PowerDetector:Malicious PowerShell Script Family Classification Based on Multi-Modal Semantic Fusion and Deep Learning  

作　　者：Xiuzhang Yang Guojun Peng Dongni Zhang Yuhang Gao Chenguang Li 

机构地区：[1]School of Cyber Science and Engineering,Wuhan University,Wuhan 430072,China [2]Key Laboratory of Aerospace Information Security and Trusted Computing,Ministry of Education,Wuhan 430072,China [3]School of Information,Guizhou University of Finance and Economics,Guiyang 550025,China

出　　处：《China Communications》2023年第11期202-224,共23页中国通信（英文版）

基　　金：This work was supported by National Natural Science Foundation of China(No.62172308,No.U1626107,No.61972297,No.62172144,and No.62062019).

摘　　要：Power Shell has been widely deployed in fileless malware and advanced persistent threat(APT)attacks due to its high stealthiness and live-off-theland technique.However,existing works mainly focus on deobfuscation and malicious detection,lacking the malicious Power Shell families classification and behavior analysis.Moreover,the state-of-the-art methods fail to capture fine-grained features and semantic relationships,resulting in low robustness and accuracy.To this end,we propose Power Detector,a novel malicious Power Shell script detector based on multimodal semantic fusion and deep learning.Specifically,we design four feature extraction methods to extract key features from character,token,abstract syntax tree(AST),and semantic knowledge graph.Then,we intelligently design four embeddings(i.e.,Char2Vec,Token2Vec,AST2Vec,and Rela2Vec) and construct a multi-modal fusion algorithm to concatenate feature vectors from different views.Finally,we propose a combined model based on transformer and CNN-Bi LSTM to implement Power Shell family detection.Our experiments with five types of Power Shell attacks show that PowerDetector can accurately detect various obfuscated and stealth PowerShell scripts,with a 0.9402 precision,a 0.9358 recall,and a 0.9374 F1-score.Furthermore,through singlemodal and multi-modal comparison experiments,we demonstrate that PowerDetector’s multi-modal embedding and deep learning model can achieve better accuracy and even identify more unknown attacks.

关 键 词：deep learning malicious family detection multi-modal semantic fusion POWERSHELL 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP18[自动化与计算机技术—计算机科学与技术]