Research on Malicious Code Detection Technology for Binary and WASM Bytecode Files in Web3.0 Distributed Applications
International Journal of Big Data Intelligent Technology · 2025
In Web3.0 distributed applications, the research on malicious code detection technology of binary and WASM bytecode files aims to meet the security challenges brought by the emerging Internet phase.This study proposes MalRing method and detection method based on N-gram feature extraction and gradient boosting tree for binary files on traditional platforms and WASM bytecode files in browser environments, respectively.The MalRing method utilizes multimodal fusion features (combining control flow graph and byte flow) for malicious code detection, and processes the features through node feature segmentation algorithm and ring domain extraction algorithm to deal with adversarial samples of control flow confusion.Experiments have shown that MalRing outperforms the baseline model in terms of accuracy.For WASM bytecode files, this study adopts the N-gram feature extraction method, selects features through out of bag errors, and fits the feature vectors using gradient boosting trees to obtain an algorithm model for malicious code detection.However, there are still some issues in current research, such as the high cost of binary file sample parsing and structural feature extraction, the lack of controllability and granularity in adversarial sample generation methods, and the lack of validation of WASM bytecode detection methods in practical systems.Therefore, future research directions will include optimizing sample parsing methods, improving adversarial sample generation methods, and enhancing the malicious code detection system for WASM bytecode, in order to improve the accuracy and efficiency of malicious code detection and provide strong support for the secure development of the Web3.0 ecosystem.