Binary file feature information extraction through binary file immobilization and wavelet signal processing
Disclosed is a method of extracting file feature information, the method being performed by a computing device including at least one processor, the method including: converting input data in a form of a binary file into data with a preset size; and extracting feature information of the input data from the data with the preset size. The representative drawing may be FIG. 2.
1. A method of extracting file feature information, the method being performed by a computing device including at least one processor, the method comprising:
converting input data in a form of a binary file into data with a preset size, wherein the converting of the input data in the form of the binary file into the data with the preset size comprises:
recognizing the input data in units of bytes;
counting the number of each of the recognized plurality of bytes; and
converting the input data into the data with the preset size based on the number of each of the plurality of bytes;
extracting feature information of the input data from the data with the preset size; and
training a network model using the feature information as training data to detect a malicious code from the input data in the form of the binary file,
wherein the converting of the input data into the data with the preset size based on the number of each of the plurality of bytes comprises:
calculating an appearance probability of each of the plurality of bytes in total data based on the number of each of the plurality of bytes; and
converting the input data into the data with the preset size based on the appearance probability.
2. The method of claim 1 , wherein the converting of the input data in the form of the binary file into the data with the preset size includes converting the input data into the data with the preset size by using a hidden Markov model.
3. The method of claim 1 , wherein the converting of the input data in the form of the binary file into the data with the preset size includes:
recognizing the input data by dividing the input data by a first unit indicating a size of a storage device;
counting the number of data recognized by the first unit; and
converting the input data into the data with the preset size based on the number of data in the first unit.
4. The method of claim 1 , wherein the converting of the input data in the form of the binary file into the data with the preset size includes:
recognizing the input data in units of bytes;
calculating the number of times of appearance of a unique concatenation structure between bytes in which a second byte is concatenated after a first byte among a plurality of recognized bytes, in which the number of times of the appearance is calculated for at least some of the recognized plurality of bytes; and
converting the input data into the data with the preset size based on the number of times of the appearance.
5. The method of claim 4 , wherein the converting of the input data into the data with the preset size based on the number of times of the appearance includes:
calculating a concatenation probability between bytes, in which the second byte appears after the first byte, based on the number of times of the appearance; and
converting the input data into data with the preset size based on the concatenation probability.
6. The method of claim 1 , wherein the extracting of the feature information of the input data from the data with the preset size includes:
extracting feature information from the data with the preset size by using a wavelet transform technique.
7. The method of claim 6 , wherein the extracting of the feature information from the data with the preset size by using the wavelet transform technique includes:
extracting a wavelet coefficient matrix by performing the wavelet transform on the data with the preset size, in which the wavelet coefficient matrix includes an approximation coefficient matrix and a detail coefficient matrix; and
extracting feature information of the input data based on the wavelet coefficient matrix.
8. The method of claim 7 , wherein the detailed coefficient matrix includes at least one of a horizontal coefficient matrix, a vertical coefficient matrix, or a diagonal coefficient matrix.
9. The method of claim 8 , wherein the data with the preset size is data having a matrix structure, and
wherein the feature information includes at least one of:
a first feature related to the approximate coefficient matrix extracted by performing a first number of times of the wavelet transform;
a second feature for the diagonal coefficient matrix value extracted by performing a second number of times of the wavelet transform within a first number range equal to or greater than a first threshold number of times and equal to or less than the first number of times;
a third feature related to the diagonal coefficient matrix extracted by performing a third number of times of the wavelet transform within a second number range equal to or greater than a first threshold number of times and less than the first number of times; and
a fourth feature related to the diagonal coefficient matrix extracted by performing a fourth number of times of the wavelet transform within a third number range equal to or greater than a second threshold number of times less than the first threshold number of times and less than the first number of times, so that the data with the preset size has a 1×1 matrix structure, and the first threshold number of times is smaller than the first number of times.
10. The method of claim 9 , wherein the third feature includes at least one of:
a third-1 feature related to a ratio of the diagonal coefficient matrix extracted by performing the wavelet transform the third number of times; and
a third-2 feature related to a first standard deviation of the diagonal coefficient matrix extracted by performing the wavelet transform the third number of times.
11. The method of claim 9 , wherein the fourth feature includes at least one of:
a fourth-1 feature related to a sum of the values of the diagonal coefficient matrixes extracted by performing the wavelet transform the fourth number of times;
a fourth-2 feature related to asymmetry of the value of the diagonal coefficient matrix extracted by performing the wavelet transform the third number of times;
a fourth-3 feature related to a second standard deviation of the diagonal coefficient matrix extracted by performing the wavelet transform the third number of times; and
a fourth-4 feature related to an average value of the diagonal coefficient matrixes extracted by performing the wavelet transform the third number of times.
12. A computing device for extracting file feature information, the computing device comprising:
a binary file converting unit for converting input data in a form of a binary file into data with a preset size,
wherein the converting of the input data in the form of the binary file into the data with the preset size comprises:
recognizing the input data in units of bytes;
counting the number of each of the recognized plurality of bytes; and
converting the input data into the data with the preset size based on the number of each of the plurality of bytes, and
wherein the converting of the input data into the data with the preset size based on the number of each of the plurality of bytes comprises:
calculating an appearance probability of each of the plurality of bytes in total data based on the number of each of the plurality of bytes; and
converting the input data into the data with the preset size based on the appearance probability; and
a signal processing unit for extracting feature information of the input data from the data with the preset size and training a network model using the feature information as training data to detect a malicious code from the input data in the form of the binary file.
13. A non-transitory computer readable medium including a computer program, wherein the computer program performs a method of extracting feature information of a file when being executed by one or more processors, the method comprising:
converting input data in a form of a binary file into data with a preset size,
wherein the converting of the input data in the form of the binary file into the data with the preset size comprises:
recognizing the input data in units of bytes;
counting the number of each of the recognized plurality of bytes; and
converting the input data into the data with the preset size based on the number of each of the plurality of bytes, and
wherein the converting of the input data into the data with the preset size based on the number of each of the plurality of bytes comprises:
calculating an appearance probability of each of the plurality of bytes in total data based on the number of each of the plurality of bytes; and
converting the input data into the data with the preset size based on the appearance probability;
extracting feature information of the input data from the data with the preset size; and
training a network model using the feature information as training data to detect a malicious code from the input data in the form of the binary file.