Cross-platform virus and Trojan horse detection method and system based on deep learning

Abstract

The invention discloses a cross-platform virus and Trojan horse detection method and system based on deep learning, and the method comprises the steps: scanning codes, files and processes in a system, obtaining each node and a dependency relationship thereof, and constructing a propagation path dependency graph; modeling the constructed dependency graph by using a graph neural network, and dynamically predicting a potential remote propagation path in combination with an iterative update and convergence mechanism of a node feature vector; through real-time monitoring of communication behaviors and network traffic between processes, the system can adaptively adjust the propagation path dependency graph, preferential isolation and early warning are carried out on paths with high propagation risks, and the protection capability of the system is significantly improved.

Description

Technical Field

[0001] The present invention relates to the field of communication and deep learning technology, and in particular to a cross-platform virus and Trojan detection method and system based on deep learning. Background Art

[0002] With the rapid development of information technology, computer systems and network environments are becoming increasingly complex, and the types and propagation methods of malware (including viruses and Trojans) are also constantly evolving. Traditional malware detection methods mainly rely on signature matching and rule-based analysis. Although these methods perform well in dealing with known threats, they are often unable to cope with new and variant malware.

[0003] In recent years, malware detection technology based on deep learning has gradually emerged. Through automatic feature extraction and pattern recognition, it has significantly improved the accuracy and generalization ability of detection. However, existing cross-platform malware detection methods based on deep learning still have many shortcomings when dealing with complex code, file and process dependencies in the system. For example, traditional methods mainly focus on static feature analysis, while ignoring the deep mining of dynamic running behaviors of malware at runtime, resulting in limited ability to predict the propagation path of malware. In addition, the existing technology lacks an adaptive mechanism in constructing and updating the propagation path dependency graph, making it difficult to respond to the rapid mutation and diversified propagation strategies of malware in real time, thus affecting the real-time and effectiveness of the overall detection system. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed. Therefore, the present invention provides a cross-platform virus and Trojan detection method based on deep learning to solve the problems mentioned in the background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a cross-platform virus and Trojan detection method based on deep learning, comprising:

[0008] Scan the code, files and processes in the system, obtain the dependency relationship between the nodes of the files and processes and the code, files and processes, and build a propagation path dependency graph;

[0009] Modeling the propagation path dependency graph based on a graph neural network, inferring potential remote propagation paths by calling a network interface, and monitoring inter-process communication behaviors and network traffic behaviors;

[0010] The propagation path dependency graph is adaptively adjusted according to the monitoring results.

[0011] As a preferred solution of the cross-platform virus and Trojan detection method based on deep learning described in the present invention, wherein: obtaining the dependency relationship between the code, file and process includes:

[0012] The dependencies between dependent libraries and system calls in the code and the dependencies between analysis files and processes.

[0013] As a preferred solution of the cross-platform virus and Trojan detection method based on deep learning described in the present invention, the dependency relationship between the dependent library and the system call in the code includes:

[0014] Scan the dependent libraries, imported modules and called system APIs of files, processes and network status from the code or binary files, extract the library functions in the dependent libraries, imported modules and called system APIs through static analysis tools, and mark the library functions as potential nodes of the propagation path.

[0015] As a preferred solution of the cross-platform virus and Trojan detection method based on deep learning described in the present invention, wherein: the dependency relationship between the analysis file and the process includes:

[0016] Treat each file as a potential node in the propagation path, connect the process accessing the file with the file, and analyze the parent-child inheritance relationship between processes;

[0017] The process of analyzing the parent-child inheritance relationship is as follows:

[0018] Let the parent be process A and the child be process B, extract the startup parameters of each process, and record the current relationship between the parent and child processes. If it is found that process B is started by process A, build an edge from process A to process B and mark it as the "start" operation. Otherwise, build an edge from process B to process A and mark it as the "pause" operation.

[0019] As a preferred solution of the cross-platform virus and Trojan detection method based on deep learning described in the present invention, modeling the propagation path dependency graph based on a graph neural network includes:

[0020] Mapping the files and processes in each system to nodes in the graph, setting an attribute set for each node type, and for each node, generating a feature vector and a feature vector dimension corresponding to the feature vector according to the set attribute set;

[0021] Define the edges between file nodes and process nodes. The graph neural network learns the relationship between nodes through the message passing mechanism. In each round of message passing, each node combines its feature vector with the feature vectors of neighboring nodes to update its own state.

[0022] The message passing mechanism is a non-stop iterative method until the feature vector updates of all nodes in the graph neural network converge.

[0023] As a preferred solution of the cross-platform virus and Trojan detection method based on deep learning described in the present invention, the potential remote propagation path is derived by calling the network interface, and the communication behavior and network traffic behavior between processes are monitored, including:

[0024] According to the connect() function in the library function, the target IP, port number and protocol type of the connection are called to create a network node. Based on the created network node, an edge is generated between the process node and the network node to determine whether the current edge has a potential remote transmission risk. If there is a potential remote transmission risk, the real-time network traffic is monitored. If it is found during monitoring that the current process is communicating with one or more external IPs, the weight value of the current remote transmission path is +1. If the current communication frequency shows an upward trend, the weight value of the current remote transmission path is +1. If the current process communicates with an unknown IP, the weight value of the current remote transmission path is +1.

[0025] As a preferred solution of the cross-platform virus and Trojan detection method based on deep learning described in the present invention, wherein: the propagation path dependency graph is adaptively adjusted according to the monitoring results, including:

[0026] Set the weight threshold of the current remote propagation path, accumulate the weight of the current remote propagation path, and if the current accumulated value does not exceed the weight threshold, isolate the node with the largest weight in the propagation path dependency graph and update the propagation path dependency graph; if the accumulated value exceeds the weight threshold, the system records the path and issues an early warning, and isolates all nodes on the path.

[0027] In a second aspect, the present invention provides a cross-platform virus and Trojan detection system based on deep learning, which includes:

[0028] A propagation dependency graph construction module is configured to scan the code, files and processes in the system, obtain the dependency relationship between the nodes of the files and processes and the code, files and processes, and construct a propagation path dependency graph;

[0029] A graph neural network processing module is configured to model the propagation path dependency graph based on the graph neural network, derive potential remote propagation paths by calling a network interface, and monitor inter-process communication behavior and network traffic behavior;

[0030] The propagation dependency graph updating module is configured to adaptively adjust the propagation path dependency graph according to the monitoring results.

[0031] In a third aspect, the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, wherein: the processor implements any step of the above method when executing the computer program.

[0032] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: the computer program implements any step of the above method when executed by a processor.

[0033] Compared with the prior art, the invention has the following beneficial effects:

[0034] 1. The present invention comprehensively scans the code, files and processes in the system to obtain the dependency relationships between components, and combines the graph neural network to construct a propagation path dependency graph, which can effectively make up for the shortcomings of traditional methods in propagation path prediction. Unlike the existing detection technology that mainly relies on static features, the present invention not only captures static dependencies, but also derives potential remote propagation paths by calling network interfaces, which can deeply analyze the dynamic behavior of malware in the system during execution, making the prediction of malware propagation paths more comprehensive and accurate.

[0035] 2. By real-time monitoring of inter-process communication and network traffic, the system can capture malware and its behavior changes according to the monitoring process and dynamically update the propagation path map; this solves the lag problem of existing technologies in dealing with rapid malware mutations, enabling the detection system to respond to and adapt to changes in malware propagation strategies in real time, effectively improving the real-time nature of malware detection and the protection effect, especially in the face of complex and changeable cross-platform attacks with stronger response capabilities;

[0036] 3. Relying on the message passing mechanism of graph neural networks, the present invention can dynamically learn the complex relationships between nodes, making the detection of malware propagation paths more flexible and efficient on different platforms, and improving the generalization ability and cross-platform application performance of the detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0038] Figure 1 This is an overall flow chart of a cross-platform virus and Trojan detection method based on deep learning according to an embodiment of the present invention;

[0039] Figure 2 This is a node feature vector convergence curve diagram of the cross-platform virus and Trojan detection method based on deep learning described in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0041] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0042] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0043] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0044] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0045] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0046] Example 1

[0047] Reference Figure 1 , which is the first embodiment of the present invention, and provides a cross-platform virus and Trojan detection method based on deep learning, comprising:

[0048] S1. Scan the code, files and processes in the system, obtain the dependency relationship between the nodes of files and processes and the code, files and processes, and build a propagation path dependency graph;

[0049] Specifically, the file nodes obtained include the file name, path, permissions (such as read, write, execute), file size, and file hash value;

[0050] Specifically, the obtained process nodes include process ID, startup parameters, parent-child process relationship, memory allocation, and bound ports;

[0051] Furthermore, the dependencies between codes, files, and processes are represented as the dependencies between dependent libraries and system calls in the code and the dependencies between analysis files and processes;

[0052] Furthermore, the dependency relationship between the dependent libraries and system calls in the code is as follows: the dependent libraries, imported modules, and called system APIs of files, processes, and network status are scanned from the code or binary files, and the library functions in the dependent libraries, imported modules, and called system APIs are extracted through static analysis tools, and the library functions are marked as potential nodes of the propagation path;

[0053] Furthermore, the dependency relationship between files and processes is analyzed as follows: each file is considered as a potential node in the propagation path, the process accessing the file is connected to the file, and the parent-child inheritance relationship between the processes is analyzed;

[0054] Specifically, the process of analyzing the parent-son inheritance relationship is as follows:

[0055] Let the parent be process A and the child be process B. Extract the startup parameters of each process and record the current parent-child relationship. If it is found that process B is started by process A, then build an edge from process A to process B and mark it as the "start" operation. Otherwise, build an edge from process B to process A and mark it as the "pause" operation.

[0056] It should be noted that by obtaining the parameters in the file node and the process node, when constructing the propagation path dependency graph, not only can the static direct dependencies between files and processes be covered, but the dependency structure can also be concretized through the startup parameters of the process and the parent-child process relationship, making the dependency graph more accurate and comprehensive; and compared with the traditional method of constructing the propagation path based only on the process ID or time sequence, the depth and accuracy of the dependency analysis are greatly improved;

[0057] S2. Model the propagation path dependency graph based on the graph neural network, derive the potential remote propagation path by calling the network interface, and monitor the communication behavior and network traffic behavior between processes;

[0058] Furthermore, the sexual transmission path dependency graph is modeled through a graph neural network. The process is as follows:

[0059] Map the files and processes in each system to nodes in the graph, set an attribute set for each node type, and for each node, generate a feature vector and a feature vector dimension corresponding to the feature vector according to the set attribute set;

[0060] Specifically, the feature vector dimensions for file nodes are expressed as: [file size, permission bits, file hash value, file type]; the feature vector dimensions for process nodes are expressed as: [PID, parent process ID, number of open files, number of network connections];

[0061] Define the edges between file nodes and process nodes. The graph neural network learns the relationship between nodes through the message passing mechanism. In each round of message passing, each node combines its feature vector with the feature vectors of neighboring nodes to update its own state.

[0062] Specifically, defining an edge between a file node and a process node means that if a process opens a file, an edge is generated from the process node to the file node, and the weight of the edge represents the frequency or duration of the process accessing the file;

[0063] Specifically, the message passing mechanism process is: let the feature vector of node v be h v , the feature vector of neighbor node u is h u , in each round of message transmission, node v updates its own state characteristics through the following formula:

[0064]

[0065] Among them, N(v) is all the neighbor nodes of node v, w vu is the weight of the edge between nodes v and u, g is the processing function of neighbor features, f is the activation function, h' v is the feature vector of the updated node;

[0066] The message passing mechanism is an uninterrupted iterative method until the feature vector updates of all nodes in the graph neural network converge;

[0067] It should be noted that after reaching convergence, the feature vector of each node not only contains its own attributes, but also incorporates the propagation information of its neighboring nodes;

[0068] Furthermore, in order to derive a potential remote propagation path by calling the network interface, it is necessary to call the connect() function in the library function, connect to the target IP, port number and protocol type, create a network node, generate an edge between the process node and the network node based on the created network node, and determine whether the current edge has a potential remote propagation risk. If there is a potential remote propagation risk, monitor the real-time network traffic. If it is found during monitoring that the current process communicates with one or more external IPs, the weight value of the current remote propagation path is increased by 1. If the current communication frequency shows an upward trend, the weight value of the current remote propagation path is increased by 1. If the current process communicates with an unknown IP, the weight value of the current remote propagation path is increased by 1.

[0069] Specifically, to determine whether the transmission risk is remote, it is necessary to divide it into internal and external networks. If the target IP address belongs to the local subnet (such as 192.168.xx), it is internal transmission within the LAN; if the target IP is a public network IP (such as 8.xxx), it is remote transmission;

[0070] Exemplarily, the remote propagation risk path is derived. For example, if process A is connected to port 22 of the target IP 10.0.0.5, the IP belongs to the internal subnet, and it is deduced that the process is propagated in the local area network, and an edge from process A to the target network node 10.0.0.5:22 is generated; if the target IP is 8.8.8.8 (belonging to the public network) and the port is 8080, it is deduced that the process is remotely propagated through the external network, and an edge from process A to the network node 8.8.8.8:8080 is generated and marked as a potential remote propagation path;

[0071] It should be noted that the risk propagation path can be further expanded based on the known malicious IP library, whether the target IP belongs to a suspicious network area, or whether the target port is a non-standard port. For example, if the target IP connected by process A is port 4444 (non-standard port) of 192.168.1.100, it is expanded into a potential remote propagation path and marked as an extended path of the potential remote propagation path;

[0072] Specifically, the created network nodes include network ports, target IP addresses, communication protocols, and traffic characteristics;

[0073] Specifically, the edge between a process node and a network node means that if a process communicates with an external network through a port number, an edge from the process to the network node is generated, and the weight of the edge represents the size of the network traffic or the duration of the connection;

[0074] It should be noted that the message passing mechanism of graph neural networks can more flexibly handle the propagation behavior of malware in dynamic networks. On the one hand, it can provide more forward-looking propagation path predictions when facing malware that is constantly mutating or spreading across platforms. On the other hand, compared with traditional methods that only analyze network behavior based on a single indicator, this solution greatly improves the detection speed and threat response capabilities of high-risk propagation paths in terms of process and network analysis.

[0075] S3, adaptively adjust the propagation path dependency graph according to the monitoring results;

[0076] Furthermore, a weight threshold of the current remote propagation path is set, and the weight of the current remote propagation path is accumulated. If the current accumulated value does not exceed the weight threshold, the node with the largest weight in the propagation path dependency graph is isolated and the propagation path dependency graph is updated; if the accumulated value exceeds the weight threshold, the system records the path and issues an early warning, and isolates all nodes on the path;

[0077] It should be noted that compared with the traditional approach of directly isolating the entire propagation path, the present invention adopts a step-by-step isolation approach. By controlling nodes with higher risks and handling potential threats in layers, it achieves hierarchical protection against the spread of malware and improves the overall protection effect and stability of the system.

[0078] Furthermore, this embodiment also provides a cross-platform virus and Trojan detection system based on deep learning, including:

[0079] A propagation dependency graph construction module is configured to scan the code, files and processes in the system, obtain the dependency relationship between the nodes of the files and processes and the code, files and processes, and construct a propagation path dependency graph;

[0080] A graph neural network processing module is configured to model the propagation path dependency graph based on the graph neural network, derive potential remote propagation paths by calling a network interface, and monitor inter-process communication behavior and network traffic behavior;

[0081] The propagation dependency graph updating module is configured to adaptively adjust the propagation path dependency graph according to the monitoring results.

[0082] This embodiment also provides a computer device, which is applicable to the case of a cross-platform virus and Trojan detection method based on deep learning, including:

[0083] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the cross-platform virus and Trojan detection method based on deep learning as proposed in the above embodiment.

[0084] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0085] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the cross-platform virus and Trojan detection method based on deep learning as proposed in the above embodiment is implemented.

[0086] The storage medium proposed in this embodiment and the data storage method proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0087] Example 2

[0088] Reference Figure 2 , which is the second embodiment of the present invention, and this embodiment provides a cross-platform virus and Trojan detection method based on deep learning, including: in order to verify the effectiveness of the solution of the present invention, a comparative simulation test is designed to compare the present invention with the traditional malware detection method; the simulation test environment includes a virtual machine cluster containing multiple operating systems (including Windows, Linux and macOS), each virtual machine is pre-installed with different types of malware and normal software, the system monitors the files, processes and network behaviors of each virtual machine, and the method of the present invention is used to construct a propagation path dependency graph in real time, and the model of the graph neural network is combined to predict the propagation path and monitor it in real time;

[0089] Before the experiment began, the code, files, and processes in each virtual machine were scanned, and the dependencies between the nodes were obtained; these nodes contain basic file information (such as file name, permissions, hash value), process information (such as PID, startup parameters, parent-child process relationship), and network communication behavior (such as target IP, port number, protocol); based on these data, a preliminary propagation path dependency graph was constructed; then, the graph neural network model was used to model the constructed propagation path dependency graph, and potential remote propagation paths were extracted by calling the network interface, and the communication behavior and network traffic behavior between processes were monitored in real time; during the monitoring process, the system isolated or warned the propagation paths whose cumulative weights exceeded the threshold through the set weight threshold, and gave priority to nodes with larger weights;

[0090] In order to compare the effects of the present invention with the traditional method, this experiment selected the traditional signature matching and rule-based malware detection methods as the comparison group, and recorded the detection rate, false alarm rate, system response time and malware propagation path prediction accuracy of each detection system respectively. The data records were taken as the average value of multiple experiments, as shown in Table 1;

[0091] Table 1

[0092]

[0093] It can be clearly seen from Table 1 that in terms of detection rate, the detection rate of the present invention reaches 96%, which is significantly improved compared with the traditional signature matching method (85%) and the rule-based method (82%). This is because the present invention can not only capture static dependencies, but also predict the dynamic propagation path of malware through the graph neural network, avoiding the omission caused by the traditional method due to reliance on specific signatures or rules. In addition, in terms of false alarm rate, the false alarm rate of the present invention is only 1.5%, which is much lower than the traditional signature matching (3.8%) and the rule-based method (4.2%). By combining the detailed dependencies between files, processes and networks, the present invention can effectively distinguish between normal system behaviors and malicious behaviors, avoiding false alarms caused by misjudgment of normal processes or files. Moreover, in the face of complex malware propagation, the present invention uses iterative learning of the graph neural network model to make the propagation path prediction accuracy as high as 93%, far exceeding the 65% and 60% of the traditional methods. This shows that the present invention can more accurately predict the spread direction of malware, and then take protective measures in time to prevent the system from being further damaged.

[0094] In addition, reference Figure 2 , the convergence of the feature vectors of all nodes in the graph neural network was tested. From the convergence curve, it can be seen that the feature vectors have tended to converge within a relatively small number of iterations; compared with the traditional propagation path analysis method (path detection based on static rules), the present invention can quickly complete the dynamic update and optimization of the propagation path dependency graph through the graph neural network, and realize the update of the feature vector with a relatively small number of iterations, which reduces the system's computing resource consumption and response time, enabling the system to detect and identify potential threats more quickly in actual operation.

[0095] Those skilled in the art will appreciate that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program codes. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0096] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0100] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A cross-platform virus and Trojan detection method based on deep learning, characterized in that: include: Scan the code, files and processes in the system, obtain the dependency relationship between the nodes of the files and processes and the code, files and processes, and build a propagation path dependency graph; Modeling the propagation path dependency graph based on a graph neural network, inferring potential remote propagation paths by calling a network interface, and monitoring inter-process communication behaviors and network traffic behaviors; The propagation path dependency graph is adaptively adjusted according to the monitoring results.

2. The cross-platform virus and Trojan detection method based on deep learning as claimed in claim 1, characterized in that: Obtain the dependencies between the code, files, and processes, including: The dependencies between dependent libraries and system calls in the code and the dependencies between analysis files and processes.

3. The cross-platform virus and Trojan detection method based on deep learning as claimed in claim 2, characterized in that: The dependencies between the dependent libraries and system calls in the code include: Scan the dependent libraries, imported modules and called system APIs of files, processes and network status from the code or binary files, extract the library functions in the dependent libraries, imported modules and called system APIs through static analysis tools, and mark the library functions as potential nodes of the propagation path.

4. The cross-platform virus and Trojan detection method based on deep learning as claimed in claim 2, characterized in that: The dependency relationship between the analysis files and processes includes: Treat each file as a potential node in the propagation path, connect the process accessing the file with the file, and analyze the parent-child inheritance relationship between processes; The process of analyzing the parent-child inheritance relationship is as follows: Assume that the parent is process A and the child is process B. Extract the startup parameters of each process and record the current parent-child process relationship. If it is found that process B is started by process A, build an edge from process A to process B and mark it as a "start" operation. Otherwise, build an edge from process B to process A and mark it as a "pause" operation.

5. The cross-platform virus and Trojan detection method based on deep learning as described in claim 3 or 4, characterized in that: Modeling the propagation path dependency graph based on a graph neural network includes: Mapping the files and processes in each system to nodes in the graph, setting an attribute set for each node type, and for each node, generating a feature vector and a feature vector dimension corresponding to the feature vector according to the set attribute set; Define the edges between file nodes and process nodes. The graph neural network learns the relationship between nodes through the message passing mechanism. In each round of message passing, each node combines its feature vector with the feature vectors of neighboring nodes to update its own state. The message passing mechanism is a non-stop iterative method until the feature vector updates of all nodes in the graph neural network converge.

6. The cross-platform virus and Trojan detection method based on deep learning as claimed in claim 5, characterized in that: Infer potential remote propagation paths by calling network interfaces and monitor inter-process communication and network traffic behaviors, including: According to the connect() function in the library function, the target IP, port number and protocol type of the connection are called to create a network node. Based on the created network node, an edge is generated between the process node and the network node to determine whether the current edge has a potential remote transmission risk. If there is a potential remote transmission risk, the real-time network traffic is monitored. If it is found during monitoring that the current process is communicating with one or more external IPs, the weight value of the current remote transmission path is +1. If the current communication frequency shows an upward trend, the weight value of the current remote transmission path is +1. If the current process communicates with an unknown IP, the weight value of the current remote transmission path is +1.

7. The cross-platform virus and Trojan detection method based on deep learning as claimed in claim 6, characterized in that: Adaptively adjusting the propagation path dependency graph according to the monitoring result includes: Set the weight threshold of the current remote propagation path, accumulate the weight of the current remote propagation path, and if the current accumulated value does not exceed the weight threshold, isolate the node with the largest weight in the propagation path dependency graph and update the propagation path dependency graph; if the accumulated value exceeds the weight threshold, the system records the path and issues an early warning, and isolates all nodes on the path.

8. A cross-platform virus and Trojan detection system based on deep learning, based on the cross-platform virus and Trojan detection method based on deep learning according to any one of claims 1 to 7, characterized in that: include: A propagation dependency graph construction module is configured to scan the code, files and processes in the system, obtain the dependency relationship between the nodes of the files and processes and the code, files and processes, and construct a propagation path dependency graph; A graph neural network processing module is configured to model the propagation path dependency graph based on the graph neural network, derive potential remote propagation paths by calling a network interface, and monitor inter-process communication behavior and network traffic behavior; The propagation dependency graph updating module is configured to adaptively adjust the propagation path dependency graph according to the monitoring results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images