Abstract:
Abstract: At present， malware attacks are one of the main threats to cyberspace security. By analyzing malicious programs from known organizations and determining the homology of unknown malicious programs based on similar characteristics， it is helpful to identify unknown malicious programs and attribution attack organizations. However， the existing homology analysis models have some problems， such as high complexity of manual feature extraction， inadaptability to large-scale analysis scenarios， low efficiency， and lack of in-depth consideration of the transmission relationship between attack behaviors. This paper proposes a homology recognition model based on the ATT&CK framework and the Bert（bidirectional encoder representation from transformers） model， which solves the problem of low homology recognition accuracy caused by code confusion and polymorphism in the face of static features through high-dimensional attack techniques and tactics in the ATT&CK framework. The Bert model is used to effectively integrate the multi-dimensional features of malicious code， and solve the problem of insufficient sequence modeling by recurrent neural network-based analysis methods. Experimental results show that the proposed scheme can effectively identify the homology between malicious codes.

Key words: Key words: malicious code； homology analysis； ATT&, CK framework； Bert model ,