Deep learning based detection of malicious shell scripts
In some implementations, a system may receive a shell script associated with a computing device. The system may generate a character frequency feature vector based on the shell script. The system may input text of the shell script to a convolutional neural network (CNN) branch of a trained deep learning model. The system may input the character frequency feature vector to a feedforward neural network (FNN) branch of the trained deep learning model. The system may determine using the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the shell script based on a combined output of the CNN branch and the FNN branch. The system may detect whether the shell script is obfuscated based on respective probability scores for each of the plurality of obfuscation types determined for the shell script.
1. A system for detecting obfuscated shell scripts, the system comprising:
one or more memories; and
one or more processors, coupled to the one or more memories, configured to:
receive a plurality of scripts of various types, including shell scripts and other executable script types;
generate, for each received script, a multi-resolution feature set, the multi-resolution feature set for each received script including:
a character frequency feature vector, and
a plurality of text representation vectors;
train a deep learning model using the generated multi-resolution feature set, wherein the deep learning model comprises:
a convolutional neural network (CNN) configured to process the plurality of text representation vectors, and
a feedforward neural network branch configured to process the character frequency feature vector; and
output a trained deep learning model to:
receive an unknown script,the respective multi-resolution feature set
generate a respective multi-resolution feature set for the unknown script,
determine, based at least in part on a combined output of the CNN and the feedforward neural network branch of the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the unknown script using the respective multi-resolution feature set generated for the unknown script, and
detect and classify the unknown script as obfuscated based at least in part on the respective probability scores.
2. The system of claim 1 , wherein a branch of the trained deep learning model is a multi-channel CNN comprising multiple CNN channels, each with distinct respective kernel sizes, wherein each kernel size corresponds to a different word group size.
3. The system of claim 1 , wherein a branch of the trained deep learning model comprises an embedding layer that encodes text into a sequence of integers based at least in part on a learned vocabulary from training data.
4. The system of claim 3 , wherein a branch of the trained deep learning model further includes multiple CNN channels, each configured to input the sequence of integers using n-grams of varying sizes derived from the sequence.
5. The system of claim 4 , wherein the multiple CNN channels comprise:
a first CNN channel that processes the sequence one at a time,
a second CNN channel that processes the sequence in groups of two,
a third CNN channel that processes the sequence in groups of four, and a fourth CNN channel that processes the sequence in groups of eight.
6. The system of claim 1 , wherein the one or more processors, to generate the character frequency feature vector, are configured to:
determine, for each character of a plurality of characters in a character set, a respective number of occurrences of that character.
7. The system of claim 1 , wherein the plurality of obfuscation types for which the system determines the respective probability scores includes a non-obfuscation type and multiple obfuscation types.
8. The system of claim 1 , wherein the plurality of obfuscation types for which the system determines the respective probability scores includes:
a string single quote obfuscation type,
a string varying case obfuscation type,
a string all obfuscation type,
a string encode obfuscation type,
an encoding string interpolation obfuscation type,
a string backtick obfuscation type, and
a non-obfuscation type.
9. The system of claim 1 , wherein the one or more processors are further configured to:
determine an obfuscation type based at least in part on at least one of the respective probability scores.
10. The system of claim 9 , wherein the one or more processors are further configured to:
transmit an alert based at least in part on detecting that the unknown script is obfuscated, wherein the alert indicates the obfuscation type associated with the unknown script.
11. The system of claim 1 , wherein the one or more processors are further configured to:
fit a tokenizer to scripts in a set of training data to learn a vocabulary for an embedding layer of a branch of the deep learning model.
12. A method for detecting obfuscated scripts in a computing environment, comprising:
receiving, by a system, a script associated with a computing device;
generating, by the system, a feature set based at least in part on the script, the feature set including:
a character frequency feature vector based at least in part on the script, and
a plurality of text representation vectors, each derived from processing text of the script at different resolutions using multiple branches of a convolutional neural network (CNN);
inputting, by the system, into a trained deep learning model that includes a CNN branch and a feedforward neural network branch:
the plurality of text representation vectors of the script to the CNN branch,
and
the character frequency feature vector to the feedforward neural network branch;
determining, by the system, using the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the script based at least in part on a combined output of the CNN branch and the feedforward neural network branch; and
detecting and classifying, by the system, whether the script is obfuscated based at least in part on the respective probability scores.
13. The method of claim 12 , wherein the CNN branch of the trained deep learning model is a multi-channel CNN branch that includes multiple CNN channels having different respective kernel sizes, and wherein a respective kernel size, for each CNN channel of the multiple CNN channels, corresponds to a number of words or tokens.
14. The method of claim 12 , wherein the method further comprises:
encoding, in an embedding layer of the CNN branch of the trained deep learning model, text of the script into a sequence of integers based at least in part on a learned vocabulary from training data.
15. The method of claim 14 , wherein the CNN branch of the trained deep learning model includes multiple CNN channels, each associated with a different respective n-gram size, and the method further comprises:
inputting, to each CNN channel of the multiple CNN channels of the CNN branch, the sequence of integers using n-grams of a respective n-gram size associated with that CNN channel.
16. The method of claim 12 , wherein generating the character frequency feature vector comprises:
determining, for each character of a plurality of characters in a character set, a respective number of occurrences of that character in the script.
17. A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a system, cause the system to:
receive a script corresponding to a computing device;
generate a feature set based at least in part on the script, the feature set including:
a character frequency feature vector based at least in part on the script, and
a plurality of text representation vectors, each derived from processing text of the script at different resolutions using multiple branches of a convolutional neural network (CNN);
input, into a trained deep learning model that includes a CNN branch and a feedforward neural network branch:
the plurality of text representation vectors of the script to the CNN branch, and
the character frequency feature vector to the feedforward neural network branch;
determine, using the trained deep learning model, respective probability scores for each of a plurality of obfuscation types for the script; and
detect and classify whether the script is obfuscated based at least in part on the respective probability scores.
18. The non-transitory computer-readable medium of claim 17 , wherein the neural network branch of the trained deep learning model includes an embedding layer that encodes text into a sequence of integers based at least in part on a learned vocabulary from training data.
19. The non-transitory computer-readable medium of claim 18 , wherein the CNN branch of the trained deep learning model further includes multiple CNN channels that input the sequence of integers using n-grams of different sizes from the sequence.
20. The non-transitory computer-readable medium of claim 17 , wherein t the one or more instructions that cause the system to generate the character frequency feature vector are configured to:
determine, for each character of a plurality of characters in a character set, a respective number of occurrences of that character in the script.