Method and device for feature extraction

Abstract

The present invention discloses a method and device for feature extraction, wherein the method comprises acquiring a batch of black sample files and white sample files from an application layer of a smart terminal operating system; parsing each file to obtain information structure of all functions contained in each file, and computing a check code of each function; determining whether each file contains functions corresponding to respective check codes so as to count times that each function appears in the black sample files and white sample files; extracting black sample features based on functions only appearing in the black sample files while not appearing in the white sample files, or extracting white sample features based on functions only appearing in the white sample files while not appearing in the black sample files. By analyzing and computing the acquired black sample files and white sample files and counting the times that a check code of each function appears in the files, the embodiments of the present invention only use the functions appearing in the black sample files while not appearing in the white sample files as the basis for feature extraction.

1 . A method for feature extraction, comprising:
 acquiring a batch of black sample files and white sample files from an application layer of a smart terminal operating system;   parsing each file to obtain information structure of all functions contained in each file, and computing a check code of each function;   determining whether each file contains functions corresponding to respective check codes so as to count times that each function appears in the black sample files and white sample files;   extracting black sample features based on functions only appearing in the black sample files while not appearing in the white sample files, or extracting white sample features based on functions only appearing in the white sample files while not appearing in the black sample files.   
     
     
         2 . The method according to  claim 1 , wherein after counting the black samples or white samples, the method further comprises: optimizing features, specifically:
 establishing a vector for each feature with respect to all files; initializing a set to be compared sequentially with the vector of each feature; if the set contains the compared vector, reserving the set; if the set does not contain the compared vector, getting a union of the set and the compared vector; sequentially comparing the vectors of all features, and taking the features contained in the finally obtained set as the last reserved features.   
     
     
         3 . The method according to  claim 1 , wherein after counting the black samples or white samples, the method further comprises: optimizing features, specifically:
 for different file sets with different features, if one file set contains all files in another file set, reserving features corresponding to a file set with a larger scope, while abandoning features corresponding to a file set with a smaller scope.   
     
     
         4 . The method according to  claim 3 , wherein the features contain a first feature and a second feature, files containing the first feature form a first file set, and files containing the second feature form a second file set; if the first file set contains all files in the second file set, the first feature is reserved, while the second feature is abandoned. 
     
     
         5 . The method according to  claim 1 , wherein before the counting times that each function appears in the black sample files and the white sample files, the method further comprises:
 performing intra-file de-duplication to the check code of the function.   
     
     
         6 . The method according to  claim 5 , wherein the performing intra-file de-duplication to the check code of the function comprises:
 for each file, if a plurality of functions have a same check code, extracting a function from the plurality of functions as a function corresponding to the check code.   
     
     
         7 . The method according to  claim 1 , wherein the black sample files and the white sample files are all virtual machine executable files;
 the parsing each file to obtain information structure of all functions contained in the each file comprises:   decompiling a virtual machine executable file to obtain a decompiled information structure of all functions contained in the virtual machine executable file.   
     
     
         8 . The method according to  claim 7 , wherein the computing a check code of each function comprises:
 computing a hash value of information structure of the function by hash algorithm, use the hash value as the check code corresponding to the function.   
     
     
         9 - 11 . (canceled) 
     
     
         12 . The method according to  claim 1 , wherein:
 the extracting black sample features based on functions only appearing in black sample files while not appearing in white sample files comprises:   using a function that only appears in the black sample files while not appearing in the white sample files as the black sample feature, or using a part of code of the function that only appears in the black sample files while not appearing in the white sample files as the black sample feature;   the extracting white sample features based on functions only appearing in white sample files while not appearing in black sample files comprises:   using a function that only appears in the white sample files while not appearing in the black sample files as the white sample feature, or using a part of code of the function that only appears in the white sample files while not appearing in the black sample files as the white sample feature.   
     
     
         13 . The method according to  claim 1 , further comprising:
 adding black sample features into a black sample feature library, and   matching a target file using the black sample feature library; if the target file contains a function or a subset of functions corresponding to a black sample feature, determining that malicious code exists in the target file.   
     
     
         14 . (canceled) 
     
     
         15 . The method according to  claim 1 , wherein, the black sample file refers to a file preliminarily determined as containing a black sample, while the white sample file refers to a file preliminarily determined as not containing a black sample. 
     
     
         16 . The method according to  claim 15 , wherein the acquiring a batch of black sample files and white sample files comprises:
 finding an installation package of an application from an application layer of a smart terminal operating system;   parsing the installation package to obtain a virtual machine executable file of the application;   using the virtual machine executable file as a black sample file or a white sample file.   
     
     
         17 . (canceled) 
     
     
         18 . A device for feature extraction, comprising a memory having instructions stored therein and at least one processor to execute the instructions to cause:
 acquiring a batch of black sample files and white sample files from an application layer of a smart terminal operating system;   parsing each file to obtain information structure of all functions contained in each file;   computing a check code of each function;   determining whether each file contains functions corresponding to respective check codes so as to count times that each function appears in the black sample files and white sample files; and   extracting black sample features based on functions only appearing in the black sample files while not appearing in the white sample files, or extracting white sample features based on functions only appearing in the white sample files while not appearing in the black sample files.   
     
     
         19 . The device according to  claim 18 , the processor further executes the instructions to cause optimizing features that comprising:
 establishing a vector for each feature with respect to all files; initializing a set to be compared sequentially with the vector of each feature; if the set contains the compared vector, reserving the set; if the set does not contain the compared vector, getting a union of the set and the compared vector; sequentially comparing the vectors of all features, and taking the features contained in the finally obtained set as the last reserved features.   
     
     
         20 . The device according to  claim 18 , the processor further executes the instructions to cause:
 for different file sets with different features, if one file set contains all files in another file set, reserving features corresponding to a file set with a larger scope, while abandoning features corresponding to a file set with a smaller scope.   
     
     
         21 - 22 . (canceled) 
     
     
         23 . The device according to claim  22 , wherein the processor further executes the instructions to cause:
 performing intra-file de-duplication to the check code of the function,   wherein the performing intra-file de-duplication to the check code of the function comprises:
 for each file, if a plurality of functions have a same check code, extracting a function from the plurality of functions as a function corresponding to the check code. 
   
     
     
         24 . The device according to  claim 18 , wherein:
 the black sample files and the white sample files are all virtual machine executable files; and   the parsing each file to obtain information structure of all functions contained in each file specifically comprises:
 decompiling the virtual machine executable file to obtain a decompiled information structure of all functions contained in the virtual machine executable file. 
   
     
     
         25 - 28 . (canceled) 
     
     
         29 . The device according to  claim 18 , wherein:
 the extracting black sample features based on functions only appearing in black sample files while not appearing in white sample files comprises:
 using a function that only appears in the black sample files while not appearing in the white sample files as the black sample feature, or using a part of code of the function that only appears in the black sample files while not appearing in the white sample files as the black sample feature; 
   the extracting white sample features based on functions only appearing in white sample files while not appearing in black sample files comprises:
 using a function that only appears in the white sample files while not appearing in the black sample files as the white sample feature, or using a part of code of the function that only appears in the white sample files while not appearing in the black sample files as the white sample feature. 
   
     
     
         30 . The device according to  claim 18 , wherein the processor further executes the instructions to cause:
 adding a black sample feature into a black sample feature library, and   matching a target file using the black sample feature library; if the target file contains a function or a subset of functions corresponding to the black sample feature, determining that malicious code exists in the target file.   
     
     
         31 - 35 . (canceled) 
     
     
         36 . A computer-readable medium, having instructions stored therein that, when executed by at least one processor, cause the processor to perform feature extraction comprising:
 acquiring a batch of black sample files and white sample files from an application layer of a smart terminal operating system;   parsing each file to obtain information structure of all functions contained in each file, and computing a check code of each function;   determining whether each file contains functions corresponding to respective check codes so as to count times that each function appears in the black sample files and white sample files; and   extracting black sample features based on functions only appearing in the black sample files while not appearing in the white sample files, or extracting white sample features based on functions only appearing in the white sample files while not appearing in the black sample files.