Malicious software multi-label classification method based on graph convolutional neural network

Abstract

The invention provides a malicious software multi-label classification method based on a graph convolutional neural network. A classification method comprises the following steps: S100, extracting features of a function call graph, disassembling an original binary file, obtaining a sink code, extracting semantic and structural features of the function call graph, and obtaining a graph embedding vector of a sample; S200, carrying out feature extraction of a multi-label relationship: constructing a model for extracting the label relationship through the label relationship graph to obtain a multi-label classifier; S300, performing point multiplication on the graph embedding vector and the multi-label classifier, and performing structure mapping on a result obtained by the point multiplication to obtain a classification result; and S400, constructing a multi-label loss function, and calculating a loss value of the classification model by calculating a difference value between a classification result and a real result of each label. Compared with the prior art, the method has a good multi-label classification effect on malicious software with various labels.

Description

technical field [0001] The invention relates to the technical field of malware detection, in particular to a multi-label classification method for malware based on a graph convolutional neural network. Background technique [0002] With the game between malware protection technology and malware, in today’s network environment, malware is no longer limited to one behavioral attack, such as WannaCry, which broke out in 2017, because of its distinctive encrypted data for extortion, it was The general public is classified as ransomware, but in addition to the behavior of ransomware encrypted files, this malware also has the behavior of worms replicating and spreading through the network, and Trojan horses disguising software. In recent years, with the development of Graph Neural Network (GNN), it has achieved good results in extracting the connection between entities. Various fields have begun to try to introduce graph neural network for research, and the field of malware detect...

AI Technical Summary

Problems solved by technology

In recent years, with the development of Graph Neural Network (GNN), it has achieved good results in extracting the connection between entities. Various fields have begun to try to introduce graph neural network for research, and the field of malware detection has also tried The control flow graph (Control Flow Graph, CFG) and function call graph (Function Call Graph, FCG) of the binary file are used as the starting point for research, but in the multi-classification of malware, the label of the data set will only have one behavior Labels are often classified as one of ransomware, worms, and Trojan horses. During the training process, only one label is used. The single result obtained after training such a model deviates from the behavior of the actual sample. Can not represent the real behavior of all samples

Images