Malware detection method and device, electronic equipment and storage medium

Abstract

The application discloses a malware detection method and device, electronic equipment and storage medium. The method comprises the following steps: obtaining network flow data of target software, wherein the network flow data comprises network flow of the target software in at least one time period; constructing a network flow node interaction graph of the target software according to the network flow data of the target software; extracting a node structure feature of the target software from the network flow node interaction graph of the target software, and obtaining flow statistical features corresponding to the network flow node interaction graph; and detecting whether the target software is malware according to the node structure feature of the target software and the flow statistical features. The embodiment of the application can improve the detection accuracy of malware.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of software detection, and in particular to a malware detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the rapid development of the Internet, the proliferation of mobile and Internet of Things devices has given rise to a large number of mobile software. At the same time, with the increase in mobile phone applications, a large number of malicious software has also appeared.

[0003] Researchers extract static features of software to detect whether it is malicious software.

[0004] Many malicious software only use code obfuscation, repackaging techniques and decoding malicious behavior during dynamic execution to evade static feature analysis. SUMMARY

[0005] The present application provides a malware detection method and device, an electronic device and a storage medium, which can improve the detection accuracy of malware.

[0006] According to an aspect of the present application, a malware detection method is provided, comprising:

[0007] Obtaining network traffic data of a target software, the network traffic data comprising network traffic of the target software in at least one time period;

[0008] Constructing a network flow node interaction graph of the target software according to the network traffic data of the target software;

[0009] Extracting node structure features of the target software from the network flow node interaction graph of the target software, and obtaining traffic statistical features corresponding to the network flow node interaction graph;

[0010] Detecting whether the target software is malicious software according to the node structure features of the target software and the traffic statistical features.

[0011] According to another aspect of the present application, a malware detection device is provided, characterized in that it comprises:

[0012] A network traffic obtaining module for obtaining network traffic data of a target software, the network traffic data comprising network traffic of the target software in at least one time period;

[0013] A node interaction graph constructing module for constructing a network flow node interaction graph of the target software according to the network traffic data of the target software;

[0014] a feature extraction module configured to extract node structure features of the target software from the network flow node interaction graph of the target software, and obtain traffic statistical features corresponding to the network flow node interaction graph;

[0015] a software type detection module configured to detect whether the target software is malicious software according to the node structure features of the target software and the traffic statistical features.

[0016] According to another aspect of the present application, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory connected to the at least one processor in communication; wherein,

[0019] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the malicious software detection method according to any one of the embodiments of the present application.

[0020] According to another aspect of the present application, a computer readable storage medium is provided, the computer readable storage medium stores computer instructions for enabling a processor to perform the malicious software detection method according to any one of the embodiments of the present application when executed by the processor.

[0021] The technical solution of the embodiments of the present application realizes feature extraction on network traffic of the same time interval by constructing a network flow node interaction graph according to network traffic of a target software, extracting node structure features from the network flow node interaction graph, and determining traffic statistical features of the network flow node interaction graph, and realizes malicious software detection according to the extracted features, thereby solving the problem of low detection accuracy of malicious software detection according to static features in the prior art. The node structure features and the traffic statistical features of the interaction graph can increase the representativeness of the features and improve the accuracy of malicious software detection. Analysis on network traffic of the same time interval can realize slicing of original traffic, reduce the amount of data for analysis, and improve detection efficiency.

[0022] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative effort.

[0024] Figure 1 is a flow chart of a malware detection method according to an embodiment of the present application;

[0025] Figure 2 is a flow chart of a malware detection method according to an embodiment of the present application;

[0026] Figure 3a is a flow chart of a malware detection method according to an embodiment of the present application;

[0027] Figure 3b is a flow chart of a malware detection method according to an embodiment of the present application;

[0028] Figure 4a is a scene diagram of a malware detection method according to an embodiment of the present application;

[0029] Figure 4b is a schematic diagram of benign software network traffic according to an embodiment of the present application;

[0030] Figure 4c is a schematic diagram of malware network traffic according to an embodiment of the present application;

[0031] Figure 4d is a schematic diagram of a boundary node conversion according to an embodiment of the present application;

[0032] Figure 4e is a schematic diagram of another boundary node conversion according to an embodiment of the present application;

[0033] Figure 4f is a scene diagram of a software classification model according to an embodiment of the present application;

[0034] Figure 5 is a structural schematic diagram of a malware detection device according to an embodiment of the present application;

[0035] Figure 6 is a structural schematic diagram of an electronic device implementing a malware detection method according to an embodiment of the present application. DETAILED DESCRIPTION

[0036] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of embodiments of the present application, rather than all embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work should fall within the protection scope of the present application.

[0037] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units need not be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] Embodiment one

[0039] Figure 1 A flowchart of a malware detection method provided by the embodiment one of the present application. The embodiment of the present application can be applicable to the detection of malware, and the method can be executed by a malware detection device, which can be realized in the form of hardware and / or software, and can be configured in an electronic device with certain data operation capability, which can be a server.

[0040] Referring to Figure 1 The malware detection method shown in the figure includes:

[0041] S110, obtaining network traffic data of a target software, the network traffic data including network traffic of the target software in at least one time period.

[0042] The target software can be an application program on an electronic device used by a user. For example, the target software can be an application program of an electronic device running an Android operating system. The electronic device implementing the provided malware detection method of the embodiments of the present application is usually different from the electronic device configured with the target software. The electronic device implementing the provided malware detection method of the embodiments of the present application can obtain network traffic of a plurality of software. The network traffic data is used to determine the flow data of the target software, which can specifically include at least one of the following: how many data packets are sent to a certain port of a certain IP address at a certain time, the size of each data packet, the duration of the sending, the number of packets sent per second, etc.

[0043] The network traffic of the target software for a certain duration is obtained, the network traffic is divided according to a preset time interval to obtain network traffic of at least one time period, and the network traffic of each time period is determined as network traffic data of the target software.

[0044] The network traffic of the target software can be captured and formed into a PCAP file (Packet Capture). The IP (Internet Protocol Address) layer protocol is analyzed, and the protocol is divided into Ipv4 or Ipv6 protocols. Then, HTTP (Hyper Text Transfer Protocol), TCP (Transmission Control Protocol) and UDP (User Data Protocol) in Ipv4 and Ipv6 are analyzed respectively. Finally, a plurality of features related to network flow behavior are obtained and stored as a CSV (Comma-Separated Values) file.

[0045] Generally, the original packet data in the PCAP file is defined as a set of flows P, where P={p1,p2……p n}n={1,2,3……}, each flow is defined as a 5-tuple, including source IP, destination IP, source port, destination port and protocol. However, direct use of PCAP cannot fully display the specific behavior of the flow, such as packet length, flow duration, flow packet number / second and packet size, etc.

[0046] S120, constructing a network flow node interaction diagram of the target software according to the network traffic data of the target software.

[0047] The network flow node interaction graph can refer to a graph describing the flow direction of network traffic. In the network flow node interaction graph, an IP can be a node, or a port can be a node. The connection between nodes represents the transmission of traffic between nodes, specifically the sending of data packets from a node to a node. Generally, the connection has a direction and can also be referred to as a directed edge.

[0048] According to the network traffic data, the network flow node interaction graph can be constructed according to the IP or port in the five-tuple, at least one node is constructed, and the connection between nodes is determined according to the relationship between the source IP (or source port) and the target IP (or target port).

[0049] S130, extracting the node structure feature of the target software from the network flow node interaction graph of the target software, and obtaining the traffic statistical feature corresponding to the network flow node interaction graph.

[0050] The node structure feature can refer to the topology of the node in the network flow node interaction graph. For example, the node structure feature can include at least one of the following: in-degree, out-degree, clustering coefficient, core degree, and betweenness centrality. The traffic statistical feature can refer to the information of the edge in the network flow node interaction graph, and specifically can be the behavior information of the flow. For example, the traffic statistical feature can include at least one of the following: packet length, flow duration, flow packet number / second, and packet size.

[0051] S140, detecting whether the target software is malicious software according to the node structure feature and the traffic statistical feature of the target software.

[0052] For example, the features of the target software can be compared with the features of the preset malicious software. In the case of similarity, the target software is determined to be malicious software; in the case of dissimilarity, the target software is determined to be non-malicious software. In addition, when the target software is malicious software, the target software can also be classified into a software type, which can be obtained by comparing the features of the target software with the features of different software types; the software type corresponding to the similar features is the software type of the target software; and the software type corresponding to the dissimilar features is not the software type of the target software. In addition, the node structure feature and the traffic statistical feature of the target software can be input into a pre-trained machine learning model to obtain detection results such as whether the target software is malicious software and the software type of the malicious software classification.

[0053] Optionally, the constructing the network flow node interaction graph of the target software according to the network flow data of the target software comprises: extracting a target number of time period network flows from the network flow data of the target software, the flow quantity of the target number of time period network flows being greater than or equal to a preset flow quantity threshold; wherein the network flow data is obtained by collecting the network flow of the target software through periodic interval time periods; and constructing the network flow node interaction graph of the target software according to the target number of time period network flows.

[0054] The network flow of the target software is collected through periodic interval time periods, which can mean that the network flow of the target software is continuously collected and periodically divided into time periods. For example, the time period is 10 minutes, and the network flow of the target software from 5:00 to 5:10 is regarded as the network flow of one time period, and the network flow of the target software from 5:10 to 5:20 is regarded as the network flow of the adjacent next time period. In fact, the network flow data includes a long period of network flow of the target software, and the collected network flow data of the target software is divided into time periods according to the length of the time period. For example, the length of the time period is 10 minutes, and the network flow of 1 day (24 hours) is collected to form 24*6=144 time period network flows.

[0055] In fact, the length of the network flow obtained by the division is the same, but the amount of data of the network flow is too small, which can cause inaccurate detection results in subsequent detection. Therefore, a minimum flow, i.e., a flow quantity threshold, can be set to ensure that the network flow content in the data for detection is sufficient to obtain accurate detection results.

[0056] The target number of time period network flows can mean network flows that can obtain accurate detection results, specifically, the flow quantity included is greater than or equal to a preset flow quantity threshold. The flow quantity can be determined by the number of ip nodes, the number of data packets, or the number of five-tuples. For example, one ip node is determined as one flow, and the flow quantity is the number of ip nodes.

[0057] The network traffic of a time period can be obtained, the traffic quantity of the network traffic is detected, whether greater than or equal to a preset traffic quantity threshold, if yes, the network traffic of the time period is determined as network traffic of a target number of time periods, and a network flow node interaction graph is formed; otherwise, the network traffic of the time period is accumulated with the network traffic of a time adjacent next time period, the traffic quantity of the network traffic at this time is detected, whether greater than or equal to a preset traffic quantity threshold, if yes, the network traffic of two time periods is determined as network traffic of a target number of time periods, and a network flow node interaction graph is formed; otherwise, the network traffic of a time adjacent next time period is continuously accumulated, and the process is repeated until network traffic of a target number of time periods is obtained. Through the foregoing method, a long time network traffic can be divided into network traffic of a target number of time periods, and a plurality of network flow node interaction graphs are obtained accordingly, so that the number of network flow node interaction graphs can be increased.

[0058] Features can be extracted according to a plurality of network flow node interaction graphs, and it is detected whether the target software is malicious software, so that the detection accuracy is improved, or only one network flow node interaction graph is used to extract features for detection, so that the amount of data for detection is reduced, and the detection efficiency is improved.

[0059] By time division of the network traffic, the time features of the network traffic can be extracted. The network traffic is usually irrelevant to the overall time of the flow, and is related to the network behavior in a certain time. Therefore, by time division, a series of network flow node interaction graphs in a short time interval are formed, the traffic behavior in a time period can be paid more attention to, the traffic detection accuracy is improved, the amount of data for detection is reduced, and the detection efficiency is improved.

[0060] Optionally, the network traffic data includes a five tuple, and the traffic quantity is the number of five tuples. The network flow node interaction graph of the target software is constructed according to the network traffic data of the target software, including: for the five tuples in the target number of time periods, the source identifier and the target identifier in the five tuples are determined as source nodes, and a source pointing edge from the source identifier to the target identifier is generated; the five tuples are added to the source node formed by the source identifier; and the source nodes in the target number of time periods and the source pointing edges between the source nodes are used to generate the network flow node interaction graph of the target software.

[0061] One five tuple is determined as one flow, and the traffic quantity is the number of five tuples. As in the foregoing example, the original packet data in the PCAP file is defined as a group of flows, and each flow is defined as a five tuple, including a source IP, a target IP, a source port, a target port and a protocol. The source identifier includes the source IP and the source port, and the target identifier includes the target IP and the target port.

[0062] At least one of the source IP, source port, target IP and target port, etc. can be determined as a source node. Optionally, the source IP in a five-tuple can be taken as a source node, and the target IP can be taken as another source node. Generally, two source nodes can be obtained from a five-tuple, and only one source node can be obtained when the source IP and the target IP are the same. The source identifier in the five-tuple sends a data packet to the target identifier. Correspondingly, the source node formed by the source identifier sends a data packet to the source node formed by the target identifier. Correspondingly, the flow direction between the two source nodes is that the source node formed by the source identifier points to the source node formed by the target identifier. Therefore, a source pointing edge can be generated between the two source nodes, and the direction of the source pointing edge is that the source node formed by the source identifier points to the source node formed by the target identifier. The network flow node interaction graph is composed of source nodes and source pointing edges. The source nodes are connected by the source pointing edges, and the source pointing edges have directionality.

[0063] The source pointing edge can be configured as a string, including a plurality of traffic statistical characteristics, for example, 45 statistical characteristics, representing detailed behavior information of the flow.

[0064] By configuring the network traffic as a five-tuple, determining the source nodes and the source pointing edges, and generating the network flow node interaction graph, the distribution structure information of the network traffic can be intuitively expressed, so as to detect malicious software and improve the detection accuracy of the malicious software.

[0065] The technical scheme of the embodiment of the application constructs a network flow node interaction graph according to the network traffic of the target software, extracts node structure characteristics from the network flow node interaction graph, and determines the traffic statistical characteristics of the network flow node interaction graph. The characteristics of the network traffic in the same time interval are extracted, and the extracted characteristics are used for malicious software detection. The problem of low detection accuracy of the existing technology for malicious software detection based on static characteristics is solved. The node structure characteristics and the traffic statistical characteristics of the interaction graph can increase the representativeness of the characteristics and improve the accuracy of the malicious software detection. The network traffic in the same time interval is analyzed, the original traffic slice can be realized, the amount of data for analysis is reduced, and the detection efficiency is improved.

[0066] Embodiment two

[0067] Figure 2A flowchart of a malware detection method provided for embodiment two of the present application. The embodiment of the present application further specifies that "extracting node structure features of the target software from the network flow node interaction graph of the target software, and obtaining traffic statistical features corresponding to the network flow node interaction graph" is "obtaining node structure features of the target software according to the network flow node interaction graph of the target software; obtaining traffic statistical features corresponding to the network flow node interaction graph from the network traffic data of the target software". The embodiment of the present application further specifies that "detecting whether the target software is malicious software according to the node structure features of the target software and the traffic statistical features" is "adding the node structure features to the network flow node interaction graph; converting source pointing edges in the network flow node interaction graph into nodes and constructing an edge node graph; adding the traffic statistical features to the edge node graph; inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model to detect whether the target software is malicious software". It should be noted that parts not described in detail in the embodiment of the present application can be referred to the descriptions of other embodiments.

[0068] Referring to Figure 2 The malware detection method shown comprises:

[0069] S210, obtaining network traffic data of a target software, the network traffic data comprising network traffic of the target software in at least one time period.

[0070] S220, constructing a network flow node interaction graph of the target software according to the network traffic data of the target software.

[0071] S230, obtaining node structure features of the target software according to the network flow node interaction graph of the target software.

[0072] According to source nodes and source pointing edges in the network flow node interaction graph, obtaining in-degree, out-degree, clustering coefficient, core degree and betweenness centrality of each source node, and taking the in-degree, out-degree, clustering coefficient, core degree and betweenness centrality of each source node as node structure features of the network flow node interaction graph.

[0073] S240, obtaining traffic statistical features corresponding to the network flow node interaction graph from the network traffic data of the target software.

[0074] In addition to five-tuple, there are interactive behaviors of flows in the network traffic data, such as packet length, flow duration, flow packet number per second and packet size, etc. The interactive behaviors are determined as traffic statistical features.

[0075] S250, adding the node structure features to the network flow node interaction graph.

[0076] The in-degree, out-degree, clustering coefficient, core degree and betweenness centrality of a source node are added to the network flow node interaction graph as additional information of the source node.

[0077] S260, converting the source-directed edges in the network flow node interaction graph into nodes and constructing an edge-node graph.

[0078] The edge-node graph can refer to a new graph formed by converting edges in the network flow node interaction graph into nodes. Specifically, the source-directed edges are converted into new nodes, and the source nodes of the source-directed edges and the source nodes pointed to are converted into new directed edges. According to the new nodes and the new directed edges, the edge-node graph is formed. In fact, the directed edges of the network flow node interaction graph are nodes in the edge-node graph.

[0079] Optionally, the converting the source-directed edges in the network flow node interaction graph into nodes and constructing an edge-node graph comprises: extracting the source-directed edges from the network flow node interaction graph and determining them as edge nodes; in the network flow node interaction graph, when two source-directed edges point to the same source node, determining the same source node as an edge-directed edge between the two edge nodes formed by the two source-directed edges, and the pointing direction is bidirectional; in the network flow node interaction graph, when a first source node pointed to by a first source-directed edge has a second source-directed edge, and the second source-directed edge points to a second source node, determining the first source node as an edge-directed edge between the edge node formed by the first source-directed edge and the edge node formed by the second source-directed edge, and the pointing direction is from the edge node formed by the first source-directed edge to the edge node formed by the second source-directed edge; wherein the first source node and the second source node are different; generating an edge-node graph according to each edge node and the directed edges of the edge nodes.

[0080] The source-directed edges in the network flow node interaction graph are determined as edge nodes. One source-directed edge forms one edge node. The edge node is a node in the edge-node graph. The edge-directed edge is a directed edge in the edge-node graph.

[0081] The source node in the network flow node interaction graph is converted into an edge pointing edge. There are usually two cases. 1. There are two source nodes sending data packets to the same source node, that is, there are two source pointing edges pointing to the same source node, at this time, the two source pointing edges are respectively converted into edge nodes, and the same source node is used as the edge pointing edge between the two edge nodes obtained by conversion, and the direction of the edge pointing edge is bidirectional. It should be noted that there may be more than two source pointing edges pointing to the same source node, at this time, two source pointing edges can be extracted to form multiple source groups, each source group is different, and the edge nodes converted from the two source pointing edges in each source group are all formed into bidirectional edge pointing edges according to the same source node. 2. There is a third source node sending data packets to the first source node, and the first source node sends data packets to the second source node, that is, there is a first source pointing edge pointing to the first source node, and the first source node has a second source pointing edge pointing to the second source node; wherein the first source node, the second source node and the third source node are different, and the first source pointing edge and the second source pointing edge are different. At this time, the first source pointing edge and the second source pointing edge respectively form two edge nodes, and the first source node is converted into an edge pointing edge between the two edge nodes, and the direction of the edge pointing edge is that the edge node formed by the first source pointing edge points to the edge node formed by the second source pointing edge.

[0082] By converting edges into nodes and nodes into edges according to different structures of source nodes and source pointing edges in the network flow node interaction graph, the establishment of the edge node graph can be accurately realized, the accuracy of the edge node graph can be improved, the information of the edges can be accurately and completely presented in the form of nodes, and the edge features can be accurately extracted to be input into a model for detection, thereby improving the accuracy of malware detection.

[0083] S270, adding the traffic statistical features to the edge node graph.

[0084] The traffic statistical features of one source pointing edge are added to the edge node graph as additional information of the corresponding node in the edge node graph.

[0085] S280, inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model to detect whether the target software is malicious software.

[0086] The software classification model is used for processing the graph, and according to the network flow node interaction graph and the edge node graph of the target software, whether the target software is malicious software is detected, and in addition, the software classification model can also detect the type of malicious software. The software classification model can be a graph network model. For example, a graph neural network (GNN), more specifically, a GGNN (Gated Graph Sequence Neural Networks), a GAT (Graph Attention Networks) or a GCN (Graph Convolutional Network) and the like.

[0087] Most graph neural network models are based on message passing to aggregate neighbors and update node information. In the graph network model, the features of the nodes can be fully learned, but it is usually difficult to learn the features of the edges, that is, the important features of a large number of edges in the network flow node interaction graph are not fully utilized. By converting the edges in the network flow node interaction graph into nodes to obtain an edge node graph, and inputting the edge node graph into the graph network model for detection, the rich features of the edges in the network flow node interaction graph can be learned, and the detection accuracy of the graph network model can be improved.

[0088] According to the embodiment of the present application, by converting the edges in the network flow node interaction graph into nodes to obtain an edge node graph, and inputting the edge node graph into the software classification model for detection, the rich features of the edges in the network flow node interaction graph can be learned, and the detection accuracy of the graph network model can be improved.

[0089] Embodiment three

[0090] Figures 3a-3bA flowchart of a malware detection method provided for the third embodiment of the present application. The embodiment of the present application further specifies the "extracting the node structure features of the target software from the network flow node interaction graph of the target software, and obtaining the traffic statistical features corresponding to the network flow node interaction graph" as "obtaining the node structure features of the target software according to the network flow node interaction graph of the target software; obtaining the traffic statistical features corresponding to the network flow node interaction graph from the network traffic data of the target software". The "detecting whether the target software is malicious software according to the node structure features of the target software and the traffic statistical features" is specified as "adding the node structure features to the network flow node interaction graph; converting the source pointing edges in the network flow node interaction graph into nodes and constructing an edge node graph; adding the traffic statistical features to the edge node graph; inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model to detect whether the target software is malicious software". The "inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model to detect whether the target software is malicious software" is specified as "inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model, the software classification model including at least two layers of feature extraction networks connected in series; performing feature extraction on the network flow node interaction graph and the edge node graph through the first feature extraction network in the software classification model and outputting intermediate feature vectors and intermediate output features; processing the intermediate output features output by the previous feature extraction network through the intermediate feature extraction networks other than the first feature extraction network in the software classification model and outputting intermediate feature vectors and intermediate output features; processing the intermediate output features output by the previous feature extraction network through the last feature extraction network in the software classification model and outputting intermediate feature vectors; fusing the intermediate feature vectors output by each feature extraction network through the feature fusion layer in the software classification model; classifying the result obtained by fusion through the classification layer in the software classification model to detect whether the target software is malicious software".

[0091] Referring to Figures 3a-3b The malware detection method shown comprises:

[0092] It should be noted that the parts not described in detail in the embodiments of the present application can be referred to the descriptions of other embodiments.

[0093] S3010, obtaining network traffic data of a target software, the network traffic data including network traffic of the target software in at least one time period.

[0094] S3020, constructing a network flow node interaction graph of the target software according to the network traffic data of the target software.

[0095] S3030, obtaining node structure features of the target software according to the network flow node interaction graph of the target software.

[0096] S3040, obtaining flow statistics features corresponding to the network flow node interaction graph from network flow data of the target software.

[0097] S3050, adding the node structure features to the network flow node interaction graph.

[0098] S3060, converting source pointing edges in the network flow node interaction graph into nodes and constructing an edge node graph.

[0099] S3070, adding the flow statistics features to the edge node graph.

[0100] S3080, inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model, the software classification model including at least two layers of concatenated feature extraction networks.

[0101] The software classification model can include a plurality of feature extraction networks, a feature fusion layer and a classification layer. The feature extraction network is used for feature extraction of the input data. The feature fusion layer is used for fusing the extracted features. The classification layer is used for processing the input data, and classifying to obtain normal software or malicious software, and can also obtain software types of malicious software. Exemplarily, the feature extraction network includes GAT. The at least two layers of concatenated feature extraction networks can be that the output of a previous feature extraction network can be used as the input of a subsequent feature extraction network.

[0102] S3090, performing feature extraction on the network flow node interaction graph and the edge node graph by a first feature extraction network in the software classification model, and outputting an intermediate feature vector and an intermediate output feature.

[0103] The output of the feature extraction network includes the intermediate feature vector. The output of the feature extraction network other than the last feature extraction network also includes the intermediate output feature. The intermediate feature vector is used for fusion and classification to obtain a malicious software detection result. The intermediate output feature is used for input to a subsequent feature extraction network for feature extraction. The intermediate output feature can include output features of the network flow node interaction graph and output features of the edge node graph.

[0104] Exemplarily, the feature extraction network can include two parallel GATs, one of which is used to process information of the network flow node interaction graph, and the other of which is used to process information of the edge node graph.

[0105] S3100, processing the intermediate output features output by the previous feature extraction network through the intermediate feature extraction network in the software classification model other than the first feature extraction network, and outputting an intermediate feature vector and the intermediate output features.

[0106] In fact, after processing by multiple feature extraction networks, the output features of the network flow node interaction graph are fused with the information of the edge node graph in the intermediate output features, and the output features of the edge node graph are fused with the information of the network flow node interaction graph.

[0107] S3110, processing the intermediate output features output by the previous feature extraction network through the last feature extraction network in the software classification model, and outputting an intermediate feature vector.

[0108] S3120, fusing the intermediate feature vectors output by each feature extraction network through the feature fusion layer in the software classification model.

[0109] The feature fusion layer is used to fuse the intermediate feature vectors output by all feature extraction networks. For example, the feature fusion layer can splice each intermediate feature vector.

[0110] S3130, classifying the fused result through the classification layer in the software classification model to detect whether the target software is malicious software.

[0111] The classification layer can include a fully connected layer and an activation function (softmax). It is used to classify the fusion result to obtain the detection result of malicious software and the type of software.

[0112] Optionally, the training step of the software classification model is as follows: obtaining training data, the training data including network traffic of a sample software in at least one time period and a true value of whether the sample software is malicious software; the number of sample softwares is at least one; in the training data, extracting network traffic of the sample number of time periods of the same sample software; wherein the traffic quantity of the sample number of time periods of network traffic is greater than or equal to a preset traffic quantity threshold; constructing a network flow node interaction graph of the sample software according to the network traffic of the sample number of time periods; extracting node structure features of the sample software from the network flow node interaction graph of the sample software; obtaining traffic statistical features corresponding to the network flow node interaction graph of the sample software in the network traffic of the sample number of time periods; determining a training sample according to the node structure features and the traffic statistical features of the sample software and the true value of whether the sample software is malicious software; inputting the training sample into the software classification model, training the software classification model, and calculating a training loss value; returning to the step of extracting network traffic of the sample number of time periods of the same sample software in the training data until the training loss value meets a training completion condition, and determining that the software classification model training is completed.

[0113] The training data includes network traffic of a certain sample software in multiple time periods, which can be divided to obtain multiple network traffic groups of the sample software. The multiple network traffic groups of the sample software only include network traffic of the sample software and do not include network traffic of other sample softwares. That is, the number of sample softwares corresponding to the network traffic of one network traffic group is one. The traffic quantity of the network traffic included in one network traffic group is greater than or equal to a preset traffic quantity threshold. One network traffic group and the true value of whether the sample software is malicious software form one training sample. Therefore, the training data can obtain multiple training samples, greatly reducing the generation cost of the training samples and improving the generation efficiency of the training samples. In addition, the software classification model can also detect the type of malicious software, and the software type of the sample software can also be added to the training sample to train the software classification model, thereby increasing the detection function of the software type of the software classification model.

[0114] In addition, the training data can also include network traffic of multiple sample softwares, and multiple training samples of each sample software can be generated respectively to obtain training samples of different sample softwares.

[0115] The training completion condition can be that a loss function converges or is minimum, a number of training times is greater than or equal to a preset number threshold, or an accuracy of a verification set is greater than or equal to a preset accuracy threshold (samples of the training set are used for training, and samples of the verification set are used for detecting whether the model is trained) and the like. The loss function can represent a difference between a detection result output by the software classification model and a true value.

[0116] By splitting the training data according to time to form multiple training samples, the number and representativeness of the training samples can be increased, the generation complexity and cost of the training samples can be reduced, the training efficiency can be improved, a well-performing model can be trained on a data set with a low label rate, the detection accuracy of the model is improved, and thus the detection accuracy of the malware is improved.

[0117] The embodiment of the application can increase the richness and representativeness of the node features and edge features by using the multi-layer feature extraction network to extract graph features, and thus the detection accuracy of the malware is improved.

[0118] Embodiment four

[0119] Figures 4a-4f A scenario diagram of a malware detection method provided by the fourth embodiment of the application.

[0120] Figure 4a The scenario diagram of the malware detection method mainly includes two parts. A NFNI (Network Flows Node Interactions) is constructed, and a node interaction graph based on a time interval is used to represent an original flow. The other part is a graph neural network model MGATMg (Multiple layer Graph Attention Merge) for detection, which can detect Android malware and classify the malware.

[0121] First, network traffic of target software is captured, and a PCAP file is formed. All PCAP files are read iteratively, and IP layer protocols are parsed, and the protocols are divided into Ipv4 or Ipv6 protocols. Then, HTTP, TCP and UDP in Ipv4 and Ipv6 are parsed respectively. Finally, multiple features related to network flow behaviors are obtained and stored as CSV files.

[0122] In most cases, human or software-induced malicious behavior accounts for only a small fraction of the entire network traffic and occurs for a short period of time. Whether it is malicious software or benign software, most of the time the network behavior is stable, while the malicious software will show network behavior that does not match its software function within a certain time interval, and the network behavior of the malicious software will be particularly active during this time interval. Therefore, slicing the traffic by time forms a series of short time interval NFNI to pay more attention to the traffic behavior of the time period and speed up the training time of the MGATMg model.

[0123] The embodiment of the present application represents the information of the flow F and its interaction behavior by a directed graph structure capable of representing more details, which is defined as a network flow node interaction graph NFNI.

[0124] Definition (network flow node interaction graph): A NFNI is defined as a triple, NFNI=(V, E, T); V is a set of vertices. Each v∈V is defined as a 5-tuple string (source IP, destination IP, source port, destination port and protocol), representing the structural information of the flow. E is a set of edges. Each e∈E is defined as a string including 45 statistical features, representing the detailed behavior information of the flow through E. T is a set of time series. Each t∈T is represented as the timestamp and duration of the flow. Wherein, T{t1, t2, t3…t i , t i+1 …t n}, the duration between t i and t i+1 is the duration of the time period in the foregoing embodiment.

[0125] After defining the NFNI in detail, a set of NFNI can be constructed. Specifically, input the network traffic data of the timestamp, five-tuple and flow behavior features. Output the set G of network flow node interaction graphs NFNI, specifically g i (V, E). Initialize V and E, the time period duration constant T1, the constant K and n=1. Sort the flows according to the timestamp to obtain the start time t1 and the end time t n . In the network traffic in the sequentially arranged multiple time periods, obtain the network traffic in a time period and count the number of five-tuples in the obtained time period. When the number of five-tuples is greater than or equal to the preset flow quantity threshold, the network traffic of the target number of time periods is obtained; when it is less than the preset flow quantity threshold, the network traffic of the next time period is obtained and is added to the network traffic of the historically obtained time period for counting to obtain the number of new five-tuples, until the number of new five-tuples is greater than or equal to the preset flow quantity threshold.

[0126] Determine the source IP in the five-tuple as a node v and add it to the set V{v iThe quintuple containing node v is identified as additional information for node v and added to V. Based on the target IP of the quintuple containing the source IP node v, a pointing edge is generated between the source IP node v and the target IP node v, with the direction pointing towards the target IP node v. This pointing edge is identified as e and added to E. The traffic statistics characteristics of this pointing edge are also added to E as additional information for the edge.

[0127] After generating nodes and edges for each quintuple within the target number of time periods, the v value is counted. i The node structure features, such as in-degree, out-degree, clustering coefficient, core degree, and betweenness centrality, are used as v. i Additional information is added to V. Nodes and edges are iteratively added to g. i (V, E), within the target number of time intervals, all 5-tuples generate corresponding nodes and edges to end, and g i (V, E) are added to set G.

[0128] In practice, experiments have shown that it is difficult to identify differences in the overall network flow node interaction graphs of different software over a long period (e.g., a day). Furthermore, applying graph neural networks to large graphs containing a large amount of node and edge information increases the time and space consumption of training. For example, the traffic behavior generated by two malware families from the Dowgin family and the Jisut family malware was analyzed, and NFNIs were constructed. Many similar NFNIs were found, and the malicious traffic behavior was also very similar over certain time periods. The NFNIs of the Jisut family malware traffic show that it is more likely to send payloads from one IP port to multiple IP address ports. Therefore, graph neural networks can be applied to aggregate neighborhoods to detect malware and classify malware categories. In addition, traffic generated by benign software mainly serves as payload receiving data from multiple IP addresses (…). Figure 4b (Left image) or simply interact between two or more IPs ( Figure 4b (As shown in the right image) is executed by [the malware], and the traffic generated by the malware can also be sent from one IP to other IPs via multiple payloads. Figure 4c (Left image) or by performing a large number of interactions between two IPs on multiple ports ( Figure 4c The right-hand image in the diagram represents the network flow itself. Figure 4b and Figure 4c In this representation, circles represent IP addresses and squares represent ports. Therefore, NFNI can effectively represent network flows and their behavior.

[0129] Most graph neural network models are based on message passing to aggregate neighbors and update node information. This method learns node features well, but a large number of important features existing in the edges of the NFNI graph are not fully utilized. For this reason, edges are converted into nodes to learn the rich features on the edges. The conversion rule is as shown in Figure 4d and Figure 4e The network flow node interaction graph and the edge node graph are both directed graphs, and the network flow node interaction graph is from the NFNI graph G(v, e), and the edge node graph is converted from the network flow node interaction graph. The conversion rule is:

[0130] (1) Each node in EG is an edge e of G;

[0131] (2) If a node v in G has an out-degree and an in-degree, the in-degree edge node has an edge pointing to the out-degree edge node As shown in Figure 4d , the source pointing edge e 12 in the NFNI graph is converted into the edge node v 12 , the source pointing edge e 25 is converted into the edge node v 25 , the source pointing edge e 12 points to the source node v2, and the source node v2 has a source pointing edge e 25 , all of which point to other source nodes, and the pointing edge between the edge node v 12 and the edge node v 52 is the edge pointing edge e2 formed by the source node v2, and the direction is v 12 points to v 25 .

[0132] (3) When e1 and e2 in G both point to a node, the edge nodes and in EG have adjacent edges. As shown in Figure 4e , the source pointing edge e 12 in the NFNI graph is converted into the edge node v 12 , the source pointing edge e 52 is converted into the edge node v 52 , the source pointing edge e 12 and the source pointing edge e 52 both point to the source node v2, and the pointing edge between the edge node v 12 and the edge node v 52 is the edge pointing edge e2 formed by the source node v2, and the direction is v 12 points to v 52 and v 52 points to v 12 , that is, bidirectional pointing.

[0133] In G(v, e) and the node features are kept and the edge features are replaced by the presence of an edge. To improve the recognition of the model, the in-degree and out-degree of the node are connected to the node features to enhance the importance of the node, as shown in equation (1):

[0134]

[0135] where x i is the node, do ut -(v i ) is the out-degree, d in+ (v i ) is the in-degree, denotes the node that merges the out-degree and in-degree of the node.

[0136] Now, there are the original graph G(v, e) from the NFNI and the graph wherein, for G(v, e) and there are where N and F H denote the number of nodes and the feature dimension of G(v, e). where M and F E denote the number of nodes and the feature dimension of .

[0137] Next, as shown in Figure 4f , the network flow node interaction graph NFNI G(v, e) and the edge node graph are input into the software classification model, which includes at least two feature extraction networks, and the number of feature extraction networks is two as an example. The feature extraction network includes two GATs, as shown in Figure 4f , one of which processes one input, and the other processes the other input, and two outputs are obtained, which are the output features of the network flow node interaction graph and the edge node graph, respectively, and determine the intermediate output features of the feature extraction network. The two intermediate output features are fused to obtain an intermediate feature vector. The intermediate output features of the feature extraction network are input into the next feature extraction network as input, and similarly, in the next feature extraction network, one GAT processes the output features of the network flow node interaction graph, and the other GAT processes the output features of the edge node graph. Finally, the intermediate feature vectors output by each feature extraction network are input into the feature fusion layer for splicing and fusion, and the fusion result is input into the classification layer, and through the fully connected layer and the softmax classification, the classification of benign software or malicious software, and the software type of the malicious software are obtained.

[0138] The NFNI graph is extended to edge node graph. The network flow node interaction graph contains five-tuple features and structure features, and the edge node graph is formed by transforming the rich features of the edges in the NFNI graph into node features.

[0139] H and are input into the GAT network for learning. For the network flow node interaction graph part, the is taken as input. To realize the corresponding input-output transformation, a weight matrix W ∈ R F’×F needs to be trained for all nodes. This weight matrix W is the relationship between the input features F and the output high-level features F'. For each node i, the coefficient between its first-order neighbor j (j ∈ N i ) and itself is calculated, as shown in formula 2.

[0140]

[0141] a is the attention coefficient, s ij is the importance index of the feature of node j to node i. The attention coefficient is normalized using the softmax function, and LeakyReLU is used as the activation function. The whole process is shown in formula 3.

[0142]

[0143] || is the concatenation operation, a ij is the weight vector.

[0144] In order to stabilize the self-attention learning process, formula (4) is executed to realize K-head attention mechanism, and in order to reduce the dimension of F', the average operation is adopted instead of the connection operation.

[0145]

[0146] where is the weight coefficient calculated by the kth group of attention mechanism. W k is the corresponding input linear transformation matrix, and the final output node feature vector also contains F' features.

[0147] For the edge node graph part, the same operation as described above is performed, and the output is

[0148] In the GAT layer, the node graph and the edge node graph of the NFNI are modeled to obtain the output H' and H' node as input after GAT, edge node as input after GAT.

[0149] However, the nodes and edges in the NFNI graph have dependencies, but now only the features of the nodes and edges are learned respectively. Therefore, cross attention is considered to be applied to fuse the features of the nodes and edges to construct the relationship between the node graph and the edge node graph. Since Therefore, the dimensions are aligned according to the dependencies between the nodes v and the edges e in G, that is, EGin the formula (5). ) in G. Then, the formula (5) is obtained.

[0150]

[0151] Where σ is the softmax normalized attention coefficient, W Q is calculated from W K and W V are calculated from H'. W Q , W K and W V are weight matrices, and then the attention matrix is obtained from crossH' is calculated by the formula (6).

[0152]

[0153] Where σ is the softmax normalized attention coefficient, W Q is calculated from H', W K and W V are calculated from Then, the attention matrix is obtained from The set is obtained, is the serial fusion of crossH' and and crossH' are two-way outputs of GATs, and are intermediate output features of GATs, The result obtained by fusing and crossH' is taken as the intermediate feature vector of GATs.

[0154] After the NFNI-MGATMg performs multi-layer GAT-Mg, the connection results are as follows.

[0155]

[0156] Where H* is the result obtained after connection, is the output result of the i-th GAT-Mg.

[0157] ​After fusing the results of each GAT-Mg, a linear transformation of GAT-Mg is implemented using a fully connected neural network. Then, a softmax function is applied to receive a probability vector of the malware classification possibility The formula is shown as follows (8).

[0158]

[0159] The softmax function output obtains the benign / malware classification result or the malware category classification result.

[0160] During training, the cross-entropy loss is used as the loss function of the model. This function is commonly used for multi-classification problems to obtain the loss loss between the true value and the predicted label, as shown in formula (9).

[0161]

[0162] Where B is the batch size of training, and y is the true label. The Adam optimizer is also used for effective stochastic optimization.

[0163] The embodiment of the application constructs a novel network flow node interaction graph NFNI, slices the original network traffic according to a time interval, and extracts features in the time interval to form a node graph and an edge node graph. This time interval-based node interaction graph provides a basis for fast malware detection based on graphs. Meanwhile, MGATMg (Multiple layer Graph Attention Merge) is proposed, which is a multi-layer GAT-Mg model based on a graph attention neural network method, and is first used for malware detection and category classification. Each GAT-Mg can fuse the learned node and edge features. And extensive experiments are provided on a popular Android malware detection dataset to compare the NFNI-MGATMg framework with flow-based Android malware detection models and graph neural network models.

[0164] Embodiment five

[0165] Figure 5 A structural schematic diagram of a malware detection device provided by the embodiment five of the application. The embodiment of the application can be applicable to the detection of malware. The device can execute a malware detection method. The device can be realized in the form of hardware and / or software. The device can be configured in an electronic device carrying a function with a certain data operation capability.

[0166] Referring to Figure 5 The malware detection device shown in the figure comprises:

[0167] The network flow acquisition module 501 is configured to acquire network flow data of the target software, wherein the network flow data comprises network flow of the target software in at least one time period.

[0168] The node interaction graph construction module 502 is configured to construct a network flow node interaction graph of the target software according to the network flow data of the target software.

[0169] The feature extraction module 503 is configured to extract node structure features of the target software from the network flow node interaction graph of the target software, and acquire flow statistical features corresponding to the network flow node interaction graph.

[0170] The software type detection module 504 is configured to detect whether the target software is malicious software according to the node structure features of the target software and the flow statistical features.

[0171] In an optional embodiment of the present application, the node interaction graph construction module 502 comprises: a flow segmentation unit configured to extract network flow of a target number of time periods from the network flow data of the target software, wherein the flow quantity of the network flow of the target number of time periods is greater than or equal to a preset flow quantity threshold; wherein the network flow data is obtained by collecting network flow of the target software through periodic interval time periods; and a segment establishment unit configured to construct the network flow node interaction graph of the target software according to the network flow of the target number of time periods.

[0172] In an optional embodiment of the present application, the network flow data comprises five-tuples; the flow quantity is the number of five-tuples; and the segment establishment unit comprises: a node edge generation subunit configured to determine source identification and target identification in the five-tuples as source nodes for the five-tuples in the target number of time periods, and generate a source pointing edge of a source node formed by the source identification pointing to a source node formed by the target identification; a five-tuple addition subunit configured to add the five-tuples to the source node formed by the source identification; and a node graph generation subunit configured to generate the network flow node interaction graph of the target software from each source node and the source pointing edge between each source node in the target number of time periods.

[0173] In an optional embodiment of the present application, the feature extraction module 503 comprises: a node feature acquisition unit configured to acquire node structure features of the target software according to the network flow node interaction graph of the target software; and a traffic feature acquisition unit configured to acquire traffic statistical features corresponding to the network flow node interaction graph from the network traffic data of the target software. The software type detection module 504 comprises: a node feature adding unit configured to add the node structure features to the network flow node interaction graph; an edge node graph construction unit configured to convert source-directed edges in the network flow node interaction graph into nodes and construct an edge node graph; a traffic feature adding unit configured to add the traffic statistical features to the edge node graph; and a software detection unit configured to input the network flow node interaction graph and the edge node graph into a pre-trained software classification model to detect whether the target software is malicious software.

[0174] In an optional embodiment of the present application, the software detection unit comprises: a model input subunit configured to input the network flow node interaction graph and the edge node graph into a pre-trained software classification model, the software classification model comprising at least two layers of feature extraction networks concatenated with each other; a first feature extraction network in the software classification model, configured to perform feature extraction on the network flow node interaction graph and the edge node graph and output an intermediate feature vector and an intermediate output feature; intermediate feature extraction networks other than the first feature extraction network in the software classification model, configured to process the intermediate output feature output by a previous feature extraction network and output an intermediate feature vector and an intermediate output feature; a last feature extraction network in the software classification model, configured to process the intermediate output feature output by a previous feature extraction network and output an intermediate feature vector; a feature fusion layer in the software classification model, configured to fuse the intermediate feature vectors output by the feature extraction networks; and a classification layer in the software classification model, configured to classify the result obtained by fusion to detect whether the target software is malicious software.

[0175] In an optional embodiment of the present application, the malware detection apparatus further comprises a training module configured to: obtain training data, wherein the training data comprises network traffic of a sample software in at least one time period and true values of whether the sample software is malware; the number of the sample software is at least one; in the training data, extract network traffic of a sample number of time periods of the same sample software; wherein the number of the sample number of time periods of network traffic is greater than or equal to a preset traffic number threshold; construct a network flow node interaction graph of the sample software according to the sample number of time periods of network traffic; extract node structure features of the sample software from the network flow node interaction graph of the sample software; obtain traffic statistical features corresponding to the network flow node interaction graph of the sample software in the sample number of time periods of network traffic; determine training samples according to the node structure features and the traffic statistical features of the sample software and the true values of whether the sample software is malware; input the training samples into a software classification model to train the software classification model and calculate a training loss value; return to the step of extracting network traffic of a sample number of time periods of the same sample software in the training data until the training loss value meets a training completion condition, and determine that the training of the software classification model is completed.

[0176] In an optional embodiment of the present application, the edge node graph construction unit comprises: an edge node conversion subunit configured to extract source-directed edges from the network flow node interaction graph and determine the source-directed edges as edge nodes; a same-source-directed conversion subunit configured to, in the network flow node interaction graph, when two source-directed edges point to the same source node, determine the same source node as an edge-directed edge between two edge nodes formed by the two source-directed edges, and the pointing direction is bidirectional; a continuous-directed conversion subunit configured to, in the network flow node interaction graph, when a first source node pointed to by a first source-directed edge exists a second source-directed edge, and the second source-directed edge points to a second source node, determine the first source node as an edge-directed edge between an edge node formed by the first source-directed edge and an edge node formed by the second source-directed edge, and the pointing direction is from the edge node formed by the first source-directed edge to the edge node formed by the second source-directed edge; wherein the first source node and the second source node are different; and a boundary point graph generation subunit configured to generate an edge node graph according to each edge node and the edge-directed edge of the edge node.

[0177] The malware detection apparatus provided by the embodiments of the present application can perform the malware detection method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0178] The acquisition, storage and application of network traffic and the like involved in the technical solutions of the embodiments of the present application comply with relevant laws and regulations and do not violate public order and good customs.

[0179] Embodiment six

[0180] Figure 6 A structural schematic diagram of an electronic device 600 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present application described and / or claimed in this document.

[0181] As shown in Figure 6 The electronic device 600 includes at least one processor 601 and memory, such as read-only memory (ROM) 602, random access memory (RAM) 603, etc., communicatively connected to the at least one processor 601, where the memory stores computer programs executable by the at least one processor. The processor 601 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 602 or loaded into the random access memory (RAM) 603 from the storage unit 608. Various programs and data required for operation of the electronic device 600 can also be stored in the RAM 603. The processor 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0182] Various components in the electronic device 600 are connected to the I / O interface 605, including an input unit 606, such as a keyboard, a mouse, etc., an output unit 607, such as various types of displays, a speaker, etc., a storage unit 608, such as a magnetic disk, an optical disk, etc., and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0183] The processor 601 can be various general-purpose and / or special-purpose processing components having processing and computing capabilities. Some examples of the processor 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, and the like. The processor 601 performs various methods and processes described above, such as the power distribution network line planning method.

[0184] In some embodiments, the power distribution network line planning method can be implemented as a computer program tangibly embodied in a computer readable storage medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded onto the RAM 603 and executed by the processor 601, one or more steps of the power distribution network line planning method described above can be performed. Alternatively, in other embodiments, the processor 601 can be configured to perform the power distribution network line planning method by any other suitable means, such as by means of firmware.

[0185] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0186] Computer programs used to implement the methods of the application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program, when executed, implements the functions / acts specified in the flowcharts and / or block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, and partially on a machine or a remote machine or a server.

[0187] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0188] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0189] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), blockchain network, and the Internet.

[0190] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS (Virtual Private Server) service.

[0191] It should be understood that the various forms of flow shown above can be reordered, added to, or have steps deleted. For example, the steps described in the present application can be performed in parallel, in series, or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which are not limited herein.

[0192] The above detailed description does not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting malicious software, characterized in that, The method includes: Acquire network traffic data of the target software, wherein the network traffic data includes the network traffic of the target software during at least one time period; Based on the network traffic data of the target software, a network flow node interaction graph of the target software is constructed; the network traffic data includes a quintuple, and the network flow node interaction graph includes source nodes and source-pointing edges between source nodes. The source node is formed by the source identifier and the target identifier in the quintuple, and the source-pointing edge indicates that the source node formed by the source identifier in the quintuple points to the source node formed by the target identifier. Extract the node structure features of the target software from the network flow node interaction graph of the target software, and obtain the traffic statistics features corresponding to the network flow node interaction graph; Based on the node structure characteristics and traffic statistics characteristics of the target software, detect whether the target software is malicious software; The step of extracting the node structure features of the target software from the network flow node interaction graph of the target software and obtaining the traffic statistics features corresponding to the network flow node interaction graph includes: Based on the network flow node interaction graph of the target software, obtain the node structure characteristics of the target software; From the network traffic data of the target software, obtain the traffic statistics features corresponding to the network flow node interaction graph; The step of detecting whether the target software is malicious software based on the node structure characteristics and traffic statistics characteristics of the target software includes: Add the node structure features to the network flow node interaction graph; Convert the source-pointing edges in the network flow node interaction graph into nodes and construct an edge-node graph; Add the traffic statistics features to the edge node graph; The network flow node interaction graph and the edge node graph are input into a pre-trained software classification model to detect whether the target software is malicious software.

2. The method according to claim 1, characterized in that, The step of constructing the network flow node interaction graph of the target software based on the network traffic data of the target software includes: From the network traffic data of the target software, network traffic for a target number of time periods is extracted, wherein the amount of network traffic for the target number of time periods is greater than or equal to a preset traffic threshold; wherein, the network traffic data is obtained by collecting the network traffic of the target software at periodic intervals. Based on the network traffic over the target time period, construct the network flow node interaction graph of the target software.

3. The method according to claim 2, characterized in that, The network traffic data includes: quintuples; the number of traffic items is the number of quintuples. The step of constructing the network flow node interaction graph of the target software based on the network traffic data of the target software includes: For the five-tuples within the time period of the target number, the source identifier and the target identifier in the five-tuple are determined as source nodes, and a source pointing edge is generated from the source node formed by the source identifier to the source node formed by the target identifier. Add the quintuple to the source node formed by the source identifier in the quintuple; The network flow node interaction graph of the target software is generated by generating each source node and the source-pointing edges between each source node within the target number of time periods.

4. The method according to claim 1, characterized in that, The step of inputting the network flow node interaction graph and the edge node graph into a pre-trained software classification model to detect whether the target software is malicious software includes: The network flow node interaction graph and the edge node graph are input into a pre-trained software classification model, which includes at least two concatenated feature extraction networks. The first feature extraction network in the software classification model is used to extract features from the network flow node interaction graph and the edge node graph, and outputs intermediate feature vectors and intermediate output features. The intermediate feature extraction networks, excluding the first feature extraction network, in the software classification model process the intermediate output features of the previous feature extraction network and output intermediate feature vectors and intermediate output features. The software classification model uses the last feature extraction network to process the intermediate output features of the previous feature extraction network and outputs an intermediate feature vector. The intermediate feature vectors output by each feature extraction network are fused through the feature fusion layer in the software classification model. The fusion results are classified using the classification layer in the software classification model to detect whether the target software is malicious software.

5. The method according to claim 1, characterized in that, The training steps for the software classification model are as follows: Acquire training data, which includes network traffic of sample software over at least one time period and ground truth values ​​for whether the sample software is malware; the number of sample software is at least one. In the training data, network traffic for a time period of the same sample software is extracted; wherein, the network traffic volume for the time period of the sample number is greater than or equal to a preset traffic volume threshold. Based on the network traffic over a time period of the sample size, construct the network flow node interaction graph of the sample software; Extract the node structure features of the sample software from the network flow node interaction graph of the sample software; Obtain the traffic statistics features corresponding to the network flow node interaction graph of the sample software within the network traffic of the time period of the sample size; Based on the node structure characteristics and traffic statistics characteristics of the sample software, and the ground truth of whether the sample software is malicious software, it is determined as a training sample; The training samples are input into the software classification model to train the software classification model, and the training loss value is calculated. Return to the step of extracting network traffic for a time period of the same software sample from the training data, until the training loss value meets the training completion condition, and determine that the software classification model training is complete.

6. The method according to claim 1, characterized in that, The step of converting source-pointing edges in the network flow node interaction graph into nodes and constructing an edge-node graph includes: Extract the source-pointing edge from the network flow node interaction graph and identify it as an edge node; In the network flow node interaction graph, when two source pointing edges point to the same source node, the same source node is determined as the edge pointing edge between the two edge nodes formed by the two source pointing edges, and the pointing direction is bidirectional. In the network flow node interaction graph, when a first source node pointed to by a first source pointing edge has a second source pointing edge, and the second source pointing edge points to a second source node, the first source node is determined as an edge pointing edge between the edge node formed by the first source pointing edge and the edge node formed by the second source pointing edge, and the pointing direction is from the edge node formed by the first source pointing edge to the edge node formed by the second source pointing edge; wherein, the first source node and the second source node are different. An edge node graph is generated based on each edge node and the edge it points to.

7. A malware detection device, characterized in that, include: A network traffic acquisition module is used to acquire network traffic data of the target software, wherein the network traffic data includes the network traffic of the target software in at least one time period. The node interaction graph construction module is used to construct the network flow node interaction graph of the target software based on the network traffic data of the target software; the network traffic data includes a 5-tuple, the network flow node interaction graph includes source nodes and source-pointing edges between source nodes, the source node is formed by the source identifier and the target identifier in the 5-tuple, and the source-pointing edge indicates that the source node formed by the source identifier in the 5-tuple points to the source node formed by the target identifier; The feature extraction module is used to extract the node structure features of the target software from the network flow node interaction graph of the target software, and obtain the traffic statistics features corresponding to the network flow node interaction graph; The software type detection module is used to detect whether the target software is malicious software based on the node structure characteristics and traffic statistics characteristics of the target software. The feature extraction module is specifically used for: Based on the network flow node interaction graph of the target software, obtain the node structure characteristics of the target software; From the network traffic data of the target software, obtain the traffic statistics features corresponding to the network flow node interaction graph; The software type detection module is specifically used for: Add the node structure features to the network flow node interaction graph; Convert the source-pointing edges in the network flow node interaction graph into nodes and construct an edge-node graph; Add the traffic statistics features to the edge node graph; The network flow node interaction graph and the edge node graph are input into a pre-trained software classification model to detect whether the target software is malicious software.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the malware detection method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the malware detection method according to any one of claims 1-6.

Images