Malware detection method based on multi-perspective fusion of API call sequence behaviors

Abstract

A malware detection method based on multi-view fusion of API call sequence behavior is proposed. In the offline stage, API relationship graphs and API cluster multi-order transition matrices are generated based on the API call sequences of the software under test as training samples. An existence feature vector is extracted from the API relationship graph and a transition feature vector is extracted from the API cluster multi-order transition matrix using a graph convolutional contrastive network model. The loss function is calculated based on the classification results of a classifier, and the model is optimized using a backpropagation algorithm, thus enabling multi-view fusion malware detection in the online stage. This proposed method fuses the API existence and API transition features of the software for malware detection and classification, achieving good classification performance in real-world scenarios.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically a malware detection method based on multi-perspective fusion of API call sequence behavior. Background Technology

[0002] Malware is any program designed to damage a computer or consume its resources. Once inside a computer, it uses executable code, scripts, or other methods to harm the target computer's network. Application Programming Interface (API) calls are a typical dynamic feature, and malware detection methods based on API calls can effectively detect and classify malware.

[0003] Existing deep learning-based malware detection methods primarily use recurrent neural networks (RNNs) to classify API call sequences. These methods typically require truncating excessively long API sequences, leading to the loss of API call information and poor performance when learning complex, long sequences. RNNs require large amounts of labeled data for training and are highly dependent on data balance; therefore, they perform poorly on imbalanced datasets with extremely uneven sample sizes across classes and are also unable to handle semi-supervised training scenarios with scarce labels. Summary of the Invention

[0004] This invention addresses the shortcomings of existing malware detection technologies that rely on static features, which are easily deceived by encryption, encapsulation, and packing techniques and cannot capture deeper behavioral characteristics of malware, resulting in a high false positive rate. It proposes a malware detection method based on multi-perspective fusion of API call sequence behavior, which integrates the existence and transfer features of the software's API for malware detection and classification, achieving good classification performance in real-world scenarios.

[0005] This invention is achieved through the following technical solution:

[0006] This invention relates to a malware detection method based on multi-view fusion of API call sequence behavior. In the offline stage, an API relationship graph based on node mutual information (PMI) and an API relationship graph based on embedding vector similarity are generated as training samples according to the API call sequence of the software under test. Existence feature vectors are extracted from the API relationship graphs and transition feature vectors are extracted from the multi-order transition matrix of API clusters. The total loss function is calculated based on the classification results of the classifier and the model is optimized by backpropagation algorithm, thereby performing multi-view fusion malware detection in the online stage.

[0007] The API call sequence mentioned refers to: the software under test s i API call sequence in: It is a collection of q APIs in the operating system.

[0008] The API relationship graph uses APIs as nodes, constructs edges based on the relationships between APIs, and calculates edge weights. It includes API relationship graphs based on node mutual information (PMI) and API relationship graphs based on embedding vector similarity.

[0009] The PMI-based API relationship graph is constructed as follows: Edge weights between APIs are defined based on node mutual information, and API nodes are associated with each other. i a j Edge weights between Among them: #W(a i ,a j ) is containing a i and a j The number of sliding windows, #W(a i ) is containing a i The number of sliding windows, where #W is the total number of sliding windows. A sliding window is based on a two-pointer approach, where the elements pointed to by the two pointers form a window. A fixed-length scan sequence is used to record the occurrences of elements within the window. The API relationship graph G is based on PMI. PMI adjacency matrix

[0010] The API relationship graph based on embedding vector similarity is constructed as follows: edges between APIs are built based on the cosine similarity of API embeddings, and API node pairs a i a j The edge weights between Sim(a) i ,a j = CosineSimilarity(emb i ,emb j ), where: emb i It is a i Based on the API embedding vector obtained from word2vec, Sim(a i ,a j ) is a i With a j Cosine similarity between API embedding vectors; API relationship graph G based on embedding vector similarity Emb adjacency matrix

[0011] The extraction of existence feature vectors from the API relationship graph specifically includes:

[0012] Step 1) Use a graph convolutional contrastive network model to obtain the existence feature vectors in the API relationship graph based on node mutual information (PMI) and the API relationship graph based on embedding vector similarity. and in: It is the weight matrix of the graph convolutional network. and It is a normalized adjacency matrix. I is the identity matrix, and X is the initial feature matrix of the node;

[0013] Step 2) Construct a positive sample set P based on a mixed positive sample strategy. i With the negative sample set N i For each software's API call sequence, calculate its cosine similarity to the TF-IDF vectors of other software's API call sequences. Select the k most similar pairs to form k positive sample pairs. Then, fine-tune the positive samples based on label information. If two software programs have the same label, they are considered positive samples. If a positive sample pair has different labels, remove it from the positive sample set. The resulting positive sample set for software i is P. i The remaining software in the same batch as i that are not positive samples are negative samples N. i ;

[0014] Step 3) Calculate the API existence feature contrast loss function L E First, z PMI With z Emb The loss function is calculated by mapping the two multilayer perceptrons to the space where they are computed. Then, a mixed positive sample selection strategy is used to determine the positive sample set P. i With the negative sample set N i Under the premise, Wherein: S b It is a collection of software within the same batch, sim(u,v) represents the cosine similarity between vector u and vector v, and τ is the temperature coefficient;

[0015] Step 4) z PMI With z Emb Concatenation yields the existence feature vector of the software. Where: || is the vector concatenation operation.

[0016] The API clusters refer to the following: API embedding vectors of the software under test are obtained using the word2vec algorithm, then K-means is used to cluster the API embedding vectors, and finally the API names in the API call sequence are replaced with cluster numbers to obtain the API cluster sequence.

[0017] The aforementioned API cluster multi-order transition matrix refers to two sets of API cluster multi-order transition matrices with different API cluster position orders, used to record the multi-hop transition relationship between API clusters. The specific construction method is as follows: the API cluster sequence is regarded as a Markov chain, the API cluster is regarded as a state, the transition probability matrix of the API cluster sequence is calculated, the nth power of the transition probability matrix is ​​the nth order transition matrix between API clusters, and the first to third order transition matrices are concatenated according to channels to obtain the multi-order state transition matrix.

[0018] The extraction of transition feature vectors from the multi-order transition matrix of the API cluster specifically includes:

[0019] Step a) Construct a multi-order state transition matrix M for different API cluster position orders P1 With M P2 Where: P1 sequence starts with any API cluster, iteratively selects the cluster with the highest transition probability as the next cluster, and forms the transition matrix M for each software in this order. P1 P2 is ordered by the frequency of the API cluster in all sequences, from largest to smallest, forming the transition matrix M for each software. P2 The transition probability matrices of the two positional orders are treated as two perspectives, and two three-channel convolutional neural networks are used to process the multi-order state transition matrix M. P1 With M P2 Feature extraction is performed to obtain the feature vectors of program i from two perspectives. and

[0020] Step b) Calculate the API transfer feature contrast loss function L T Used to train feature vectors from two perspectives. and Through two multilayer perceptrons and Mapped into the space where the loss function is computed, i.e.

[0021] Step c) will and The existence feature vector z of the software is obtained by concatenation. T .Right now Where: || is the vector concatenation operation.

[0022] The total loss function L = L E +L T +L sup Where: the contrastive loss function for existence features Contrast loss function for transferred features Supervised loss function Wherein: S b It is a collection of software within the same batch, where sim(u,v) represents the cosine similarity between vectors u and v, and τ is the temperature coefficient; the linear classifier predicts the labels of the software. W sup With b sup These are the weight matrix and bias vector of a linear classifier. It is a collection of tagged malware samples.

[0023] This invention relates to a system for implementing the above method, comprising: an API existence feature extraction unit, an API transition feature extraction unit, and a feature fusion unit, wherein: the API existence feature extraction unit performs graph comparison learning based on the API relationship graph to obtain the API existence feature vector of the software; the API transition feature extraction unit performs comparison learning based on a convolutional neural network between multi-order state transition matrices at different positions based on the multi-order transition matrix of the API cluster to obtain the API transition features of the software; and the feature fusion unit fuses the API existence features and API transition features of the software and obtains the classification result of the software with the help of a classifier.

[0024] Technical effect

[0025] This invention constructs two API relationship graphs based on node mutual information (PMI) and embedding vector similarity, and uses a graph contrastive network to extract API existence features from the two graphs, fully utilizing the complex and rich relationships between APIs. A hybrid positive sample selection strategy is used to define the positive sample set in the graph contrastive network. Positive sample pairs are defined based on TF-IDF vector similarity, and then label information is introduced for fine-tuning to better adapt to semi-supervised learning scenarios. First- to third-order transition matrices are concatenated by channel to obtain multi-order state transition matrices for API clusters. A contrastive network based on a convolutional neural network is used to extract API transition features between multi-order state transition matrices at different positions to uncover deeper API transition features of the software. Compared with existing technologies, this invention can accurately detect malware in imbalanced datasets and when labeled samples are scarce. Attached Figure Description

[0026] Figure 1 This is a flowchart of the present invention.

[0027] Figure 2 This is a schematic diagram of the system in the embodiment. Detailed Implementation

[0028] like Figure 1 As shown in the figure, this embodiment relates to a multi-view fusion malware detection method based on API call sequences, which includes the following steps:

[0029] Step 1: Input software set API call sequence in: It is a collection of q types of APIs. It is a set of labels, where: y0 represents benign software, y1, ..., y c It is a type of malware, number c.

[0030] Step 2: Construct a graph G based on node mutual information according to the API call sequence. PMI Compared with graph G based on embedding vector similarity Emb It is used to extract the calling relationship between software and API and the association relationship between APIs.

[0031] Node mutual information (PMI) measures the relevance between two APIs by examining their co-occurrence frequency. A positive PMI value indicates a high semantic relevance between the APIs in the corpus, while a negative value indicates little or no semantic relevance. Therefore, this embodiment adds edges between API pairs with positive PMI values. The graph based on node mutual information shows API node pairs a. i ,a j Edge weights between Among them: #W(a i ,a j ) is containing a i and a j The number of sliding windows, and #W(a i ) is containing a i The number of sliding windows, where #W is the total number of sliding windows. In addition to the edges between APIs, this embodiment also constructs edges between the software and the APIs, when the software s i API is called during execution. j If , then there exists an edge between nodes i and j. PMI Adjacency matrix A PMI elements

[0032] Proposed by Mikolov et al. in "Efficient estimation of word representations in vector space" in 2013, word2vec can obtain the representation vectors of words through context inference, allowing words with similar functions to be close to each other in a high-dimensional space. After obtaining the API embeddings through word2vec, we select the n closest neighbors for each API by calculating the distance in the representation space and add edges between them. The API node pair a in the graph based on the embedding vector similarity is then calculated. i ,a j The edge weights between Sim(a)i ,a j = CosineSimilarity(emb i ,emb j ), where: emb i It is a i Based on the API embedding vector obtained from word2vec, Sim(a i ,a j ) is a i With a j Cosine similarity between API embedding vectors. Similarly, this embodiment also constructs edges between the software and the API, when the software s i API is called during execution. j If i and j are adjacent nodes, then there exists an edge between them. This is based on the similarity of the embedding vectors in the graph G. Emb Adjacency matrix A Emb elements

[0033] Step 3: Learn the existence feature vector z of the software from the two API relationship graphs based on the graph convolutional contrastive network model. E This embodiment uses a graph convolutional network (GCN) to obtain the node's position in the G network. PMI With G Emb Representation in: in: It is the weight matrix of the graph convolutional network. It is a normalized adjacency matrix. Where: and X is the initial feature matrix of the node. If no initial feature matrix is ​​provided, a one-hot matrix will be used.

[0034] For the shared consistency feature mentioned above, this embodiment uses a graph contrastive learning framework to extract the API existence feature of the software. First, this embodiment uses two multilayer perceptrons (MLPs) to map them to the space for calculating the loss function:

[0035] The contrastive loss function for API existence features is: Wherein: S b This refers to a set of software within the same batch, where sim(u,v) represents the cosine similarity between vectors u and v, and τ is the temperature coefficient. This embodiment uses a mixed positive sample strategy to construct the positive sample set P. i With the negative sample set N iFor each software's API call sequence, this embodiment calculates the cosine similarity of its TF-IDF vectors with other software's API call sequences. The top k most similar vectors are selected to form k positive sample pairs. Then, the positive samples are fine-tuned based on label information. If two software programs have the same label, they are considered positive samples; if a positive sample pair has different labels, it is removed from the positive sample set. After fine-tuning, the positive sample set for software i is P. i The remaining software in the same batch as i that are not positive samples are considered negative samples, i.e., N. i In this embodiment, the top 32 pairs of software samples with the highest similarity to their embedding vectors are selected as positive sample pairs.

[0036] Will and By concatenating the vectors, we can obtain the existence feature vector z of the software's API. i E , Where: || is the vector concatenation operation.

[0037] Step 4: Construct two sets of multi-order transition matrices for API clusters with different API cluster position orders based on the API call sequence, and record the multi-hop transition relationships between API clusters. In this embodiment, after obtaining the embedding vector of each API using word2vec, the k-means algorithm is used for clustering, and the original API call sequence is converted into an API cluster sequence by replacing the APIs in the API call sequence with the cluster names containing those APIs. In this embodiment, the number of API clusters is 200.

[0038] This embodiment treats API clusters as state-constructed Markov chains, with each software's API call sequence corresponding to a transition probability matrix for an API cluster. The transition probability matrix describes the single-hop transition relationship between two API clusters. Some software, to conceal its purpose, may insert "noisy" APIs between two important API calls. Therefore, to express this long-distance transition relationship between APIs, this embodiment uses an n-order transition probability matrix, i.e., the nth power of the original transition probability matrix, to calculate the n-order transition matrix between APIs, and concatenates the 1st, 2nd, and 3rd order transition matrices to obtain a multi-order state transition matrix.

[0039] Step 5: Learn the software's transition feature vector z from the two sets of API cluster multi-order transition matrices using a convolutional contrastive learning framework. TUnlike pixels in an image where positions are relatively fixed, the order of API cluster positions in the transition probability matrix is ​​not predetermined. Although transition probability matrices in different orders may appear different, the transition features they imply for classifying different software are consistent. To eliminate the influence of positional order, this embodiment treats two sets of multi-hop transition matrices at different positions as two different views and uses a contrastive learning method based on a multi-channel convolutional neural network to extract the shared consistency features for classifying different software. The first layer of the convolutional neural network has a kernel size of 3*3 and an output dimension of 16; the second layer has a kernel size of 3*3 and an output dimension of 32. Considering that CNNs excel at extracting local features in Euclidean space, this embodiment selects orders that cluster strong transition probability signals in the transition matrix as locally as possible. On one hand, this embodiment starts with any API cluster and iteratively selects the cluster with the highest transition probability as the next cluster, forming the transition matrix M for each software in this order. P1 Larger transition probabilities tend to cluster around the main diagonal. Note that the transition probabilities used for ranking here are calculated based on the overall transition probabilities of the corpus comprising all sequences. On the other hand, in this embodiment, API clusters are arranged in descending order of frequency of occurrence across all sequences, forming the transition matrix M for each software in this order. P2 Higher transition probabilities tend to focus on the lower left corner. A convolutional neural network is used to obtain the representation of software i in two views. and Subsequently, this experiment used two multilayer perceptrons to map them onto the space for calculating the loss function: The contrastive loss function for API transfer features is:

[0040] Will and By concatenating the vectors, we can obtain the API transfer feature vector z of the software. i T ,Right now Where: || is the vector concatenation operation.

[0041] Step 6: Construct a classifier and input the concatenated API existence features and API transition features. Define the total loss function L = L based on the classification results. E +L T +L sup The model parameters are then trained and updated using the backpropagation algorithm based on the total loss function.

[0042] This embodiment uses the existence feature vector z of the software's API. E With API transfer feature vector z TThe software representation vector z is obtained by concatenation. A single-layer perceptron is then used to classify the software representation vector. in: It is the predicted label, W sup With b sup These are the weight matrix and biases. The cross-entropy loss function is used to calculate the supervised loss function. in: It is a set of labeled software samples.

[0043] The implementation was carried out under the following environment settings through specific experiments: CPU Intel(R) Xeon(R) CPU E5-2630 v4@2.20GHz, GPU NVIDIA TITAN RTX, RAM 128.00GB, operating system CentOS 7, and simulation environment Python.

[0044] Experiments were conducted on five real-world malware datasets to evaluate the efficiency and effectiveness of the algorithm. The five real-world malware datasets are ACMD, ACSAC, Malapi2019, csv9, and apiMDs. ACMD contains behavioral information for 13,887 files, with 89,806,693 call records, involving 308 APIs within the operating system. The malicious file types in this dataset include infectious viruses, Trojans, mining programs, DDoS Trojans, and ransomware. ACSAC contains behavioral information for 5,000 normal software files and information for 5,079 malicious software files, including infectious viruses, Trojans, mining programs, DDoS Trojans, and ransomware. Malapi2019 contains information on 7,107 malicious software files, involving eight types of malware, including viruses, backdoors, and DDoS programs. The csv9 dataset contains 100 normal software samples and 452 malicious software samples, with malware types including Trojans, backdoors, worms, and infectious viruses. Apimds contains behavioral information on 17,125 malware entries, encompassing nine malware types. This embodiment concatenates the API calls made by each software during execution into an API call sequence in chronological order.

[0045] In this embodiment, MINES is used in the simulation experiment. This embodiment is compared with four other malware detection methods in simulation. These four methods are as follows: The SCLMD method proposed by Gao et al. in "MalwareDetection with Limited Supervised Information via Contrastive Learning on APICall Sequences" published at the International Conference on Information and Communications Security in 2022. This method uses a multiple attention mechanism based on recurrent neural networks to extract the temporal information feature vector of API call sequences, uses a graph attention mechanism to obtain the structural feature vector of software nodes, and performs comparative learning between the two feature vectors to obtain the software representation vector for classification. The GDroid method was proposed by Gao et al. in their 2021 paper "GDroid: Android malware detection and classification with graph convolutional network" published in *Computers & Security*. The LGMal method was proposed by Chai et al. in their 2020 paper "LGMal: A joint framework based on local and global features for malware detection" published in *International Wireless Communications and Mobile Computing*. The MaMadroid method was proposed by Enrico et al. in their 2016 paper "Mamadroid: Detecting android malware by building markov chains of behavioral models" published in *Network and Distributed System Security Symposium*. The parameter settings for this embodiment are as follows: 70% of the data is used as the training set, 10% as the validation set, and 20% as the test set. The learning rate is set to 0.0001, the training batch size is 100, the temperature coefficient τ is set to 0.5, and the representation vector for each software is set to 256.

[0046] Table 1 compares the performance of this embodiment and several existing methods on five datasets: ACMD, ACSAC, Malapi2019, csv9, and apimeds.

[0047]

[0048] Compared to existing techniques, our method achieves performance improvements of 9.69%, 7.27%, 34.55%, 5.78%, and 3.52% over suboptimal algorithms on the ACMD, ACSAC, Malapi2019, Csv9, and Apimds datasets, respectively. Notably, it achieves the largest lead on the MINES dataset. The API sequences in Malapi2019 are generally long, contain significant noise, and exhibit large differences in the number of APIs across different categories, making it a typical imbalanced dataset. Our method constructs API relationship graphs based on two approaches to describe the complex and rich relationships between APIs, outperforming GDroid, LGMal, and SCLMD, which use only a single graph construction method. Furthermore, our method constructs multi-order state transition matrices for API cluster sequences to describe API transition relationships and employs a contrastive network based on convolutional neural networks to extract API transition features, outperforming MaMadroid, which only uses principal component analysis (PCA) on the transition probability matrix.

[0049] This embodiment is compared with the four malware detection methods mentioned above in a simulation under a scarce label environment. 20%, 10%, and 5% of the training samples are randomly selected with open labels, while the labels on the remaining samples are masked, thus simulating a semi-supervised training environment with scarce labeled samples. 10% of the dataset is still used as the validation set, and 20% as the test set.

[0050] Table 2 compares the malware detection and classification performance of this embodiment and several existing methods on the ACMD dataset when there is limited labeled data.

[0051] Tag open rate Evaluation indicators GDroid SCLMD LGMal MaMadroid MINES 20％ Micro F1 0.8321 0.8551 0.8449 0.8146 0.8882 Macro F1 0.6078 0.6303 0.6357 0.5524 0.7079 10％ Micro F1 0.7745 0.8076 0.7938 0.8076 0.8512 Macro F1 0.6028 0.6225 0.5704 0.548 0.6876 5％ Micro F1 0.643 0.7789 0.694 0.7962 0.8451 Macro F1 0.5362 0.5945 0.5543 0.5305 0.6221

[0052] Compared to existing technologies, this method achieves performance improvements of 7.73%, 7.93%, and 5.39% over suboptimal algorithms at label open rates of 20%, 10%, and 5%, respectively. This method utilizes a graph contrastive network and a convolutional neural network-based contrastive network to extract API presence and API transition features from the software. The contrastive network is a self-supervised training framework that can be trained without label information. Furthermore, this method employs a hybrid positive sample selection strategy to define the positive sample set for the graph contrastive network, fully utilizing limited label information to guide training. These factors contribute to the significant performance advantage of this method over other methods when labels are sparse.

[0053] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. A malware detection method based on multi-perspective fusion of API call sequence behavior, characterized in that, In the offline phase, API relationship graphs based on node mutual information and embedding vector similarity are generated as training samples based on the API call sequence of the software under test. Existence feature vectors are extracted from the API relationship graphs and transition feature vectors are extracted from the multi-order transition matrix of the API clusters. The total loss function is calculated based on the classification results of the classifier and the model is optimized by backpropagation algorithm, so as to perform multi-view fusion malware detection in the online phase. The API call sequence mentioned refers to: the software under test API call sequence ,in: In the operating system A collection of APIs; The API relationship graph uses APIs as nodes, constructs edges based on the relationships between APIs, and calculates edge weights. It includes API relationship graphs based on node mutual information (PMI) and API relationship graphs based on embedding vector similarity. The extraction of existence feature vectors from the API relationship graph specifically includes: Step 1) Use a graph convolutional contrastive network model to obtain the existence feature vectors in the API relationship graph based on node mutual information (PMI) and the API relationship graph based on embedding vector similarity. and ,in: It is the weight matrix of the graph convolutional network. and It is a normalized adjacency matrix , It is the identity matrix. It is the initial feature matrix of the node; Step 2) Construct a positive sample set based on a mixed positive sample strategy With negative sample set For each software's API call sequence, calculate its cosine similarity to the TF-IDF vectors of other software's API call sequences, and select the sequences with the highest similarity. Formation We first obtain a set of positive sample pairs, then fine-tune the positive samples based on the label information. When two software programs have the same label, they are considered positive samples to each other. When a positive sample pair has different labels, it is removed from the positive sample set, and the software is obtained. The set of positive samples is The remainder and Software that is not a positive sample in the same batch is considered a negative sample. ; Step 3) Calculate the API existence feature contrast loss function First of all and The loss function is calculated by mapping the two multilayer perceptrons to the space where they are computed. Then, a mixed positive sample selection strategy is used to determine the positive sample set. With negative sample set Under the premise, ,in: It is a collection of software from the same batch. Representing vectors with vector cosine similarity, It is the temperature coefficient; Step 4) and Concatenation yields the existence feature vector of the software. ,in: It is a vector concatenation operation.

2. The malware detection method based on multi-perspective fusion of API call sequence behavior according to claim 1, characterized in that, The PMI-based API relationship graph is constructed as follows: Edge weights between APIs are defined based on node mutual information, and API node pairs... Edge weights between them ,in: It includes and The number of sliding windows, It includes The number of sliding windows, This refers to the total number of sliding windows. A sliding window is based on the idea of ​​two pointers, where a window is formed between the elements pointed to by the two pointers. A fixed-length scan sequence is used to record the occurrence of elements within the window. (Based on the PMI API relationship diagram) adjacency matrix .

3. The malware detection method based on multi-perspective fusion of API call sequence behavior according to claim 1, characterized in that, The API relationship graph based on embedding vector similarity is constructed as follows: edges between APIs are built based on the cosine similarity of API embeddings, and API node pairs... Edge weights between ,in: yes API embedding vectors obtained from word2vec yes and Cosine similarity between API embedding vectors; API relationship graph based on embedding vector similarity. adjacency matrix .

4. The malware detection method based on multi-perspective fusion of API call sequence behavior according to claim 1, characterized in that, The aforementioned API cluster multi-order transition matrix refers to two sets of API cluster multi-order transition matrices with different API cluster position orders, used to record the multi-hop transition relationship between API clusters. The specific construction method is as follows: the API cluster sequence is regarded as a Markov chain, the API cluster is regarded as a state, the transition probability matrix of the API cluster sequence is calculated, the nth power of the transition probability matrix is ​​the nth order transition matrix between API clusters, and the first to third order transition matrices are concatenated according to channels to obtain the multi-order state transition matrix. The API clusters refer to the following: API embedding vectors of the software under test are obtained using the word2vec algorithm, then K-means is used to cluster the API embedding vectors, and finally the API names in the API call sequence are replaced with cluster numbers to obtain the API cluster sequence.

5. The malware detection method based on multi-perspective fusion of API call sequence behavior according to claim 4, characterized in that, The extraction of transition feature vectors from the multi-order transition matrix of the API cluster specifically includes: Step a) Construct a multi-order state transition matrix for different API cluster position orders and Where: P1 sequence starts with any API cluster, iteratively selects the cluster with the highest transition probability as the next cluster, and forms the transition matrix for each software in this order. P2 order arranges the API clusters in descending order of their frequency of occurrence across all sequences, forming the transition matrix for each software in this order. By treating the transition probability matrices of the two positional orders as two perspectives, two three-channel convolutional neural networks are used to process the multi-order state transition matrix. and Perform feature extraction to obtain the program Feature vectors from two perspectives and ; Step b) Calculate the API transfer feature contrast loss function Used to train feature vectors from two perspectives. ; through two multilayer perceptrons Mapped into the space where the loss function is computed, i.e. , Contrastive loss function for API-transferred features ; Step c) will Concatenation yields the existence feature vector of the software. ;Right now ,in: It is a vector concatenation operation.

6. The malware detection method based on multi-perspective fusion of API call sequence behavior according to claim 1 or 5, characterized in that, The total loss function Where: the contrastive loss function for existence features Contrast loss function for transferred features Supervised loss function ,in: It is a collection of software from the same batch. Representing vectors with vector cosine similarity, It is the temperature coefficient; a label for linear classifier prediction software. and These are the weight matrix and bias vector of a linear classifier. It is a collection of tagged malware samples.

7. A system for implementing the malware detection method based on API call sequence behavior multi-view fusion as described in any one of claims 1-6, characterized in that, include: The system comprises an API existence feature extraction unit, an API transition feature extraction unit, and a feature fusion unit. Specifically, the API existence feature extraction unit performs graph comparison learning based on the API relationship graph to obtain the software's API existence feature vector. The API transition feature extraction unit performs comparison learning based on a convolutional neural network between multi-order state transition matrices at different positions based on the multi-order transition matrix of the API cluster to obtain the software's API transition features. The feature fusion unit integrates the software's API existence features and API transition features and obtains the software's classification result using a classifier.

Images