature, and judge whether the frequency of the fusion behavior feature in the normal program is less than the set threshold, if If less than, it means that the common behavior of the source behavior feature and the target behavior feature is not common in normal programs and is specific to malware, and it is determined that the source behavior feature and the target behavior feature belong to the same malware; otherwise, it is determined that the source behavior feature and the target behavior feature are different. belong to the same malware;

4.4) If it is verified that the source behavior characteristic and the destination behavior characteristic belong to the same malicious software, then the destination behavior characteristic of the remote node is the neighbor behavior characteristic of the source behavior characteristic, and the remote node assigns the source behavior characteristic number, the destination behavior characteristic number, the source behavior characteristic The similarity between the target behavior feature and the neighbor behavior feature flag is assembled into a return message and returned to the source node where the source behavior feature is located, otherwise the remote node returns a negative message to the source node where the source behavior feature has no neighbor behavior feature flag;

4.5) The source node creates the edge of the behavioral feature adjacency graph according to the returned behavioral feature neighbor relationship, and the weight of the edge is the similarity between the two behavioral features represented by the two vertices, and finally constructs the behavioral feature adjacency graph ; Adopt one-way edge mode or two-way edge mode when the edge of described creation behavior feature adjacency graph, when adopting one-way edge mode: 1) when verifying that remote source behavior feature and local purpose behavior feature are the same malicious software Behavior features, create an edge between the local destination behavior feature and the remote source behavior feature, and add it into the local associated edge data structure; 2) According to the neighbor behavior feature message with the neighbor behavior feature flag bit returned by the remote node , check the local associated edge data structure to see if an edge has been created between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, if yes, no Do any operation, if not, create an edge between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, add it to the local associated edge data structure, and finally construct Feature adjacency graph; when the two-way edge method is adopted, when the local behavior feature neighbor relationship verification sub-module verifies that the remote source behavior feature and the local target behavior feature are the same malware behavior feature and receives information about the local target behavior Only when the feature number and the remote source behavior feature number have a neighbor behavior feature message with a neighbor behavior feature flag bit, an edge is created between the local destination behavior feature and the remote source behavior feature, and the local association is added. In the edge data structure, the feature adjacency graph is finally constructed.

The detailed steps of described step 5) are as follows:

5.1) On the basis of the feature adjacency graph, the source node adopts a distributed minimum spanning tree algorithm that preferentially selects edges with large weights to generate maximum similarity of behavioral features on the adjacency graph according to the associated edge data structure of behavioral features The tree is used as a fusion tree, and the fusion order of the behavioral features in the fusion tree is determined on the basis of the maximum similarity tree of the behavioral features so that the most similar behavioral features are preferentially fused;

5.2) The source node generates a process or thread independently as a feature fusion agent for the behavior characteristics of each vertex in the feature adjacency graph, or generates a feature fusion agent for the behavior characteristics of all vertices in the feature adjacency graph; The fusion agent submits the fusion result containing its own behavioral characteristics to the feature fusion agent of the next layer according to the fusion sequence; the feature fusion agent that receives the fusion result records the corresponding feature adjacency of the upper layer feature fusion agent that received the fusion result Adjacent edges in the relationship graph, check whether the adjacent edges are the edges with the largest weight among the associated edges of their own behavior characteristics among all adjacent edges, and if so, fuse their own behavior characteristics with all received fusion results And submit the fusion result to the next layer of feature fusion agent according to the fusion order, otherwise, fuse all the received fusion results and submit the fusion result and its own behavior characteristics to the next layer of feature fusion agent according to the fusion order, Final fusion obtains the root behavior characteristic of described fusion tree;

5.3) Outputting the root behavior feature of the fusion tree as a malware feature fusion analysis result.

The present invention also provides a malicious software feature fusion analysis system based on behavior segment sharing, which includes deploying geographically dispersed nodes in the network, each node is responsible for the collection and analysis of malicious software samples in a network area, and the nodes include :

The behavior feature segmentation module is used for nodes to collect malware samples and divide them into fixed-length behavior segment sets, count the number of local malware samples with the behavior of each behavior segment in the behavior segment set to obtain the local statistical characteristics of the behavior segment set and Submit to the Behavior Fragment Collaborative Sharing Module;

Distributed hash table module, used to build distributed hash table in the node;

Behavior segment collaborative sharing module, used for each node to publish and share the set of behavior segments and their local statistical characteristics to the distributed hash table, gather the same behavior segments from different nodes through the nodes of the distributed hash table and gather the behaviors statistically The global characteristics of the segment, the global characteristics of the behavior segment include a set of ternary pairs of the behavior segment, source node address, and the number of local malware samples of the source node locally having the behavior of the behavior segment, and the behavior segment set with the global feature Return to the source node that shares the collection of behavioral fragments and their local statistical properties;

The neighbor behavior feature discovery module is used to calculate the set of candidate neighbor nodes with similar behavior features according to the behavior features of the malware formed by the behavior fragments of the malware and its global characteristics, and send the source information corresponding to the malware to the remote nodes in the set of candidate neighbor nodes. Behavior characteristics; at the same time, when the node is a remote node in the candidate neighbor node set, compare the received source behavior characteristics with the local destination behavior characteristics to judge whether the destination behavior characteristics are the neighbor behavior characteristics of the source behavior characteristics, and use the judgment result as the behavior characteristic neighbor The relationship returns the source node, and constructs a behavior feature adjacency graph according to the behavior feature neighbor relationship returned by the remote node;

The distributed hierarchical fusion tree construction module is used to generate on the adjacency graph based on the feature adjacency graph, using a distributed minimum spanning tree algorithm that preferentially selects edges with large weights according to the associated edge data structure of behavioral features The maximum similarity tree of behavioral characteristics is used as a fusion tree to realize distributed generation of fusion trees;

A behavioral feature progressive fusion module, used to fuse the behavioral features in the fusion tree, and determine the fusion order of the behavioral features in the fusion tree based on the behavioral feature maximum similarity tree so that the most similar behavioral features are preferentially fused, The root behavior feature of the fusion tree is output as the fusion analysis result of the malware feature.

As a further improvement of the malware feature fusion analysis system based on behavior fragment sharing of the present invention:

The behavior feature segmentation module includes:

A continuous behavior subsequence submodule or a behavior-dependent subgraph segmentation submodule, the continuous behavior subsequence submodule is used to regard the behavior of the malware sample as a sequentially executed behavior sequence, and select a fixed behavior sequence from the sequentially executed behavior sequence. The continuous behavior subsequence of length is used as a set of fixed-length behavior fragments obtained by segmentation; the behavior dependency subgraph segmentation submodule is used to establish a behavior dependency graph according to the dependency between the behavior operation data of the malware sample, from the behavior A behavior-dependent subgraph with a fixed number of vertices is selected in the dependency graph as a set of fixed-length behavior fragments obtained by segmentation;

The behavior segment set statistics sub-module is used to count the number of local malware samples with the behavior of each behavior segment in the behavior segment set to obtain the local statistical characteristics of the behavior segment set and output it to the behavior segment collaborative sharing module.

The distributed hash table module includes:

Behavior fragment keyword mapping sub-module, used to obtain keyword value through hash calculation according to the input behavior fragment;

The keyword routing sub-module is used to find the collection and analysis node responsible for the keyword value according to the keyword value, and route the distributed hash table message to the node responsible for the keyword value for storage;

The behavior fragment collaborative sharing module includes:

The behavior fragment publishing submodule is used to call the distributed hash table module to obtain the key value of the behavior fragment, encapsulate the behavior fragment and its local statistical characteristics into a distributed hash table message, and then send the key value The value and the DHT message are sent to the DHT module;

Behavior fragment receiving sub-module, when the node is a node with distributed statistics global characteristics, it receives the behavior fragments stored in the distributed hash table module and its local statistical characteristics;

Behavior segment statistics sub-module, used to perform statistical global characteristics according to the behavior segment and its source node, the local malware sample number of the source node locally having the behavior of the behavior segment when the node is used as a node of distributed statistical global properties, the behavior The global characteristics of the segment include a triplet set of the behavior segment, the source node address, the number of local malware samples of the source node locally having the behavior of the behavior segment;

The behavior fragment global characteristic return submodule is used to send the behavior fragment set with global characteristics output by the behavior fragment statistics submodule to the source node address when the node is a node of distributed statistical global characteristics;

The behavior fragment global characteristic receiving sub-module is used for receiving the behavior fragment global characteristic and returning the behavior fragment set with the global characteristic sent by the sub-module when the node is the source node of the shared behavior fragment.

The neighbor behavior feature discovery module includes:

The candidate neighbor node set calculation submodule is used to obtain the behavioral characteristics of each local malware according to the behavioral fragments of the malware and its global characteristics, and calculate the behavioral fragments between the behavioral characteristics and other remote nodes according to formula (1) Sharing degree, using all remote nodes whose fragment sharing degree is greater than a preset sharing degree threshold as a set of candidate neighbor nodes with similar behavioral characteristics;

Behavioral feature sending sub-module, used to send the behavioral feature of local malware as source behavioral feature to all remote nodes in the candidate neighbor node set when the node is used as the source node;

Behavior characteristic receiving sub-module, used for receiving the source behavior characteristics sent by the source node when the node is a remote node of the candidate neighbor node set;

Behavioral feature neighbor relationship verification sub-module, used to form the common behavior of the received source behavior feature and the local target behavior feature into the fusion behavior feature, and judge whether the frequency of the fusion behavior feature in the normal program is less than the set threshold, If it is less than, it means that the common behavior of the source behavior feature and the target behavior feature is not common in normal programs and is specific to malware, and it is determined that the source behavior feature and the target behavior feature belong to the same malware; otherwise, it is determined that the source behavior feature and the target behavior feature do not belong to the same malware; if it is verified that the source behavior characteristic and the destination behavior characteristic belong to the same malware, then the destination behavior characteristic of the remote node is the neighbor behavior characteristic of the source behavior characteristic, and the remote node assigns the source behavior characteristic number, the destination behavior characteristic number , the similarity between the source behavior feature and the destination behavior feature, and the neighbor behavior feature flag bits are assembled into a return message and returned to the source node where the source behavior feature is located, otherwise the remote node returns to the source node where the source behavior feature has no neighbor behavior feature flag bits negative news;

The adjacency graph calculation sub-module is used to create the edge of the behavior feature adjacency graph according to the returned behavior feature neighbor relationship. The weight of the edge is the similarity between the two behavior features represented by the two vertices, and finally constructs the behavior feature Adjacency graph; when creating the edge of the behavior feature adjacency graph, adopt a one-way edge mode or a two-way edge mode, when using a one-way edge mode: 1) when verifying that the remote source behavior feature is identical to the local destination behavior feature For the behavior characteristics of malware, an edge is created between the local destination behavior characteristics and the remote source behavior characteristics, and added to the local associated edge data structure; When a behavior feature message is received, check the local associated edge data structure to see if an edge has been created between the local behavior feature represented by the source behavior feature number in the message and the remote behavior feature represented by the destination behavior feature number in the message, if Yes, do nothing, if not, create an edge between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, and add it to the local associated edge data structure; When the two-way edge method is adopted, when the local behavior characteristic neighbor relationship verification sub-module verifies that the remote source behavior characteristic and the local destination behavior characteristic are the behavior characteristics of the same malware and receives information about the local destination behavior characteristic number and the remote Only when the source behavior characteristic number of the source behavior characteristic number carries the neighbor behavior characteristic message with the neighbor behavior characteristic flag bit, an edge is created between the local destination behavior characteristic and the remote source behavior characteristic, and added to the local associated edge data structure;

${\mathrm{<span\; class="notranslate">\; share</span>}}_{\mathrm{<span\; class="notranslate">\; tj</span>}}<span\; class="notranslate">\; =</span>\underset{{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; FragSet</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{\underset{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; FragStatSet</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; log</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; log</span>}\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&le;</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

In formula (1), FragStatSet is a set of ternary pairs representing the global characteristics of behavior fragments, N is the number of nodes, M _i is the number of local behavior characteristics of node i, and the behavior fragment set of behavior characteristic t is FragSet _t , the behavior characteristic The number of local samples of t is Num _t , (Frag _s , Node _s , Num _s ) is the ternary pair in FragStatSet _where the behavior fragment is Frag _s , the source node is Node s and the number of local samples is Num _s , and F _s is the behavior Fragment is the frequency of Frag _s in normal program behavior, Node _j is the remote node; Share _tj (1≤t≤M _i ,1≤j≤N, j≠i) is the relationship between behavioral feature t and remote node Node _j The degree of sharing of behavioral fragments among them.

The distributed hierarchical fusion tree construction module includes:

Behavioral feature maximum similarity tree construction sub-module, used for on the basis of the feature adjacency graph, using a distributed minimum spanning tree algorithm that preferentially selects edges with large weights on the adjacency graph according to the associated edge data structure of the behavior feature Generate the maximum similarity tree of behavioral features as a fusion tree;

Behavior feature fusion sequence construction submodule, used to determine the fusion order of behavior features in the fusion tree based on the maximum similarity tree of behavior features so that the most similar behavior features are preferentially fused;

The behavioral feature fusion module includes a plurality of feature fusion agents corresponding to the behavioral features of each vertex in the feature adjacency graph or a feature fusion agent corresponding to the behavioral features of all vertices in the feature adjacency graph in the form of processes or threads ;

The feature fusion agent includes:

Behavioral feature submission submodule, used to submit the fusion result containing its own behavioral features to the feature fusion agent of the next layer according to the fusion order;

The behavior feature receiving sub-module is used to receive the fusion result submitted by the feature fusion agent of the upper layer and record the adjacent edge in the feature adjacency graph corresponding to the feature fusion agent of the upper layer that received the fusion result; the behavior feature fusion sub-module , is used to judge whether the adjacent edge is the edge with the largest weight among the associated edges of its own behavior characteristics among all adjacent edges, and if so, fuse its own behavior characteristics and all received fusion results Submit to the next layer of feature fusion agent according to the fusion order, otherwise, fuse all received fusion results and submit the fusion result and its own behavior characteristics to the next layer of feature fusion agent according to the fusion order; finally the fusion tree The root feature fusion agent fuses to obtain the root behavior feature of the fusion tree, and outputs the root behavior feature of the fusion tree as a malware feature fusion analysis result.

The malware feature fusion analysis method based on behavior fragment sharing of the present invention has the following advantages: because malware may utilize technologies such as message encryption and polymorphism, different samples of the same type of malware may have various different behavioral characteristics, but due to the functional The similarity with the source and the consistency of the communication method, the behavior of the same kind of malware is similar, specifically shown that some behavior fragments are the same among the samples of the same malware, so the information about the same kind of malware distributed in each node of the network The sample behaviors have the same behavior fragments, and the common parts of these sample behaviors are the characteristics of malware. Based on the characteristics of the behavior characteristics of different samples of the same type of malware, the present invention designs a malware feature distributed fusion method based on the sharing of behavior fragments, through the sharing of behavior fragment distribution information and the discovery mechanism of neighbor nodes, it can communicate with a small network To achieve scalable distribution is the fusion of malware features, through the malware feature adjacency graph, support the hierarchical fusion of polymorphic malware features according to the family tree; in addition, the feature fusion verification technology of the distribution level of the present invention can realize more accurate malware Software feature mining; in summary, the present invention has the advantages of high analysis accuracy, strong analysis performance and good scalability.

The malware feature fusion analysis system based on behavior segment sharing in the present invention is a system corresponding to the malware feature fusion analysis method based on behavior segment sharing in the present invention, and has the same technology as the malware feature fusion analysis method based on behavior segment sharing in the present invention effect, which will not be repeated here.

Description of drawings

Fig. 1 is a schematic flow chart of the implementation of the method of the embodiment of the present invention.

FIG. 2 is a schematic diagram of a topological structure of a converged overlay network composed of behavior segments of nodes in an embodiment of the present invention.

Fig. 3 is a schematic diagram of the segmentation principle of continuous behavior subsequences in the embodiment of the present invention.

FIG. 4 is a schematic diagram of the segmentation principle of behavior-dependent subgraphs in an embodiment of the present invention.

Fig. 5 is a schematic diagram of the frame structure of the system of the embodiment of the present invention.

Fig. 6 is a schematic diagram of the working principle of the distributed hash table module and the collaborative sharing module of behavior fragments in the embodiment of the present invention.

Fig. 7 is a schematic diagram of the workflow of the neighbor behavior feature discovery module in the embodiment of the present invention.

Fig. 8 is a schematic diagram of the frame structure of the distributed hierarchical fusion tree construction module in the embodiment of the present invention.

FIG. 9 is a schematic diagram of the workflow of the behavior feature gradual fusion module in the embodiment of the present invention.

FIG. 10 is a schematic diagram of a multi-process representation mode in which the behavior feature set of node i adopts an unmanaged process in an embodiment of the present invention.

FIG. 11 is a schematic diagram of a multi-process representation of a managed process of a behavior feature set in node i in an embodiment of the present invention.

Fig. 12 is a schematic structural diagram of the process of behavior feature representation in the embodiment of the present invention.

Detailed ways

As shown in Figure 1, the implementation steps of the malware feature fusion analysis method based on behavioral segment sharing in this embodiment are as follows:

1) Deploy geographically dispersed nodes in the network, each node is responsible for the collection and analysis of malware samples in a network area, and establish a distributed hash table module for building a distributed hash table in the node;

2) Each node collects malware samples and divides them into fixed-length behavior segment sets, and counts the number of local malware samples with behaviors of each behavior segment in the behavior segment set to obtain the local statistical characteristics of the behavior segment set;

3) Each node publishes and shares the set of behavior fragments and their local statistical characteristics to the distributed hash table, and gathers the same behavior fragments from different nodes through the nodes of the distributed hash table, and collects statistics on the global characteristics of the behavior fragments, which will have The set of behavior fragments of the global characteristics is returned to the source node that shares the collection of behavior fragments and its local statistical characteristics;

4) The source node calculates the set of candidate neighbor nodes with similar behavior characteristics according to the behavior characteristics of malware composed of behavior fragments and global characteristics of the malware, and sends the source behavior characteristics corresponding to the malware to the remote nodes in the set of candidate neighbor nodes. The remote nodes in the neighbor node set compare the received source behavior characteristics with the local destination behavior characteristics to judge whether the destination behavior characteristics are the neighbor behavior characteristics of the source behavior characteristics, and return the judgment result to the source node as the neighbor relationship of the behavior characteristics. Behavior feature neighbor relations returned by nodes construct behavior feature adjacency graph;

5) Generate a fusion tree in a distributed manner based on the feature adjacency graph, fuse the behavior features in the fusion tree, and output the root behavior feature of the fusion tree as the malware feature fusion analysis result.

As shown in Figure 2, this embodiment includes several nodes, and each node performs local analysis on the malware samples collected by itself. Behavior characteristics and the number of local samples with the behavior characteristics (abbreviated as the number of local samples of behavior characteristics), each node jointly forms a "behavior fragment fusion overlay network", and the "behavior fragment fusion overlay network" is composed of the distributed hash table of each node Modules and behavior fragments are composed of collaborative sharing modules through network connections. The nodes divide the behavioral features into a collection of behavioral fragments, and then share the local analysis results of the same malware through the "behavior fragment fusion overlay network", and then construct a behavioral feature fusion tree at the nodes responsible for the same malware. Ideally, each There is a fusion tree corresponding to one kind of malware, and this embodiment gradually fuses all these local analysis results of the same malware in different nodes according to the order specified by the fusion tree. The fusion process is divided into three stages: 1) Neighbor behavior feature discovery stage; 2) the stage of constructing a behavior feature fusion tree; 3) the stage of obtaining the global analysis result by the fusion tree, and finally obtain the global accurate global analysis result of the malware corresponding to the fusion tree at the root node of the fusion tree. Due to the widespread dispersion and extremely concealment of malware, the amount of malware sample information obtained by the malware single-point analysis system is small, and malware uses encryption, multiple attack paths, polymorphic techniques, etc., making different samples of the same malware With different behaviors, it is difficult for a single-point analysis system to extract the essential characteristics of malware from a small number of malware samples, and the analysis accuracy is low; on the other hand, the number of malware is huge and exponentially growing, and all collected samples There are computing and communication bottlenecks in the distributed collection and centralized analysis system that is submitted to the centralized server for centralized processing. This embodiment is based on the similarity of behavioral features, sources, and communication modes of different samples of the same kind of malware. Nodes realize the sharing of malware behavior fragments between nodes through a distributed hash table, and nodes discover similar malware through a malware similarity discovery mechanism. Other nodes of malware, and then build a load-balanced aggregation tree on the nodes that find similar malware, realize the global analysis of malware features and the hierarchical fusion of polymorphic features, and the distributed hash table module can effectively overcome malware collection. It can detect and extract monomorphic malware whose behavior does not change during the propagation process, and can also deal with various types of malicious software that use complex technologies such as message encryption, changing propagation channels, and polymorphism. The software has the advantages of high analysis accuracy, strong analysis performance, and good scalability. It not only solves the problem of non-essential malware characteristics obtained due to the small amount of malware sample information obtained by the malware single-point analysis system, but also solves the problem of The distributed collection and centralized analysis system has a good application prospect due to the computing and communication bottlenecks caused by the huge number and exponential growth of malware, and taking into account the accuracy and scalability of malware analysis.

In this embodiment, the detailed steps of step 2) are as follows: 2.1) The behavior of the malware sample is regarded as a sequentially executed behavior sequence, and a fixed-length continuous behavior subsequence is selected from the sequentially executed behavior sequence as the fixed-length subsequence obtained by segmentation. set of behavior fragments; or establish a behavior dependency graph according to the dependency relationship between the behavior operation data of the malware sample, and select a behavior dependency subgraph with a fixed number of vertices from the behavior dependency graph as a fixed-length behavior fragment set obtained by segmentation; 2.2) Counting the number of local malware samples with the behavior of each behavior segment in the behavior segment set to obtain and output the local statistical characteristics of the behavior segment set. As shown in Figure 3, assume that a certain behavioral feature has the following behaviors: 1) create the CreateFile behavior of copying the target file of malicious software under the specified directory; 2) read the registry entry of the specified keyword in the registry to obtain the malicious The ReadRegistry behavior of the source file path of the software; 3) the CopyFile behavior of copying the malware file under the source file path to the newly created destination file; 4) and then creating a new process to run the newly copied destination file as an executable file 5) Afterwards, different samples have different behaviors, which are represented by the wildcard "*" in the figure; 6) CreateSocket behavior for creating a socket interface locally; 7) Connecting to a remote server with the created socket interface Connect behavior; 8) SendMsg behavior of communicating with the server using the connected socket interface. Assuming that the local analysis results generated by each node do not consider the sequence behavior characteristics of data dependencies between behaviors, as shown in the upper part of Figure 3, the sequence behavior sequence shown in Figure 3 is divided into three lengths of 3 Behavior subsequences (behavior fragments). As shown in Figure 4, starting from the dependency relationship between behavioral data, the behavior dependency diagram of some malware in Figure 3 is shown in the upper part of Figure 4: CopyFile depends on the destination file created by CreateFile and the source file path output by ReadRegistry, RunFile Depends on the copied content copied by CopyFile to the destination file, Connect depends on the socket interface created by CreateSocket, and SendMsg depends on the connection with the server generated by Connect. In the behavior dependency graph, behavior fragments are any connected subgraphs with a fixed number of vertices. As shown in the lower part of Figure 4, three behavior-dependent subgraphs (behavior fragments) with a length (number of vertices) of 3 are obtained after division. The specific manner of dividing the set of behavior fragments may be selected according to the deployment environment and the type of information available. However, the behavior dependency graph can more accurately express the behavior characteristics of malware. Even if the malware completes a specific function, it can change the execution sequence of behaviors without dependencies, while the behavior dependency graph focuses on the dependencies between behavior and operation data. The dependency relationship generally does not change when the same function is completed. Therefore, when the semantics of the completed function remain unchanged, the behavior dependency graph generally does not change, which can improve the accuracy of detection.

In the present embodiment, the detailed steps of step 3) are as follows: 3.1) each node invokes the distributed hash table module to obtain the key value of the behavior segment, encapsulates the behavior segment and its local statistical characteristics into a distributed hash table message, and then Send the keyword value and the distributed hash table message to the distributed hash table module; the distributed hash table module searches for the collection and analysis node responsible for the keyword value according to the keyword value, and routes the distributed hash table message 3.2) Different nodes are responsible for different behavior fragments, gather the same behavior fragments of different nodes to the same node through the distributed hash table module and record the source node address of the published behavior fragments, and the nodes pass Behavior fragments and their local statistical characteristics stored in the distributed hash table module, according to the behavior fragments and their source nodes, and the number of local malware samples with behavior fragment behavior in the source node, the global characteristics are calculated. The global characteristics of behavior fragments include behavior fragments , the address of the source node, and the number of local malware samples with behavior fragments in the source node; A collection of behavioral fragments with global properties.

In the present embodiment, the detailed steps of step 4) are as follows:

4.1) The source node obtains the behavior characteristics of each local malware according to the behavior fragments of the malware and its global characteristics, and calculates the behavior fragment sharing degree between the behavior characteristics and other remote nodes according to formula (1), and the fragment sharing degree is greater than All remote nodes with a preset sharing degree threshold are used as a set of candidate neighbor nodes with similar behavioral characteristics;

${\mathrm{<span\; class="notranslate">\; share</span>}}_{\mathrm{<span\; class="notranslate">\; tj</span>}}<span\; class="notranslate">\; =</span>\underset{{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; FragSet</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{\underset{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; FragStatSet</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; log</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; log</span>}\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&le;</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

In formula (1), FragStatSet is a set of ternary pairs representing the global characteristics of behavior fragments, N is the number of nodes, M _i is the number of local behavior characteristics of node i, and the behavior fragment set of behavior characteristic t is FragSet _t , the behavior characteristic The number of local samples of t is Num _t , (Frag _s , Node _s , Num _s ) is the ternary pair in FragStatSet _where the behavior fragment is Frag _s , the source node is Node s and the number of local samples is Num _s , and F _s is the behavior Fragment is the frequency of Frag _s in normal program behavior, Node _j is the remote node; Share _tj (1≤t≤M _i ,1≤j≤N, j≠i) is the relationship between behavioral feature t and remote node Node _j The sharing degree of behavior fragments among them;

4.2) The source node sends the behavior characteristics of the local malware as the source behavior characteristics to all remote nodes in the candidate neighbor node set;

4.3) The remote nodes in the candidate neighbor node set will receive the common behavior of the source behavior feature and the local destination behavior feature to form the fusion behavior feature, and judge whether the frequency of the fusion behavior feature in the normal program is less than the set threshold, if it is less than then Explain that the common behavior of the source behavior feature and the target behavior feature is not common in normal programs and is specific to malware. It is determined that the source behavior feature and the target behavior feature belong to the same malware; otherwise, it is determined that the source behavior feature and the target behavior feature do not belong to the same malware. malicious software;

4.4) If it is verified that the source behavior characteristic and the destination behavior characteristic belong to the same malicious software, then the destination behavior characteristic of the remote node is the neighbor behavior characteristic of the source behavior characteristic, and the remote node assigns the source behavior characteristic number, the destination behavior characteristic number, the source behavior characteristic The similarity between the target behavior feature and the neighbor behavior feature flag is assembled into a return message and returned to the source node where the source behavior feature is located, otherwise the remote node returns a negative message to the source node where the source behavior feature has no neighbor behavior feature flag;

4.5) The source node creates the edge of the behavioral feature adjacency graph according to the returned behavioral feature neighbor relationship, and the weight of the edge is the similarity between the two behavioral features represented by the two vertices, and finally constructs the behavioral feature adjacency graph; When the edge of the behavior feature adjacency graph adopts the one-way edge method or the two-way edge method, when the one-way edge method is adopted: 1) when verifying that the remote source behavior characteristic and the local destination behavior characteristic are the behavior characteristics of the same malware, Create an edge between the local destination behavior feature and the remote source behavior feature, and add it to the local associated edge data structure; 2) When receiving the neighbor behavior feature message with the neighbor behavior feature flag bit returned by the remote node, check the local In the associated edge data structure, check whether an edge has been created between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, and if so, do nothing. If not, create an edge between the local behavior feature represented by the source behavior feature number in the message and the remote behavior feature represented by the destination behavior feature number in the message, add it to the local associated edge data structure, and finally construct the feature adjacency graph ; When the two-way edge mode is adopted, when the local behavior characteristic neighbor relationship verification sub-module verifies that the remote source behavior characteristic and the local destination behavior characteristic are the behavior characteristics of the same malware and receives information about the local destination behavior characteristic number and the Only when the remote source behavior feature number carries the neighbor behavior feature message with the neighbor behavior feature flag, an edge is created between the local destination behavior feature and the remote source behavior feature, and added to the local associated edge data structure , and finally construct the feature adjacency graph.

In the present embodiment, the detailed steps of step 5) are as follows:

5.1) On the basis of the feature adjacency graph, the source node adopts the distributed minimum spanning tree algorithm that preferentially selects edges with large weights to generate the maximum similarity tree of behavioral features on the adjacency graph as a fusion tree according to the associated edge data structure of behavioral features , based on the behavioral feature maximum similarity tree, determine the fusion order of the behavioral features in the fusion tree so that the most similar behavioral features are fused first;

5.2) The source node generates a separate process or thread as a feature fusion agent for the behavior characteristics of each vertex in the feature adjacency graph, or generates a feature fusion agent for the behavior characteristics of all vertices in the feature adjacency graph; the feature fusion agent is based on the fusion Sequentially submit the fusion result containing its own behavioral features to the feature fusion agent of the next layer; the feature fusion agent that receives the fusion result records the adjacency edge in the corresponding feature adjacency graph of the upper layer feature fusion agent that received the fusion result, check Is the adjacent edge the edge with the largest weight among the associated edges of its own behavior characteristics among all adjacent edges? If so, fuse its own behavior characteristics with all received fusion results and submit the fusion results to the following according to the fusion order A layer of feature fusion agents, otherwise, fuse all received fusion results and submit the fusion results and their own behavioral characteristics to the next layer of feature fusion agents according to the fusion sequence, and finally fuse to obtain the root behavioral characteristics of the fusion tree;

5.3) Output the root behavior feature of the fusion tree as the result of fusion analysis of malware features.

As shown in Figure 5, the malware feature fusion analysis system based on the sharing of behavioral fragments in this embodiment includes separately deploying geographically dispersed nodes in the network, each node is responsible for the collection and analysis of malware samples in a network area, and the nodes include :

Behavior feature segmentation module, used for nodes to collect malware samples and divide them into fixed-length behavior fragment sets, count the number of local malware samples with the behavior of each behavior fragment in the behavior fragment set, obtain the local statistical characteristics of the behavior fragment set and submit it to Behavior fragment collaborative sharing module;

Distributed hash table module, used to build distributed hash table in the node;

Behavior segment collaborative sharing module, used for each node to publish and share the set of behavior segments and their local statistical characteristics to the distributed hash table, gather the same behavior segments from different nodes through the nodes of the distributed hash table, and count the aggregated behavior segments Global properties, returns the set of behavior fragments with global properties to the source node sharing the set of behavior fragments and their local statistical properties;

The neighbor behavior feature discovery module is used to calculate the set of candidate neighbor nodes with similar behavior features according to the behavior features of the malware formed by the behavior fragments of the malware and its global characteristics, and send the source information corresponding to the malware to the remote nodes in the set of candidate neighbor nodes. Behavior characteristics; at the same time, when the node is a remote node in the candidate neighbor node set, compare the received source behavior characteristics with the local destination behavior characteristics to judge whether the destination behavior characteristics are the neighbor behavior characteristics of the source behavior characteristics, and use the judgment result as the behavior characteristic neighbor The relationship returns the source node, and constructs a behavior feature adjacency graph according to the behavior feature neighbor relationship returned by the remote node;

The distributed hierarchical fusion tree construction module is used to generate the fusion tree distributedly on the basis of the feature adjacency graph;

The behavior feature fusion module is used to fuse the behavior features in the fusion tree, and output the root behavior feature of the fusion tree as the malware feature fusion analysis result.

In this embodiment, the behavior feature segmentation module includes:

The continuous behavior sub-sequence sub-module or the behavior-dependent subgraph segmentation sub-module, the continuous behavior sub-sequence sub-module is used to treat the behavior of malware samples as a sequentially executed behavior sequence, and select a fixed-length continuous behavior from the sequentially executed behavior sequence The subsequence is a set of fixed-length behavior fragments obtained by segmentation; the behavior dependency subgraph segmentation submodule is used to establish a behavior dependency graph according to the dependency relationship between the behavior operation data of malware samples, and select and obtain a fixed number of vertices from the behavior dependency graph The target behavior depends on the subgraph as a set of fixed-length behavior fragments obtained by segmentation;

The behavior segment set statistics sub-module is used to count the number of local malware samples with the behavior of each behavior segment in the behavior segment set to obtain the local statistical characteristics of the behavior segment set and output it to the behavior segment collaborative sharing module.

In order to realize the fully distributed polymorphic behavior characteristic analysis of malicious software, this embodiment constructs a distributed analysis method through a scalable distributed hash table (DHT, Distributed Hash Table), and deploys multiple nodes on the network. Establish a distributed hash table module for building a distributed hash table. The behavior fragments of each node cooperate with the shared module to localize the node in the form of a distributed hash table by calling the relevant functions of the distributed hash table module. The behavior fragment set of behavior characteristics is stored in the distributed hash structure. The specific method of storing each behavior fragment in the behavior fragment set is: use the behavior fragment as the resource name, use the behavior fragment and the local sample number of the behavior fragment Wait for the local analysis result to be the content, use the hash function to hash the behavior fragment (resource name) to obtain the keyword value of the behavior fragment, and store the content of the behavior fragment based on the distributed hash table to be responsible for the purpose of the keyword value node; the destination node is receiving and storing the content of the behavior fragment; according to the characteristics of the distributed hash table, all the same behavior fragments from different nodes will be routed and stored on the same destination node, so the destination node has the malware local The global information of the behavior segment in the analysis result distributed fusion system. The destination node obtains the binary pair set of source nodes and local samples with the behavior fragment in the whole system by accumulating the node address of the same behavior fragment and the local sample number of the node about the behavior fragment; the destination node combines the source node of the behavior fragment with the local The sample number binary pair plus the third element—the corresponding behavior segment—constitutes the behavior segment, source node and local sample number triplet pair set and returns to all source nodes in the triplet pair set; returns after the above release In the process, each node obtains the global characteristics of behavior fragments of its own behavior characteristics in the distributed fusion system of malware local analysis results (a set of ternary pairs of behavior fragments, source nodes, and local sample numbers). The distributed hash table module is used to support the collaborative sharing module of behavior fragments, which maps behavior fragments to key values after hashing, and then routes local analysis results such as behavior fragments and their local sample numbers to the responsible The node of key value, distributed hash table module includes in the present embodiment:

Behavior fragment keyword mapping sub-module, used to obtain keyword value through hash calculation according to the input behavior fragment;

The keyword routing sub-module is used to find the collection and analysis node responsible for the keyword value according to the keyword value, and route the distributed hash table message to the node responsible for the keyword value for storage.

Behavior Fragment Collaborative Sharing Module is used for load-balancing, decentralized, and scalable aggregation of the same behavior fragments from different nodes and statistics of the global characteristics of the aggregated behavior fragments. The global characteristics include the node set and the behavior fragments in the whole system. The local sample number set of each node in the behavior fragment in the node set, because the node corresponds to the local sample number one by one, that is, the global characteristics include the nodes with the behavior fragment in the whole system and the nodes with the behavior fragment behavior on the node The number of local malware samples (abbreviated as the number of local samples of the behavior segment) binary pair set, plus the behavior segment itself constitutes the ternary pair of the behavior segment, the address of the source node, and the number of local malware samples with the behavior of the behavior segment in the source node gather.

In this embodiment, the behavior segment cooperative sharing module includes:

Behavior Fragment Publishing sub-module is used to call the Distributed Hash Table module to obtain the key value of the Behavior Fragment, encapsulate the Behavior Fragment and its local statistical characteristics into a Distributed Hash Table message, and then combine the key value and the distributed hash The table message is sent to the distributed hash table module;

Behavior fragment receiving sub-module, when the node is a node with distributed statistics global characteristics, it receives the behavior fragments stored in the distributed hash table module and its local statistical characteristics;

Behavior fragment statistics sub-module, used to count global characteristics and global characteristics of behavior fragments according to behavior fragments and their source nodes, and the number of local malware samples with behavior fragment behaviors in source nodes A set of ternary pairs including the behavior fragment, source node address, and the number of local malware samples of the source node that have the behavior of the behavior fragment;

Behavior fragment global characteristic return sub-module, used to send the behavior fragment collection with global characteristics output by the behavior fragment statistics sub-module to the source node address when the node is a node with distributed statistics global characteristics;

Behavior Fragment Global Feature Receiving Sub-module, used to receive Behavior Fragment Global Feature when the node is the source node of Shared Behavior Fragment and return the set of Behavior Fragment with global feature sent by the sub-module.

As shown in Figure 6, the working steps of the behavior fragment collaborative sharing module are as follows: ①. The behavior fragment release sub-module calls the behavior fragment keyword mapping sub-module of the distributed hash table module to obtain the keyword value of the behavior fragment, and converts the behavior fragment and Its local statistical characteristics are encapsulated into a distributed hash table message, and then the keyword value and distributed hash table message are sent to the keyword routing sub-module of the distributed hash table module, and sent to the responsible The nodes corresponding to the key value are stored; ②, the nodes responsible for the key value are respectively used as the nodes of the global characteristics of distributed statistics, and each node stored in the distributed hash table module is received through the behavior segment receiving sub-module to publish the responsible key value Corresponding behavior fragments and their local statistical characteristics; ③. The behavior fragment statistics sub-module performs statistical global characteristics according to the behavior fragments and their source nodes, and the number of local malware samples with behavior fragment behaviors in the source node. The global characteristics of behavior fragments include behavior A set of ternary pairs of fragments, source node addresses, and the number of local malware samples with behavioral fragment behaviors in the source node; ④, global characteristics of behavioral fragments return submodules across nodes and export behaviors with global characteristics from the behavioral fragment statistics submodule The fragment set is sent to the source node address; the behavior fragment global characteristic receiving submodule receives the behavior fragment global characteristic and returns the behavior fragment collection with global characteristics sent by the submodule, and finally each node that publishes the behavior fragment obtains the global behavior fragment released Attributes. The Behavior Fragment Cooperative Sharing Module is built on top of the Distributed Hash Table module, and completes the routing of the Behavior Fragment Sets of local behavior characteristics to their respective responsible nodes according to the traditional Distributed Hash Table method, so as to realize the same behavior fragments from different nodes Gather to the same node, gather different behavior fragments to different nodes, realize load-balanced, decentralized, and scalable aggregation of the same behavior fragments from different nodes; then perform global characteristics on the behavior fragments at the aggregation point of the behavior fragments Statistics; finally, the behavior fragment and its global characteristics are returned to the source node set of the behavior fragment; the final result is that each node has obtained the global characteristics of the behavior fragment collection of its own behavior characteristics in the whole system, and the global characteristics of the behavior fragment include the global characteristics of the whole system. A set of ternary pairs including the behavior fragment of the system, the source node, and the local sample number of the source node locally having the behavior of the behavior fragment. The behavior segment collaborative sharing module is built on top of the distributed hash table module. According to the traditional distributed hash table method, the behavior segment set routing of the local behavior characteristics is sent to the node responsible for the corresponding key value of each behavior segment, realizing from The same behavior fragments of different nodes are gathered at the same node, and different behavior fragments are gathered at different nodes to achieve load-balanced, decentralized, and scalable gathering of the same behavior fragments from different nodes; and then at the gathering point of the behavior fragments Perform global characteristic statistics on the behavior fragments; finally, return the behavior fragments and their global characteristics to the source node set of the behavior fragments; the final result is that each node obtains the global characteristics of the behavior fragment set of its own behavior characteristics in the whole system, and the behavior The global characteristics of a segment include a triplet set of a behavior segment of the whole system, a source node, and a local sample number of the source node locally having the behavior of the behavior segment. The behavior fragment cooperative sharing module includes: a behavior fragment publishing submodule, a behavior fragment receiving submodule, a behavior fragment statistics submodule, a behavior fragment global characteristic returning submodule and a behavior fragment global characteristic receiving submodule. The behavior fragment release sub-module takes the behavior fragment set output by the behavior feature segmentation module as input, and does the following processing for each behavior fragment in the behavior fragment set: first, the behavior fragment keyword of the distributed hash table module is invoked with the behavior fragment as input The mapping submodule obtains the keyword value corresponding to the behavior fragment, assembles the behavior fragment and its local sample number and other local analysis results into a distributed hash table message, and returns it from the fragment keyword mapping submodule of the distributed hash table module The keyword value of is input to the keyword routing submodule of the distributed hash table module as the routing keyword, and the keyword routing submodule of the distributed hash table module completes the transmission of the message to the node responsible for the routing keyword. The implementation gathers the same behavior fragments from different nodes to the same node responsible for the corresponding key value of the same behavior fragments. The behavior segment receiving sub-module is an extension of the traditional distributed hash table routing message receiving module. In addition to the traditional distributed hash table routing message receiving function, this sub-module also records the address of the source node that sent the message. The behavior segment statistics sub-module takes the routing message received by the behavior segment receiving sub-module (including the local analysis results such as the behavior segment and its local sample number) and the address of the message sending source node as input, and through the statistics of the routing message received by the behavior segment receiving sub-module The source node address and local sample number in all routing messages with the same behavior segment get the source node and local sample number binary pair set with the behavior segment in the whole system, that is, the global characteristics of the behavior segment. The behavior segment global feature return sub-module takes the behavior segment output by the behavior segment statistics sub-module, the corresponding global feature, and the address set of the source node that issued the behavior segment as input, assembles the behavior segment and the corresponding global feature into a return message, and then passes The socket interface sends the return message to each address in the source node address set. Behavior Fragment Global Feature Receiving Submodule is a simple server-side socket interface, which receives return messages (including behavior fragments and corresponding global features) sent to the server-side socket interface by other nodes. Malware local analysis results The behavior fragments of each node in the distributed fusion system cooperate with the sharing module and the distributed hash table module to form a behavior fragment fusion overlay network, which sends the behavior fragment collection of its own behavior characteristics through the source node, responsible for The destination node of the corresponding keyword value of the behavior fragment counts the global characteristics of the same behavior fragment from different source nodes, and then returns the behavior fragment and global characteristics to the source node, and finally all source nodes obtain the behavior fragment collection of their own behavior characteristics Global properties throughout the system. The source node receives the global characteristics of different local behavior fragments, that is, a set of binary pairs of source nodes and local samples of different behavior fragments. In order to uniformly express the global characteristics of all behavior fragments in the following modules, the global characteristics of behavior fragments Adding the behavior segment to each binary pair in (source node and local sample number binary pair set) becomes a behavior segment, source node, and local sample number triple pair set, so it can also be said that the behavior segment cooperates with the shared module to obtain The collection of local behavior fragments is a collection of ternary pairs of behavior fragments, source nodes, and local sample numbers in the whole system.

The neighbor behavior feature discovery module calculates the candidate neighbor node set for each local behavior feature based on the global characteristics of the behavior segment returned by the behavior segment collaborative sharing module, and then sends the behavior feature to the nodes in the candidate node set, and receives the behavior feature (called The candidate node of the source behavior feature) finds the behavior feature most similar to the behavior feature (called the target behavior feature) locally, and verifies whether the two belong to the same malware. If it is verified that they belong to the same malware, the target behavior feature is the source Neighbor behavior characteristics of behavior characteristics, otherwise destination behavior characteristics are not neighbor behavior characteristics of source behavior characteristics.

In this embodiment, the neighbor behavior feature discovery module includes:

The candidate neighbor node set calculation sub-module is used to obtain the behavior characteristics of each local malware according to the behavior fragments of the malware and its global characteristics, and calculate the behavior characteristics and the behavior fragment sharing degree between other remote nodes according to formula (1) , taking all the remote nodes whose segment sharing degree is greater than the preset sharing degree threshold as a set of candidate neighbor nodes with similar behavioral characteristics;

Behavioral feature sending sub-module, used to send the behavioral feature of local malware as source behavioral feature to all remote nodes in the candidate neighbor node set when the node is used as the source node;

Behavior feature receiving sub-module, used to receive source behavior features sent by source nodes when the node is a remote node of the candidate neighbor node set;

The behavior feature neighbor relationship verification sub-module is used to combine the common behavior of the received source behavior feature and the local destination behavior feature to form a fusion behavior feature, and judge whether the frequency of the fusion behavior feature in the normal program is less than the set threshold. If it is less than Explain that the common behavior of the source behavior feature and the target behavior feature is not common in normal programs and is specific to malware. It is determined that the source behavior feature and the target behavior feature belong to the same malware; otherwise, it is determined that the source behavior feature and the target behavior feature do not belong to the same malware. Malware; if it is verified that the source behavior characteristic and the destination behavior characteristic belong to the same malware, then the destination behavior characteristic of the remote node is the neighbor behavior characteristic of the source behavior characteristic, and the remote node assigns the source behavior characteristic number, the destination behavior characteristic number, the source behavior characteristic The similarity between the feature and the target behavior feature, and the neighbor behavior feature flag are assembled into a return message and returned to the source node where the source behavior feature is located, otherwise the remote node returns a negative message to the source node where the source behavior feature has no neighbor behavior feature flag

The adjacency graph calculation sub-module is used to create the edge of the behavior feature adjacency graph according to the returned behavior feature neighbor relationship. The weight of the edge is the similarity between the two behavior features represented by the two vertices, and finally constructs the behavior feature Adjacency graph; when creating the edge of the behavior characteristic adjacency graph, use the one-way edge method or the two-way edge method. When using the one-way edge method: 1) When verifying that the remote source behavior characteristic and the local destination behavior characteristic are the same malware When the behavior characteristics of the local destination behavior characteristics and the remote source behavior characteristics are created, the edge is added to the local associated edge data structure; 2) according to the neighbor behavior characteristics returned by the remote node with the neighbor behavior characteristic flag bit When sending a message, check the local associated edge data structure to see if an edge has been created between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, if so, Do nothing, if not, create an edge between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, and add it to the local associated edge data structure; when using In the two-way side mode, when the local behavior characteristic neighbor relationship verification sub-module verifies that the remote source behavior characteristic and the local destination behavior characteristic are the same malware behavior characteristics and receives information about the local destination behavior characteristic number and the remote source behavior characteristic Only when the behavior characteristic number carries the neighbor behavior characteristic message with the neighbor behavior characteristic flag bit, an edge is created between the local destination behavior characteristic and the remote source behavior characteristic, and added to the local associated edge data structure;

${\mathrm{<span\; class="notranslate">\; share</span>}}_{\mathrm{<span\; class="notranslate">\; tj</span>}}<span\; class="notranslate">\; =</span>\underset{{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; FragSet</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}{\underset{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Frag</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; node</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; FragStatSet</span>}}{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}}\mathrm{<span\; class="notranslate">\; log</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; t</span>}}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; Num</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; log</span>}\frac{\mathrm{<span\; class="notranslate">\; 1</span>}}{{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; the\; s</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; \&le;</span>{\mathrm{<span\; class="notranslate">\; m</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

In formula (1), FragStatSet is a set of ternary pairs representing the global characteristics of behavior fragments, N is the number of nodes, M _i is the number of local behavior characteristics of node i, and the behavior fragment set of behavior characteristic t is FragSet _t , the behavior characteristic The number of local samples of t is Num _t , (Frag _s , Node _s , Num _s ) is the ternary pair in FragStatSet _where the behavior fragment is Frag _s , the source node is Node s and the number of local samples is Num _s , and F _s is the behavior Fragment is the frequency of Frag _s in normal program behavior, Node _j is the remote node; Share _tj (1≤t≤M _i ,1≤j≤N, j≠i) is the relationship between behavioral feature t and remote node Node _j The degree of sharing of behavioral fragments among them.

When the adjacency graph calculation submodule of this embodiment acquires a set of candidate neighbor nodes with similar behavior characteristics, the calculation of the degree of sharing of behavior fragments between local behavior characteristics and remote nodes meets the following principles: 1) behavior fragments shared by behavior characteristics and remote nodes, The more elements in the ternary pair set of source node and local sample number, the higher the sharing degree of behavior fragments; 3) Behavioral fragments shared with remote nodes, source nodes, and local samples triplet the behavior fragments in the set of behavior fragments are less frequent in normal program behavior, and behavior fragments share The higher the value is. Therefore, in addition to the above formula (1), other similarity calculation methods for candidate neighbor node sets that meet the above principles can also be used as needed. The candidate neighbor node set calculation sub-module calculates a threshold value based on the shared degree Share _tj (1≤t≤M _i , 1≤j≤N, j≠i) of all the local behavior characteristics of the node and the behavior fragments of the remote node: assuming behavior based on experience Fragment sharing degree Share _tj (1≤t≤M _i , 1≤j≤N, j≠i) obeys a certain probability distribution, such as normal distribution, calculates the ratio of local node behavior characteristics and remote node behavior fragment sharing degree according to interval estimation A normal lower bound interval (the lower bound of the lower bound interval is called the sharing degree threshold), and all remote nodes whose sharing degree with the behavior segment of the behavior feature is greater than the sharing degree threshold are the set of candidate neighbor nodes for the behavior feature. The neighbor behavior feature discovery module calculates the candidate neighbor node set for each behavior feature based on the global characteristics of the local behavior segment returned by the behavior segment collaborative sharing module, and then sends the corresponding behavior feature to the nodes in the candidate node set, and receives the behavior feature (called is the candidate node of the source behavior feature) to find the behavior feature (called the target behavior feature) that is most similar to the behavior feature locally, and verify whether the two belong to the same malware. If the verification belongs to the same malware, the target behavior feature Neighbor behavior feature of the source behavior feature, otherwise the target behavior feature is not the neighbor behavior feature of the source behavior feature.

As shown in Figure 7, the neighbor behavior feature discovery module uses a two-stage neighbor behavior feature discovery method to calculate remote neighbor behavior features for each local behavior feature. In the two-stage neighbor behavior feature discovery method, the calculation of candidate neighbor nodes in the first stage is completed by the candidate neighbor node set calculation submodule, and the neighbor behavior feature verification in the second stage is performed by the behavior feature sending submodule, behavior feature receiving submodule, and behavior feature neighbor relationship The verification sub-module is completed, and the adjacency graph calculation sub-module derives the adjacency graph between the behavior features from the neighbor behavior features of the behavior features.

The first stage: the candidate neighbor node set calculation sub-module calculates the sharing degree of local behavior characteristics and remote nodes' behavior fragments based on the triple pair set obtained by the behavior fragment fusion overlay network, the source node and the local sample number. The behavior segment set of behavior feature refers to the behavior segment obtained after the behavior feature is segmented by the behavior feature segmentation module, and the triple pair set of behavior segment, source node and local sample number refers to the behavior segment fusion overlay network Behavior Fragments, Source Nodes, and Local Sample Number Triple Pairs Behavior Fragments Belonging to Behavioral Fragments Belonging to Behavior Feature All triplet pairs of Behavior Fragments, Source Nodes, and Local Sample Numbers Behavior Fragments Belonging to Behavior Feature Behavior Fragments Behavior Fragments Shared by Remote Nodes , source node and local sample number ternary pair set refers to all behavior fragments, source nodes and local sample number ternary pairs in the set of behavioral feature fragments, source nodes and local sample number ternary pairs whose source node is equal to the remote node .

The second stage: the feature sending sub-module sends the local behavior feature to all nodes in the candidate neighbor node set of the behavior feature calculated by the candidate neighbor node set calculation sub-module. The behavior feature receiving sub-module receives the behavior features sent to the node by other nodes, and all the behavior features received in a period are called the source behavior feature set. Behavior feature neighbor relationship verification sub-module finds the most similar behavior feature (called destination behavior feature) in the local behavior feature set for each source behavior feature in the source behavior feature set, and then verifies whether the source behavior feature and the target behavior feature are the same The behavior characteristics of malicious software, the verification method can be as follows: verify whether the fusion behavior characteristics composed of the common behavior of the source behavior characteristics and the destination behavior characteristics appear in the normal program. It is not common in normal programs and is specific to malware, then it is determined that the two belong to the same malware, otherwise it is determined that the two do not belong to the same malware, if it is verified that the two belong to the same malware, then the target behavior characteristic is the source behavior The neighbor behavior feature of the feature, and assemble the source behavior feature number, the target behavior feature number, the similarity between the two, and the neighbor behavior feature flag into a return message and return it to the node where the source behavior feature is located, otherwise return to the source behavior feature. A negative message for a node that has no neighbor behavior feature flags.

The adjacency graph calculation sub-module derives the adjacency graph between behavioral features from the neighbor behavioral features of the behavioral features. The adjacency graph calculation sub-module receives the neighbor behavior feature message about the local behavior feature returned by the remote node, and outputs the associated edge data structure of each behavior feature in the adjacency graph. The adjacency graph refers to the local behavior characteristics of participating nodes in the system as vertices, and the edges between vertices are created according to the neighbor relationship between behavior characteristics. There are two ways to create an edge according to the neighbor relationship between behavioral features: 1) One-way edge, behavioral feature A is the neighbor behavioral feature of behavioral feature B or behavioral feature B is the neighbor's behavioral feature of behavioral feature A, then in the representative behavioral feature Create an edge between vertex A of A and vertex B representing behavior feature B; 2) bidirectional edge, behavior feature A is the neighbor behavior feature of behavior feature B and behavior feature B is the neighbor behavior feature of behavior feature A, it represents the behavior feature Only one edge can be created between vertex A of A and vertex B representing behavior characteristic B. The weight of an edge is the similarity between two behavioral features represented by two vertices. There are also two ways for the adjacency graph calculation sub-module to calculate the edge between the local behavior feature and the behavior feature of the remote node. When using the one-way edge method: 1) When the behavior feature neighbor relationship verification sub-module verifies that the remote source behavior feature and the local target behavior feature are the same malware behavior feature, the local target behavior feature and the remote source behavior Create an edge between features and add it to the local associated edge data structure; 2) When receiving the neighbor behavior feature message with the neighbor behavior feature flag bit returned by the remote node, check the local associated edge data structure to see if it has been in the relevant edge data structure An edge is created between the local behavior characteristic represented by the source behavior characteristic number in the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message. An edge is created between the local behavior characteristic represented by the message and the remote behavior characteristic represented by the destination behavior characteristic number in the message, and added to the local associated edge data structure. When the two-way edge method is adopted, when the local behavior characteristic neighbor relationship verification sub-module verifies that the remote source behavior characteristic and the local destination behavior characteristic are the behavior characteristics of the same malware and receives information about the local destination behavior characteristic number and the remote Only when the source behavior characteristic number of the source behavior characteristic number carries the neighbor behavior characteristic message with the neighbor behavior characteristic flag bit, an edge is created between the local destination behavior characteristic and the remote source behavior characteristic, and added to the local associated edge data structure.

The distributed hierarchical fusion tree construction module constructs the behavior feature adjacency graph based on the neighbor behavior features about the local behavior features output by the neighbor behavior feature discovery module. In the behavior feature adjacency graph, with the behavior feature as the vertex, an edge is constructed between the behavior feature and its neighbor behavior features, and the weight of the edge is the similarity between the behavior features at both ends of the edge. Some fusion trees are generated in a distributed manner on the behavioral feature adjacency graph, and the fusion tree tries to fuse the behavioral features represented by the vertices in the tree in a hierarchical fusion manner: the most similar behavioral features are fused first, and the least similar behavioral features are fused last fusion.

As shown in Figure 8, the distributed hierarchical fusion tree construction module in this embodiment includes:

Behavior feature maximum similarity tree construction sub-module, used to generate behavior on the adjacency graph based on the feature adjacency graph, using the distributed minimum spanning tree algorithm that preferentially selects edges with large weights according to the associated edge data structure of behavior features The feature maximum similarity tree is used as a fusion tree;

The behavioral feature fusion order construction sub-module is used to determine the fusion order of the behavioral features in the fusion tree based on the maximum similarity tree of the behavioral features so that the most similar behavioral features are fused first.

The distributed hierarchical fusion tree construction module of this embodiment first completes the construction of the behavior feature maximum similarity tree through the behavior feature maximum similarity tree construction sub-module, and then completes the behavior feature fusion sequence construction by the behavior feature fusion sequence construction sub-module.

The distributed hierarchical fusion tree construction module is based on the neighbor behavior characteristics of the local behavior characteristics output by the neighbor behavior characteristic discovery module, and takes the behavior characteristics as vertices, and constructs an edge between the local behavior characteristics and its neighbor behavior characteristics, and the weight of the edge is In this way, an undirected graph is constructed between all behavioral features, and some fusion trees are generated distributedly on the undirected graph. The fusion tree tries to fuse the behavioral features represented by the vertices in the tree in a hierarchical fusion manner. : The most similar behavior features are fused first, and the least similar behavior features are fused last. The distributed hierarchical fusion tree construction module takes the associated edge data structure of the local behavior characteristics in the adjacency graph output by the neighbor behavior characteristic discovery module as input, first generates the maximum similarity tree of behavior characteristics among the behavior characteristics, and then based on the maximum similarity tree Determines the fusion order of behavioral features. Each behavioral feature runs a modified version of the classic distributed minimum spanning tree algorithm MST (the algorithm is detailed in the paper "A Distributed Algorithm for Minimum-Weight Spanning Trees" published in the first issue of volume 5 of ACM Transactions on Programming Languages and Systems): Change from preferentially selecting edges with small weights to preferentially selecting edges with large weights (that is, edges between the most similar behavioral features). The modified distributed minimum spanning tree algorithm generates the maximum similarity tree of behavioral features on the adjacency graph according to the associated edge data structure of behavioral features. Based on the maximum similarity tree of behavioral features, the fusion order of behavioral features is determined, and a hierarchical fusion method is achieved in which the most similar behavioral features are first fused as much as possible. The distributed hierarchical fusion tree construction module is composed of the behavior feature maximum similarity tree construction sub-module and the behavior feature fusion sequence construction sub-module. Behavioral feature maximum similarity tree construction sub-module takes the associated edge data structure about the local behavior feature in the adjacency graph output by the neighbor behavior feature discovery module as input, and runs the modified distributed minimum spanning tree algorithm MST agent for each behavior feature, The maximum similarity tree of behavioral features is generated on the adjacency graph, and each local behavioral feature has a corresponding maximum similarity tree of behavioral features corresponding to it. The behavior feature fusion sequence construction sub-module takes the behavior feature maximum similarity tree output by the behavior feature maximum similarity tree construction sub-module as input, and runs the fusion sequence selection agent for each behavior feature. The behavior feature of the next layer in the fusion sequence refers to the behavior feature in the behavior feature maximum similarity tree to which the behavior feature needs to submit its own fusion result for the next fusion. The following principles must be met for the fusion sequence selection agent to select the next layer of behavior features: 1) Among the edges that have not received the fusion results of other behavior features, the behavior feature at the other end of the edge with the largest weight is the behavior feature of the next layer; If the condition 1) is not satisfied, the parent node of the behavior feature maximum similarity tree is the behavior feature of the next layer. Each behavioral feature independently selects the next layer of behavioral features according to the weight of the edge between itself and other behavioral features, to achieve distributed and gradual fusion of behavioral features, and finally fuse all behaviors in the maximum similarity tree at the root node of the maximum similarity tree of behavioral features Features get global behavioral features.

The behavioral feature fusion module gradually fuses the behavioral features in the tree according to the fusion tree output by the distributed hierarchical fusion tree construction module, and finally obtains the global behavioral features and other global attributes at the root behavioral feature (vertex) of the fusion tree. Some other global attributes may include the distribution of addresses of hosts infected with the malware collected throughout the system, which can be used to further confirm the maliciousness and spread of the malware. The behavioral feature progressive fusion module includes multiple feature fusion agents corresponding to the behavioral features of each vertex in the feature adjacency graph or one feature fusion agent corresponding to the behavioral features of all vertices in the feature adjacency graph in the form of processes or threads. The feature fusion agent can also be implemented by an unmanaged process, or by a managed thread or an unmanaged thread, or by a single-process event-driven implementation. The implementation principle is the same as that of this embodiment, and will not be repeated here. The behavioral feature fusion module gradually fuses the behavioral features in the tree according to the fusion tree output by the distributed hierarchical fusion tree construction module, and finally obtains global behavioral features and other global attributes at the root behavioral feature (vertex) of the fusion tree, and other Some global attributes can include the distribution of addresses of hosts infected with the malware sample detected by the whole system, which can be used to further confirm the maliciousness and spread of the malware.

In this embodiment, the feature fusion agent includes:

The behavior feature submission submodule is used to submit the fusion result containing its own behavior features to the feature fusion agent of the next layer according to the fusion order;

The behavior feature receiving sub-module is used to receive the fusion result submitted by the feature fusion agent of the upper layer and record the adjacency edge in the feature adjacency graph corresponding to the feature fusion agent of the upper layer that received the fusion result; the behavior feature fusion sub-module uses It is used to judge whether the adjacent edge is the edge with the largest weight among the associated edges of its own behavior characteristics among all adjacent edges. If so, fuse its own behavior characteristics with all received fusion results and submit the fusion results according to the fusion order Give the next layer of feature fusion agents, otherwise, fuse all received fusion results and submit the fusion results and their own behavioral features to the next layer of feature fusion agents according to the fusion sequence; finally, the root feature fusion agent of the fusion tree is fused to obtain fusion The root behavior feature of the tree, and the root behavior feature of the fusion tree is output as the malware feature fusion analysis result.

The behavioral feature fusion module runs the behavioral feature fusion agent for each local behavioral feature. The behavioral feature fusion agent is responsible for submitting its own behavioral features to its next-level behavioral features and receiving its corresponding behavioral features from other behaviors in the maximum similarity tree. The behavioral features submitted by the feature (vertex), and then perform fusion processing on the received behavioral features and its own behavioral features. The behavior feature fusion module includes a behavior feature submission sub-module, a behavior feature reception sub-module and a behavior feature fusion sub-module, and the behavior feature fusion agent of each behavior feature includes the agents of these three modules. The behavior feature submission sub-module submits its own fusion results (including its own behavior features) to the behavior features of the next layer of behavior features and gradually fuses the agent according to the next layer of behavior features of its own behavior features output by the distributed hierarchical fusion tree construction module. The behavioral feature receiving sub-module receives the fusion result (also a behavioral feature) of other behavioral features sent to its behavioral feature gradual fusion agent, and records the associated edge that receives the fusion result. The behavioral feature fusion sub-module takes the behavioral feature where it is located and gradually fuses the behavioral features received by the agent’s behavioral feature receiving sub-module and its own behavioral features as input, and checks whether the received adjacent edges recorded by the behavioral feature receiving sub-module are its own behavioral features The edge with the largest weight in the associated edge, if there is one, fuses all received and its own behavioral features, and then submits the fusion result to the next layer of behavioral features through the behavioral feature submission sub-module; otherwise, fuses the received behavioral features , and then submit the fusion result and its own behavioral features to the next layer of behavioral features through the behavioral feature submission sub-module.

As shown in FIG. 9 , the working steps of the behavior feature fusion module in this embodiment are as follows: 1. Behavior feature fusion tree reception. Each fusion agent receives the fusion result (also a behavior feature) sent to its behavior feature to gradually fuse other behavior features of the agent, and records the associated edge that receives the fusion result. 2. Behavioral feature fusion. Taking the received behavioral characteristics and its own behavioral characteristics as input, check whether there is an edge with the largest weight in the adjacent edges of the receiving result recorded in the previous step, and if so, fuse all the received and its own Behavior features, and then submit the fusion result to the next step for behavior feature fusion tree transmission; otherwise, fuse the received behavior features, and then submit the fusion result and its own behavior features to the next step for behavior feature fusion tree transmission. 3. Behavioral feature fusion tree submission: Submit the fusion result (including its own behavioral features) to the behavioral features of the next layer of behavioral features according to the behavioral features of its own behavioral features output by the distributed hierarchical fusion tree construction module. Fusion Proxy.

The feature fusion agent of the behavioral feature gradual fusion module can adopt the technical scheme of multiple feature fusion agents in the form of processes or threads corresponding to the behavioral features of each vertex in the feature adjacency graph as needed. As shown in Figure 10, when the multi-process representation of the unmanaged process of the behavior characteristics of node i in the process of distributed hierarchical fusion tree construction and behavior characteristics fusion, it is assumed that node i has a total of M_i behavior characteristics locally, and each behavior characteristic creates a corresponding process and bind a socket interface. Behavioral features (vertices in the adjacency graph) communicate with remote behaviors (vertices in the adjacency graph) through the socket interface between the two. This representation requires socket interface information bound to interactive behavior features before the process of distributed hierarchical fusion tree construction and behavior feature fusion; as shown in Figure 11, node i in the process of distributed hierarchical fusion tree construction and behavior feature fusion When the multi-process representation of the behavioral characteristics of , it is assumed that node i has M_i behavioral characteristics locally. Node i first creates a management process and binds a management socket interface. Then the management process generates a process for each local behavioral feature and records the correspondence between the process and the behavioral feature, and the behavioral feature (the vertex in the adjacency graph) and the remote behavior (the vertex in the adjacency graph) are through the correspondence The management process communicates, and the communication message indicates which behavior characteristic it belongs to. When the management process receives the communication message, it sends the message to the process corresponding to the behavior characteristic indicated by the message through the inter-process communication method. The management socket interface bound by the management process can be fixed, so before the process of distributed hierarchical fusion tree construction and behavior feature fusion, there is no need to interact with the management socket interface information; as shown in Figure 12, the behavior in this embodiment Feature multi-process representation In the process structure shown in Figure 10 and Figure 11, each process has a distributed hierarchical fusion tree construction module agent and a behavioral feature gradual fusion module agent, and the distributed hierarchical fusion tree construction module agent completes the distributed hierarchical fusion tree Construct the functions of the modules, and the behavioral features are gradually fused with the module agent to complete the functions of the behavioral features and gradually fused modules.

The above descriptions are only preferred implementations of the present invention, and the protection scope of the present invention is not limited to the above-mentioned embodiments, and all technical solutions under the idea of the present invention belong to the protection scope of the present invention. It should be pointed out that for those skilled in the art, some improvements and modifications without departing from the principles of the present invention should also be regarded as the protection scope of the present invention.

Claims (10)

1. the characteristic of malware convergence analysis method that Behavior-based control fragment is shared, is characterized in that implementation step is as follows:

1) dispose the node of geographical position dispersion in a network respectively, each node is responsible for collection and the analysis of Malware sample in a slice network area, sets up the distributed hashtable module for building distributed hashtable in node;

2) each node gathers Malware sample and is divided into the fixing behavior segment set of length, and statistics this locality has the local Malware sample number of each behavior segment behavior in described behavior segment set and obtains the local statistical property of behavior segment set;

3) behavior segment set and local statistical property thereof are issued and are shared to distributed hashtable by each node, gather the identical behavior segment from different node by the node of distributed hashtable and add up the global property gathering described behavior segment, the global property of described behavior segment comprises behavior segment, source node address, source node this locality have the ternary of the local Malware sample number of described behavior segment behavior to set, the behavior segment set with global property is returned to the source node of shared behavior segment set and local statistical property thereof;

4) behavioural characteristic of Malware that described source node is formed according to the behavior segment of Malware and global property thereof calculates the candidate neighbor nodes collection with similar behavioural characteristic, the remote node concentrated to candidate neighbor nodes sends source behavioural characteristic corresponding to Malware, whether the source behavioural characteristic received and local object behavioural characteristic multilevel iudge object behavioural characteristic are neighbours' behavioural characteristic of source behavioural characteristic by the remote node concentrated of candidate neighbor nodes, judged result is returned source node as behavioural characteristic neighborhood, the behavioural characteristic neighborhood structure behavioural characteristic syntople figure that described source node returns according to remote node,

5) on the basis of described feature syntople figure, adopt the distributed minimal spanning tree algorithm on the large limit of prioritizing selection weights on syntople figure, to generate the maximum similar tree of behavioural characteristic according to the incidence edge data structure of behavioural characteristic and realize distributed generation fusion tree as fusion tree, the described behavioural characteristic merged in tree is merged, and based on the maximum similar tree of behavioural characteristic, determine that the described fusion sequence merging behavioural characteristic in tree makes the most similar behavioural characteristic preferentially be merged, the described root behavioural characteristic merging tree is exported as characteristic of malware convergence analysis result.

2. Behavior-based control fragment according to claim 1 share characteristic of malware convergence analysis method, it is characterized in that, described step 2) detailed step as follows:

2.1) behavior of Malware sample is considered as the behavior sequence that order performs, from the behavior sequence that described order performs, selects the behavior segment set that the Continuous behavior subsequence of regular length is fixed as the length that segmentation obtains; Or set up behavior dependency graph according to the dependence between the behavior operating data of Malware sample, from described behavior dependency graph, select the behavior obtaining fixed vertices number to rely on subgraph as splitting the fixing behavior segment set of the length that obtains;

2.2) statistics is local has the local Malware sample number of each behavior segment behavior in described behavior segment set and obtains the local statistical property of behavior segment set and export.

3. Behavior-based control fragment according to claim 1 share characteristic of malware convergence analysis method, it is characterized in that, described step 3) detailed step as follows:

3.1) each node calls the key value that distributed hashtable module obtains described behavior segment, described behavior segment and local statistical property thereof are encapsulated as distributed hashtable message, then described key value and distributed hashtable message are sent to distributed hashtable module; Described distributed hashtable module searches the collection analysis node of this key value responsible according to key value, and is stored to the node being responsible for this key value by distributed hashtable Message routing;

3.2) different node is responsible for different behavior segment, by distributed hashtable module, the identical behavior segment of different node is brought to same node and the source node address of record issue behavior segment, the behavior segment that described node is stored by distributed hashtable module and local statistical property thereof, according to behavior segment and source node thereof, the local Malware sample number that source node this locality has described behavior segment behavior carries out statistics global property, the global property of described behavior segment comprises behavior segment, source node address, source node this locality has the ternary of the local Malware sample number of described behavior segment behavior to set, then the behavior segment set with global property is sent to source node address, source node corresponding to source node address receives the behavior segment set with global property.

4. the Behavior-based control fragment according to claim 1 or 2 or 3 share characteristic of malware convergence analysis method, it is characterized in that, described step 4) detailed step as follows:

4.1) source node obtains the behavioural characteristic of the Malware of each this locality according to the behavior segment of Malware and global property thereof, calculate the behavior segment sharing degree between described behavioural characteristic and other remote node according to formula (1), described fragment sharing degree is greater than all remote nodes of default sharing degree threshold value as the candidate neighbor nodes collection with similar behavioural characteristic;

${\mathrm{Share}}_{\mathrm{tj}}=\underset{{\mathrm{Frag}}_s\&Element;{\mathrm{FragSet}}_t,{\mathrm{Node}}_s={\mathrm{Node}}_j}{\underset{({\mathrm{Frag}}_s,{\mathrm{Node}}_s,{\mathrm{Num}}_s)\&Element;\mathrm{FragStatSet}}{\mathrm{\&Sigma;}}}\log ({\mathrm{Num}}_t+{\mathrm{Num}}_s)\log \frac{1}{F_s}(1\&le;t\&le;M_i,1\&le;j\&le;N,j\&NotEqual;i)---\left(1\right)$

In formula (1), FragStatSet be the ternary of the global property representing behavior segment to set, N is number of nodes, M _ifor the local behavior characteristic amount of node i, the behavior segment of behavioural characteristic t integrates as FragSet _t, the local sample number of behavior feature t is Num _t, (Frag _s, Node _s, Num _s) for the behavior segment in FragStatSet be Frag _s, source node is Node _sbe Num with local sample number _sternary pair, F _sfor behavior segment is Frag _sthe frequency occurred in the behavior of normal procedure, Node _jfor remote node; Share _tj(1≤t≤M _i, 1≤j≤N, j ≠ i) and be behavioural characteristic t and remote node Node _jbetween behavior segment sharing degree;

4.2) source node using the behavioural characteristic of local Malware as source behavioural characteristic send to candidate neighbor nodes concentrate all remote nodes;

4.3) remote node concentrated of candidate neighbor nodes to form with the joint act in local object behavioural characteristic merge behavioural characteristic by receiving source behavioural characteristic, judge whether the frequency that described fusion behavioural characteristic occurs in normal procedure is less than setting threshold, if be less than, illustrate that the joint act of source behavioural characteristic and object behavioural characteristic is uncommon and specific to Malware in normal procedure, judge that source behavioural characteristic and object behavioural characteristic belong to same Malware; Otherwise judge that source behavioural characteristic and object behavioural characteristic do not belong to same Malware;

4.4) if belong to same Malware by checking source behavioural characteristic and object behavioural characteristic, then the object behavioural characteristic of remote node is neighbours' behavioural characteristic of source behavioural characteristic, source row is feature number by remote node, the similarity of the numbering of object behavioural characteristic, source behavioural characteristic and object behavioural characteristic, have neighbours' behavioural characteristic flag bit to be assembled into return messages to return to behavioural characteristic place, source source node, otherwise remote node returns to the nack message of behavioural characteristic place, source source node without neighbours' behavioural characteristic flag bit;

4.5) described source node creates the limit of behavioural characteristic syntople figure according to the behavioural characteristic neighborhood that returns, the similarity between the weights on limit two behavioural characteristics representated by two summits, final structure behavioural characteristic syntople figure, unidirectional limit mode or two-way limit mode is adopted during the limit of described establishment behavioural characteristic syntople figure, when adopting unidirectional limit mode: 1) when the source behavioural characteristic of authenticating remote is the behavioural characteristic of same Malware with local object behavioural characteristic, create limit between the object behavioural characteristic in this locality and long-range source behavioural characteristic, be added in local incidence edge data structure, 2) according to receive remote node return the neighbours' behavioural characteristic message with neighbours' behavioural characteristic flag bit time, check in local incidence edge data structure check whether in about this message in the local behavioural characteristic of source row representated by feature number and message object behavioural characteristic number representated by long-range behavioural characteristic between create limit, if had, do not do any operation, if not, in breath in the local behavioural characteristic of source row representated by feature number and message object behavioural characteristic number representated by long-range behavioural characteristic between create limit, be added in local incidence edge data structure, final structure obtains feature syntople figure, when adopting two-way limit mode, when source behavioural characteristic and the local object behavioural characteristic of the behavioural characteristic neighborhood checking submodule authenticating remote of this locality be same Malware behavioural characteristic and the object behavioural characteristic received about this this locality is numbered and this long-range source row be feature number with when having neighbours' behavioural characteristic message of neighbours' behavioural characteristic flag bit, limit is created between the object behavioural characteristic just in this this locality and this long-range source behavioural characteristic, be added in local incidence edge data structure, final structure obtains feature syntople figure.

5. Behavior-based control fragment according to claim 4 share characteristic of malware convergence analysis method, it is characterized in that, described step 5) detailed step as follows:

5.1) described source node is on the basis of described feature syntople figure, adopt the distributed minimal spanning tree algorithm on the large limit of prioritizing selection weights on syntople figure, to generate the maximum similar tree of behavioural characteristic as fusion tree according to the incidence edge data structure of behavioural characteristic, based on the maximum similar tree of behavioural characteristic, determine that the described fusion sequence merging behavioural characteristic in tree makes the most similar behavioural characteristic preferentially be merged;

5.2) described source node is that the behavioural characteristic on each summit in feature syntople figure generates separately a process or thread is acted on behalf of as Fusion Features, or generates a Fusion Features agency for the behavioural characteristic on all summits in feature syntople figure, the fusion results comprising self behavioural characteristic is submitted to the Fusion Features agency of lower one deck by described Fusion Features agency according to described fusion sequence, the last layer Fusion Features that the Fusion Features proxy records receiving fusion results receives described fusion results acts on behalf of the adjacent side in character pair syntople figure, check that described adjacent side is the limit of the maximum weight in the incidence edge of self behavioural characteristic in all of its neighbor limit, if, then the behavioural characteristic of self and all fusion results that receives are carried out merging and fusion results is submitted to lower one deck Fusion Features agency according to described fusion sequence, otherwise, merge all fusion results of receiving and fusion results and the behavioural characteristic of self are submitted to lower one deck Fusion Features agency according to described fusion sequence, final fusion obtains the described root behavioural characteristic merging tree,

5.3) the described root behavioural characteristic merging tree is exported as characteristic of malware convergence analysis result.

6. the characteristic of malware convergence analysis system that a Behavior-based control fragment is shared, it is characterized in that, comprise the node disposing geographical position dispersion in a network respectively, each node is responsible for collection and the analysis of Malware sample in a slice network area, and described node comprises:

Behavioural characteristic segmentation module, gather Malware sample for node and be divided into the fixing behavior segment set of length, statistics this locality has the local Malware sample number of each behavior segment behavior in described behavior segment set and obtains the local statistical property of behavior segment set and submit to behavior segment coordination sharing module;

Distributed hashtable module, for setting up for building distributed hashtable in node;

Behavior segment coordination sharing module, for each node, behavior segment set and the issue of local statistical property thereof are shared to distributed hashtable, gather the identical behavior segment from different node by the node of distributed hashtable and add up the global property gathering described behavior segment, the global property of described behavior segment comprises behavior segment, source node address, source node this locality has the ternary of the local Malware sample number of described behavior segment behavior to set, behavior segment set with global property is returned to the source node of shared behavior segment set and local statistical property thereof,

Neighbours' behavioural characteristic finds module, behavioural characteristic for the Malware formed according to behavior segment and the global property thereof of Malware calculates the candidate neighbor nodes collection with similar behavioural characteristic, and the remote node concentrated to candidate neighbor nodes sends source behavioural characteristic corresponding to Malware; Simultaneously node alternatively neighbor node concentrate remote node time be whether neighbours' behavioural characteristic of source behavioural characteristic by the source behavioural characteristic received and local object behavioural characteristic multilevel iudge object behavioural characteristic, judged result is returned source node as behavioural characteristic neighborhood, according to the behavioural characteristic neighborhood structure behavioural characteristic syntople figure that remote node returns;

Distributed level merges tree constructing module, for the basis at described feature syntople figure, adopt the distributed minimal spanning tree algorithm on the large limit of prioritizing selection weights on syntople figure, to generate the maximum similar tree of behavioural characteristic according to the incidence edge data structure of behavioural characteristic and realize distributed generation fusion tree as fusion tree;

Behavioural characteristic is Fusion Module progressively, for the described behavioural characteristic merged in tree is merged, and based on the maximum similar tree of behavioural characteristic, determine that the described fusion sequence merging behavioural characteristic in tree makes the most similar behavioural characteristic preferentially be merged, the described root behavioural characteristic merging tree is exported as characteristic of malware convergence analysis result.

7. the characteristic of malware convergence analysis system that Behavior-based control fragment according to claim 6 is shared, is characterized in that, described behavioural characteristic segmentation module comprises:

Continuous behavior subsequence submodule or behavior rely on dividing sub-picture submodule, described Continuous behavior subsequence submodule is used for the behavior sequence behavior of Malware sample being considered as order execution, selects the behavior segment set that the Continuous behavior subsequence of regular length is fixed as the length that segmentation obtains from the behavior sequence that described order performs; Described behavior dependence dividing sub-picture submodule, for setting up behavior dependency graph according to the dependence between the behavior operating data of Malware sample, selects the behavior segment set that the behavior dependence subgraph obtaining fixed vertices number is fixed as the length that segmentation obtains from described behavior dependency graph;

Behavior segment set statistics submodule, has the local Malware sample number of each behavior segment behavior in described behavior segment set and obtains the local statistical property of behavior segment set for adding up this locality and export behavior segment coordination sharing module to.

8. the characteristic of malware convergence analysis system that Behavior-based control fragment according to claim 6 is shared, it is characterized in that, described distributed hashtable module comprises:

Behavior segment keyword mapping submodule, for obtaining key value according to the behavior segment of input by Hash calculation;

Keyword route submodule, for searching the collection analysis node of this key value responsible according to key value, and stores distributed hashtable Message routing to the node being responsible for this key value;

Described behavior segment coordination sharing module comprises:

Behavior segment issues submodule, the key value of described behavior segment is obtained for calling distributed hashtable module, described behavior segment and local statistical property thereof are encapsulated as distributed hashtable message, then described key value and distributed hashtable message are sent to distributed hashtable module;

Behavior segment receives submodule, receives behavior segment and local statistical property thereof that distributed hashtable module stores when the node of node as distributed statistics global property;

Behavior segment statistics submodule, local Malware sample number for having a described behavior segment behavior according to behavior segment and source node thereof, source node this locality when the node of node as distributed statistics global property carries out statistics global property, described behavior segment global property comprises behavior segment, source node address, source node is local has the ternary of the local Malware sample number of described behavior segment behavior to set;

Behavior segment global property returns submodule, for the behavior segment set with global property that described behavior segment statistics submodule exports being sent to source node address when the node of node as distributed statistics global property;

Behavior segment global property receives submodule, returns for receiving described behavior segment global property when the source node of node as shared behavior segment the behavior segment set with global property that submodule sends.

9. the characteristic of malware convergence analysis system that the Behavior-based control fragment according to claim 6 or 7 or 8 is shared, is characterized in that, described neighbours' behavioural characteristic finds that module comprises:

Candidate neighbor nodes collection calculating sub module, for obtaining the behavioural characteristic of the Malware of each this locality according to the behavior segment of Malware and global property thereof, calculate the behavior segment sharing degree between described behavioural characteristic and other remote node according to formula (1), described fragment sharing degree is greater than all remote nodes of default sharing degree threshold value as the candidate neighbor nodes collection with similar behavioural characteristic;

Behavioural characteristic send submodule, for node as during source node using the behavioural characteristic of local Malware as source behavioural characteristic send to candidate neighbor nodes concentrate all remote nodes;

Behavioural characteristic receives submodule, for will receive the source behavioural characteristic that source node sends when the remote node of node alternatively neighbor node collection;

Behavioural characteristic neighborhood checking submodule, behavioural characteristic is merged for being formed by the joint act received in source behavioural characteristic and local object behavioural characteristic, judge whether the frequency that described fusion behavioural characteristic occurs in normal procedure is less than setting threshold, if be less than, illustrate that the joint act of source behavioural characteristic and object behavioural characteristic is uncommon and specific to Malware in normal procedure, judge that source behavioural characteristic and object behavioural characteristic belong to same Malware; Otherwise judge that source behavioural characteristic and object behavioural characteristic do not belong to same Malware; If belong to same Malware by checking source behavioural characteristic and object behavioural characteristic, then the object behavioural characteristic of remote node is neighbours' behavioural characteristic of source behavioural characteristic, source row is feature number by remote node, the similarity of the numbering of object behavioural characteristic, source behavioural characteristic and object behavioural characteristic, have neighbours' behavioural characteristic flag bit to be assembled into return messages to return to behavioural characteristic place, source source node, otherwise remote node returns to the nack message of behavioural characteristic place, source source node without neighbours' behavioural characteristic flag bit;

Syntople figure calculating sub module, for creating the limit of behavioural characteristic syntople figure according to the behavioural characteristic neighborhood that returns, the similarity between the weights on limit two behavioural characteristics representated by two summits, final structure behavioural characteristic syntople figure, unidirectional limit mode or two-way limit mode is adopted during the limit of described establishment behavioural characteristic syntople figure, when adopting unidirectional limit mode: 1) when the source behavioural characteristic of authenticating remote is the behavioural characteristic of same Malware with local object behavioural characteristic, create limit between the object behavioural characteristic in this locality and long-range source behavioural characteristic, be added in local incidence edge data structure, 2) according to receive remote node return the neighbours' behavioural characteristic message with neighbours' behavioural characteristic flag bit time, check in local incidence edge data structure check whether in about this message in the local behavioural characteristic of source row representated by feature number and message object behavioural characteristic number representated by long-range behavioural characteristic between create limit, if had, do not do any operation, if not, in breath in the local behavioural characteristic of source row representated by feature number and message object behavioural characteristic number representated by long-range behavioural characteristic between create limit, be added in local incidence edge data structure, when adopting two-way limit mode, when source behavioural characteristic and the local object behavioural characteristic of the behavioural characteristic neighborhood checking submodule authenticating remote of this locality be same Malware behavioural characteristic and the object behavioural characteristic received about this this locality is numbered and this long-range source row be feature number with when having neighbours' behavioural characteristic message of neighbours' behavioural characteristic flag bit, create limit between the object behavioural characteristic just in this this locality and this long-range source behavioural characteristic, be added in local incidence edge data structure,

${\mathrm{Share}}_{\mathrm{tj}}=\underset{{\mathrm{Frag}}_s\&Element;{\mathrm{FragSet}}_t,{\mathrm{Node}}_s={\mathrm{Node}}_j}{\underset{({\mathrm{Frag}}_s,{\mathrm{Node}}_s,{\mathrm{Num}}_s)\&Element;\mathrm{FragStatSet}}{\mathrm{\&Sigma;}}}\log ({\mathrm{Num}}_t+{\mathrm{Num}}_s)\log \frac{1}{F_s}(1\&le;t\&le;M_i,1\&le;j\&le;N,j\&NotEqual;i)---\left(1\right)$

In formula (1), FragStatSet be the ternary of the global property representing behavior segment to set, N is number of nodes, M _ifor the local behavior characteristic amount of node i, the behavior segment of behavioural characteristic t integrates as FragSet _t, the local sample number of behavior feature t is Num _t, (Frag _s, Node _s, Num _s) for the behavior segment in FragStatSet be Frag _s, source node is Node _sbe Num with local sample number _sternary pair, F _sfor behavior segment is Frag _sthe frequency occurred in the behavior of normal procedure, Node _jfor remote node; Share _tj(1≤t≤M _i, 1≤j≤N, j ≠ i) and be behavioural characteristic t and remote node Node _jbetween behavior segment sharing degree.

10. the characteristic of malware convergence analysis system that Behavior-based control fragment according to claim 9 is shared, is characterized in that, described distributed level merges tree constructing module and comprises:

Behavioural characteristic maximum similar tree constructor module, for the basis at described feature syntople figure, the distributed minimal spanning tree algorithm on the large limit of prioritizing selection weights is adopted on syntople figure, to generate the maximum similar tree of behavioural characteristic as fusion tree according to the incidence edge data structure of behavioural characteristic;

Behavioural characteristic fusion sequence constructor module, for determining that based on the maximum similar tree of behavioural characteristic the described fusion sequence merging behavioural characteristic in tree makes the most similar behavioural characteristic preferentially be merged;

Described behavioural characteristic progressively Fusion Module comprises a Fusion Features agency by the behavioural characteristic on all summits in multiple Fusion Features agency of the behavioural characteristic on each summit in the form of process or thread respectively character pair syntople figure or character pair syntople figure;

Described Fusion Features agency comprises:

Behavioural characteristic submits submodule to, for the fusion results comprising self behavioural characteristic being submitted to according to described fusion sequence the Fusion Features agency of lower one deck;

Behavioural characteristic receives submodule, the fusion results that the Fusion Features agency for receiving last layer submits to the last layer Fusion Features that record receives described fusion results acts on behalf of the adjacent side in character pair syntople figure;

Behavioural characteristic fusant module, for judging that described adjacent side is the limit of the maximum weight in the incidence edge of self behavioural characteristic in all of its neighbor limit, if, then the behavioural characteristic of self and all fusion results that receives are carried out merging and fusion results is submitted to lower one deck Fusion Features agency according to described fusion sequence, otherwise, merge all fusion results of receiving and fusion results and the behavioural characteristic of self submitted to lower one deck Fusion Features agency according to described fusion sequence; Finally levy fusion agent by the Gent merging tree and merge the root behavioural characteristic obtaining described fusion tree, and the described root behavioural characteristic merging tree is exported as characteristic of malware convergence analysis result.