近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数...近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标(IOC,indicators of compromise)提取系统XLMRevealer;在此基础上,根据XLM代码特点提取Word和Token特征,通过特征融合能够捕获多层次细粒度特征,并在XLMRevealer中构造CNN-BiLSTM(convolution neural network-bidirectional long short term memory)模型,从不同维度挖掘家族样本的关联性和完成家族分类。最后,从5个来源构建包含2346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明,XLMRevealer的反混淆成功率达到71.3%,相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%;反混淆效率稳定,平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%,效果优于所有基线模型,有效体现Word和Token特征融合的优势。此外,为探索反混淆对家族分类的影响,并考虑不同家族使用的混淆技术可能有所不同,模型会识别到混淆技术的特征,分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验,家族分类准确率为89.58%、53.61%,证明模型能够学习混淆技术特征,更验证了反混淆对家族分类极大的促进作用。展开更多
This paper investigates the design of an attitude autopilot for a dual-channel controlled spinning glideguided projectile(SGGP),addressing model uncertainties and external disturbances.Based on fixed-time stable theor...This paper investigates the design of an attitude autopilot for a dual-channel controlled spinning glideguided projectile(SGGP),addressing model uncertainties and external disturbances.Based on fixed-time stable theory,a disturbance observer with integral sliding mode and adaptive techniques is proposed to mitigate total disturbance effects,irrespective of initial conditions.By introducing an error integral signal,the dynamics of the SGGP are transformed into two separate second-order fully actuated systems.Subsequently,employing the high-order fully actuated approach and a parametric approach,the nonlinear dynamics of the SGGP are recast into a constant linear closed-loop system,ensuring that the projectile's attitude asymptotically tracks the given goal with the desired eigenstructure.Under the proposed composite control framework,the ultimately uniformly bounded stability of the closed-loop system is rigorously demonstrated via the Lyapunov method.Validation of the effectiveness of the proposed attitude autopilot design is provided through extensive numerical simulations.展开更多
文摘近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标(IOC,indicators of compromise)提取系统XLMRevealer;在此基础上,根据XLM代码特点提取Word和Token特征,通过特征融合能够捕获多层次细粒度特征,并在XLMRevealer中构造CNN-BiLSTM(convolution neural network-bidirectional long short term memory)模型,从不同维度挖掘家族样本的关联性和完成家族分类。最后,从5个来源构建包含2346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明,XLMRevealer的反混淆成功率达到71.3%,相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%;反混淆效率稳定,平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%,效果优于所有基线模型,有效体现Word和Token特征融合的优势。此外,为探索反混淆对家族分类的影响,并考虑不同家族使用的混淆技术可能有所不同,模型会识别到混淆技术的特征,分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验,家族分类准确率为89.58%、53.61%,证明模型能够学习混淆技术特征,更验证了反混淆对家族分类极大的促进作用。
基金supported by the National Natural Science Foundation of China(Grant Nos.52272358 and 62103052)。
文摘This paper investigates the design of an attitude autopilot for a dual-channel controlled spinning glideguided projectile(SGGP),addressing model uncertainties and external disturbances.Based on fixed-time stable theory,a disturbance observer with integral sliding mode and adaptive techniques is proposed to mitigate total disturbance effects,irrespective of initial conditions.By introducing an error integral signal,the dynamics of the SGGP are transformed into two separate second-order fully actuated systems.Subsequently,employing the high-order fully actuated approach and a parametric approach,the nonlinear dynamics of the SGGP are recast into a constant linear closed-loop system,ensuring that the projectile's attitude asymptotically tracks the given goal with the desired eigenstructure.Under the proposed composite control framework,the ultimately uniformly bounded stability of the closed-loop system is rigorously demonstrated via the Lyapunov method.Validation of the effectiveness of the proposed attitude autopilot design is provided through extensive numerical simulations.
