Propagation prediction method for malicious software

Abstract

The invention belongs to the technical field of internet application, and particularly relates to a propagation prediction method for malicious software. The method comprises the steps of obtaining user nodes in a database and interaction data of the user nodes, and extracting propagation attributes of the user nodes; learning a user behavior feature vector of the user node from a paragraph formed by user node propagation contents by adopting a Doc2vec algorithm; adopting a vectorization algorithm Tensor2vec based on tensor decomposition to learn a user node network structure feature vector from the malicious software propagation network; and performing propagation prediction on the malicious software in the graph convolutional neural network, and predicting whether the malicious software is propagated to a user node and the propagation trend of the malicious software. According to the method, the problem of inaccurate calculation precision caused by data sparsity is considered, the infection intensity between the user nodes is calculated by adopting a tensor decomposition method, and the malicious software propagation spatial feature information is mined by utilizing a representation learning method, so that propagation prediction of the malicious software can be effectively carried out.

Description

technical field [0001] The invention belongs to the field of Internet application technology, relates to network and information security technology, and in particular to a method for predicting the spread of malicious software. Background technique [0002] In recent years, the amount and harm of malware have increased dramatically, and its threat to networks and user nodes is considered to be one of the most significant risks in the coming years. Early malware was mainly limited to computer viruses, but with the development of the Internet and the diversification of network attacks, the concept of malware has surpassed the traditional narrow concept, especially with the advanced persistent threat (Advanced Persistent Threat, referred to as APT) ), Supply Chain Attacks (Supply Chain Attacks, SCA for short), botnets and ransomware and other malware, malware has highlighted its proprietary, control and destructiveness to the target. [0003] In addition, three years after th...

AI Technical Summary

Problems solved by technology

[0005] Based on the classic SIR propagation dynamics research malware propagation prediction is based on the network structure and user node attributes to extract features, but does not fully consider the impact of potential interactions between user nodes on the accuracy of feature extraction

Models based on machine learning or neural networks often ignore the diversity of user relationships and user behaviors in the malware propagation network, resulting in the need to explicitly extract the infection intensity between users and the influence of different malware

Images