Malware processing method and device, electronic equipment and storage medium
By generating control flow graphs and utilizing multilayer graph neural networks and fully connected networks for malware detection, the problem of easily tampered features is solved, improving the accuracy and correctness of detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- AGRICULTURAL BANK OF CHINA
- Filing Date
- 2022-11-25
- Publication Date
- 2026-07-21
AI Technical Summary
In existing malware detection methods, the extracted software features are easily modified, resulting in low detection accuracy and high error rate.
By generating the control flow graph of the software under test, initializing the node feature vectors, updating the feature matrix using a multi-layer graph neural network, calculating the global graph vector, and using a multi-layer fully connected network for prediction, it is determined whether the software is malicious software.
It improves the accuracy of malware detection, reduces the error handling rate, and enhances the correctness of software processing.
Smart Images
Figure CN115935348B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer network security technology, and in particular to a method, apparatus, electronic device and storage medium for handling malware. Background Technology
[0002] With the continuous development of software engineering technology, the types and numbers of malware have also increased rapidly, making malware one of the most serious threats in cyberspace today. To effectively detect malware, there are currently two main methods: static analysis and dynamic analysis. Static analysis extracts static features from the software under test to determine if it is malware, while dynamic analysis analyzes the behavioral data generated by the software during its operation in the system. Because dynamic analysis consumes a significant amount of computational resources, static analysis has certain advantages over dynamic analysis.
[0003] Traditional static analysis methods, such as signature-based detection, determine whether the software under test is malware by checking if its signature exists in a malware signature database. However, this method has the limitation of only detecting known malware. Recently, with the continuous development of machine learning, especially deep learning, and in order to detect unknown malware, researchers have begun to utilize models in this field to detect malware. These methods typically first extract various features from the software under test (including string information, function calls, byte sequences, grayscale images, etc.), and then use various models to detect malware.
[0004] However, the detection methods for this type of malware also have limitations. When these detection methods extract software features, the extracted features are easily modified, making it easy to bypass the detection and obtain incorrect detection results, which in turn leads to a high error rate in software processing. Summary of the Invention
[0005] This application provides a method, apparatus, electronic device, and storage medium for processing malware, in order to solve the technical problem that existing malware detection methods have low detection accuracy due to the ease with which the extracted software features can be tampered with, resulting in a high error rate in software processing.
[0006] According to a first aspect of this application, a method for handling malware is provided, comprising:
[0007] Obtain the executable file of the software under test and generate the control flow graph of the executable file;
[0008] Initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph;
[0009] Based on the initial feature matrix of the control flow graph, generate the global graph vector of the control flow graph;
[0010] The software under test corresponding to the global graph vector of the control flow graph is predicted to obtain a prediction result of whether the software under test is malware.
[0011] Based on the prediction results, corresponding processing is performed on the software under test.
[0012] Optionally, generating the global graph vector of the control flow graph based on the initial feature matrix of the control flow graph includes:
[0013] The initial feature matrix of the control flow graph is updated using a preset multi-layer graph neural network to obtain an updated feature matrix;
[0014] The global graph vector of the control flow graph is calculated based on the updated feature matrix.
[0015] Optionally, updating the initial feature matrix of the control flow graph using a preset multi-layer graph neural network to obtain an updated feature matrix includes:
[0016] Obtain the adjacency matrix of the control flow graph, and calculate the normalized Laplace matrix based on the adjacency matrix of the control flow graph;
[0017] The initial feature matrix of the control flow graph is input into the preset multilayer graph neural network, so that the preset multilayer graph neural network updates the initial feature matrix of the control flow graph based on the normalized Laplacian matrix and outputs the updated feature matrix.
[0018] Optionally, calculating the global graph vector of the control flow graph based on the updated feature matrix includes:
[0019] The feature vector of each node in the updated feature matrix is linearly transformed to obtain the linearly transformed feature vector of each node.
[0020] Max pooling is performed on the feature vectors of all nodes after linear transformation to obtain a global pooling vector, and the global pooling vector is determined as the global graph vector of the control flow graph.
[0021] Optionally, the control flow graph for generating the executable file includes:
[0022] The executable file is disassembled to obtain the assembly code of the software under test;
[0023] The assembly code of the software under test is divided into basic blocks, and the control flow graph of the executable file is constructed using the basic blocks as nodes.
[0024] Optionally, the feature vectors of each node in the control flow graph are initialized to obtain the initial feature matrix of the control flow graph, including:
[0025] For each node in the control flow graph, the numerical characteristics of each type of assembly code contained in the node are statistically analyzed, and the feature vector of the node is determined based on the numerical characteristics of each type of assembly code contained in the node.
[0026] The feature vectors of all nodes in the control flow graph are merged into the initial feature matrix of the control flow graph.
[0027] Optionally, the software under test corresponding to the global graph vector of the control flow graph is predicted to obtain a prediction result on whether the software under test is malware, including:
[0028] Using a pre-defined multi-layer fully connected network, the global graph vector of the control flow graph is transformed into a one-dimensional graph vector;
[0029] Using a preset activation function, a predicted probability value corresponding to the one-dimensional graph vector is output; wherein, the predicted probability value is used to reflect the probability that the software under test is malicious software;
[0030] Based on the comparison between the predicted probability value and the preset threshold, the prediction result of whether the software under test is malicious software is determined.
[0031] According to a second aspect of this application, a malware processing apparatus is provided, comprising:
[0032] The acquisition and generation module is used to acquire the executable file of the software under test and generate the control flow graph of the executable file;
[0033] An initialization module is used to initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph.
[0034] A generation module is used to generate a global graph vector of the control flow graph based on the initial feature matrix of the control flow graph.
[0035] The prediction module is used to predict the software under test corresponding to the global graph vector of the control flow graph, and obtain a prediction result of whether the software under test is malicious software.
[0036] The processing module is used to perform corresponding processing on the software under test based on the prediction results.
[0037] According to a third aspect of this application, an electronic device is provided, comprising: at least one processor and a memory;
[0038] The memory stores computer-executed instructions;
[0039] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the malware processing method as described in the first aspect above.
[0040] According to a fourth aspect of this application, a computer-readable storage medium is provided, wherein computer-executable instructions are stored therein, which, when executed by a processor, are used to implement the malware processing method described in the first aspect above.
[0041] According to a fifth aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the malware processing method described in the first aspect.
[0042] This application provides a method for handling malware, which involves obtaining the executable file of the software under test and generating a control flow graph of the executable file; initializing the feature vectors of each node in the control flow graph to obtain an initial feature matrix of the control flow graph; generating a global graph vector of the control flow graph based on the initial feature matrix of the control flow graph; predicting the software under test corresponding to the global graph vector of the control flow graph to obtain a prediction result of whether the software under test is malware; and performing corresponding processing on the software under test based on the prediction result.
[0043] This application uses the global graph vector of the control flow graph to represent the structured information of the software under test. Since the control flow graph itself has the advantage of being difficult to tamper with, the structured information is not easily bypassed when predicting the software under test based on the global graph vector of the control flow graph, and accurate prediction results can be obtained, thereby improving the accuracy of processing the software under test.
[0044] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description
[0045] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0046] Figure 1 A flowchart illustrating a malware processing method provided in an embodiment of this application;
[0047] Figure 2Provided for the embodiments of this application Figure 1 Flowchart of S101;
[0048] Figure 3 Provided for the embodiments of this application Figure 1 Flowchart of S102 in China;
[0049] Figure 4 Provided for the embodiments of this application Figure 1 Flowchart of S103;
[0050] Figure 5 Provided for the embodiments of this application Figure 1 Flowchart of S104 in China;
[0051] Figure 6 This is a schematic diagram of the structure of a malware processing device provided in an embodiment of this application;
[0052] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.
[0053] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0054] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application.
[0055] Traditional static analysis methods, such as signature-based detection, determine whether the software under test is malware by checking if its signature exists in a malware signature database. However, this method has the limitation of only detecting known malware. Recently, with the continuous development of machine learning, especially deep learning, and in order to detect unknown malware, researchers have begun to utilize models in this field to detect malware. These methods typically first extract various features from the software under test (including string information, function calls, byte sequences, grayscale images, etc.), and then use various models to detect malware.
[0056] However, the detection methods for this type of malware also have limitations. When these detection methods extract software features, the extracted features are easily modified, making it easy to bypass the detection and obtain incorrect detection results, which in turn leads to a high error rate in software processing.
[0057] To address the aforementioned technical problems, the overall inventive concept of this application is to provide a method for improving the prediction accuracy of malware and thus improving the processing accuracy in the field of computer network security technology.
[0058] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.
[0059] Figure 1 This is a flowchart illustrating a malware processing method provided in an embodiment of this application. Figure 1 As shown, the method of this embodiment includes the following steps S101 to S105, wherein:
[0060] S101: Obtain the executable file of the software under test and generate the control flow graph of the executable file.
[0061] It should be understood that the software under test may be malicious or non-malicious. Malicious software refers to software that is forcibly installed and run on a user's computer or other terminal without explicit notification or permission, thereby infringing upon the user's legitimate rights and interests. This is a concept distinct from computer viruses. Non-malicious software is also known as normal software or benign software. Executable files may refer to binary files. The control flow graph process for generating executable files in this application embodiment is shown in S201 to S202 below, and will not be repeated here.
[0062] In this embodiment, the software under test is denoted as R, and the control flow graph of the executable file of the software under test is denoted as G. R .
[0063] S102: Initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph.
[0064] According to the embodiments of this application, the feature vector of the corresponding node can be initialized according to the assembly code of each node in the control flow graph. The specific initialization process is shown in S301 to S302 below.
[0065] S103: Generate the global graph vector of the control flow graph based on the initial feature matrix of the control flow graph.
[0066] It should be understood that the global graph vectors of the control flow graph belong to graph-structured data. To improve prediction efficiency, this embodiment can introduce a graph neural network in S103 to learn the rich semantic and structural information in the software under test. This graph neural network refers to an algorithm that uses a neural network to learn graph-structured data and extract and mine features from it. Optionally, this graph neural network can refer to a preset multi-layer graph neural network. The application process of this preset multi-layer graph neural network is described in S4011-S4012 below, and will not be repeated here. This embodiment can also introduce a max-pooling network in S103. The application of this max-pooling network is described in S4021-S4022 below, and will not be repeated here.
[0067] S104: Predict the software under test corresponding to the global graph vector of the control flow graph to obtain the prediction result of whether the software under test is malicious software.
[0068] In this application embodiment, in order to improve prediction efficiency, a network model can be used for prediction, such as a multi-layer fully connected network.
[0069] S105: Based on the prediction results, perform corresponding processing on the software to be tested.
[0070] The above prediction results can determine whether the software under test is malicious or non-malicious, and different processing is performed for malicious and non-malicious software. Therefore, based on the improved accuracy of the prediction results, the embodiments of this application can also improve the accuracy of processing the software under test.
[0071] This application uses the global graph vector of the control flow graph to represent the structured information of the software under test. Since the control flow graph itself has the advantage of not being easily tampered with by attackers, the structured information in the software under test is considered when extracting features. This structured information is not easily tampered with. Therefore, based on the global graph vector of the control flow graph, it is not easy to bypass when predicting the software under test, and accurate prediction results can be obtained, thereby improving the accuracy of processing the software under test.
[0072] In one possible implementation, S105: Based on the prediction result, perform corresponding processing on the software under test, including the following two cases: First case: When the prediction result is that the software under test is malicious software, output a first prompt message and / or uninstall the software under test; Second case: When the prediction result is that the software under test is non-malicious software, output a second prompt message; wherein, the content of the second prompt message is different from the content of the first prompt message.
[0073] It should be understood that the first prompt message may indicate to the user that the test software is malicious software, or it may indicate to the user that the malicious software should be uninstalled. The second prompt message may indicate to the user that the test software is security software. If the prediction result indicates that the software under test is malicious software, this application embodiment can directly delete the test software without user confirmation. The specific processing flow can be adaptively modified according to user needs, and this application embodiment does not specifically limit the specific steps of the processing flow.
[0074] By providing different prompts and by uninstalling software identified as malware, the security of data on the system can be improved.
[0075] Based on the above embodiments, the technical solution of this application will be described in more detail below with reference to several specific embodiments.
[0076] Figure 2 Provided for the embodiments of this application Figure 1 A flowchart of S101. Figure 1 Based on the illustrated embodiment, this embodiment focuses on Figure 1 S101 in the text is further refined. For example... Figure 2 As shown, in S101, the control flow graph for generating the executable file is generated, including the following steps S201 to S202, wherein:
[0077] S201: Disassemble the executable file to obtain the assembly code of the software under test.
[0078] It should be understood that the executable file can be disassembled using a disassembler tool, which may be an interactive disassembler professional version or other types of disassemblers, without specific limitations here.
[0079] S202: Divide the assembly code of the software under test into basic blocks, and construct the control flow graph of the executable file using the basic blocks as nodes.
[0080] In this embodiment, the purpose of disassembly is to obtain the assembly code of the software under test. Then, using the structural information of the assembly code (including basic blocks and the calling relationships between basic blocks), a control flow graph of the executable file is constructed. Basic blocks are the nodes of the control flow graph, and the calling relationships between basic blocks are the edges of the control flow graph. The control flow graph can be represented as G. R = (V, E), with node v k ∈V, k=1,2,…,N,k∈N, N is the total number of nodes in the control flow graph; the number of edges is e. k1，k2 =(vk1 ,v k2 V ∈ E, where V is the set of all nodes and E is the set of all edges.
[0081] Steps S201 to S202 provide data support for providing structured information about the software under test. However, due to the node v in the control flow graph of the executable file generated in S202... k ∈V contains a sequence of assembly instructions, so it cannot be directly input into the preset multilayer graph neural network in S103. Therefore, in this embodiment, the feature vectors of each node in the control flow graph can be initialized according to the assembly code of each node in the control flow graph. Figure 3 Provided for the embodiments of this application Figure 1 A flowchart of process S102. Figure 1 Based on the illustrated embodiment, this embodiment focuses on Figure 1 S102 in the text is further refined. For example... Figure 3 As shown, S102 includes the following steps S301 to S302, wherein:
[0082] S301: For each node in the control flow graph, statistically analyze the numerical characteristics of the assembly code of each type contained in the node, and determine the feature vector of the node based on the numerical characteristics of the assembly code of each type contained in the node.
[0083] It should be understood that assembly code, or assembly instructions, can be used to initialize the control flow graph G by statistically analyzing the numerical characteristics of the various types of assembly code contained in the nodes. R Each node v k The eigenvectors of ∈V, where the eigenvectors of the nodes are... (k = 1, ..., N), where R is the set of real numbers and d represents the dimension, which is used to reflect the total number of types of assembly code that have appeared in the control flow graph.
[0084] In the control flow graph represented as G R Based on (V,E), for node v k ∈V, we can statistically analyze the numerical characteristics of the various types of assembly code contained in that node. For example, when node v k If the assembly code in a node contains 2 logical instructions and 3 comparison instructions, and other nodes do not involve other types of assembly code, then d = 2.
[0085] S302: Merge the feature vectors of all nodes in the control flow graph into the initial feature matrix of the control flow graph.
[0086] In this embodiment of the application, after the feature vectors of all nodes are determined, they can be merged into an initial feature matrix of the control flow graph, i.e.
[0087] By executing S301 to S302, the embodiments of this application can ensure that the initial feature matrix of the control flow graph can be used as input data for the preset multi-layer graph neural network in S103, thereby providing data support for the preset multi-layer graph neural network to update the feature matrix.
[0088] Figure 4 Provided for the embodiments of this application Figure 1 A flowchart of process S103. Figure 1 Based on the illustrated embodiment, this embodiment focuses on Figure 1 S103 in the text is further refined. For example... Figure 4 As shown, S103 includes the following steps S401 to S402, wherein:
[0089] S401: The initial feature matrix of the control flow graph is updated using a preset multi-layer graph neural network to obtain the updated feature matrix.
[0090] It should be understood that the updated feature matrix contains the updated feature vectors of all nodes in the control flow graph. The update process is described in S4011-S4012 below and will not be repeated here. The purpose of the preset multilayer graph neural network is based on the initial feature matrix of the control flow graph. By learning the rich semantic and structural information in the corresponding software under test, the updated feature matrix H of the (T-1)th layer is obtained. (T-1) , where T is the number of layers in the preset multi-layer graph neural network.
[0091] S402: Calculate the global graph vector of the control flow graph based on the updated feature matrix.
[0092] It should be understood that the entire calculation process is described in S4021 to S4022 below, and will not be repeated here. S402 can achieve the purpose of using the global graph vector of the control flow graph to characterize the entire software under test.
[0093] By executing S401 to S402, the embodiments of this application can learn rich semantic and structural information in the software under test, and use the global graph vector of the control flow graph to represent the entire software under test, thereby providing data support for obtaining accurate prediction results in the future.
[0094] In one possible implementation, S401: The initial feature matrix of the control flow graph is updated using a preset multilayer graph neural network to obtain an updated feature matrix, including the following steps S4011 to S4012, wherein:
[0095] S4011: Obtain the adjacency matrix of the control flow graph and calculate the normalized Laplace matrix based on the adjacency matrix of the control flow graph.
[0096] In this embodiment of the application, the adjacency matrix is denoted as A, and the normalized Laplace matrix is denoted as... in, Let I be the degree matrix, and let I be the identity matrix.
[0097] S4012: Input the initial feature matrix of the control flow graph into a preset multilayer graph neural network, so that the preset multilayer graph neural network updates the initial feature matrix of the control flow graph based on the normalized Laplacian matrix and outputs the updated feature matrix.
[0098] When updating embodiments of this application, the following formula can be used:
[0099]
[0100] Among them, H (T-1) W is the feature matrix updated at layer T-1. (T-1) represents the training parameters of the graph convolutional neural network at layer T-1, where ReLU is the linear rectified activation function.
[0101] In this embodiment, the malware processing method based on multi-layer graph neural networks can further improve the detection efficiency of malware in steps S4011 to S4012. Compared with the initial feature matrix, the updated feature matrix has learned rich semantic and structural information of the corresponding software under test, providing a foundation for subsequent accurate prediction.
[0102] To learn a global graph vector to represent the entire software under test, embodiments of this application employ a max pooling network to update the feature matrix H of the software under test. (T-1) Learn a corresponding global graph vector in the middle In one possible implementation, S402: Calculate the global graph vector of the control flow graph based on the updated feature matrix, including the following steps S4021 to S4022, wherein:
[0103] S4021: Perform a linear transformation on the eigenvector of each node in the updated eigenma matrix to obtain the linearly transformed eigenvector of each node.
[0104] The updated feature matrix is The eigenvector of each node in the updated feature matrix is h. k (T-1) In this embodiment of the application, a fully connected layer (FC) network can be used to manage all h... k (T-1) Perform a linear transformation to obtain the feature vectors of all nodes after the linear transformation.
[0105] S4022: Perform max pooling on the feature vectors of all nodes after linear transformation to obtain the global pooling vector, and determine the global pooling vector as the global graph vector of the control flow graph.
[0106] In this embodiment, after MaxPooling, the global pooling vector corresponding to the linearly transformed feature vectors of all nodes is used as the global graph vector. The specific formula used is as follows:
[0107]
[0108] Where FC represents a fully connected layer, MaxPooling represents maximum pooling, and d′ is the dimension of the global graph vector, the value of which depends on the output dimension of the fully connected layer.
[0109] Through the linear transformation in S4021 and the maximum pooling operation in S4022, the embodiments of this application can characterize the entire software under test through global graph vectors, thereby providing data support for rapid prediction in the later stage.
[0110] In order to predict the probability that the software under test is malicious, this application embodiment introduces a multi-layer fully connected network. Figure 5 Provided for the embodiments of this application Figure 1 A flowchart of process S104. Figure 1 Based on the illustrated embodiment, this embodiment focuses on Figure 1 S104 in the text is further refined. For example... Figure 5 As shown, S104: Predict the software under test corresponding to the global graph vector of the control flow graph to obtain the prediction result of whether the software under test is malicious software, including the following steps S501 to S503, wherein:
[0111] S501: Using a pre-defined multi-layer fully connected network, the global graph vector of the control flow graph is transformed into a one-dimensional graph vector.
[0112] S502: Using a preset activation function, output the predicted probability value corresponding to the one-dimensional graph vector. The predicted probability value reflects the probability that the software under test is malicious software.
[0113] In this embodiment, the activation function can be the Sigmoid function. The Sigmoid function can restrict a 1-dimensional graph vector to the range [0,1], and the output value is used as the prediction probability value. The prediction formula is as follows:
[0114]
[0115] Among them, FC M It is the Mth layer fully connected network in a multilayer fully connected network, and FCM The output dimension is 1.
[0116] S503: Based on the comparison between the predicted probability value and the preset threshold, determine the prediction result of whether the software under test is malicious software.
[0117]
[0118] Among them, P R The predicted probability value is Δ, which is a preset threshold. It can be a threshold obtained through a binary classification detection model or an adaptive threshold set by human experience.
[0119] In summary, to determine whether the software under test is malware, we can first use a multi-layer fully connected network to predict the probability that it is malware (i.e., the predicted probability value mentioned above), and then make a judgment based on this probability and a preset threshold.
[0120] It should be noted that the network in any of the above embodiments can be replaced with other types of networks in deep learning technology as needed, including Support Vector Machine (SVM), Multi-layer Neural Network (MLP), Convolutional Neural Network (CNN), Recurrent Neural Network (RNN), Long Short-Term Memory (LSTM), etc.
[0121] This application embodiment improves the detection efficiency of malicious software while enhancing the accuracy of malicious detection through a multi-layer fully connected network.
[0122] Figure 6 This is a schematic diagram of a malware processing device provided in an embodiment of this application. The device in this embodiment can be in the form of software and / or hardware. Figure 6 As shown, the malware processing device provided in this embodiment includes: an acquisition and generation module 61, an initialization module 62, a generation module 63, a prediction module 64, and a processing module 65. Wherein:
[0123] The acquisition and generation module 61 is used to acquire the executable file of the software under test and generate the control flow graph of the executable file.
[0124] Initialization module 62 is used to initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph.
[0125] The generation module 63 is used to generate a global graph vector of the control flow graph based on the initial feature matrix of the control flow graph.
[0126] The prediction module 64 is used to predict the software under test corresponding to the global graph vector of the control flow graph, and obtain the prediction result of whether the software under test is malicious software.
[0127] The processing module 65 is used to perform corresponding processing on the software to be tested based on the prediction results.
[0128] In one possible implementation, the generation module 63 is further used for:
[0129] The initial feature matrix of the control flow graph is updated using a pre-defined multi-layer graph neural network to obtain the updated feature matrix.
[0130] Calculate the global graph vector of the control flow graph based on the updated feature matrix.
[0131] In one possible implementation, the generation module 63 is further used for:
[0132] Obtain the adjacency matrix of the control flow graph, and calculate the normalized Laplace matrix based on the adjacency matrix of the control flow graph.
[0133] The initial feature matrix of the control flow graph is input into a preset multilayer graph neural network, so that the preset multilayer graph neural network updates the initial feature matrix of the control flow graph based on the normalized Laplacian matrix and outputs the updated feature matrix.
[0134] In one possible implementation, the generation module 63 is further used for:
[0135] The eigenvectors of each node in the updated eigenma matrix are linearly transformed to obtain the linearly transformed eigenvectors of each node.
[0136] Max pooling is performed on the feature vectors of all nodes after linear transformation to obtain the global pooling vector, and the global pooling vector is determined as the global graph vector of the control flow graph.
[0137] In one possible implementation, the generation module 61 is further used for:
[0138] The executable file is disassembled to obtain the assembly code of the software under test.
[0139] The assembly code of the software under test is divided into basic blocks, and the control flow graph of the executable file is constructed using the basic blocks as nodes.
[0140] In one possible implementation, initialization module 62 is also used for:
[0141] For each node in the control flow graph, the numerical characteristics of the assembly code of each type contained in the node are statistically analyzed, and the feature vector of the node is determined based on the numerical characteristics of the assembly code of each type contained in the node.
[0142] The eigenvectors of all nodes in the control flow graph are merged into the initial eigenma matrix of the control flow graph.
[0143] In one possible implementation, the prediction module 64 is also used for:
[0144] By using a pre-defined multi-layer fully connected network, the global graph vector of the control flow graph is transformed into a one-dimensional graph vector.
[0145] Using a preset activation function, the system outputs a predicted probability value corresponding to a one-dimensional graph vector. This predicted probability value reflects the probability that the software under test is malware.
[0146] Based on the comparison between the predicted probability value and the preset threshold, the prediction result determines whether the software under test is malicious software.
[0147] The malware processing device provided in this embodiment can be used to execute the malware processing method provided in any of the above method embodiments. Its implementation principle and technical effect are similar, and will not be described in detail here.
[0148] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0149] According to embodiments of this application, this application also provides an electronic device and a readable storage medium.
[0150] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device includes a receiver 70, a transmitter 71, at least one processor 72, and a memory 73. The electronic device composed of the above components can be used to implement the above-described specific embodiments of this application, which will not be described in detail here.
[0151] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the methods described above.
[0152] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the various steps in the methods described above.
[0153] Various embodiments of the systems and technologies described above in this application can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0154] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or electronic device.
[0155] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be a machine-readable signal medium or a machine-readable storage medium. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0156] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0157] The systems and technologies described herein can be implemented in computing systems that include back-end components (e.g., as data electronic devices), or computing systems that include middleware components (e.g., application electronic devices), or computing systems that include front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and technologies described herein), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.
[0158] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.
[0159] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the principles of this application should be included within the scope of protection of this application.
Claims
1. A method for handling malware, characterized in that, include: Obtain the executable file of the software under test and generate the control flow graph of the executable file; Initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph; Obtain the adjacency matrix of the control flow graph, and calculate the normalized Laplacian matrix based on the adjacency matrix of the control flow graph; input the initial feature matrix of the control flow graph into a preset multilayer graph neural network, so that the preset multilayer graph neural network updates the initial feature matrix of the control flow graph based on the normalized Laplacian matrix, and outputs the updated feature matrix; calculate the global graph vector of the control flow graph based on the updated feature matrix. The software under test corresponding to the global graph vector of the control flow graph is predicted to obtain a prediction result of whether the software under test is malware. Based on the prediction results, corresponding processing is performed on the software under test.
2. The method according to claim 1, characterized in that, The step of calculating the global graph vector of the control flow graph based on the updated feature matrix includes: The feature vector of each node in the updated feature matrix is linearly transformed to obtain the linearly transformed feature vector of each node. Max pooling is performed on the feature vectors of all nodes after linear transformation to obtain a global pooling vector, and the global pooling vector is determined as the global graph vector of the control flow graph.
3. The method according to claim 1, characterized in that, The control flow graph for generating the executable file includes: The executable file is disassembled to obtain the assembly code of the software under test; The assembly code of the software under test is divided into basic blocks, and the control flow graph of the executable file is constructed using the basic blocks as nodes.
4. The method according to claim 1, characterized in that, Initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph, including: For each node in the control flow graph, the numerical characteristics of each type of assembly code contained in the node are statistically analyzed, and the feature vector of the node is determined based on the numerical characteristics of each type of assembly code contained in the node. The feature vectors of all nodes in the control flow graph are merged into the initial feature matrix of the control flow graph.
5. The method according to claim 1, characterized in that, Predicting whether the software under test is malware by analyzing the global graph vectors of the control flow graph includes: Using a pre-defined multi-layer fully connected network, the global graph vector of the control flow graph is transformed into a one-dimensional graph vector; Using a preset activation function, a predicted probability value corresponding to the one-dimensional graph vector is output; wherein, the predicted probability value is used to reflect the probability that the software under test is malicious software; Based on the comparison between the predicted probability value and the preset threshold, the prediction result of whether the software under test is malicious software is determined.
6. A malware processing device, characterized in that, include: The acquisition and generation module is used to acquire the executable file of the software under test and generate the control flow graph of the executable file; An initialization module is used to initialize the feature vectors of each node in the control flow graph to obtain the initial feature matrix of the control flow graph. A generation module is used to obtain the adjacency matrix of the control flow graph and calculate the normalized Laplacian matrix based on the adjacency matrix of the control flow graph; input the initial feature matrix of the control flow graph into a preset multilayer graph neural network, so that the preset multilayer graph neural network updates the initial feature matrix of the control flow graph based on the normalized Laplacian matrix and outputs the updated feature matrix; and calculate the global graph vector of the control flow graph based on the updated feature matrix. The prediction module is used to predict the software under test corresponding to the global graph vector of the control flow graph, and obtain a prediction result of whether the software under test is malicious software. The processing module is used to perform corresponding processing on the software under test based on the prediction results.
7. An electronic device, characterized in that, include: At least one processor and memory; The memory stores computer-executed instructions; The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the malware processing method as described in any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the malware processing method as described in any one of claims 1 to 5.