A malware detection method using dynamic graph attention network

Abstract

The application discloses a malware detection method using a dynamic graph attention network. The application segments API sequences, constructs API graph snapshot sequences, and uses multiple snapshots to record the change process of software API call graphs, so as to indirectly represent the order and process of software behavior actions, and enable the model to better understand software behavior. The application updates the attention coefficient through the graph attention neural network module, and updates the hidden state through the gated recurrent neural network module, so that the model can capture the local malicious behavior information of the call graph and the evolution process of the call graph structure, and is more suitable for atypical malware detection.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network security, and relates to a malware detection method using a dynamic graph attention network, specifically, API call sequences generated during software running are used to learn the structural information and behavior information contained therein through a dynamic graph attention network, and according to the captured feature information, the classification task of malware is completed, and the performance of malware detection is improved. BACKGROUND

[0002] Since the birth of computers, the threat of malware has always existed. In the early days of the Internet, malware mainly existed in the form of file infection and self-replication, so the structure of the file was relatively simple, the static features were obvious, and it was easy to detect through feature code matching. However, with the development of Internet technology, the types and complexity of malware have increased, and malware detection has become increasingly difficult. Therefore, researchers have proposed a behavior-based dynamic analysis technology to determine whether a sample is malicious by comparing the behavior differences between the detection sample and the normal software. Generally, the behavior track of malicious code and the behavior track of benign code will be significantly different. After the deep learning model fully understands the behavior characteristics of benign code, a set of standards and specifications will be formed. If the behavior characteristics of the software to be detected are abnormal, the sample can be determined as malware.

[0003] API is a set of functions predefined by the system. In the method of malware detection, API call sequences are very obvious behavior characteristics. All programs can interact with Windows API and access predefined functions through API calls to access resources. It is the most basic operation of software at the function level, and API is a set of actions. Therefore, the API call sequence is an ideal object for studying software behavior and purpose.

[0004] Current research mainly focuses on semantic-based malware detection methods, which cannot well handle the problem of long sequence data. During the running of software, API calls may be continuous. Sequence prediction models such as recurrent neural networks have the characteristic of forgetting, which may greatly reduce the detection performance. Therefore, in order to deal with the problem of declining classification effect of long sequence prediction, some research methods also consider converting the sequence into a graph structure and using a graph neural network to classify it. Because no matter how long the sequence is, converting it into a graph structure is a graph composed of fixed nodes and edges. However, this method also has limitations, that is, it cannot fully extract the timing information of the behavior. Although the timing information can be learned by converting it into a directed graph and using a graph attention network, this method can only obtain local behavior order features. SUMMARY

[0005] The first object of the present application is to solve the above problems, and to improve the network's ability to capture the behavior characteristics of software, a method for malware detection based on dynamic graph attention network is proposed. Based on the classic graph attention network, the method adds a gated recurrent neural network to understand the evolution process of the software call graph structure, better captures the timing information of the software behavior, and improves the precision of malware detection.

[0006] The technical solutions adopted by the present application are as follows:

[0007] Step (1), data preprocessing stage:

[0008] 1-1. Obtain the API call sequence of the software to be detected; remove the API call sequence to obtain the API call sequence that truly reflects the software behavior;

[0009] The de-duplication processing is to delete the same API function or the same API sequence fragment of continuous call. After deleting these API fragments containing redundant information trying to hide the malicious intent of the code, the API call sequence that truly reflects the software behavior will be obtained.

[0010] 3-2. After the API call sequence in step 1-1 is de-duplicated, remove the suffix of all API function names of the same function to make the function names the same.

[0011] The system will call different functions for different encoding formats, but the tasks completed are consistent. In the system, the API with W at the end is used for UNICODE encoding, and the API with A at the end is used for ASCII encoding. Therefore, the API is classified by removing the API suffix, highlighting the association between software API and malicious behavior.

[0012] 1-3. Divide the API call sequence processed in step 1-2 according to the observation window to obtain T API subsequences. Specifically, a window that expands continuously is used to intercept the API call sequence. The length of the window increases each time, which is a hyperparameter and can be selected as needed.

[0013] 1-4. Convert each API subsequence in step 1-3 into an API call graph form. Among them, the API in the subsequence is the node of the API call graph, and the directed edge represents the calling relationship between the current API and other API nodes, and the number of calls is the weight of the edge. The API call graph constructed is represented as G=(N,E), where N is the set of nodes, and E is the set of edges.

[0014] 1-5. Concatenate the T API call graphs obtained in step 1-4 according to the API sub-sequence order to obtain a sequence of call graph snapshots, which is used to represent the structural change process and trend of the API call graph.

[0015] Step (2): Capture the software malicious information between local APIs using the graph attention network.

[0016] 2-1. Use one-hot encoding for each API node in the sequence of graph snapshots in step 1-5 as its initial feature. In addition, in order to reduce the computational overhead, the initial feature is processed by dimension reduction, and the feature vector of the API node is mapped to a lower dimensional vector space by the Embedding function and denoted as where N is the number of APIs, and F is the dimension of the API.

[0017] 2-2. Initialize the shared linear transformation matrix W, where W ∈ R F*F' , which represents the conversion of the feature matrix H from F dimensions to F' dimensions. The API nodes are converted by using the shared linear transformation matrix W, and the attention coefficients between nodes are calculated.

[0018] The calculation formula of the attention coefficient of each API node i and its neighbor node j is as follows:

[0019]

[0020] where is the attention coefficient between node i and node j, which represents the importance of the neighbor API node to the current target API node; is the initial feature vector of node i; N i is the set of all neighbor nodes of node i; || represents the concatenation operation, which concatenates the vectors together; is a single-layer feedforward neural network; LeakyReLU is an activation function.

[0021] 2-3. According to the attention coefficient, the node information is weighted and aggregated, and the result is used as the new feature vector of the current node Further, the new feature matrix F' represents the feature dimension of the output node.

[0022]

[0023] 4-4. To capture the behavior characteristics of API nodes from multiple potential perspectives, multi-head attention is adopted to give API nodes stronger expressive power. It mainly uses multiple independent single-head attention layers to update the node embedding by concatenating or averaging the results. The multi-head formula adopts one of the following:

[0024]

[0025]

[0026] where || denotes the concatenation operation, denotes the normalized attention coefficient between nodes i and j calculated by the kth attention mechanism, W k denotes the corresponding input linear transformation weight matrix, denotes the feature output of the K-head attention layer.

[0027] 2-5. The feature vectors of API nodes in each call graph snapshot are flattened and concatenated together to obtain the feature vector x i representing the current call graph snapshot as the input of the gated recurrent neural network module. The feature representation of the graph snapshot sequence is X = {x1, x2,..., x T}, where T denotes the number of snapshots.

[0028] Step (3): Use the gated recurrent neural network to learn the evolution process of the software call graph structure and capture the long-term timing information of the software behavior occurrence.

[0029] 3-1. The feature vectors X of all call graph snapshots output by the graph attention network are taken as the input of the gated recurrent neural network, and the hidden state h t-1 passed down from the previous time and the input x t at the current time are used to calculate the state information of the update gate and the reset gate at the current time. The state of the update gate and the reset gate at each time can be represented as:

[0030] r t =σ(W xr x t +W hr h t-1 +b r ) (5)

[0031] z t =σ(W xz x t +W hz h t-1 +b z ) (6)

[0032] where xt represents the t-th element of feature vector X; h t-1 represents the hidden layer state at t-1 time; r t represents the reset gate, which is used to control the previous time hidden layer state h t-1 the influence of the current input x t ; z t represents the update gate, which is used to determine whether to ignore the current input x t ; σ is a Sigmoid activation function.

[0033] 3-2. After calculating the gating signal, the reset gate is used to control whether the candidate state depends on the state h t-1 of the previous moment. Specifically, the data after resetting is spliced or added with the input x t of the current moment, and then scaled to the range of (-1, 1) through a tanh activation function to obtain the hidden information representing the current moment. The specific calculation formula is as follows:

[0034]

[0035] 3-3. The update gate is used to control the degree of preservation of historical information. The closer the information size of the update gate is to 1, the more information is remembered; the closer it is to 0, the more information is forgotten. The specific calculation formula is as follows:

[0036]

[0037] Step (4): The output result of the gated recurrent neural network is input to the classifier to realize the malicious condition of the software to be tested.

[0038] The classifier calculation method is as follows:

[0039]

[0040] Where B is the bias, W s is a linear transformation weight matrix, which is used to map the hidden features output by GRU into a two-dimensional output, where the first bit represents the probability that the sample is malicious software, and the second bit represents the probability that the sample is a benign sample.

[0041] A second object of the present application is to provide an electronic device comprising a processor and a memory, said memory storing machine executable instructions executable by said processor, said processor executing said machine executable instructions to implement the method of any one of claims 1-4.

[0042] A third object of the present application is to provide a machine-readable storage medium storing machine-executable instructions which, when invoked and executed by a processor, cause the processor to implement the method of any one of claims 1-4.

[0043] Advantages of the present application:

[0044] The present application updates attention coefficients through a graph attention neural network module, and updates hidden states through a gated recurrent neural network module, so that the model can capture local malicious behavior information of the call graph and the evolution process of the call graph structure, and is more suitable for atypical malware detection.

[0045] The present application uses a dynamic graph attention network to improve the detection effect of malware. The present application segments API sequences, constructs API graph snapshot sequences, and uses multiple snapshots to record the change process of software API call graphs, thereby indirectly representing the order and process of software behavior actions, so that the model can better understand software behavior. The present application updates attention coefficients through a graph attention neural network module, and updates hidden states through a gated recurrent neural network module, so that the model can capture local malicious behavior information of the call graph and the evolution process of the call graph structure, and is more suitable for atypical malware detection. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application:

[0047] Figure 1 is the architecture diagram of the model.

[0048] Figure 2 is the process diagram of constructing the graph snapshot sequence.

[0049] Figure 3 is the structure diagram of the gated recurrent unit.

[0050] Figure 4 is the confusion matrix comparison diagram of the present application and the LSTM algorithm, the GRU algorithm and the GAT algorithm. (a), (b), (c) and (d) correspond to LSTM, GAT, GRU and the model of the present application respectively.

[0051] Figure 5 is the comparison diagram of four performance evaluation indexes of the present application under different window sizes. DETAILED DESCRIPTION

[0052] In order to make the objects, technical solutions and advantages of the present application more clear and apparent, the following will further describe the present application in combination with the drawings.

[0053] As Figure 1As shown, the application is a malware detection method based on dynamic graph attention network, comprising the following steps:

[0054] Step (1), data preprocessing stage:

[0055] 1-1. Obtain the API call sequence of the software to be detected; remove the API call sequence to obtain the API call sequence that truly reflects the software behavior;

[0056] The de-duplication processing is to delete the same API function or the same API sequence fragment of continuous calls. After deleting these API fragments containing redundant information trying to hide the malicious intent of the code, the API call sequence that truly reflects the software behavior will be obtained.

[0057] 1-2. Remove the suffix of all API function names of the same function in the API call sequence after step 1-1 de-duplication processing, so that the function names are the same.

[0058] The system will call different functions for different encoding formats, but the tasks completed are consistent. In the system, the API with W at the end is used for UNICODE encoding, and the API with A at the end is used for ASCII encoding. Therefore, the API is classified by removing the API suffix, highlighting the association between software API and malicious behavior.

[0059] 1-3. As shown in Figure 2 , divide the API call sequence after step 1-2 processing according to the observation window to obtain T API subsequences. Specifically, a window that expands continuously is used to intercept the API call sequence. The length of the window increases each time, which is a hyperparameter and can be selected as needed.

[0060] 1-4. Convert each API subsequence in step 1-3 into an API call graph form. Among them, the API in the subsequence is the node of the API call graph, and the directed edge represents the calling relationship between the current API and other API nodes, and the number of calls is the weight of the edge. The API call graph constructed is represented as G=(N,E), where N is the set of nodes, and E is the set of edges.

[0061] 1-5. According to the API subsequence order, splice the T API call graphs obtained in step 1-4 to obtain a call graph snapshot sequence, which is used to represent the structural change process and trend of the API call graph.

[0062] Step (2): Use the graph attention network to capture the local API software malicious information.

[0063] 2-1. Use one-hot encoding as the initial feature of each API node in the snapshot sequence of step 1-5. In addition, in order to reduce the computational overhead, the initial feature is processed by dimension reduction, and the feature vector of the API node is mapped to a lower dimensional vector space by the Embedding function and recorded as where N is the number of APIs, and F is the dimension of the API.

[0064] 2-2. Initialize the shared linear transformation matrix W, where w e R F*F' , which represents the conversion of the feature matrix H from F dimensions to F' dimensions. The API nodes are converted by using the shared linear transformation matrix W, and the attention coefficient between nodes is calculated.

[0065] The calculation formula of the attention coefficient of each API node i and its neighbor node j is as follows:

[0066]

[0067] In the formula, a ij is the attention coefficient between nodes i and j, which represents the importance of the neighbor API node to the current target API node; is the initial feature vector of node i; N i is the set of all neighbor nodes of node i; || represents the concatenation operation, which concatenates vectors together; is a single-layer feedforward neural network; LeakyReLU is an activation function

[0068] 2-3. According to the attention coefficient, the information of each node is weighted and aggregated, and the result is taken as the new feature vector of the current node Further, the new feature matrix F' represents the feature dimension of the output node.

[0069]

[0070] 2-4. In order to capture the behavior features contained in the API nodes from multiple potential angles, the multi-head attention method is used to give the API nodes stronger expression ability. It mainly uses multiple independent single-head attention layers to update the node embedding by concatenation or averaging the results. The multi-head formula adopts one of the following:

[0071]

[0072]

[0073] where || represents the concatenation operation, denotes the normalized attention coefficient between node i and j computed by the kth attention mechanism, W k denotes the corresponding input linear transformation weight matrix, denotes the feature output of the K-head attention layer.

[0074] 2-5. The feature vectors of API nodes in each call graph snapshot are flattened together to get the feature vector x representing the current call graph snapshot. i , as the input of the gated recurrent neural network module. The feature representation of the sequence of graph snapshots is denoted as X = {x1, x2,..., x T}, where T denotes the number of snapshots.

[0075] Step (3): Use the gated recurrent neural network to learn the evolution process of the software call graph structure, capturing the long-term timing information of the behavior occurrence of the software.

[0076] 3-1. As shown in Figure 3 , the feature vectors X of all call graph snapshots output by the graph attention network are taken as the input of the gated recurrent neural network, and the state information of the update gate and the reset gate at the current time is calculated according to the hidden state h t-1 passed down from the last time and the input x t at the current time. The state of the update gate and the reset gate at each time can be represented as:

[0077] r t = σ(W xr x t +W hr h t-1 +b r ) (5)

[0078] z t = σ(W xz x t +W hz h t-1 +b z ) (6)

[0079] where x t denotes the tth element of the feature vector X; h t-1 denotes the hidden layer state at time t-1; r t denotes the reset gate, which controls the influence of the previous hidden layer state h t-1 on the current input x t ; z t denotes the update gate, which decides whether to ignore the current input x t ; σ is the Sigmoid activation function.

[0080] 3-2. After calculating the gating signal, a reset gate is used to control the candidate state Whether to rely on the state h of the last moment t-1 Specifically, the data after resetting is spliced or added with the input x of the current moment, and then scaled to the range of (-1, 1) through a tanh activation function to obtain hidden information representing the current moment t Specific calculation formula is as follows:

[0081]

[0082] 3-3. The update gate is used to control the degree of preservation of historical information. The closer the information size of the update gate is to 1, the more information is remembered; the closer it is to 0, the more information is forgotten. The specific calculation formula is as follows:

[0083]

[0084] Step (4): The output result of the gated recurrent neural network is input to the classifier to realize the malicious condition of the software to be tested.

[0085] The classifier calculation method is as follows:

[0086]

[0087] Where B is the bias, W s is a linear transformation weight matrix for mapping the hidden features output by the GRU into a two-dimensional output, where the first bit represents the probability that the sample is malicious software, and the second bit represents the probability that the sample is a benign sample.

[0088] Embodiment

[0089] The TGAT model for malware detection based on a dynamic graph attention network is implemented, API call sequence data of software is used as a data set, and ten thousand sequence data are taken as sample data. All sample data are divided into a training set, a validation set and a test set according to a ratio of 6:2:2. The validation set is used to prevent model overfitting by using an early stopping mechanism. In the learning stage, the environment parameters and network parameters are initialized. The environment parameters mainly include the maximum length of sequence selection and the length range selected for each snapshot. The network parameters mainly include the initial parameters in the gated recurrent neural network and the graph attention network.

[0090] The remaining steps of this embodiment are the same as the specific embodiments, and will not be described here. The implementation and implementation results of the comparative algorithm are shown as follows:

[0091] ​The TGAT model to be implemented by the application is compared with LSTM model, GRU model and GAT model. In the training process, the TGAT of the application can reach the lowest loss value and the highest accuracy in fewer iteration times. The final detection effect is evaluated by using a confusion matrix. As shown in Figure 4 TGAT model can correctly classify the proportion of benign or malicious samples, which is 96%, and has better detection performance than other models.

[0092] In addition, in order to study the influence of different window sizes on the detection performance, six window sizes of 200, 300, 500, 700, 900 and 1000 are selected respectively. The accuracy (Accuracy), precision (Precision), recall (Recall) and F1-Score four evaluation indexes are used to represent the detection performance. As shown in Figure 5 The performance of the detection changes according to the selected window size, and the performance is best when the window size is set to 900 length units.

Claims

1. A method of malware detection based on dynamic graph attention networks, characterized in that The method comprises the following steps: Step (1), a data preprocessing stage: 1-1 obtaining an API calling sequence of the software to be detected; performing a de-duplication processing on the API calling sequence to obtain an API calling sequence that truly reflects the behavior of the software; 1-2 removing the suffixes of all API function names of the same function in the API calling sequence after the de-duplication processing in step 1-1, so that the function names are the same; 1-3 dividing the API calling sequence after the processing in step 1-2 according to an observation window to obtain T API subsequences; 1-4 converting each API subsequence in step 1-3 into an API calling graph form; wherein the APIs in the subsequence are nodes of the API calling graph, and a directed edge represents the calling relationship between the current API and other API nodes, and the number of calls is the weight of the edge; the API calling graph constructed is represented as G=(N, E), wherein N is a set of nodes, and E is a set of edges; 1-5 splicing the T API calling graphs obtained in step 1-4 according to the API subsequence order to obtain a calling graph snapshot sequence, which is used to represent the structural change process and trend of the API calling graph; Step (2), capturing the malicious information between local APIs using a graph attention network; 2-1 Use one-hot encoding for each API node in the snapshot sequence of Step 1-5 as its initial feature vector; map the feature vector of an API node into a lower dimensional vector space by the Embedding function and denote it as where N is the number of APIs and F is the dimension of an API. 2-2 Initialize the shared linear transformation matrix W, where W ∈ R F*F' , which represents the conversion of the feature matrix H from F dimensions to F' dimensions; the API nodes are converted using the shared linear transformation matrix W, and the inter-node attention coefficients are calculated simultaneously; The calculation formula of the attention coefficient of each API node i and its neighbor node j is as follows: where, is the attention coefficient between node i and node j, representing the importance of the neighbor API node to the current target API node; is the initial feature vector of node i; N i is the set of all neighbor nodes of node i; || represents the concatenation operation, concatenating vectors together; is a single-layer feedforward neural network; LeakyReLU is an activation function 2-3 Weighted aggregation of each node information according to the attention coefficient, and the result is taken as the new feature vector of the current node Further obtain the new feature matrix F' represents the feature dimension of the output node; 2-4 using multiple independent single-head attention layers to update the embedding of the node by splicing or averaging the results; the multi-head formula uses formula (3) or formula (4): wherein || denotes a concatenation operation, denotes the normalized attention coefficient between nodes i and j calculated by the kth attention mechanism, W k denotes the corresponding input linear variation weight matrix, denotes the feature output of the K-head attention layer; 2-5 Feature vectors of API nodes in each call graph snapshot Flattening the series together, we get the feature vector x representing the current call graph snapshot i as input to the gated recurrent neural network module; the feature representation of the sequence of graph snapshots is denoted as X = {x1, x2,..., x T T, where T denotes the number of snapshots; Step (3), learning the evolution process of the software calling graph structure using a gated recurrent neural network to capture long-term timing information of the behavior of the software; 3-1 Take all the feature vectors X of the call graph snapshots output by the graph attention network as the input of the gated recurrent neural network, and calculate the state information of the update gate and the reset gate according to the hidden state h t-1 and the input x t of the current moment; the state of the update gate and the reset gate at each moment is represented as: r t = σ(W xr x t + W hr h t-1 + b r ) (5) z t = σ(W xz x t + W hz h t-1 + b z ) (6) where x t represents the t-th element of the feature vector X; h t-1 represents the hidden layer state at time t-1; r t represents the reset gate, which controls the influence of the previous hidden layer state h t-1 on the current input x t ; z t represents the update gate, which decides whether to ignore the current input x t ; and σ is the Sigmoid activation function. 3-2 After calculating the gating signal, a reset gate is used to control the candidate state Whether it depends on the state h of the last moment t-1 ; Specifically, the data after resetting is spliced or added with the input x of the current moment t , and then scaled to the range of (-1, 1) through a tanh activation function to obtain the hidden information representing the current moment The calculation formula is as follows: 3-3 using an update gate to control the retention degree of historical information; the specific calculation formula is as follows: Step (4), inputting the output result of the gated recurrent neural network into a classifier to realize the malicious condition of the software to be detected.

2. The method of claim 1, wherein The de-duplication processing in step 1-1 is to delete the same API function or the same API sequence fragment in continuous calling, and after deleting the API fragment containing redundant information and trying to hide the malicious intention of the code, the API calling sequence that truly reflects the behavior of the software is obtained.

3. The method of claim 1, wherein Step 1-3 specifically uses a window that is continuously expanded to intercept the API calling sequence, and the length of the window is increased by a hyperparameter each time.

4. The method of claim 1, wherein The calculation method of the classifier in step (4) is as follows: where B is a bias, W s is a linear transformation weight matrix.

5. An electronic device, comprising: The processor and the memory, the memory stores machine executable instructions that can be executed by the processor, and the processor executes the machine executable instructions to realize the method of any one of claims 1-4.

6. A machine-readable storage medium, characterized in that, The machine readable storage medium stores machine executable instructions, when the machine executable instructions are called and executed by the processor, the machine executable instructions cause the processor to realize the method of any one of claims 1-4.

Images