A Deep Learning-Based Method for Detecting DKOM Attacks on Linux Systems

Abstract

This invention discloses a deep learning-based method for detecting DKOM attacks on Linux systems, addressing the limitations of existing methods that detect a limited number of DKOM attack types and have limited applicability to specific Linux kernel versions. The steps of this invention are: (1) constructing an extended memory graph; (2) generating node labels for the extended memory graph; (3) constructing a graph neural network; (4) generating a dataset; (5) training the graph neural network; (6) inferring kernel objects; and (7) detecting DKOM attacks on the Linux system under test. This invention designs an extended memory graph structure for Linux memory images and uses a graph neural network to supervise the learning of the extended memory graph's topology, enabling the identification of various kernel objects in the Linux memory image. It then analyzes whether any objects are hidden by DKOM attacks to detect DKOM attacks, thus enabling the invention to detect various maliciously hidden kernel objects using DKOM attacks with high accuracy.

Description

Technical Field

[0001] This invention relates to the field of information processing technology, and more specifically to a deep learning-based method for detecting Direct Kernel Object Manipulation (DKOM) attacks on Linux systems within the field of network security technology. This invention can be used to analyze Linux system memory images to detect whether the system is under a DKOM attack, thereby ensuring the secure operation of the Linux system. Background Technology

[0002] DKOM (Device-Based Memory Omission) techniques are often exploited by malware (such as kernel-level rootkits) as a means of attacking Linux systems. For example, modifying process objects can hide processes, and modifying kernel module objects can hide modules; hence the name DKOM attack. This type of attack can penetrate deep into the operating system's kernel layer, posing a significant threat to operating system security. Furthermore, DKOM attacks are highly stealthy, making them difficult to detect using conventional methods. Currently, DKOM attack detection for Linux systems is mainly divided into two categories: dynamic detection and static detection. Dynamic methods primarily involve installing detection software on the Linux system under test and then analyzing the software within the system to detect DKOM attack behavior. Static detection methods primarily involve analyzing the contents of Linux memory image files to determine if traces of DKOM attacks are present.

[0003] Hunan University, in its patent application "A Rootkit Intrusion Detection and System Recovery Method Based on Kernel Invariant Protection" (application number CN201110124261.0, publication number CN 102147843 A), proposed a method for detecting kernel-level rootkits by protecting Linux system kernel invariants. These kernel invariants are data structures or invariant logical relationships between data structures that remain unchanged throughout the operating system's operation. For specific kernel rootkit attack behaviors, specific corresponding kernel data structure invariants can be generated. When changes to these invariants are detected, it indicates that a kernel-level rootkit has been detected. The drawback of this method is that it can only detect a limited number of DKOM attack types because these kernel invariants are not present in every kernel object. If a kernel-level rootkit uses DKOM technology to attack certain kernel data structures that lack constant data structures or invariant logical relationships, this method cannot detect such attacks.

[0004] In his paper "SigGraph: Brute Force Scanning of Kernel DataStructure Instances Using Graph-based Signatures" (Purdue University, Proceedings of the Symposium on Network and Distributed Systems Security, 2013), Lin Zhiqiang proposed a method for detecting DKOM attacks in Linux systems. This method generates graph-based immutable signatures for Linux kernel data structures based on the pointing relationships between various kernel data structures. It then uses signature scanning to traverse the memory image to identify target kernel objects and determines whether any maliciously hidden elements are present, thus detecting DKOM attacks. This method effectively utilizes the point-to-point relationships between kernel data structures, and compared to object detection methods based on value-immutable signatures, it can more accurately identify kernel data structures with pointer fields. However, this method still has limitations: it requires generating a graph-based immutable signature for each kernel data structure, relying on domain knowledge of the operating system, resulting in high technical costs and complex implementation; furthermore, this method is only applicable to Linux kernel version 2.6 and cannot detect other kernel versions of Linux. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of the existing technologies by proposing a deep learning-based method for detecting DKOM attacks on Linux systems. This method can identify various kernel objects in Linux memory and solves the problems of current methods being incomplete in detecting the types of DKOM attacks on Linux systems, complex implementation, and limited by Linux kernel versions.

[0006] The specific approach to achieving the objective of this invention is as follows: The method proposed in this invention includes a model training phase and an attack detection phase. In the model training phase, a deep learning model is trained on Linux memory image samples of all known kernel object distributions to obtain an object detection model. In the attack detection phase, the model obtained in the training phase is used to detect the Linux system memory image under test to obtain a set of target object addresses. Then, by comparing whether this set is consistent with the objects in the Linux system kernel linked list, it is determined whether there are hidden kernel objects in memory, and thus whether the Linux system is under DKOM attack.

[0007] The specific steps to achieve the objective of this invention are as follows:

[0008] Step 1, Construct the extended memory graph:

[0009] Step 1.1: Use a memory analysis framework to analyze the Linux system memory image and find the addresses of all constants inside the kernel objects;

[0010] Step 1.2: Traverse the contents of the Linux system memory image and find the addresses of all pointers within it;

[0011] Step 1.3: Sort all constant addresses and all pointer addresses in ascending order. Based on the sorted addresses, treat the Linux system memory image byte sequence between every two adjacent addresses as a graph node. Record all nodes to form a node set. The starting address of the byte sequence is the address of the node, the size of the node is the length of the byte sequence, and the content of the byte sequence is the initial vector of the node.

[0012] Step 1.4: Sort the nodes in the set according to their addresses in ascending order. For all adjacent left and right nodes, generate an edge from the left node to the right node as the left adjacent edge, and generate an edge from the right node to the left node as the right adjacent edge. For all adjacent nodes, check the field between them. If the field is a pointer, find the node pointed to by the pointer and denote it as the dest node. Generate an edge from the dest node to the left node as the right pointer edge, and generate an edge from the dest node to the right node as the left pointer edge. If the field is a constant, generate an edge from the left node to itself as the right pointer edge, and generate an edge from the right node to itself as the left pointer edge.

[0013] Step 1.5: Generate the extended memory graph G = (N, E) corresponding to the Linux system memory image. ln E rn E lp E rp ), where N represents the set of nodes, E ln Let E represent the set of all left adjacent edges. rn Let E represent the set of all right adjacent edges. lp Let E represent the set of all left-pointer edges. rp Represents the set consisting of all right-pointer edges;

[0014] Step 2, generate node labels for the extended memory graph:

[0015] Step 2.1: Analyze the Linux memory image using a memory analysis framework to obtain the addresses and sizes of all kernel objects; traverse the nodes of the extended memory graph generated by the memory image to generate a label for each node. The content of the node label includes the kernel object type in which the node is located, the offset of the node address in the kernel object, and the size of the node.

[0016] Step 2.2: Calculate the label weight of each node in each type of kernel object;

[0017] Step 2.3: Select the top 20 node labels with the highest weights for each type of object to form a set of key node labels for that type of object;

[0018] Step 3, construct a graph neural network including an embedding network and a classifier:

[0019] Step 3.1: Construct an embedded network with the following structure: first convolutional layer, second convolutional layer, and third convolutional layer. Set the size of the first, second, and third convolutional layers to 64*64, and use the ReLU function to activate the convolutional layers.

[0020] Step 3.2: Build a classifier using a fully connected network. The classifier network has three fully connected layers with the following structure: 64*64, 64*64, 64*21. The activation function is the Softmax function.

[0021] Step 4, generate the dataset:

[0022] Step 4.1: Collect 500 memory images of the Linux system. Construct the corresponding extended memory graph for each memory image using the method in Step 1, resulting in 500 extended memory graphs. Use Step 2 to generate node labels for each node in the extended memory graph, resulting in a node label file for each extended memory graph.

[0023] Step 5, train the graph neural network:

[0024] All extended memory graphs of the training set and their corresponding node labels are input into the graph neural network for training. The cross-entropy loss value between the predicted node label and the labeled label of the network output is calculated at each iteration. The weight parameters of the graph neural network are updated while minimizing the error until the loss value converges, and the trained graph neural network is obtained.

[0025] Step 6, infer kernel objects:

[0026] The node prediction labels output by the graph neural network are regarded as voters who vote for the existence and type of the object. Based on the validation dataset and the detection dataset, the kernel object inference algorithm is used to convert the prediction labels of each node output by the trained graph neural network into the starting address of the corresponding kernel object. These addresses are recorded to obtain the kernel object address set.

[0027] Step 7: Detect DKOM attacks on the Linux system under test:

[0028] Step 7.1: Extract the memory image of the Linux system under test, and use Step 1 to build an extended memory graph for the memory image;

[0029] Step 7.2: Use the trained graph neural network to predict node labels in the extended memory graph of the memory image of the Linux system under test, and obtain the target kernel object address set S1 based on the kernel object inference algorithm;

[0030] Step 7.3: Use a memory analysis framework to analyze the memory image of the Linux system under test to obtain the target kernel object address set S2;

[0031] Step 7.4: Compare whether S1 and S2 are the same. If they are the same, it is determined that the Linux system under test has not been attacked by DKOM. Otherwise, it is determined that the Linux system under test has been attacked by DKOM.

[0032] Compared with the prior art, the present invention has the following advantages:

[0033] First, the kernel object detection method of the present invention combines pointer mapping-based and value-invariant signature-based methods, which can detect most kernel objects and thus can detect hidden DKOM attacks on various objects. This overcomes the shortcomings of existing technologies in detecting a limited number of DKOM attacks, giving the present invention the advantage of high robustness.

[0034] Second, the kernel object detection model designed in this invention uses deep learning to automatically learn the structural knowledge of kernel objects in Linux memory images. It does not rely on the domain knowledge of the operating system, thus overcoming the disadvantages of existing technologies that rely on the domain knowledge of the operating system and have high technical costs. This makes the present invention have the advantages of low technical cost and simple implementation.

[0035] Third, the detection method implemented in this invention can detect various Linux kernel versions, overcoming the shortcomings of existing technologies that strictly limit Linux kernel versions, thus making this invention applicable to various Linux kernel versions. Attached Figure Description

[0036] Figure 1 This is a flowchart of the method of the present invention;

[0037] Figure 2 Extended memory diagram designed for this invention; Detailed Implementation

[0038] This invention proposes a deep learning-based method for detecting DKOM attacks on Linux systems. This method, based on a graph neural network model, identifies potential kernel objects by analyzing Linux memory images, and then determines whether the system is under a DKOM attack by analyzing whether any hidden kernel objects exist. (See reference...) Figure 1 The specific implementation process of the present invention is as follows:

[0039] Step 1: Collect Linux memory images as a dataset. Run an Ubuntu guest machine on a VMware virtual machine. After performing some random operations, save a snapshot to obtain a Linux memory image. Repeat the above steps 500 times to obtain a dataset containing 500 Linux memory images.

[0040] Step 2: Construct extended memory graphs for the Linux memory images to obtain the training dataset. For each Linux memory image in the dataset, traverse its contents, recording the addresses of pointer and constant fields, and use these addresses to segment the Linux memory image. The segmentation process is as follows: Sort all pointer and constant field addresses, and combine the byte sequences of the Linux memory image between every two adjacent addresses as a node in the extended memory graph. The node's address is the starting address of the byte sequence, and the node size is the length of the byte sequence. Then, create edges based on the adjacency relationships of the nodes and the pointer relationships in the extended memory graph to obtain an extended memory graph corresponding to each Linux memory image. Construct extended memory graphs for each Linux memory image in the dataset using the above steps, ultimately obtaining a training dataset containing 500 extended memory graphs.

[0041] The following is combined Figure 2 The process of constructing an extended memory graph according to an embodiment of the present invention will be further described.

[0042] Figure 2 (a) is a Linux memory image. Figure 2 In (a), the black shaded area represents the pointer field in the memory image, and the gray shaded area represents the constant field. The arrow points to the address pointed to by the pointer. A, B, C, and D are the contents between the pointer field and the constant field. After dividing the memory image using the pointer field and the constant field, we get four byte sequences: A, B, C, and D. These four sequences are used as nodes in the extended memory graph, meaning the node set of the extended memory graph is N = {A, B, C, D}. To construct the edges of the extended memory graph, we first construct the adjacent edges: Figure 2 In (a), nodes A and B are adjacent nodes. Therefore, we construct a left adjacent edge from A to B and a right adjacent edge from B to C. Similarly, we can construct the following left adjacent edges for nodes B, C, and D: B→C, C→D, and right adjacent edges: C→B, D→C. The final set of left adjacent edges is E. ln Including A→B, B→C, C→D, and the right adjacent edge set E rn Including B→A, C→B, D→C; then construct pointer edges: in Figure 2In (a), there is a pointer field between nodes A and B, and this pointer points to the interior of node C. Therefore, a right pointer edge from C to A is constructed, and a left pointer edge from C to B is constructed. Similarly, a right pointer edge from D to B and a left pointer edge from D to C can be constructed for nodes B and C. Since there is a constant field between nodes C and D, a right pointer edge from C to C and a left pointer edge from D to D are constructed. The final extended memory graph is G = (N, E ln E rn E lp E rp ),like Figure 2 As shown in (b).

[0043] Step 3: Construct extended memory graph node labels.

[0044] Step 3.1: Analyze the Linux memory images in the training set using the memory analysis framework Volatility to identify the starting addresses and sizes of all kernel objects and save them as a kernel object set. Then, traverse the extended memory graph nodes corresponding to the Linux memory images. Based on the relationship between the node addresses and the detected object addresses, generate a node label for each node. Specifically, for each kernel object in the kernel object set, traverse the extended memory graph nodes to find the nodes whose addresses fall inside the kernel objects. Then, generate a triplet label for this node in the form of "kernel object type_node offset_node size", where the kernel object type is the type of the current kernel object, the node offset represents the difference between the current node address and the current kernel object address, and the node size is the size of the current node.

[0045] Step 3.2 generates all node label weights and key node label sets for each type of kernel object. After executing Step 3.1, for each node in the extended memory graph, there is a corresponding triplet label. Nodes whose "kernel object type" is of type 'c' in the triplet label are recorded as nodes of type 'c' objects. The node labels of all nodes of type 'c' objects in the extended memory graph are recorded. For each node label l i Generate the corresponding node label weights v(c,l) according to the following formula. i ), and record the top 20 node labels with the highest weights to obtain the key node label set L(c) of class c objects.

[0046]

[0047] Where, v(c,l) i ) represents the node label, and the weight ρ(·) represents a counting function, ρ(c,l) i ) indicates that the memory image contains node labels l iThe number of class c kernel objects n, where ρ(c) represents the total number of class c kernel objects in the memory image.

[0048] Step 4: Construct a graph neural network. A graph neural network consists of an embedding network and a classifier network.

[0049] Step 4.1, Construct the embedding network. An embedding network is implemented using a relational graph convolutional network, with the following propagation model:

[0050]

[0051] in Let σ(·) represent the l-th layer embedding representation of node i, and let σ(·) represent the activation function. Let be the weight matrix of node i at layer l, r represent the adjacency relationships of the node, and R represent the set of all adjacency relationships of the node. Let c represent the set of neighboring nodes of node i whose relation is r. i,r It is a normalization constant. This is the weight matrix of the neighboring nodes of node i with relation r at layer l. The embedding representation of all neighboring nodes of node i is shown in layer l. The values ​​of the weight matrix are obtained through supervised learning. The embedding network contains 3 convolutional layers, and the size of each of the 3 layers is set to 64*64.

[0052] Step 4.2: Construct the classifier network. The classifier network consists of three fully connected layers, with the sizes of the three layers set to 64*64, 64*64, and 64*21 respectively.

[0053] Step 5, Train the Graph Neural Network. Input all extended memory graphs of the training dataset and their corresponding node label files into the graph neural network for training. Calculate the cross-entropy loss between the predicted label and the node label, and update the neural network weight parameters while minimizing the error. When the error stabilizes within an acceptable range, the trained node classifier is obtained. The loss function to be optimized is as follows:

[0054]

[0055] Where J(w1,w2) represents the loss function of the neural network. It is the cross-entropy loss function. w1 are the training parameters of the embedding network, w2 are the training parameters of the classifier network, and y (i) This represents the node labels marked in step 2, M(·) represents the graph neural network, and x (i) It is the initial vector of the node.

[0056] Step 6, Kernel Object Inference. By analyzing the predicted node labels output by the graph neural network, the addresses of all target kernel objects in the memory image under test are inferred. Based on the weights v(c,l) of each node label obtained in Step 3.2... i The nodes vote on the addresses inferred from the predicted labels, and the voting rules are as follows:

[0057]

[0058] Where λ(a,c) is the prediction function, δ represents the predefined threshold, and L(a,c) represents the set of node labels that vote for class c objects at address a. λ(a,c) determines whether a class c object is detected at address a by measuring the difference between the prediction confidence and the predefined threshold δ. When the value of the weighted voting combination exceeds the threshold, λ(a,c) = 1, indicating that a class c object is detected at address s; otherwise, λ(a,c) = 0, indicating that no class c object is detected at address a.

[0059] Step 6.1, in the verification phase of the graph neural network:

[0060] Step 6.1.1: The kernel object inference module derives the set of target object addresses for verification based on the label content of the verification dataset.

[0061] Step 6.1.2: Use the trained graph neural network to predict node labels on the extended memory graph of the validation dataset, output the set of predicted node labels, and initialize the δ value in the formula of the object inference algorithm to 0.

[0062] Step 6.1.3: Then, substitute the predicted node label set from step 6.1.2 into the formula in the object inference algorithm to perform target inference, obtain the inferred target object address set, and then verify it with the address set in step 6.1.1, and calculate the inferred Precision, Recall and F-score values.

[0063] Step 6.1.4: Increment the value of δ by 0.1, and then repeat the calculation process in step 6.1.3. Iterate several times until the highest F-score is obtained, and record the value of δ at this time.

[0064] Step 6.2, in the detection phase of the graph neural network:

[0065] Step 6.2.1: Use the trained neural network to classify the nodes in the extended memory graph of the Linux system memory image under test, and output the predicted set of node labels.

[0066] Step 6.2.2: Using the δ value recorded in step 6.1.4, substitute the predicted node label set from step 6.2.1 into the formula in the object inference algorithm to obtain the final set of detected target object addresses.

[0067] Step 7: Perform DKOM attack detection on the Linux system under test. Use the memory analysis framework Volatility to analyze the memory image of the Linux system under test to obtain the target kernel object address set. Then compare this set with the kernel object address set in Step 6.2.2. If they are the same, the system under test is determined not to be under DKOM attack; otherwise, the system is determined to be under DKOM attack.

Claims

1. A method for detecting a DKOM attack on a Linux system based on deep learning, characterized in that, All node label weights of the kernel object are generated by using the frequency of the node label, the node of the extended memory graph is represented by using the supervised learning to train the graph neural network, and the object address is speculated by using the object speculation algorithm based on the voting mechanism; the specific steps of the method comprise: Step 1, constructing an extended memory graph: Step 1.1, analyzing the Linux system memory image by using a memory analysis framework to find all constant addresses in the kernel object; Step 1.2, traversing the content of the Linux system memory image to find all pointer addresses therein; Step 1.3, sorting all constant addresses and all pointer addresses in ascending order, and according to the sorted addresses, taking the byte sequence of the Linux system memory image between every two adjacent addresses as a graph node, recording all nodes to form a node set, the start address of the byte sequence being the address of the node, the size of the node being the length of the byte sequence, and the content of the byte sequence being the initial vector of the node; Step 1.4, sorting the nodes in the set in ascending order according to their addresses, generating a left adjacent edge from the left node to the right node and a right adjacent edge from the right node to the left node for all adjacent two left and right nodes; judging the field between all adjacent two nodes, if it is a pointer, finding the node pointed to by the pointer, denoted as a dest node, generating an edge from the dest node to the left node as a right pointer edge and an edge from the dest node to the right node as a left pointer edge; if it is a constant, generating an edge from the left node to itself as a right pointer edge and an edge from the right node to itself as a left pointer edge; Step 1.5, generating an extended memory graph G=(N, E ln ,E rn ,E lp ,E rp ) corresponding to the Linux system memory image, wherein N represents a node set, E ln represents a set consisting of all left adjacent edges, E rn represents a set consisting of all right adjacent edges, E lp represents a set consisting of all left pointer edges, and E rp represents a set consisting of all right pointer edges; Step 2, generating the node label of the extended memory graph: Step 2.1, analyzing the Linux memory image by using the memory analysis framework to obtain the addresses and sizes of all kernel objects; traversing the extended memory graph nodes generated from the memory image to generate the label of each node, the content of the node label including the type of the kernel object where the node is located, the offset of the node address in the kernel object and the size of the node; Step 2.2, calculating the weight value of each node label in each kernel object; Step 2.3, forming a key node label set of each type of object by using the top 20 node labels with the highest weight value of all node labels of each type of object; Step 3, constructing a graph neural network comprising an embedding network and a classifier: Step 3.1, building an embedding network, the structure of which is in turn: a first convolutional layer, a second convolutional layer and a third convolutional layer; the sizes of the first, second and third convolutional layers are all set to 64*64, and the activation function of the convolutional layer is realized by using a ReLU function; Step 3.2, building a classifier, which is realized by using a fully connected network; the classifier network has 3 fully connected layers, the structure of which is in turn: 64*64, 64*64 and 64*21, and the activation function uses a Softmax function; Step 4, generating a data set: Step 4.1, 500 memory images are collected for the Linux system, and the extended memory graph corresponding to each memory image is constructed in the manner of step 1, so as to obtain 500 extended memory graphs; the node labels of each extended memory graph are generated in step 2, so as to generate the node label file of each extended memory graph; Step 5, training the graph neural network: all the extended memory graphs in the training set and the corresponding node labels are input into the graph neural network for training, the cross-entropy loss value between the predicted node label output by the network in each iteration and the labeled label is calculated, and the weight parameters of the graph neural network are updated in the process of minimizing the error until the loss value converges, thereby obtaining the trained graph neural network; Step 6, predicting the kernel object: the node prediction label output by the graph neural network is regarded as a voter supporting the existence and type of the object, and the kernel object prediction algorithm is used according to the verification data set and the detection data set to convert the prediction label of each node output by the trained graph neural network into the starting address of the corresponding kernel object, and the address set of the kernel object is recorded; Step 7, detecting DKOM attack on the to-be-tested Linux system: Step 7.1, extracting the memory image of the to-be-tested Linux system, and constructing the extended memory graph of the memory image in step 1; Step 7.2, using the trained graph neural network to predict the node label of the extended memory graph of the memory image of the to-be-tested Linux system, and obtaining the target kernel object address set S1 according to the kernel object prediction algorithm; Step 7.3, using the memory analysis framework to analyze the memory image of the to-be-tested Linux system, and obtaining the target kernel object address set S2; Step 7.4, comparing whether S1 and S2 are the same, if yes, it is determined that the to-be-tested Linux system is not attacked by DKOM, otherwise, it is determined that the to-be-tested Linux system is attacked by DKOM.

2. The deep learning based Linux system DKOM attack detection method of claim 1, wherein, The calculation of each node label weight v(c, l i ) in each kernel object is described in Step 2.2 above and is obtained from the following equation: where v(c, l i ) denotes the node label, and the weight value p(·) denotes a counting function, p(c, l i ) denotes the number of c-class n-kernel objects in the memory image containing the node label l i , and p(c) denotes the number of all c-class kernel objects in the memory image.

3. The deep learning based Linux system DKOM attack detection method of claim 1, wherein, The loss function of the neural network in step 5 is as follows: where J(w1, w2) denotes the loss function of the neural network, is a cross-entropy loss function, w1 is the training parameter of the embedding network, w2 is the training parameter of the classifier network, y (i) denotes the node label labeled in step 2, M(·) denotes the graph neural network, x (i) is the initial vector of the node.

4. The deep learning based Linux system DKOM attack detection method of claim 1, wherein, The specific steps of the kernel object prediction algorithm in step 6 are as follows: In the first step, each node casts a vote for the predicted label conversion address of the node according to the following voting rules: the weight v(c, l) of each node label is calculated as follows: i v(c, l) = 1 / (1 + e^(- (c - l) / s)) Wherein, λ(a,c) is a prediction function, δ represents a pre-defined threshold, and L(a,c) represents a node label set for voting for a class c object at address a; λ(a,c) judges whether a class c object is detected at address a by measuring the difference between the prediction confidence and the pre-defined threshold δ, when the value of the weighted voting combination exceeds the threshold, λ(a,c) is set to 1, indicating that a class c object is detected at address s; otherwise, λ(a,c) is set to 0, indicating that a class c object is not detected at address a; Second step, in the verification stage of the graph neural network: According to the label content of the verification data set, the target object address set for verification is obtained, the node label of the extended memory graph of the verification data set is predicted by using the trained graph neural network, and the predicted node label set is output, and the value of δ in the formula in the object prediction algorithm is initialized to 0; The predicted node label set is substituted into the formula in the object speculation algorithm to calculate a speculated target object address set, which is then verified with the target object address set of the verification set to calculate the precision, recall, and F-score values of the speculation; The value of δ is increased by 0.1, and the above calculation process is repeated until the highest F-score value is obtained, the calculation is stopped, and the value of δ at this time is recorded; In the third step, in the test stage of the graph neural network: The trained neural network is used to classify the nodes of the extended memory graph of the detection data set, and a predicted node label set is output; the value of δ recorded in the second step is used to substitute the predicted node label set into the formula in the object speculation algorithm to calculate a final detected target object address set.

Images