Malicious code classification method based on graph convolution network and topic model

Abstract

The invention provides a malicious code homology method based on a graph convolution network and a topic model. According to the method, the function call graph and the function instruction distribution can be automatically extracted from malicious codes, the function call graph is embedded by using a graph convolution network, and the instruction distribution is transformed and dimensionally reduced by using a topic model. The method mainly comprises the following steps of (1) extracting a function call graph of malicious codes; (2) extracting function instruction distribution of malicious codes; (3) selecting an optimal theme number; (4) converting the function instruction distribution into function topic distribution; (5) inputting the function topic distribution and the function call graph into a classification model, and training the model; and (6) the trained model is used for judging family classification of malicious codes.

Description

technical field [0001] The invention relates to the technical field of machine learning and network security. Background technique [0002] In recent years, the situation of the global network security offensive and defensive game has become increasingly severe, and various attacks that use malicious code to seek political and economic interests emerge in an endless stream. The current malicious code has several characteristics: [0003] 1) The number of malicious codes keeps increasing rapidly; [0004] 2) The vast majority of malicious codes belong to known malicious code families; [0005] 3) Most malicious codes of the same family have some commonality. [0006] According to the above points, it can be concluded that the family classification of malicious codes by extracting features can realize the homology determination of most malicious codes. Currently, homology analysis techniques for malicious codes include dynamic analysis and static analysis. Static analysis...

AI Technical Summary

Problems solved by technology

[0003] 1) The number of malicious codes keeps increasing rapidly;

[0004] 2) The vast majority of malicious codes belong to known malicious code families;

[0005] 3) Most malicious codes of the same family have some commonality

However, the number of instructions is large, and there are some redundant instructions

Images