Malicious code homology analysis method based on graph convolution network and topic model

Abstract

The invention provides a malicious code homology analysis method based on a graph convolution network and a topic model. According to the method, two static features are extracted from malicious codesto form mixed features, an attention mechanism and a topic model are used for carrying out weighting processing on key features, and then a normalized classification model is used for classifying thekey features. The method mainly comprises the following steps: (1) extracting a function call graph and function instruction distribution characteristics of malicious codes by utilizing IDA; (2) performing node embedding on the function call graph by using an improved graph convolution network; (3) performing graph embedding operation on node embedding by using an attention mechanism; (4) performing dimensionality reduction and transformation on function instruction distribution by using a semi-supervised topic model; (4) combining the mixed features by using a neural tensor network; and (5)carrying out family classification on the malicious software by utilizing the normalized classification model.

Description

technical field [0001] The technical field of the present invention is the field of deep learning and information security, and specifically relates to a malicious code homology analysis method based on a graph convolutional network and a topic model. This method is used to trace the source of attackers or organizations, and use accurate traceability methods to deter attackers and reduce the damage caused by malicious codes. Background technique [0002] In recent years, the situation of the global network security offensive and defensive game has become increasingly severe, and various attacks that use malicious code to seek political and economic interests emerge in an endless stream. The production and utilization of malicious code by attackers has gradually shown a tendency to be teamed and organized, resulting in a rapid growth trend in the number of malicious codes. At present, malicious codes of different families have technical common problems, and there are certain...

AI Technical Summary

Problems solved by technology

The main difference between static analysis and dynamic analysis is that the feature extraction methods are different, but they have great similarities in similarity and homology judgment

Images