Auto forensic detecting algorithms of malicious code fragment based on TensorFlow

Binglong LI; Jinlong TONG; Yu ZHANG; Yifeng SUN; Qingxian WANG; Chaowen CHANG

doi:10.11959/j.issn.2096-109x.2021048

您当前的位置：

首页 >

文章列表页 >

Auto forensic detecting algorithms of malicious code fragment based on TensorFlow

Papers | 更新时间：2024-06-03

- Auto forensic detecting algorithms of malicious code fragment based on TensorFlow
- Chinese Journal of Network and Information Security Vol. 7, Issue 4, Pages: 154-163(2021)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021048
  CLC： TP309
- Online First：2021-08，
  
  Published：15 August 2021
- 稿件说明：
移动端阅览
Binglong LI, Jinlong TONG, Yu ZHANG, et al. Auto forensic detecting algorithms of malicious code fragment based on TensorFlow[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 154-163.
DOI：

Binglong LI, Jinlong TONG, Yu ZHANG, et al. Auto forensic detecting algorithms of malicious code fragment based on TensorFlow[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 154-163. DOI： 10.11959/j.issn.2096-109x.2021048.

摘要

针对数字犯罪事件调查，在复杂、异构及底层的海量证据数据中恶意代码片段识别难的问题，通过分析TensorFlow深度学习模型结构及其特性，提出一种基于TensorFlow的恶意代码片段检测算法框架；通过分析深度学习算法训练流程及其机制，提出一种基于反向梯度训练的算法；为解决不同设备、不同文件系统的证据源中恶意代码片段特征提取问题，提出一种基于存储介质底层的二进制特征预处理算法；为进行反向传播训练，设计并实现了一个代码片段数据集制作算法。实验结果表明，基于TensorFlow的恶意代码片段检测算法针对不同存储介质以及证据存储容器中恶意代码片段的自动取证检测，综合评价指标F

达到 0.922，并且和 CloudStrike、Comodo、FireEye 等杀毒引擎相比，该算法在处理底层代码片段数据方面具有绝对优势。

Abstract

In order to auto detect the underlying malicious code fragments in complex，heterogeneous and massive evidence data about digital forensic investigation

a framework for malicious code fragment detecting algorithm based on TensorFlow was proposed by analyzing TensorFlow model and its characteristics.Back-propagation training algorithm was designed through the training progress of deep learning.The underlying binary feature pre-processing algorithm of malicious code fragment was discussed and proposed to address the problem about different devices and heterogeneous evidence sources from storage media and such as AFF forensic containers.An algorithm which used to generate data set about code fragments was designed and implemented.The experimental results show that the comprehensive evaluation index F

of the method can reach 0.922

and compared with CloudStrike

Comodo

FireEye antivirus engines

the algorithm has obvious advantage in dealing with the underlying code fragment data from heterogeneous storage media.

关键词

Keywords

references

TEPE A N , BOYLAN A A , DAVIS D W . Analysis of digital forensic capabilities in texas law enforcement agencies [R ] . The Bush School of Government ＆ Public Service , 2019 .

CAVIGLIONE L , WENDZE S , MAZURCZKY W . The future of digital forensics:challenges and the road ahead [J ] . IEEE Security＆ Privacy , 2017 , 15 ( 6 ): 12 - 17 .

LIN X D , CHEN T , ZHU T , et al . Automated forensic analysis of mobile applications on Android devices [J ] . Digital Investigation , 2018 , 26 : S59 - S66 .

高元照 , 李炳龙 , 陈性元 . 基于MapReduce的HDFS数据窃取随机检测算法 [J ] . 通信学报 , 2018 , 39 ( 10 ): 11 - 21 .

GAO Y Z , LI B L , CHEN X Y . Stochastic algorithm for HDFS data detection based on MapReduce [J ] . Journal on Communications , 2018 , 39 ( 10 ): 11 - 21 .

ZAWOAD S , HASAN R . Digital forensics in the age of big data:challenges,approaches,and opportunities [C ] // IEEE Big Data Security 2015 . 2015 : 1 - 7 .

SERVIDA F , CASEY E . IoT forensic challenges and opportunities for digital traces [J ] . Digital Investigation , 2019 , 28 : S22 - S29 .

韩宗达 , 李炳龙 . 基于证据库的数据证据转换模型 [J ] . 计算机应用研究 , 2015 , 32 ( 7 ): 2140 - 2143 .

HAN Z D , LI B L . Evidence conversion model based on evidence database [J ] . Application Research of Computers , 2015 , 32 ( 7 ): 2140 - 2143 .

JAMES J I , PAVEL G . Challenges with automation in digital forensic investigations [J ] . arXiv:1303.4498 , 2013 .

Guidanc [EB ] .

AccessData [EB ] .

ZHU Y , JAMES J , GLADYSHEV P . A consistency study of the windows registry [C ] // 6th IFIP WG 11.9 International Conference on Digital Forensics(DF) . 2010 : 77 - 90 .

ROGERS M , GOLDMAN J , et al . Computer forensics field triage process model [J ] . Journal of Digital Forensics,Security and Law , 2006 , 1 ( 2 ): 27 - 40 .

MISLAN R P , CASEY E , et al . The growing need for on-scene triage of mobile devices [J ] . Digital Investigation , 2010 , 6 ( 3-4 ): 112 - 124 .

MARZIALE L , RICHARD G G , ROUSSEV V . Massive threading:using GPUs to increase the performance of digital forensics tools [J ] . Digital Investigation , 2007 , 4S : S73 - S81 .

GARFINKEL S , NELSON A , WHITE D , et al . Using purpose-built functions and block hashes to enable small block and sub-file forensics [J ] . Digital Investigation , 2010 , 7 : S13 - S23 .

QUICK D , CHOO K K R . Impacts of increasing volume of digital forensic data:a survey and future research challenges [J ] . Digital Investigation , 2014 , 11 ( 4 ): 273 - 294 .

Federal Bureau of Investigation(FBI) . 2019 Internet Crime Report [R ] . 2020 .

McAfee Labs . 2019 Threats Report [EB ] . 2019 .

PIRSCOVEANU R , HANSEN S , CZECH A . Analysis of malware behavior:type classification using machine learning [C ] // Proceedings of the 2015 International Conference on Cyber Situational Awareness,Data Analytics and Assessment (CyberSA) . 2015 .

MOHAISEN A , ALRAWI O , MOHAISEN M . Amal:High-fidelity,behavior-based automated malware analysis and classification [J ] . Computers ＆ Security , 2015 , 52 : 251 - 266 .

LIN Y D , LAI Y C , LU C N , et al . Three-phase behavior-based detection and classification of known and unknown malware [J ] . Security and Communication Networks , 2015 , 8 ( 11 ): 2004 - 2015 .

KRIS C , MAREK R . A Joint model for word embedding and word morphology [C ] // Proc of the 1st Workshop on Representation Learning for NLP,August 11th . 2016 : 18 - 26 .

陈翠平 . 基于深度信念网络的文本分类算法 [J ] . 计算机系统应用 , 2015 , 24 ( 2 ): 121 - 126 .

CHEN C P . Text Categorization based on deep belief network [J ] . Computer System ＆ Application , 2015 , 24 ( 2 ): 121 - 126 .

黎亚雄 , 张坚强 , 潘登 , 等 . 基于RNN-RBM语言模型的语音识别研究 [J ] . 计算机研究与发展 , 2014 , 51 ( 9 ): 1936 - 1944 .

LI Y X , ZHANG J Q , PAN D , et al . A study of speech recognition based on RNN-RBM language model [J ] . Journal of Computer Research and Development , 2014 , 51 ( 9 ): 1936 - 1944 .

LUKASZ K , AIDAN N.G , NOAM S , et al . One model to learn them all [J ] . arXiv:1706.05137v1 , 2017 .06:1-10.

Ponemon Institite . 2017 Cost of Data Breach Study [R ] .

RAFF E , ZAK R , MUNOZ G , et al . Automatic yara rele generation using biclustering [C ] // Proceedings of the 13th ACM Workshop on Artificial Intelligence and Security . 2020 : 71 - 82 .

Views

451

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Multi-task adversarial attribution method based on hierarchical structure

Research progress of color image steganalysis

Related Author

Guo Kai

Wang Heng

Ma Ziqiang

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

ZUO Peng

Related Institution

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Computer Science, Nanjing University of Posts and Telecommunications

⁰