Static script malware detection with semantic code representations
Techniques for static script malware detection with semantic code representations are described. A request to perform a static malware detection analysis is received, the request identifying a script comprising code. A semantic representation of the script is generated, the semantic representation including context about statements in the code of the script. A feature space embedding is generated based at least in part on the semantic representation of the script. generating, based at least in part on the feature space embedding, A result indicating whether the script is malicious is generated based at least in part on the feature space embedding. An identification of the script and the result is stored in an entry in a log.
1 . A computer-implemented method comprising:
receiving, by a malware detection service of a cloud provider network, a request to perform a static malware detection analysis, the request identifying a script comprising code;
generating, with a bytestring encoder, a bytestring embedding from a bytestring of a code statement in the script;
generating a semantic representation of the script, the semantic representation including context about statements in the code of the script, wherein the context includes at least one of an identification of language keywords or an identification of function structure;
generating, with a semantics encoder, a semantics embedding from a feature of the semantic representation, the feature corresponding to the code statement in the script;
generating a sequence of feature space embeddings based at least in part on the semantic representation of the script by combining the bytestring embedding and the semantics embedding, wherein the sequence of feature space embeddings is a sequence of vectors that encodes script semantic features in a feature space;
evaluating the sequence of feature space embeddings using a recurrent neural network (RNN)-based sequential classifier model to generate a result that indicates whether the script is malicious; and
storing an identification of the script and the result in an entry in a log of the malware detection service.
2 . The computer-implemented method of claim 1 , wherein each feature space embedding in the sequence of feature space embeddings corresponds to a statement in the code, and wherein the result is generated based on the sequence of feature space embeddings.
3 . The computer-implemented method of claim 1 , wherein the sequence of feature space embeddings represents a graph in a graph feature space, and wherein feature space embeddings in the sequence of feature space embeddings from similar graphs are closer together within the graph feature space than feature space embeddings in the sequence of feature space embeddings from dissimilar graphs.
4 . A computer-implemented method comprising:
receiving a request to perform a static malware detection analysis, the request identifying a script comprising code;
generating, with a bytestring encoder, a bytestring embedding from a bytestring of a code statement in the script;
generating a semantic representation of the script, the semantic representation including context about statements in the code of the script;
generating, with a semantics encoder, a semantics embedding from a feature of the semantic representation, the feature corresponding to the code statement in the script;
generating a sequence of feature space embeddings based at least in part on the semantic representation of the script by combining the bytestring embedding and the semantics embedding;
evaluating the sequence of feature space embeddings using a recurrent neural network (RNN)-based sequential classifier model to generate a result that indicates whether the script is malicious; and
storing an identification of the script and the result in an entry in a log.
5 . The computer-implemented method of claim 4 , wherein the semantic representation of the script is generated using a static code analysis parsing component from at least one of a syntax highlighter application or an abstract syntax tree constructor application.
6 . The computer-implemented method of claim 4 , wherein each feature space embedding in the sequence of feature space embeddings corresponds to a statement in the code.
7 . The computer-implemented method of claim 4 , wherein the sequence of feature space embeddings is ordered based on at least one of a sequence of statements in the code or a serialized traversal of nodes in an abstract syntax tree representing the script.
8 . The computer-implemented method of claim 4 , wherein the semantic representation of the script is generated using a static code analysis parsing component from an abstract syntax tree constructor application, and wherein each feature space embedding in the sequence of feature space embeddings corresponds to a node in an abstract syntax tree of the script.
9 . The computer-implemented method of claim 4 :
wherein the sequence of feature space embeddings represents a graph;
wherein generating the sequence of feature space embeddings and generating the result are performed using a machine learning model, the machine learning model including a graph embedding model and a classifier; and
wherein the graph embedding model is trained to generate feature space embeddings in a graph feature space, and wherein feature space embeddings in the sequence of feature space embeddings from similar graphs are closer together within the graph feature space than feature space embeddings in the sequence of feature space embeddings from dissimilar graphs.
10 . The computer-implemented method of claim 9 , wherein the classifier is trained after learning parameters of the graph embedding model.
11 . The computer-implemented method of claim 4 , wherein the context about statements in the code of the script includes at least one of an identification of language keywords or an identification of function structure.
12 . The computer-implemented method of claim 4 , wherein the RNN-based sequential classifier model includes a bidirectional long short-term memory module.
13 . The computer-implemented method of claim 12 , wherein the RNN-based sequential classifier model further includes multiple layers followed by an attention module and a fully-connected output layer.
14 . A system comprising:
a first one or more computing devices to implement a data store in a multi-tenant provider network; and
a second one or more computing devices to implement a static script malware detection service in the multi-tenant provider network, the static script malware detection service including instructions that upon execution cause the static script malware detection service to:
receive a request to perform a static malware detection analysis, the request identifying a script comprising code;
generate, with a bytestring encoder, a bytestring embedding from a bytestring of a code statement in the script;
generate a semantic representation of the script, the semantic representation including context about statements in the code of the script;
generate, with a semantics encoder, a semantics embedding from a feature of the semantic representation, the feature corresponding to the code statement in the script;
generate a sequence of feature space embeddings based at least in part on the semantic representation of the script by combining the bytestring embedding and the semantics embedding;
evaluating the sequence of feature space embeddings using a recurrent neural network (RNN)-based sequential classifier model to generate a result that indicates whether the script is malicious; and
store an identification of the script and the result in an entry in a log in the data store.
15 . The system of claim 14 , wherein the semantic representation of the script is generated using a static code analysis parsing component from at least one of a syntax highlighter application or an abstract syntax tree constructor application.
16 . The system of claim 14 , wherein each feature space embedding in the sequence of feature space embeddings corresponds to a statement in the code.
17 . The system of claim 14 , wherein the semantic representation of the script is generated using a static code analysis parsing component from an abstract syntax tree constructor application, and wherein each feature space embedding in the sequence of feature space embeddings corresponds to a node in an abstract syntax tree of the script.
18 . The system of claim 14 , wherein the sequence of feature space embeddings represents a graph;
wherein generating the sequence of feature space embeddings and generating the result are performed using a machine learning model, the machine learning model including a graph embedding model and a classifier; and
wherein the graph embedding model is trained to generate feature space embeddings in a graph feature space, and wherein feature space embeddings in the sequence of feature space embeddings from similar graphs are closer together within the graph feature space than feature space embeddings in the sequence of feature space embeddings from dissimilar graphs.
19 . The system of claim 14 , wherein the sequence of feature space embeddings is ordered based on at least one of a sequence of statements in the code or a serialized traversal of nodes in an abstract syntax tree representing the script.
20 . The system of claim 14 , wherein the context about statements in the code of the script includes at least one of an identification of language keywords or an identification of function structure.