A method and system for detecting malicious code in the Internet of Things based on graph neural network

Abstract

The present invention belongs to the technical field of malicious code detection and identification, and specifically relates to an Internet of Things malicious code detection method and system based on a graph neural network, comprising: obtaining an Internet of Things code data set; extracting data features of the obtained Internet of Things code data set to obtain a feature vector data set; considering virtual nodes, pruning the obtained feature vector data set to obtain a simplified graph structure; adding a skip node algorithm to a graph convolutional layer to construct a graph neural network detection model; and detecting Internet of Things malicious code based on the constructed graph neural network detection model and the simplified graph structure.

Description

Technical Field

[0001] The present invention belongs to the technical field of malicious code detection and identification, and specifically relates to a method and system for detecting malicious code in the Internet of Things based on a graph neural network. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of IoT technology, more and more devices, including smart home devices, wearable devices, and industrial control systems, are connected to the Internet. The popularity of IoT devices has brought convenience and efficiency improvements, but it has also caused serious security issues. In particular, IoT devices using the Android system have become the main target of malicious code attacks due to their openness and wide application. These malicious codes can exist in many forms, including but not limited to viruses, worms, Trojans, spyware, and ransomware. These malicious programs exploit security vulnerabilities in IoT devices to steal data, control devices, and perform distributed denial of service (DDoS) attacks, posing serious threats to personal privacy and organizational security. Therefore, exploring more efficient and accurate malicious code detection methods has become an important topic of current research.

[0004] Graph neural network is a branch of deep learning, which has shown strong capabilities in processing data sets with complex relational structures, such as social network analysis and chemical molecular structure prediction. In the field of malicious code detection, malicious code often performs its functions through complex network activities and process interactions, which can be modeled as graphs composed of nodes and edges. Graph neural networks can analyze malicious code by capturing the relationships between nodes and node attributes. However, when processing large-scale graph-structured data sets, it is not realistic to directly analyze them because the graph structure is relatively large and complex, especially for some IoT devices with scarce computing resources. In addition, there is a significant problem in the application of graph neural network models, namely the over-smoothing problem. As the number of network layers increases, the representation of nodes tends to be consistent, resulting in the loss of diversity of node features. This phenomenon affects the model's ability to distinguish, making subsequent learning tasks difficult. Therefore, it is very necessary to solve the over-smoothing problem of graph neural network models. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a method and system for detecting malicious code in the Internet of Things based on graph neural network. A graph pruning algorithm is used to simplify the graph structure, and a skip node algorithm is added to the graph convolution layer to improve the performance of the graph neural network model, thereby improving the detection efficiency while improving the accuracy of malicious code detection in the Internet of Things.

[0006] According to some embodiments, a first solution of the present invention provides an IoT malicious code detection method based on a graph neural network, which adopts the following technical solutions:

[0007] A method for detecting malicious code in the Internet of Things based on a graph neural network, comprising:

[0008] Get the IoT code dataset;

[0009] Extracting data features of the acquired IoT code data set to obtain a feature vector data set;

[0010] Considering virtual nodes, the obtained feature vector data set is pruned to obtain a simplified graph structure;

[0011] Add the skip node algorithm to the graph convolution layer to build a graph neural network detection model;

[0012] Based on the constructed graph neural network detection model and simplified graph structure, malicious code in the Internet of Things is detected.

[0013] As a further technical limitation, in the process of extracting data features of the acquired IoT code data set, an integrated tool is used to parse each file in the acquired data set and extract a function call graph of each sample.

[0014] Furthermore, based on the extracted function call graph, the relevant attributes of each node of the function call graph are allocated to obtain a feature vector corresponding to each node; and a feature vector data set is obtained according to the obtained feature vector corresponding to each node.

[0015] Furthermore, before pruning, virtual nodes are introduced, and bidirectional connections are established between the virtual nodes and each node. The importance of each node is updated iteratively according to the importance of neighboring nodes. After each iteration, the scores of all nodes are normalized so that the sum of the scores of all nodes remains unchanged. The iteration ends when and only when convergence occurs, and the virtual nodes are removed to obtain the final node importance score.

[0016] As a further technical limitation, during the pruning process, a network node sorting algorithm and a sensitive API are used to make a comprehensive judgment on whether to keep or remove nodes and edges in the feature vector data set, thereby completing the simplification of the feature vector data set and obtaining a simplified graph structure.

[0017] As a further technical limitation, a skip node module is added to the graph convolution layer, that is, a skip connection is added to each output layer of the graph neural network to generate a mask matrix in the output, so that the output features of the node features are directly replaced by the input features, and the unselected nodes are subjected to convolution operations to achieve the distinction between different node features, thereby completing the construction of the graph neural network detection model.

[0018] According to some embodiments, a second solution of the present invention provides an IoT malicious code detection system based on a graph neural network, which adopts the following technical solutions:

[0019] An IoT malicious code detection system based on graph neural network, comprising:

[0020] An acquisition module, configured to acquire an IoT code dataset;

[0021] An extraction module is configured to extract data features of the acquired IoT code data set to obtain a feature vector data set;

[0022] A pruning module is configured to consider virtual nodes and perform pruning processing on the obtained feature vector data set to obtain a simplified graph structure;

[0023] A modeling module, which is configured to add a skip node algorithm to the graph convolution layer to build a graph neural network detection model;

[0024] The detection module is configured to detect malicious code in the Internet of Things based on the constructed graph neural network detection model and the simplified graph structure.

[0025] According to some embodiments, a third solution of the present invention provides a computer-readable storage medium, which adopts the following technical solution:

[0026] A computer-readable storage medium stores a program thereon, which, when executed by a processor, implements the steps in the method for detecting malicious code in the Internet of Things based on a graph neural network as described in the first solution of the present invention.

[0027] According to some embodiments, a fourth solution of the present invention provides an electronic device, which adopts the following technical solution:

[0028] An electronic device comprises a memory, a processor and a program stored in the memory and running on the processor, wherein when the processor executes the program, the steps in the method for detecting malicious code in the Internet of Things based on a graph neural network as described in the first scheme of the present invention are implemented.

[0029] According to some embodiments, a fifth solution of the present invention provides a computer program product, which adopts the following technical solution:

[0030] A computer program product includes software code, wherein the program in the software code executes the steps in the method for detecting malicious code in the Internet of Things based on a graph neural network as described in the first embodiment of the present invention.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] The present invention extracts a feature vector dataset of an IoT code dataset to display the calling relationship between functions in an application program, thereby identifying malicious behavior; a graph pruning method is used to obtain a simplified graph structure, remove redundant and invalid information, alleviate the memory burden during training, and improve detection efficiency.

[0033] The present invention adds a skip node algorithm to the graph convolution layer, and makes some nodes skip the convolution operation by sampling, so as to prevent the problem of excessive smoothing due to too many intermediate layers in the model, thereby improving the performance of the model and improving the detection accuracy. This method only involves the operation of nodes, and compared with other solutions to the problems of excessive smoothing and gradient disappearance, it does not bring additional computational burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings in the specification that constitute a part of this embodiment are used to provide a further understanding of this embodiment. The schematic embodiments of this embodiment and their descriptions are used to explain this embodiment and do not constitute improper limitations on this embodiment.

[0035] Figure 1 This is a flow chart of the method for detecting malicious code in the Internet of Things based on graph neural network in Embodiment 1 of the present invention;

[0036] Figure 2 This is a framework diagram of the method for detecting malicious code in the Internet of Things based on a graph neural network in Embodiment 1 of the present invention;

[0037] Figure 3 A schematic diagram of the structure of data set acquisition in Embodiment 1 of the present invention;

[0038] Figure 4 This is a schematic diagram of the structure of the .dex file parsed in the first embodiment of the present invention;

[0039] Figure 5 It is a schematic diagram of a local structure of a function call graph in the first embodiment of the present invention;

[0040] Figure 6 Schematic diagram of the GCN network propagation process in the first embodiment of the present invention;

[0041] Figure 7 Schematic diagram of the node aggregation process of the GCN network in the first embodiment of the present invention;

[0042] Figure 8 is a schematic diagram of a jump node in the first embodiment of the present invention;

[0043] Fig. 9 This is a schematic diagram of the graph pruning in the first embodiment of the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0045] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0046] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0047] In the present invention, terms such as "upper", "lower", "left", "right", "front", "back", "vertical", "horizontal", "side", "bottom", etc. indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings. They are relational words determined only for the convenience of describing the structural relationships of the various parts or elements of the present invention, and do not specifically refer to any part or element in the present invention and should not be understood as limitations on the present invention.

[0048] In the present invention, terms such as "fixed connection", "connected", "connection", etc. should be understood in a broad sense, indicating that it can be fixedly connected, integrally connected or detachably connected; it can be directly connected or indirectly connected through an intermediate medium. For relevant scientific research or technical personnel in this field, the specific meanings of the above terms in the present invention can be determined according to specific circumstances, and they cannot be understood as limitations on the present invention.

[0049] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0050] Embodiment 1

[0051] Embodiment 1 of the present invention introduces a method for detecting malicious code in the Internet of Things based on a graph neural network.

[0052] like Figure 1 As shown, this embodiment provides an IoT malicious code detection method based on a graph neural network, comprising the following steps:

[0053] Step S01: Acquire and collect IoT code data sets, which include benign and malignant samples;

[0054] Step S02: using an integrated tool to parse each file in the acquired data set, extracting data features of the acquired data set, and obtaining a function call graph of each sample;

[0055] Step S03: Generate node-related feature vectors of the function call graph;

[0056] Step S04: prune the constructed data set to simplify the graph structure;

[0057] Step S05: adding a skip node algorithm to the graph convolution layer to construct a graph neural network detection model;

[0058] Step S06: Generate a malicious code detection training set based on the graph neural network detection model and the simplified graph structure, and train the constructed graph neural network model.

[0059] This embodiment combines Figure 2 The framework diagram of the IoT malicious code detection method based on graph neural network is shown in detail as follows:

[0060] As one or more implementation modes, in step S01, this embodiment uses an Android data set as shown in Table 1, where the benign samples are publicly provided by MalDroid and the malicious samples are publicly provided by drebin.

[0061] Table 1 Android dataset

[0062]

[0063] As one or more implementation modes, in step S02, construct Figure 3 The function call graph dataset shown: Android files contain the following components, namely Asset (original static file), Resources.arsc (resource index file), META-INF (signature file), Manifest.xml (system manifest file), Class.dex (application executable file), Lib (library file) and Res (compiled resource file), which together constitute a complete Android application; in the process of building the dataset, the Androguard tool needs to be used to parse the .dex file to extract the function call graph, and the API and opcode are used as its node attributes, and weights are assigned to them.

[0064] The .dex file contains the compiled code of the application, so as to extract the FCG function call graph. The structure of the .dex file is as follows Figure 4As shown in the figure, the .dex file contains three parts: file header, index area, and data area. The file header stores some basic information. The index area includes string, type, method prototype, domain, and method index, which is used to quickly find the specific location of string constants, type definitions, method prototypes, field declarations, and method implementations. The data area stores the actual class definition and related data content. When using the androguard tool for analysis, the index area and the class definition area of ​​the data area are mainly analyzed.

[0065] The FCG function call graph is a set of directed graphs, which can be represented as G(M,E); where M is the set of all nodes in the FCG function call graph, which is divided into external nodes and internal nodes, representing methods in the code. External nodes refer to methods that only contain the definition of the method in the .dex file, and internal methods refer to methods that contain the definition and implementation of the method in the .dex file. E is the set of all directed edges in the FCG function call graph, representing the relationship between the caller and the called party; the local structure of the function call graph is as follows Figure 5 As shown in the figure, the Mainclass.execute method calls the Logger.log method, so there is a directed edge from the Mainclass.execute node to the Logger.log node.

[0066] As one or more implementations, in step S03, each node of the FCG function call graph is assigned a relevant attribute. Internal functions are usually functions defined by programmers, and their function names are easily confused. Therefore, instead of using function names, opcode sequences are used to represent internal functions.

[0067] In this embodiment, when updating the library, the external functions of the API of the existing library may also be changed. The package name is more stable than the function name. Therefore, the API package name is used to represent the external node. For each node in the FCG function call graph, the Word2vec algorithm is used to obtain the corresponding feature vector. The feature vector formed by the API package is used for the external node, and the feature vector formed by the operation code is used for the internal node.

[0068] The process of obtaining feature vectors using the Word2vec algorithm in this embodiment is as follows:

[0069] Generate corpus by API package and opcode sequence respectively; select a fixed window size of 2M+1, and consider M words before and after each center word as context words; then use the selected window size to traverse each word in the corpus, and calculate the loss based on the actual context words and predicted probabilities; finally, based on the loss function, use the gradient descent method to update the vectors of the center word and context words; the formula for calculating the loss function is: J(a)=1 / k ; = . Get the feature vector of the API package and the feature vector of the opcode For each node in the function call graph, if it is an external node, the opcode vector Set to 0; if it is an internal node, the feature vector of the API package Set to 0. The feature vector of each node is expressed as ]. In addition, the importance score calculated by the LeaderRank algorithm is used as the weight of the node vector, that is, the final vector is expressed as .

[0070] The LeaderRank algorithm introduces a virtual node that has a two-way connection with each node in the network to balance the importance of all nodes in the network and avoid the "ranking leakage" problem in PageRank; specifically, each node in the graph is assigned the same initial score, a virtual node is added, and this virtual node is bidirectionally connected to each node in the network. In each iteration, the importance of each node is updated according to the importance of its neighboring nodes. In each iteration, the new score of each node is the sum of the scores passed to it by its neighboring nodes. For the virtual node, it receives scores from all other nodes equally, and also distributes scores to all other nodes equally. After each iteration, the scores of all nodes are normalized so that the sum remains unchanged. When converged, the virtual node is removed and the final node importance score is obtained. .

[0071] As one or more implementation modes, in step S04, this embodiment uses the LeaderRank algorithm and sensitive API combination to determine whether to keep or remove nodes and edges; the sensitive API list generated by the analysis of sensitive APIs by PScout et al. is used, which has approximately 21,986 types.

[0072] like Fig. 9 As shown, the pruning strategy adopted in this embodiment is: first, the sensitive API nodes identified according to the sensitive API list Search upward for all ancestor nodes of sensitive API nodes , , Keep the mark, and then look down for the descendant nodes of all the marked ancestor nodes, that is, Descendants of a node , , , ; Descendants of a node , , ; Descendants of a node , Then, the importance score of each node is calculated based on the LeaderRank algorithm, and the threshold is set to retain the nodes. , Nodes, and finally a simplified function call graph with high impact and sensitive API information is obtained. The threshold of the present invention is set by the interquartile range method. If the importance score of the node is lower than the threshold, it is deleted, and if it is higher than the threshold, it is retained. The implementation process of the method based on the interquartile range is: first, the importance scores of all nodes are arranged in ascending order, and then the first quartile (Q1) is determined to be the value at the 25% position. The third quartile (Q3) is the value at the 75% position, and then the IQR is calculated, that is, Q3 - Q1, and finally The range determines the threshold.

[0073] As one or more implementations, in step S05, the GCN algorithm is a classic deep learning model for processing graph data. It captures information in the graph structure through a graph convolution layer, thereby being used for graph classification tasks. The model has an input layer, a graph convolution layer, an activation function, and an output layer. The node aggregation process of GCN is as follows: Figure 7 As shown in Figure 1, each node has a feature vector representation, and the feature vector of the intermediate node is updated by aggregating the features of the node and its neighboring nodes. The graph convolution formula of GCN is: =σ( ),in, Represents the node feature matrix of the lth layer, whose dimension is usually N× , where N is the number of nodes, is the characteristic dimension of this layer; Represents the output feature matrix of layer l+1, with a dimension of N× is the weight matrix of the lth layer, which is used to perform linear transformation and has the dimension ; σ is a nonlinear activation function, usually a ReLu function, which is applied to the features of each node; is a modified version of the adjacency matrix A, usually with self-connections added to A (i.e., a diagonal matrix I such that each node is connected to itself), It is expressed as =A+I; yes The degree matrix of = , and yes The inverse matrix of the square root of is used for normalization to ensure that the influence of node degrees is balanced during information transfer.

[0074] The propagation process of the GCN network is as follows Figure 6 As shown in Figure 2, through a layer of graph convolution, a new hidden layer feature is obtained. , and the GCN neural network is a stack of graph convolutional layers. (i.e. X) is calculated ,from Calculated , calculating layer by layer. When the number of layers of the network model is large, the performance will degrade. Specifically, each intermediate layer tends to mix the features of the connected nodes through message propagation when operating. When too many operations are piled up, the features between the connected nodes will quickly become difficult to distinguish, and over-smoothing will occur. Therefore, improvements are made to the above GCN algorithm by adding a jump node module to better capture information at different levels.

[0075] The principle of skip connection is to add a skip connection to the output of each layer. This module will randomly select some nodes and directly replace the output features of the node features with the input features. The unselected nodes still pass through the convolution operation. The principle diagram of the skip node module is as follows Figure 8 As shown, the function call graph is input in the form of a matrix, and a mask matrix is ​​generated when passing through the convolutional layer. , which is a diagonal matrix, =1 means that the node is a sampled node. Through this mask matrix, the first graph convolution layer with a random jump node module is obtained. =σ((I- ) + ), that is, the matrix X(l-1) is output as Xl. Mask matrix Determined by the sampling strategy and sampling rate ρ. For the selected nodes, the skip operation suppresses the exponential smoothing effect of the model depth by keeping their features in the current layer. The sampling strategy uses uniform sampling to select the mask matrix Uniform sampling is a common sampling method that aims to select samples from a data set with equal probability. When using it, first define the data set or sample space to be sampled, and then randomly select samples from the sample space, with each sample having an equal probability of being selected.

[0076] As one or more implementation methods, in step S06, after the model design is completed, the constructed data set needs to be labeled and divided into a training set and a test set, and then fed into the model. During the detection process, parameters need to be continuously adjusted to achieve the best effect.

[0077] This embodiment constructs a data set by extracting the FCG function call graph in the APK file, which can show the calling relationship between functions in the application, thereby identifying malicious behavior. In addition, the present invention proposes a graph pruning method to simplify the graph structure, remove redundant and invalid information, alleviate the memory burden during training, and improve detection efficiency. This method uses sensitive APIs and importance scores to comprehensively judge the retention of nodes, which is more reliable than the method of only using sensitive APIs to retain nodes; a skip node algorithm is added to the graph convolution layer, and some nodes are sampled to skip the convolution operation to prevent the problem of excessive smoothing due to too many intermediate layers in the model, thereby improving the performance of the model and improving the detection accuracy. This method only involves node operations, and compared with other solutions to the problems of over-smoothing and gradient disappearance, it does not bring additional computational burden.

[0078] Embodiment 2

[0079] Embodiment 2 of the present invention introduces an Internet of Things malicious code detection system based on graph neural network.

[0080] An IoT malicious code detection system based on graph neural network, comprising:

[0081] An acquisition module, configured to acquire an IoT code dataset;

[0082] An extraction module is configured to extract data features of the acquired IoT code data set to obtain a feature vector data set;

[0083] A pruning module is configured to consider virtual nodes and perform pruning processing on the obtained feature vector data set to obtain a simplified graph structure;

[0084] A modeling module, which is configured to add a skip node algorithm to the graph convolution layer to build a graph neural network detection model;

[0085] The detection module is configured to detect malicious codes in the Internet of Things based on the constructed graph neural network detection model and the simplified graph structure.

[0086] The detailed steps are the same as the IoT malicious code detection method based on graph neural network provided in Example 1, and will not be repeated here.

[0087] Embodiment 3

[0088] Embodiment 3 of the present invention provides a computer-readable storage medium.

[0089] A computer-readable storage medium stores a program, which, when executed by a processor, implements the steps in the method for detecting malicious code in the Internet of Things based on a graph neural network as described in Embodiment 1 of the present invention.

[0090] The detailed steps are the same as the IoT malicious code detection method based on graph neural network provided in Example 1, and will not be repeated here.

[0091] Embodiment 4

[0092] A fourth embodiment of the present invention provides an electronic device.

[0093] An electronic device comprises a memory, a processor and a program stored in the memory and running on the processor, wherein when the processor executes the program, the steps in the method for detecting malicious code in the Internet of Things based on a graph neural network as described in Embodiment 1 of the present invention are implemented.

[0094] The detailed steps are the same as the IoT malicious code detection method based on graph neural network provided in Example 1, and will not be repeated here.

[0095] Embodiment 5

[0096] Embodiment 5 of the present invention provides a computer program product.

[0097] A computer program product includes software code, wherein the program in the software code executes the steps in the method for detecting malicious code in the Internet of Things based on a graph neural network as described in Embodiment 1 of the present invention.

[0098] The detailed steps are the same as the IoT malicious code detection method based on graph neural network provided in Example 1, and will not be repeated here.

[0099] The above description is only a preferred embodiment of the present embodiment and is not intended to limit the present embodiment. For those skilled in the art, the present embodiment may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present embodiment shall be included in the protection scope of the present embodiment.

Claims

1. A method for detecting malicious code in the Internet of Things based on graph neural network, characterized in that: include: Get the IoT code dataset; Extracting data features of the acquired IoT code data set to obtain a feature vector data set; Considering virtual nodes, the obtained feature vector data set is pruned to obtain a simplified graph structure; Add the skip node algorithm to the graph convolution layer to build a graph neural network detection model; Detect malicious code in the Internet of Things based on the constructed graph neural network detection model and simplified graph structure; The pruning process is as follows: sensitive API nodes identified according to the sensitive API list Search upward for all ancestor nodes of sensitive API nodes , , Keep the mark, look down for the mark and keep the descendant nodes of all ancestor nodes, that is, Descendants of a node , , , ; Descendants of a node , , ; Descendants of a node , ; Calculate the importance score of the descendant nodes of each ancestor node according to the LeaderRank algorithm, and retain it by setting the threshold , Node, complete pruning process, and obtain a simplified graph structure; A skip node module is added to the graph convolution layer, that is, a skip connection is added to each output layer of the graph neural network to generate a mask matrix in the output, so that the output features of the node features are directly replaced by the input features, and the unselected nodes are subjected to convolution operations to distinguish different node features, thus completing the construction of the graph neural network detection model; For each node in the FCG function call graph, the Word2vec algorithm is used to obtain the corresponding feature vector. The feature vector formed by the API package is used for external nodes, and the feature vector formed by the operation code is used for internal nodes. The process of obtaining feature vectors using the Word2vec algorithm is: Generate corpora for API packages and opcode sequences respectively; select a fixed window size of 2M+1, and for each center word, consider the M words before and after as context words; then use the selected window size to traverse each word in the corpus, and calculate the loss based on the actual context words and predicted probabilities; finally, based on the loss function, use the gradient descent method to update the vectors of the center word and context words; in addition, use the importance score calculated by the LeaderRank algorithm as the weight of the node vector.

2. The method for detecting malicious code in the Internet of Things based on graph neural network as described in claim 1, characterized in that: In the process of extracting data features of the acquired IoT code dataset, an integrated tool is used to parse each file in the acquired dataset and extract the function call graph of each sample.

3. A method for detecting malicious code in the Internet of Things based on a graph neural network as described in claim 2, characterized in that: Based on the extracted function call graph, the relevant attributes of each node of the function call graph are allocated to obtain the feature vector corresponding to each node; and the feature vector data set is obtained according to the obtained feature vector corresponding to each node.

4. A method for detecting malicious code in the Internet of Things based on graph neural network as described in claim 3, characterized in that: Before pruning, virtual nodes are introduced, bidirectional connections are established between virtual nodes and each node, and the importance of each node is updated and iterated according to the importance of neighboring nodes. After each iteration, the scores of all nodes are normalized so that the sum of the scores of all nodes remains unchanged. The iteration ends when and only when convergence occurs, the virtual nodes are removed, and the final node importance score is obtained.

5. The method for detecting malicious code in the Internet of Things based on graph neural network as described in claim 1, characterized in that: During the pruning process, the network node sorting algorithm and sensitive API are used to make a comprehensive judgment on whether to keep or remove nodes and edges in the feature vector dataset, thus completing the simplification of the feature vector dataset and obtaining a simplified graph structure.

6. An IoT malicious code detection system based on graph neural network, characterized in that: include: An acquisition module, configured to acquire an IoT code dataset; An extraction module is configured to extract data features of the acquired IoT code data set to obtain a feature vector data set; A pruning module is configured to consider virtual nodes and perform pruning processing on the obtained feature vector data set to obtain a simplified graph structure; A modeling module, which is configured to add a skip node algorithm to the graph convolution layer to build a graph neural network detection model; A detection module, which is configured to detect IoT malicious code based on the constructed graph neural network detection model and the simplified graph structure; The pruning process is as follows: sensitive API nodes identified according to the sensitive API list Search upward for all ancestor nodes of sensitive API nodes , , Keep the mark, look down for the mark and keep the descendant nodes of all ancestor nodes, that is, Descendants of a node , , , ; Descendants of a node , , ; Descendants of a node , ; Calculate the importance score of the descendant nodes of each ancestor node according to the LeaderRank algorithm, and retain it by setting the threshold , Node, complete pruning process, and obtain a simplified graph structure; A skip node module is added to the graph convolution layer, that is, a skip connection is added to each output layer of the graph neural network to generate a mask matrix in the output, so that the output features of the node features are directly replaced by the input features, and the unselected nodes are subjected to convolution operations to distinguish different node features, thus completing the construction of the graph neural network detection model; For each node in the FCG function call graph, the Word2vec algorithm is used to obtain the corresponding feature vector. The feature vector formed by the API package is used for external nodes, and the feature vector formed by the operation code is used for internal nodes. The process of obtaining feature vectors using the Word2vec algorithm is: Generate corpora for API packages and opcode sequences respectively; select a fixed window size of 2M+1, and for each center word, consider the M words before and after as context words; then use the selected window size to traverse each word in the corpus, and calculate the loss based on the actual context words and predicted probabilities; finally, based on the loss function, use the gradient descent method to update the vectors of the center word and context words; in addition, use the importance score calculated by the LeaderRank algorithm as the weight of the node vector.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of a method for detecting malicious code in the Internet of Things based on a graph neural network as described in any one of claims 1-5 are implemented.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the program, the steps of a method for detecting malicious code in the Internet of Things based on a graph neural network as described in any one of claims 1-5 are implemented.

9. A computer program product comprising software code, characterized in that The program in the software code executes the steps of a method for detecting malicious code in the Internet of Things based on a graph neural network as described in any one of claims 1-5.

Images