Botnet malicious software detection method based on download link
Through the detection method based on download links, combined with original traffic analysis, data set sorting and graph convolution network training, the problems of low classification accuracy and limitation of the existing detection methods are solved, and efficient and flexible multi-platform botnet malware detection is achieved.
Patent Information
- Application Number
- CN202411725602.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-28
- Publication Date
- 2025-02-28
AI Technical Summary
The existing botnet malware detection methods have problems such as low classification accuracy, insufficient learning ability, limited to a single system architecture, and reduced efficiency and accuracy when fighting obfuscation techniques.
Using a detection method based on download links, the detection strategies and parameters are dynamically adjusted through raw traffic analysis, data set collation and graph convolutional network (GCN) training to adapt to the ever-changing malware attack methods and patterns.
It realizes efficient and flexible botnet malware detection, reduces coupling, improves classification accuracy and learning ability, supports multi-platform operation, and adapts to multiple hardware environments.
Smart Images
Figure CN119544333A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of data detection, and in particular to a botnet malware detection method based on download links. Background Art
[0002] A botnet is a network of computers infected with malware.
[0003] Traditional detection methods for botnets are mainly based on static and dynamic features of malware. Static features include low-level features of raw binary files, such as file structure, raw bytecode, etc., and high-level features of static disassembled files, such as opcodes, strings, etc. Dynamic features include using CFG to represent botnet malware binaries and analyzing graphs extracted from botnet malware. Currently, there are the following methods for detecting botnet malware:
[0004] Approach 1: Low-level features based on raw binary files
[0005] The most representative method is to use the low-level features of the original botnet malware binary file. This method is proposed by Nataraj et al. using a Markov gray image, i.e., a grayscale image. The binary file is converted into a Markov grayscale image, and the gist texture features are extracted for malware classification; in the IoT environment, Jiawei Su et al. extract grayscale images from binary files and use shallow CNN (convolutional neural network) to classify and detect the malware families that constitute the IoT botnet.
[0006] Method 1 has the following defects: During the preprocessing of the grayscale image, the loss of byte information in the malware will have a negative impact on the accuracy of classification. In addition, the shallow CNN and general machine learning algorithms have insufficient learning ability due to the small number of layers and trainable parameters, resulting in low accuracy in the classification and prediction results of unknown botnet malware.
[0007] Method 2: Advanced features based on static disassembly files
[0008] Hamed et al. used recurrent neural network (RNN) to analyze the operation code of malware based on ARM architecture and achieved a relatively ideal accuracy rate; Darabian et al. used maximum frequency pattern (MFP) to identify infected network environments; Ensieh et al. converted the operation code into vector space and used fuzzy and fast fuzzy pattern tree methods for malware detection; Sitalakshmi et al. converted the operation code into vector space and used fuzzy and fast fuzzy pattern tree methods for malware detection and classification. A new malware classification using similarity matrix visualization was designed and achieved high classification accuracy; Amin et al. proposed a deep learning-based method to detect battlefield Internet of Things (IoBT) malware through operation code; Phu et al. proposed a feature selection method called CFDex to detect cross-architecture botnet malware, but they only conducted experiments on MIPS-based samples.
[0009] Method 2 has the following defects: it only supports a single system architecture category, such as ARM-based, MIPS-based or X86-based architecture. This means that it is not compatible with multiple platforms at the same time, resulting in significant limitations and flexibility issues. In a multi-platform business environment, this single architecture limitation will seriously affect the scalability and adaptability of the system. For applications that require cross-platform operation or integration of multiple hardware environments, it limits the widespread application and promotion of the technology.
[0010] Method 3: Based on the information of dynamic disassembly file
[0011] Other information about the disassembled files, such as strings and CFG, can also be used to classify IoT botnet malware. Alhanahnah et al. proposed an efficient IoT botnet malware signature generation method to generate signatures for each malware family. Alasmary et al. used CFG to represent malware binaries and conducted a detailed analysis of graphs extracted from IoT botnet malware. They also used CFG and deep learning-based models to establish a detection mechanism for IoT botnet malware, while Phu et al. proposed the C500-CFG algorithm based on CFG features for IoT malware detection based on the idea of dynamic programming.
[0012] Method 3 has the following defects: Due to the application of obfuscation technology, disassembly analysis may face great challenges in locating the original entry point of botnet malware. Obfuscation not only increases the complexity of the code, but also deliberately creates interference to cover up the real logic of the malicious code. This makes it difficult for security analysts to accurately identify and understand the behavior path of the malware, thereby prolonging the analysis time. In addition, accurately extracting the control flow graph (CFG) is a very time-consuming process. The extraction of CFG is crucial to understanding the execution flow of the program, but due to the influence of obfuscation technology, the extraction process becomes more complicated and error-prone. All these factors together lead to a significant reduction in the efficiency and accuracy of disassembly analysis and CFG extraction when fighting botnet malware, increasing the difficulty and cost of security protection.
[0013] Therefore, to address the above problems, a botnet malware detection method based on download links is proposed. Summary of the invention
[0014] The purpose of the present invention is to provide a botnet malware detection method based on download links. The detection method of the present invention is flexible in design and can adapt to the ever-changing malware attack methods and patterns. By dynamically adjusting the detection strategy and parameters, the method can quickly respond to and adapt to emerging threats and maintain efficient detection capabilities.
[0015] The present invention is implemented in this way. The present invention provides a botnet malware detection method based on download links, which is specifically performed in the following steps:
[0016] S1: parse the original traffic, capture the pcap packets in the environment and extract the IP, port and URL information of each frame in the pcap packets;
[0017] Please follow the steps below:
[0018] S1.1: Create a dictionary for the IP, port and URL information of each frame obtained and save the above information;
[0019] S1.2: Iterate each frame in each pcap package until the information of all frames in the pcap package is saved;
[0020] S1.3: Create a file to save the information in each frame;
[0021] S1.4: Use the XGBoost algorithm to classify the download links according to their text similarity.
[0022] S2: Arrange the data set of the pcap package data in the environment; specifically, perform the following steps:
[0023] S2.1: Categorize the keyword text extracted from the pcap file and organize it into CSV file format;
[0024] S2.2: traverse the CSV file and re-execute step S1 to further check whether there is a null value;
[0025] S2.3: Process the CSV file and convert it into all text data before the adjacency matrix;
[0026] S2.4: extract label data and five-tuple data of different download links in the CSV file, including source IP, destination IP and download link;
[0027] S2.5: Use Python's third-party library numpy to convert the data into the specified array format;
[0028] S2.6: Traverse all data, extract and convert them into the data format for input to the graph neural network, and store them together with the quintuple data;
[0029] S2.7: Generate and output array data in the adjacency matrix format after numpy conversion;
[0030] S2.8: The array data for each adjacency matrix is stored as a separate file named according to the type of adjacency matrix stored; for example, "node_features.pkl".
[0031] S3: Perform training and testing, first construct the adjacency matrix, and then initialize the parameters; specifically, follow the following steps:
[0032] S3.1: Construct an adjacency matrix and determine the node types involved in the prediction, including source IP, destination IP, and link name;
[0033] S3.2: Determine the meta-path of a specific relationship, including SIP A —DIP B —SIP C , as shown in formula (1);
[0034]
[0035] S3.3: Construct an adjacency matrix for each meta-path, as shown in formula (2);
[0036]
[0037] Wherein, formula (2) represents the node connection in the relationship, and the number of adjacency matrices depends on the desired relationship complexity in formula (2). tm The adjacency matrix formed for different nodes;
[0038] S3.4; unify the adjacency matrices of all relations to the same dimension N×N;
[0039] S3.5: combine all nodes together to form an N×N matrix A';
[0040] S3.6: concatenate the three different node source IPs, destination IPs, and link names together to form an edge of length N;
[0041] S3.7: Ensure that the combined matrix contains all nodes and reflects the complete node relationship, the adjacency matrix A'.
[0042] S4: Perform matrix operations on the initialized data, then perform multi-channel training, and input the graph convolution layer to train the recognition model; parameter initialization is specifically performed in the following steps:
[0043] S4.1: Initialize multiple sets of random trainable parameters W, each set of trainable parameters W consists of K vectors, and the value of K is the number of types of edges;
[0044] S4.2: Perform softmax normalization on the trainable parameters to obtain a 1*1*K convolution kernel;
[0045] S4.3: Store the parameters after the softmax operation in a numpy array.
[0046] Further, the matrix operation is specifically performed according to the following steps:
[0047] S6.1: Multiply the convolution parameters one by one with the adjacency matrix of the input meta-path, as shown in formula (3), to obtain a set of matrices;
[0048]
[0049] Among them, φ belongs to the convolutional layer, W φ ∈R 1×1×K ;
[0050] S6.2: Perform addition operation on these matrices, as shown in formula (4), to obtain an added matrix;
[0051] Q n =∑ t∈n Q t Formula (4)
[0052] S6.3: As in formula (5), matrix multiplication is used to obtain all Q n Multiply, where the matrix D is the degree matrix, which is used to normalize the matrix;
[0053] A(1)=D -1 Πn>1 Q n Formula (5)
[0054] S5: Perform model training and optimization on the trained recognition model;
[0055] S6: Apply the trained model to detect botnet malware based on download link data.
[0056] Furthermore, multi-channel training is performed in the following steps:
[0057] S4.1: After the steps in parameter initialization and matrix operation, a set of adjacency matrices A'(1) is obtained, and the number of channels of A'(1) is 1;
[0058] S4.2: Calculate the adjacency matrix A'(l),r when the number of channels is l as in formula (6). After multiple layers of stacking, the adjacency matrix A'(l) of the input GCN is obtained;
[0059]
[0060] in, is the adjacency matrix A i The weights at layer l, D (l-1) A (l-1) The degree matrix of , and A'(l)∈R N ×N×C , where C represents the number of channels.
[0061] Furthermore, the graph convolution layer input is performed in the following steps:
[0062] S8.1: Apply GCN to the adjacency matrix A'(l) obtained after stacking l GT layers in step S3, and concatenate the vectors of multiple nodes; as shown in formula (7);
[0063]
[0064] Among them, || is the connection operation, C represents the number of channels, is the adjacency matrix of the ith channel of A'(l), yes The degree matrix, W∈R d×d is the weight matrix to be trained in the 1×1 convolution, X∈R N×d is the input feature matrix;
[0065] S8.2: Use Z for supervised node classification tasks, construct optimization objectives, and learn node representations through convolution operations on the learned meta-path graph to achieve detection effects.
[0066] Further, in step S5, the various types of adjacency matrices obtained in step S2 are divided into a training set and a test set, with a specific allocation ratio of 7:3. The model tuning is specifically performed according to the following steps:
[0067] S9.1: Based on the K-fold cross-validation method, the training set is divided into K non-overlapping training subsets, each set consists of K-1 partial training sets and 1 partial test set; the partial training sets in each set are sequentially input into the GTN heterogeneous graph model, and the other partial training sets are labeled for training the GTN heterogeneous graph model;
[0068] S9.2: Input the sub-test sets of each set into the first trained GTN heterogeneous graph model in sequence, and output the label prediction results of the sub-test sets; as shown in formula (8);
[0069]
[0070] Among them, S i is a test subset, G is heterogeneous graph data, f GTN (G,W) is the trained GTN model, whose parameter is W, For the test set S i The predicted label of
[0071] S9.3: Each subtest set S i Input into the trained GTN model, as shown in the formula
[0072]
[0073] For each subtest set S i , prediction results , as shown in formula (10)
[0074]
[0075] The label prediction results of the sub-test set and the label true results of the sub-test set are concatenated in the order of the training subset numbers to obtain a new global feature expression, as shown in formula (11);
[0076]
[0077] in For each subtest set S i The predicted label and the true label y i Splice to form a new feature expression, || is a connection symbol;
[0078] S9.4: Input the feature expression obtained by training with the subtest set into the GCN model, output the label prediction result, train the GCN model by inputting the real result of the label, and use the test set to test the learned GTN heterogeneous graph model and GCN model to verify the model learning effect;
[0079] S9.5: According to the previous model learning effect, adjust the parameter W and the number of model channels in step S3, and during the training process, by judging when the loss value tends to be stable and no longer has a significant impact on the model prediction accuracy, use the method of early termination of training to avoid overfitting results and obtain a suitable model.
[0080] Compared with the prior art, the present invention has the following beneficial effects:
[0081] 1. The botnet detection method based on download links described in the present invention is adopted, and each step is relatively independent, which greatly reduces the coupling degree when running the detection, and ensures that each module will not affect each other during operation. In the initial stage of prediction, multiple preliminary classifications and filtering of input data are performed to ensure that no null values will affect the prediction results during the model training process, and ensure that high-accuracy classification can be maintained in the absence of information.
[0082] 2. In the process of keyword classification, in order to improve the classification accuracy and eliminate the negative impact of null values on the classification results, the present invention provides an improved detection method. Specifically, the detection method implements a null value processing mechanism to ensure that null values will not interfere with the effect of the classification model during the classification process, thereby improving the stability and accuracy of the classification. Based on the propagation mode of download links used by botnets, the present invention constructs several heterogeneous graphs, and introduces a heterogeneous graph analysis algorithm, the graph transformation network (GTN). The GTN does not need to rely on a priori defined meta-paths, that is, it does not need to rely on the prior knowledge of experts, and adaptively learns meta-paths of appropriate length for a given data set. In addition, the importance of the meta-path is reflected by its attention index. These characteristics enable the GTN method to perform well in processing data with heterogeneous graph structures, and can automatically optimize and adapt to different application scenarios, while increasing the depth of the model and the number of trainable parameters, thereby significantly improving the learning ability and classification effect.
[0083] 3. The detection method is designed to support multi-platform operation and has wide applicability. Whether in different operating systems or multiple hardware environments, the detection method can be effectively executed to ensure cross-platform compatibility and stability. The detection method can be compatible with and support multiple types of platforms at the same time, including but not limited to systems with ARM, MIPS and X86 architectures. This multi-platform support benefits from the universal design of the method itself, as well as specific optimizations and adjustments, which enable the present invention to be used in a wide range of hardware environments, significantly expanding its scope of application. Due to differences in system architectures of different platforms, traditional botnet malware detection methods often need to be specifically designed and adjusted for each architecture. However, the detection method proposed in the present invention achieves detection compatible with multiple platforms through a general algorithm and an architecture-independent implementation method.
[0084] 4. This detection method also has more trainable parameters and deeper model features, which make the model have stronger learning ability and feature extraction ability. By increasing the number of layers and parameters of the training model, this detection method can more deeply explore the potential patterns and relationships in the data, significantly improve the classification and detection performance, and can handle new botnet malware detection tasks. The detection method of the present invention is flexible in design and can adapt to the ever-changing malware attack methods and patterns. By dynamically adjusting the detection strategy and parameters, this method can quickly respond to and adapt to emerging threats and maintain efficient detection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS
[0085] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It is understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.
[0086] Figure 1 is a flow chart of the method of the present invention;
[0087] Figure 2 It is a screenshot of the code for the data set arrangement of the present invention;
[0088] Figure 3 This is a screenshot of the code of the present invention for processing a CSV file and converting it into all text data before the adjacency matrix;
[0089] Figure 4 It is a screenshot of the code of the present invention for generating and outputting array data in the adjacency matrix format after numpy conversion;
[0090] Figure 5The array data of the adjacency matrix of the present invention is stored as a separate file, and the file is named as a code screenshot of the type of adjacency matrix stored;
[0091] Figure 6 The model training of the present invention Figure 1 ;
[0092] Figure 7 The model training of the present invention Figure 2 ;
[0093] Figure 8 It is the original flow analysis flow chart of the present invention;
[0094] Fig. 9 is a data set arrangement flow chart of the present invention;
[0095] Fig.10 is a botnet connection diagram of the present invention;
[0096] Fig.11 The multi-channel training process of the present invention is Figure 1 ;
[0097] Fig.12 The multi-channel training process of the present invention is Figure 2 . DETAILED DESCRIPTION
[0098] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but is only for selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.
[0099] See also Figure 1-Figure 12 The present invention provides a method for detecting botnet malware based on download links, which is specifically performed in the following steps:
[0100] like Figure 8 ,S1: parse the original traffic, capture the pcap package in the environment and extract the IP, port and url information of each frame in the pcap package; as shown in Table 1;
[0101] Table 1 Pcap package extraction data in the environment
[0102] index src_ip dst_ip Download 0 99.92.137.185 58.255.208.46 58.255.208.46:45964 / mozi.m 1 99.92.137.185 58.255.13.132 58.255.13.132:52561 / Mozi.m 2 99.79.77.56 221.232.181.17 221.232.181.170:56803 / i 3 99.79.77.244 111.38.9.114 111.38.9.114:40171 / i 4 99.79.69.54 222.188.31.204 222.188.31.204:46374 / i 5 99.79.69.11 114.239.17.121 114.239.17.121:47542 / Mozi.m 6 99.79.69.11 113.88.85.124 113.88.85.124:52986 / i 7 99.79.69.11 113.88.85.124 113.88.85.124:52986 / bin.sh 8 99.79.64.96 120.209.121.24 120.209.121.243:60246 / i 9 99.79.58.220 175.10.18.167 175.10.18.167:33553 / i 10 99.79.58.151 112.30.110.58 112.30.110.58:50834 / i 11 99.79.51.201 58.48.152.77 58.48.152.77:46420 / i 12 99.79.48.169 116.30.223.83 116.30.223.83:49079 / Mozi.m 13 99.79.40.170 113.118.251.23 113.118.251.203:45139 / Mozi. … … … … 104842 96.126.124.197 120.193.91.184 120.193.91.177:41502 / i 104843 96.126.124.197 112.233.105.40 175.11.20.220:58815 / i 104844 96.126.124.197 39.87.110.99 111.176.160.6:34117 / i
[0103] Please follow the steps below:
[0104] S1.1: Create a dictionary for the IP, port and URL information of each frame obtained and save the above information;
[0105] S1.2: Iterate each frame in each pcap package until the information of all frames in the pcap package is saved;
[0106] S1.3: Create a file to save the information in each frame;
[0107] S1.4: Use the XGBoost algorithm to classify the download links according to their text similarity.
[0108] S2: Arrange the data set of the pcap package data in the environment; specifically, perform the following steps:
[0109] like Figure 2 ,S2.1: Categorize the keyword text extracted from the pcap file and organize it into CSV file format;
[0110] like Figure 3 , S2.2: traverse the CSV file, re-execute step S1, and further check whether there is a null value;
[0111] S2.3: Process the CSV file and convert it into all text data before the adjacency matrix;
[0112] like Figure 4 , ,S2.4: Extract the label data and five-tuple data of different download links in the CSV file, including the source IP, destination IP and download link;
[0113] S2.5: Use Python's third-party library numpy to convert the data into the specified array format;
[0114] S2.6: Traverse all data, extract and convert them into the data format for input to the graph neural network, and store them together with the quintuple data;
[0115] S2.7: Generate and output array data in the adjacency matrix format after numpy conversion;
[0116] like Figure 5 , S2.8: The array data of each adjacency matrix is stored as a separate file, and the file is named according to the type of adjacency matrix stored; for example, "node_features.pkl".
[0117] S3: Perform training and testing, first construct the adjacency matrix, and then initialize the parameters; specifically, follow the following steps:
[0118] S3.1: Construct an adjacency matrix and determine the node types involved in the prediction, including source IP, destination IP, and link name;
[0119] S3.2: Determine the meta-path of a specific relationship, including SIP A —DIP B —SIP C , as shown in formula (1);
[0120]
[0121] S3.3: Construct an adjacency matrix for each meta-path, as shown in formula (2);
[0122]
[0123] Wherein, formula (2) represents the node connection in the relationship, and the number of adjacency matrices depends on the desired relationship complexity in formula (2). The adjacency matrix formed for different nodes;
[0124] S3.4; unify the adjacency matrices of all relations to the same dimension N×N;
[0125] S3.5: combine all nodes together to form an N×N matrix A';
[0126] S3.6: concatenate the three different node source IPs, destination IPs, and link names together to form an edge of length N;
[0127] like Figure 4 ,S3.7: Ensure that the combined matrix contains all nodes and reflects the complete node relationship, adjacency matrix A',.
[0128] S4: Perform matrix operations on the initialized data, then perform multi-channel training, and input the graph convolution layer to train the recognition model; parameter initialization is specifically performed in the following steps:
[0129] S4.1: Initialize multiple sets of random trainable parameters W, each set of trainable parameters W consists of K vectors, and the value of K is the number of types of edges;
[0130] S4.2: Perform softmax normalization on the trainable parameters to obtain a 1*1*K convolution kernel;
[0131] S4.3: Store the parameters after the softmax operation in a numpy array.
[0132] Further, the matrix operation is specifically performed according to the following steps:
[0133] S6.1: Multiply the convolution parameters one by one with the adjacency matrix of the input meta-path, as shown in formula (3), to obtain a set of matrices;
[0134]
[0135] Among them, φ belongs to the convolutional layer, W φ ∈R 1×1×K ;
[0136] S6.2: Perform addition operation on these matrices, as shown in formula (4), to obtain an added matrix;
[0137] Q n =∑ t∈n Q t Formula (4)
[0138] S6.3: As in formula (5), matrix multiplication is used to obtain all Q n Multiply, where the matrix D is the degree matrix, which is used to normalize the matrix;
[0139] A(1)=D -1 Π n>1 Q n Formula (5)
[0140] S5: Perform model training and optimization on the trained recognition model;
[0141] S6: Apply the trained model to detect botnet malware based on download link data.
[0142] Furthermore, multi-channel training is performed in the following steps: Figure 11-Figure 12 ;
[0143] S4.1: After the steps in parameter initialization and matrix operation, a set of adjacency matrices A'(1) is obtained, and the number of channels of A'(1) is 1;
[0144] S4.2: Calculate the adjacency matrix A'(l),r when the number of channels is l as in formula (6). After multiple layers of stacking, the adjacency matrix A'(l) of the input GCN is obtained;
[0145]
[0146] in, is the adjacency matrix A i The weights at layer l, D (l-1) A (l-1 The degree matrix of , and A'(l)∈RN×N×C , where C represents the number of channels.
[0147] Furthermore, the graph convolution layer input is performed in the following steps:
[0148] S8.1: Apply GCN to the adjacency matrix A'(l) obtained after stacking l GT layers in step S3, and concatenate the vectors of multiple nodes; as shown in formula (7);
[0149]
[0150] Among them, || is the connection operation, C represents the number of channels, is the adjacency matrix of the ith channel of A'(l), yes The degree matrix, W∈R d×d is the weight matrix to be trained in the 1×1 convolution, X∈R N×d is the input feature matrix;
[0151] S8.2: Use Z for supervised node classification tasks, construct optimization objectives, and learn node representations through convolution operations on the learned meta-path graph to achieve detection effects.
[0152] Further, in step S5, the various types of adjacency matrices obtained in step S2 are divided into a training set and a test set, with a specific allocation ratio of 7:3. The model tuning is specifically performed according to the following steps:
[0153] S9.1: Based on the K-fold cross-validation method, the training set is divided into K non-overlapping training subsets, each set consists of K-1 partial training sets and 1 partial test set; the partial training sets in each set are sequentially input into the GTN heterogeneous graph model, and the other partial training sets are labeled for training the GTN heterogeneous graph model;
[0154] S9.2: Input the sub-test sets of each set into the first trained GTN heterogeneous graph model in sequence, and output the label prediction results of the sub-test sets; as shown in formula (8);
[0155]
[0156] Among them, S i is a test subset, G is heterogeneous graph data, f GTN (G,W) is the trained GTN model, whose parameter is W, For the test set S i The predicted label of
[0157] S9.3: Each subtest set S i Input into the trained GTN model, as shown in formula (9);
[0158]
[0159] For each subtest set S i , prediction results , as shown in formula (10)
[0160]
[0161] The label prediction results of the sub-test set and the label true results of the sub-test set are concatenated in the order of the training subset numbers to obtain a new global feature expression, as shown in formula (11);
[0162]
[0163] in For each subtest set S i The predicted label and the true label y i Splice to form a new feature expression, || is a connection symbol;
[0164] S9.4: Input the feature expression obtained by training with the sub-test set into the GCN model, output the label prediction result, train the GCN model by inputting the real result of the label, and use the test set to test the learned GTN heterogeneous graph model and GCN model to verify the model learning effect; as shown in Table 2-Table 4;
[0165] Table 2 Results of 250 training rounds
[0166]
[0167]
[0168] Table 3 Results of 300 training rounds
[0169] Dataset Nodes Edges EdgeType Training Test Accuracy Mix1 9883 25986 4 1000 2351 0.59 Mix2 19053 70864 4 1200 2879 0.58 Mix3 13107 39428 4 400 2457 0.61
[0170] Table 4 Results of training with 350 rounds
[0171] Dataset Nodes Edges EdgeType Training Test Accuracy Mix1 9883 25986 4 1000 2351 0.65 Mix2 19053 70864 4 1200 2879 0.63 Mix3 13107 39428 4 400 2457 0.69
[0172] S9.5: According to the previous model learning effect, adjust the parameter W and the number of model channels in step S3, and use the early termination method to avoid overfitting results and obtain a suitable model by judging when the loss value tends to be stable and no longer has a significant impact on the model prediction accuracy during the training process. Figure 6-Figure 7By adjusting the parameter W and the number of model channels three times, three experimental results are obtained. It can be seen that the loss values in the first two figures fluctuate greatly and the stable range cannot be determined. The last figure can clearly show that with the increase of training rounds, the loss value area is relatively stable, and the accuracy tends to a stable value. In addition, the training can be terminated early between 250-350 training rounds, and a more suitable model is obtained.
[0173] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention has various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A method for detecting botnet malware based on download links, characterized in that: Please follow the steps below: S1: parse the original traffic, capture the pcap packets in the environment and extract the IP, port and URL information of each frame in the pcap packets; S2: organize the data sets of the pcap packages in the environment; S3: Perform training and testing, first construct the adjacency matrix, and then initialize the parameters; S4: Perform matrix operations on the initialized data, then perform multi-channel training, and input the graph convolution layer to train the recognition model; S5: Perform model training and optimization on the trained recognition model; S6: Apply the trained model to detect botnet malware based on download link data.
2. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S1, the following steps are specifically performed: S1.1: Create a dictionary for the IP, port and URL information of each frame obtained and save the above information; S1.2: Iterate each frame in each pcap package until the information of all frames in the pcap package is saved; S1.3: Create a file to save the information in each frame; S1.4: Use the XGBoost algorithm to classify the download links according to their text similarity.
3. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S2, the following steps are specifically performed: S2.1: Categorize the keyword text extracted from the pcap file and organize it into CSV file format; S2.2: traverse the CSV file and re-execute step S1 to further check whether there is a null value; S2.3: Process the CSV file and convert it into all text data before the adjacency matrix; S2.4: extract label data and five-tuple data of different download links in the CSV file, including source IP, destination IP and download link; S2.5: Use Python's third-party library numpy to convert the data into the specified array format; S2.6: Traverse all data, extract and convert them into the data format for input to the graph neural network, and store them together with the quintuple data; S2.7: Generate and output array data in the adjacency matrix format after numpy conversion; S2.8: The array data of each adjacency matrix is stored as a separate file, and the file is named according to the type of adjacency matrix stored;.
4. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S3, the following steps are specifically performed: S3.1: Construct an adjacency matrix and determine the node types involved in the prediction, including source IP, destination IP, and link name; S3.2: Determine the meta-path of a specific relationship, including SIP A —DIP B —SIP C , as shown in formula (1); S3.3: Construct an adjacency matrix for each meta-path, as shown in formula (2); in, The adjacency matrix formed for different nodes; S3.4; unify the adjacency matrices of all relations to the same dimension N×N; S3.5: combine all nodes together to form an N×N matrix A'; S3.6: concatenate the three different node source IPs, destination IPs, and link names together to form an edge of length N; S3.7: Ensure that the combined matrix contains all nodes and reflects the complete node relationship, the adjacency matrix A'.
5. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S4, parameter initialization is specifically performed according to the following steps: S4.1: Initialize multiple sets of random trainable parameters W, each set of trainable parameters W consists of K vectors, and the value of K is the number of types of edges; S4.2: Perform softmax normalization on the trainable parameters to obtain a 1*1*K convolution kernel; S4.3: Store the parameters after the softmax operation in a numpy array.
6. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S4, the matrix operation is specifically performed according to the following steps: S6.1: Multiply the convolution parameters one by one with the adjacency matrix of the input meta-path, as shown in formula (3), to obtain a set of matrices; Among them, φ belongs to the convolutional layer, W φ ∈R 1×1×K ; S6.2: Perform addition operation on these matrices, as shown in formula (4), to obtain an added matrix; Q n = ∑ t∈n Q t Formula (4) S6.3: As in formula (5), matrix multiplication is used to obtain all Q n Multiply, where matrix D is the degree matrix, which is used to normalize the matrix; A(1) = D -1 Π n>1 Q n Equation (5).
7. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S4, the multi-channel training is specifically performed according to the following steps: S7.1: After the steps of parameter initialization and matrix operation, a set of adjacency matrices A'(1) is obtained, and the number of channels of A'(1) is 1; S7.2: Calculate the adjacency matrix A'(l),r when the number of channels is l as in formula (6). After multiple layers of stacking, the adjacency matrix A'(l) of the input GCN is obtained; in, is the adjacency matrix A i The weights at layer l, D (l-1) A (l-1 The degree matrix of , and A'(l)∈R N×N×C , where C represents the number of channels.
8. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S4, the graph convolution layer input is specifically performed according to the following steps: S8.1: Apply GCN to the l The adjacency matrix obtained by stacking GT layers A'(l) , and concatenate the vectors of multiple nodes; as shown in formula (7); Among them, || is the connection operation, C represents the number of channels, is the adjacency matrix of the ith channel of A'(l), yes The degree matrix, W∈R d×d is the weight matrix to be trained in the 1×1 convolution, X∈R N×d is the input feature matrix; S8.2: Use Z for supervised node classification tasks, construct optimization objectives, and learn node representations through convolution operations on the learned meta-path graph to achieve detection effects.
9. The method for detecting botnet malware based on download links according to claim 1, characterized in that: In step S5, the various types of adjacency matrices obtained in step S2 are divided into training sets and test sets, and the model tuning is specifically performed according to the following steps: S9.1: Based on the K-fold cross-validation method, the training set is divided into K non-overlapping training subsets, each set consists of K-1 partial training sets and 1 partial test set; the partial training sets in each set are sequentially input into the GTN heterogeneous graph model, and the other partial training sets are labeled for training the GTN heterogeneous graph model; S9.2: Input the sub-test sets of each set into the first trained GTN heterogeneous graph model in sequence, and output the label prediction results of the sub-test sets; as shown in formula (8); Among them, S i is a test subset, G is heterogeneous graph data, f GTN (G,W) is the trained GTN model, whose parameter is W, For the test set S i The predicted label of S9.3: Each subtest set S i Input into the trained GTN model, as shown in formula (9); For each subtest set S i , prediction results As shown in formula (10) The label prediction results of the sub-test set and the label true results of the sub-test set are concatenated in the order of the training subset numbers to obtain a new global feature expression, as shown in formula (11); in For each subtest set S i The predicted label and the true label y i Splice to form a new feature expression, || is a connection symbol; S9.4: Input the feature expression obtained by training with the subtest set into the GCN model, output the label prediction result, train the GCN model by inputting the real result of the label, and use the test set to test the learned GTN heterogeneous graph model and GCN model to verify the model learning effect; S9.5: According to the previous model learning effect, adjust the parameter W and the number of model channels in step S3, and during the training process, by judging when the loss value tends to be stable and no longer has a significant impact on the model prediction accuracy, use the method of early termination of training to avoid overfitting results and obtain a suitable model.