Malicious software attack detection method based on graph deep learning

Abstract

The invention discloses a malicious software attack detection method based on graph deep learning, which comprises the following steps: defining space event graphs of normal software and known malicious software, and constructing a computer internal software space graph model; calculating the weight of the software space graph model, and quantifying the event risk; designing an event prediction model based on graph deep learning, and predicting a possible access event of the software in the next step; and a risk early warning and cloud processing method is designed, early warning is initiated for suspicious access events of software, and risk processing is carried out. According to the method, a computer internal software space graph model is constructed, event risks are quantified, a multi-layer graph convolutional network is introduced for malicious software detection, and multi-layer feature representation is performed on the structure and behavior of malicious software, so that information in data is more comprehensively mined, and the detection effect is improved; the method has the advantages that modes and features in data are automatically learned, high adaptability is achieved, malicious software variants and novel threat changes can be adapted, better interpretability is achieved, and high performance is still achieved for complex data.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a malware attack detection method based on graph deep learning. Background Art

[0002] Malware detection is a vital task in the field of information security, used to identify and prevent the harm caused by malware to computer systems and networks. As malware technology continues to evolve and become more complex, threats such as viruses, Trojans, and ransomware continue to increase, and malware detection becomes more urgent and necessary. Through malware detection, potential malware can be discovered and removed in a timely manner, protecting user data security, maintaining system stability, and avoiding financial losses and personal privacy leaks. Effective malware detection technology is at the forefront of network security and is of great significance in the information society. It plays a vital role in maintaining network security and ensuring normal information exchange.

[0003] Although existing malware detection methods are effective, they still have some problems. For example, traditional methods are simple and easy to understand but have limited generalization capabilities. Machine learning methods require careful feature design and have limited effectiveness when dealing with complex data. Deep learning methods can better mine data features and improve detection accuracy, but they require a large amount of data and computing resources and have poor interpretability. Therefore, how to conduct comprehensive and accurate malware detection is a key issue that needs to be solved.

[0004] In view of the above problems, the present invention provides a malware attack detection method based on graph deep learning to improve the detection effect. Summary of the invention

[0005] The present invention provides a malware attack detection method based on graph deep learning for improving detection effect.

[0006] The purpose of the present invention is to disclose a malware attack detection method based on graph deep learning, the detection method comprising the following steps:

[0007] Step 1: Define the spatial event graph of normal software and known malware, and build a spatial graph model of computer internal software;

[0008] Step 2: Calculate the weight of the software space graph model to quantify the event risk;

[0009] Step 3: Design an event prediction model based on graph deep learning to predict the next possible access event of the software;

[0010] Step 4: Design risk warning and cloud processing methods to issue warnings and perform risk management for suspicious access events of the software.

[0011] Furthermore, the steps for constructing the computer internal software space graph model in step 1 are as follows:

[0012] Step 1: Collect text data such as system logs and access permissions of normal software and known malware;

[0013] Step 2: Perform event extraction on the text data to identify and extract the actions described in the text;

[0014] Step 3: Treat each action extracted from the text as a node in the event graph; determine the correlation between events based on the time sequence, causal relationship or other logical relationship between events in the text, and convert these relationships into edges in the graph;

[0015] Step 4: Build an event graph based on event nodes and event relationships:

[0016] G=(V,E)

[0017] Among them, V represents the node set, E represents the edge set, and in the event graph, each node represents an event, and the edge represents the relationship between events, including causal relationships and parallel relationships.

[0018] Furthermore, the software space graph model weight calculation method in step 2 is as follows:

[0019] Step 1: Calculate the coefficient of variation V of each indicator j :

[0020]

[0021] in,

[0022]

[0023] Among them, y ij represents the index value of the jth indicator of event i, and n is the total number of events;

[0024] Step 2: Calculate the weight of each indicator:

[0025]

[0026] Among them, V j represents the coefficient of variation of indicator j, and m is the total number of indicators;

[0027] Step 3: Calculate the comprehensive score:

[0028]

[0029] Furthermore, the design steps of the event prediction model in step 3 are as follows:

[0030] Step 1: For the event graph G = (V, E), first define the adjacency matrix and generate the adjacency matrix A according to the graph structure. ij =1 indicates node v i and v j There is a connection between ij = 0 means no connection; then, normalize the adjacency matrix A to get Then use multi-layer GCN for event prediction. The multi-layer GCN is expressed as follows:

[0031]

[0032] Among them, W (L) represents the weight matrix, σ is the activation function, X represents the input data features, and Z is the output event prediction result.

[0033] Furthermore, the risk warning and cloud processing method design steps in step 4 are as follows:

[0034] Step 1: Locate the nodes in the event graph based on the event prediction results and obtain the weight threshold;

[0035] Step 2: If the software executes a predicted event, the current event weight is calculated and compared with the weight threshold. If it exceeds the threshold, it means that the current software action is risky, and an early warning is sent to the cloud server, and a suitable risk plan is matched; if it does not exceed the threshold, it means that the current software action does not have a risk, and no early warning is sent;

[0036] Step 3: If the software does not execute the predicted event and executes other events, the software event is prohibited and an early warning is immediately initiated.

[0037] The present invention has the following advantages: the present invention constructs a computer internal software space graph model, quantifies event risks, introduces a multi-layer graph convolutional network for malware detection, and performs multi-level feature representation of the structure and behavior of malware, thereby more comprehensively mining the information in the data and improving the detection effect; the present invention automatically learns the patterns and features in the data, has strong adaptability, can adapt to changes in malware variants and new threats, has better interpretability, and still has high performance for complex data. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is the principle framework diagram of the present invention;

[0039] Figure 2 It is a schematic diagram of the software space graph modeling and weight calculation process of the present invention;

[0040] Figure 3 Schematic diagram of the event prediction process of the present invention. DETAILED DESCRIPTION

[0041] The present invention provides a malware attack detection method based on graph deep learning, and the detection method comprises the following steps:

[0042] Step 1: Define the spatial event graph of normal software and known malware, and build a spatial graph model of computer internal software;

[0043] Step 2: Calculate the weight of the software space graph model to quantify the event risk;

[0044] Step 3: Design an event prediction model based on graph deep learning to predict the next possible access event of the software;

[0045] Step 4: Design risk warning and cloud processing methods to issue warnings and perform risk management for suspicious access events of the software.

[0046] In this embodiment, the steps for constructing the computer internal software space graph model in step 1 are as follows:

[0047] Step 1: Collect text data such as system logs and access permissions of normal software and known malware;

[0048] Step 2: Perform event extraction on the text data to identify and extract the actions described in the text;

[0049] Step 3: Treat each action extracted from the text as a node in the event graph; determine the correlation between events based on the time sequence, causal relationship or other logical relationship between events in the text, and convert these relationships into edges in the graph;

[0050] Step 4: Build an event graph based on event nodes and event relationships:

[0051] G=(V,E)

[0052] Among them, V represents the node set, E represents the edge set, and in the event graph, each node represents an event, and the edge represents the relationship between events, including causal relationships and parallel relationships.

[0053] In this embodiment, the software space graph model weight calculation method in step 2 is as follows:

[0054] Step 1: Calculate the coefficient of variation V of each indicator j :

[0055]

[0056] in,

[0057]

[0058] Among them, y ijrepresents the index value of the jth indicator of event i, and n is the total number of events;

[0059] Step 2: Calculate the weight of each indicator:

[0060]

[0061] Among them, V j represents the coefficient of variation of indicator j, and m is the total number of indicators;

[0062] Step 3: Calculate the comprehensive score:

[0063]

[0064] In this embodiment, the steps of designing the event prediction model in step 3 are as follows:

[0065] Step 1: For the event graph G = (V, E), first define the adjacency matrix and generate the adjacency matrix A according to the graph structure. ij =1 indicates node v i and v j There is a connection between ij = 0 means no connection; then, normalize the adjacency matrix A to get Then use multi-layer GCN for event prediction. The multi-layer GCN is expressed as follows:

[0066]

[0067] Among them, W (L) represents the weight matrix, σ is the activation function, X represents the input data features, and Z is the output event prediction result.

[0068] In this embodiment, the risk warning and cloud processing method design steps in step 4 are as follows:

[0069] Step 1: Locate the nodes in the event graph based on the event prediction results and obtain the weight threshold;

[0070] Step 2: If the software executes a predicted event, the current event weight is calculated and compared with the weight threshold. If it exceeds the threshold, it means that the current software action is risky, and an early warning is sent to the cloud server, and a suitable risk plan is matched; if it does not exceed the threshold, it means that the current software action does not have a risk, and no early warning is sent;

[0071] Step 3: If the software does not execute the predicted event and executes other events, the software event is prohibited and an early warning is immediately initiated.

[0072] In this embodiment, in the software access event, the access times and access duration are considered. The software access times are 5 and 1000 respectively, and the access durations are 15s and 360s respectively. The coefficient of variation is calculated as:

[0073]

[0074]

[0075] Calculate the weight of each indicator:

[0076]

[0077] The comprehensive score of the access event can be obtained as follows:

[0078]

[0079] This score is the event weight value in the event graph.

[0080] Although the specific implementation of the present invention is described in detail in conjunction with the drawings, it should not be understood as limiting the scope of protection of this patent. Within the scope described in the claims, various modifications and variations that can be made by those skilled in the art without creative work still fall within the scope of protection of this patent.

Claims

1. A malware attack detection method based on graph deep learning, characterized by: The detection method comprises the following steps: Step 1: Define the spatial event graph of normal software and known malware, and build a spatial graph model of computer internal software; Step 2: Calculate the weight of the software space graph model to quantify the event risk; Step 3: Design an event prediction model based on graph deep learning to predict the next possible access event of the software; Step 4: Design risk warning and cloud processing methods to issue warnings and perform risk management for suspicious access events of the software.

2. The method for detecting malware attacks based on graph deep learning according to claim 1, characterized in that: The steps for constructing the computer internal software space graph model in step 1 of claim 1 are as follows: Step 1: Collect text data such as system logs and access permissions of normal software and known malware; Step 2: Perform event extraction on the text data to identify and extract the actions described in the text; Step 3: Treat each action extracted from the text as a node in the event graph; determine the correlation between events based on the time sequence, causal relationship or other logical relationship between events in the text, and convert these relationships into edges in the graph; Step 4: Build an event graph based on event nodes and event relationships: G=(V,E) Among them, V represents the node set, E represents the edge set, and in the event graph, each node represents an event, and the edge represents the relationship between events, including causal relationships and parallel relationships.

3. The malware attack detection method based on graph deep learning as claimed in claim 1, characterized in that: The steps of the software space graph model weight calculation method in step 2 of claim 1 are as follows: Step 1: Calculate the coefficient of variation V of each indicator j : in, Among them, y ij represents the index value of the jth indicator of event i, and n is the total number of events; Step 2: Calculate the weight of each indicator: Among them, V j represents the coefficient of variation of indicator j, and m is the total number of indicators; Step 3: Calculate the comprehensive score:

4. The malware attack detection method based on graph deep learning as claimed in claim 1, characterized in that: The steps for designing the event prediction model in step 3 of claim 1 are as follows: Step 1: For the event graph G = (V, E), first define the adjacency matrix and generate the adjacency matrix A according to the graph structure. ij =1 indicates node v i and v j There is a connection between ij = 0 means no connection; then, normalize the adjacency matrix A to get Then use multi-layer GCN for event prediction. The multi-layer GCN is expressed as follows: Among them, W (L) represents the weight matrix, σ is the activation function, X represents the input data features, and Z is the output event prediction result.

5. The method for detecting malware attacks based on graph deep learning according to claim 1, characterized in that: The risk warning and cloud processing method design steps in step 4 of claim 1 are as follows: Step 1: Locate the nodes in the event graph based on the event prediction results and obtain the weight threshold; Step 2: If the software executes a predicted event, the current event weight is calculated and compared with the weight threshold. If it exceeds the threshold, it means that the current software action is risky, and an early warning is sent to the cloud server, and a suitable risk plan is matched; If the threshold is not exceeded, it means that there is no risk in the current software action and no warning is issued; Step 3: If the software does not execute the predicted event and executes other events, the software event is prohibited and an early warning is immediately initiated.

Images