基于TensorFlow的恶意代码片段自动取证检测算法

李炳龙; 佟金龙; 张宇; 孙怡峰; 王清贤; 常朝稳

doi:10.11959/j.issn.2096-109x.2021048

您当前的位置：

首页 >

文章列表页 >

基于TensorFlow的恶意代码片段自动取证检测算法

学术论文 | 更新时间：2024-06-03

- 基于TensorFlow的恶意代码片段自动取证检测算法
- Auto forensic detecting algorithms of malicious code fragment based on TensorFlow
- 网络与信息安全学报 2021年7卷第4期页码：154-163
- 作者机构：
- 作者简介：
  
  [ "李炳龙（1974− ），男，河南卫辉人，博士，信息工程大学副教授，主要研究方向为数字调查与取证、网络入侵溯源追踪与取证、云计算取证、智能手机取证等" ]
  [ "佟金龙（1997− ），男，河北保定人，信息工程大学助理工程师，主要研究方向为信息智能安全" ]
  [ "张宇（1996− ），男，江苏连云港人，信息工程大学硕士生，主要研究方向为智能手机取证" ]
  [ "孙怡峰（1976− ），男，河南新乡人，博士，信息工程大学副教授，主要研究方向为人工智能与信息安全" ]
  [ "王清贤（1960− ），男，河南卫辉人，信息工程大学教授、博士生导师，主要研究方向为网络与信息安全" ]
  [ "常朝稳（1966− ），男，河南滑县人，博士，信息工程大学教授、博士生导师，主要研究方向为网络信息防御" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(60903220)
- DOI：10.11959/j.issn.2096-109x.2021048
  中图分类号： TP309
- 网络首发：2021-08，
  
  纸质出版：2021-08-15
- 稿件说明：
移动端阅览
李炳龙, 佟金龙, 张宇, 等. 基于TensorFlow的恶意代码片段自动取证检测算法[J]. 网络与信息安全学报, 2021,7(4):154-163.

Binglong LI, Jinlong TONG, Yu ZHANG, et al. Auto forensic detecting algorithms of malicious code fragment based on TensorFlow[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 154-163.
李炳龙, 佟金龙, 张宇, 等. 基于TensorFlow的恶意代码片段自动取证检测算法[J]. 网络与信息安全学报, 2021,7(4):154-163. DOI： 10.11959/j.issn.2096-109x.2021048.

Binglong LI, Jinlong TONG, Yu ZHANG, et al. Auto forensic detecting algorithms of malicious code fragment based on TensorFlow[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 154-163. DOI： 10.11959/j.issn.2096-109x.2021048.

摘要

针对数字犯罪事件调查，在复杂、异构及底层的海量证据数据中恶意代码片段识别难的问题，通过分析TensorFlow深度学习模型结构及其特性，提出一种基于TensorFlow的恶意代码片段检测算法框架；通过分析深度学习算法训练流程及其机制，提出一种基于反向梯度训练的算法；为解决不同设备、不同文件系统的证据源中恶意代码片段特征提取问题，提出一种基于存储介质底层的二进制特征预处理算法；为进行反向传播训练，设计并实现了一个代码片段数据集制作算法。实验结果表明，基于TensorFlow的恶意代码片段检测算法针对不同存储介质以及证据存储容器中恶意代码片段的自动取证检测，综合评价指标F

达到 0.922，并且和 CloudStrike、Comodo、FireEye 等杀毒引擎相比，该算法在处理底层代码片段数据方面具有绝对优势。

Abstract

In order to auto detect the underlying malicious code fragments in complex，heterogeneous and massive evidence data about digital forensic investigation

a framework for malicious code fragment detecting algorithm based on TensorFlow was proposed by analyzing TensorFlow model and its characteristics.Back-propagation training algorithm was designed through the training progress of deep learning.The underlying binary feature pre-processing algorithm of malicious code fragment was discussed and proposed to address the problem about different devices and heterogeneous evidence sources from storage media and such as AFF forensic containers.An algorithm which used to generate data set about code fragments was designed and implemented.The experimental results show that the comprehensive evaluation index F

of the method can reach 0.922

and compared with CloudStrike

Comodo

FireEye antivirus engines

the algorithm has obvious advantage in dealing with the underlying code fragment data from heterogeneous storage media.

关键词

Keywords

references

TEPE A N , BOYLAN A A , DAVIS D W . Analysis of digital forensic capabilities in texas law enforcement agencies [R ] . The Bush School of Government ＆ Public Service , 2019 .

CAVIGLIONE L , WENDZE S , MAZURCZKY W . The future of digital forensics:challenges and the road ahead [J ] . IEEE Security＆ Privacy , 2017 , 15 ( 6 ): 12 - 17 .

LIN X D , CHEN T , ZHU T , et al . Automated forensic analysis of mobile applications on Android devices [J ] . Digital Investigation , 2018 , 26 : S59 - S66 .

高元照 , 李炳龙 , 陈性元 . 基于MapReduce的HDFS数据窃取随机检测算法 [J ] . 通信学报 , 2018 , 39 ( 10 ): 11 - 21 .

GAO Y Z , LI B L , CHEN X Y . Stochastic algorithm for HDFS data detection based on MapReduce [J ] . Journal on Communications , 2018 , 39 ( 10 ): 11 - 21 .

ZAWOAD S , HASAN R . Digital forensics in the age of big data:challenges,approaches,and opportunities [C ] // IEEE Big Data Security 2015 . 2015 : 1 - 7 .

SERVIDA F , CASEY E . IoT forensic challenges and opportunities for digital traces [J ] . Digital Investigation , 2019 , 28 : S22 - S29 .

韩宗达 , 李炳龙 . 基于证据库的数据证据转换模型 [J ] . 计算机应用研究 , 2015 , 32 ( 7 ): 2140 - 2143 .

HAN Z D , LI B L . Evidence conversion model based on evidence database [J ] . Application Research of Computers , 2015 , 32 ( 7 ): 2140 - 2143 .

JAMES J I , PAVEL G . Challenges with automation in digital forensic investigations [J ] . arXiv:1303.4498 , 2013 .

Guidanc [EB ] .

AccessData [EB ] .

ZHU Y , JAMES J , GLADYSHEV P . A consistency study of the windows registry [C ] // 6th IFIP WG 11.9 International Conference on Digital Forensics(DF) . 2010 : 77 - 90 .

ROGERS M , GOLDMAN J , et al . Computer forensics field triage process model [J ] . Journal of Digital Forensics,Security and Law , 2006 , 1 ( 2 ): 27 - 40 .

MISLAN R P , CASEY E , et al . The growing need for on-scene triage of mobile devices [J ] . Digital Investigation , 2010 , 6 ( 3-4 ): 112 - 124 .

MARZIALE L , RICHARD G G , ROUSSEV V . Massive threading:using GPUs to increase the performance of digital forensics tools [J ] . Digital Investigation , 2007 , 4S : S73 - S81 .

GARFINKEL S , NELSON A , WHITE D , et al . Using purpose-built functions and block hashes to enable small block and sub-file forensics [J ] . Digital Investigation , 2010 , 7 : S13 - S23 .

QUICK D , CHOO K K R . Impacts of increasing volume of digital forensic data:a survey and future research challenges [J ] . Digital Investigation , 2014 , 11 ( 4 ): 273 - 294 .

Federal Bureau of Investigation(FBI) . 2019 Internet Crime Report [R ] . 2020 .

McAfee Labs . 2019 Threats Report [EB ] . 2019 .

PIRSCOVEANU R , HANSEN S , CZECH A . Analysis of malware behavior:type classification using machine learning [C ] // Proceedings of the 2015 International Conference on Cyber Situational Awareness,Data Analytics and Assessment (CyberSA) . 2015 .

MOHAISEN A , ALRAWI O , MOHAISEN M . Amal:High-fidelity,behavior-based automated malware analysis and classification [J ] . Computers ＆ Security , 2015 , 52 : 251 - 266 .

LIN Y D , LAI Y C , LU C N , et al . Three-phase behavior-based detection and classification of known and unknown malware [J ] . Security and Communication Networks , 2015 , 8 ( 11 ): 2004 - 2015 .

KRIS C , MAREK R . A Joint model for word embedding and word morphology [C ] // Proc of the 1st Workshop on Representation Learning for NLP,August 11th . 2016 : 18 - 26 .

陈翠平 . 基于深度信念网络的文本分类算法 [J ] . 计算机系统应用 , 2015 , 24 ( 2 ): 121 - 126 .

CHEN C P . Text Categorization based on deep belief network [J ] . Computer System ＆ Application , 2015 , 24 ( 2 ): 121 - 126 .

黎亚雄 , 张坚强 , 潘登 , 等 . 基于RNN-RBM语言模型的语音识别研究 [J ] . 计算机研究与发展 , 2014 , 51 ( 9 ): 1936 - 1944 .

LI Y X , ZHANG J Q , PAN D , et al . A study of speech recognition based on RNN-RBM language model [J ] . Journal of Computer Research and Development , 2014 , 51 ( 9 ): 1936 - 1944 .

LUKASZ K , AIDAN N.G , NOAM S , et al . One model to learn them all [J ] . arXiv:1706.05137v1 , 2017 .06:1-10.

Ponemon Institite . 2017 Cost of Data Breach Study [R ] .

RAFF E , ZAK R , MUNOZ G , et al . Automatic yara rele generation using biclustering [C ] // Proceedings of the 13th ACM Workshop on Artificial Intelligence and Security . 2020 : 71 - 82 .

浏览量

451

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法

彩色图像隐写分析研究进展