Malicious software detection method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a malicious software detection method and device, equipment and a storage medium, and relates to the technical field of network information security, the method comprises the following steps: statically analyzing a binary file of to-be-detected software to obtain an assembly code and a function call graph of the to-be-detected software; converting the assembly code to obtain a semantic feature vector of each function in the to-be-detected software; combining the semantic feature vector with the function call graph to generate an attribute function call graph; and inputting the attribute function call graph into a graph neural network classification model to obtain malicious attribute information of the to-be-detected software. According to the malicious software detection method, the semantic features and the structural features of the binary program can be automatically extracted, the semantic features and the structural features are combined and judged through the graph neural network, the problems that in an existing detection method, feature representation is incomplete, and the missing report rate and the false alarm rate are high are solved, and the malicious software can be quickly and accurately detected.

Description

technical field [0001] The embodiments of the present application relate to the technical field of network information security, and in particular, to a malware detection method, device, device, and storage medium. Background technique [0002] The rapid development of computer technology makes people's daily life more convenient, but also promotes the continuous improvement of hackers' attack methods and technologies, resulting in increasingly serious network attacks. The number of security threats in cyberspace is increasing year by year, and malware is the most important of all security threats. The largest category. Malware is a program that causes damage or performs unwanted actions on a computer system. Attackers can attack computer systems through malicious software to achieve privilege escalation, remote control, privacy theft, etc., and further attack other terminals in the computer network. [0003] Early malware was simple in structure and did not use complex pr...

AI Technical Summary

Problems solved by technology

Second, in order to bypass or disable various security mechanisms to achieve malicious behavior, new malware uses more complex codes, structures and techniques, making it more destructive and harder to detect

[0004] However, the existing malware detection methods have the disadvantages of being unable to deal with unknown malware, false positives and false negatives in the detection of the new generation of malware.

Images