Multi-view feature fusion network hostile attack detection method and system

Abstract

The invention provides a multi-view feature fusion network hostile attack detection method and system, and relates to the technical field of network security. The method comprises the following steps: extracting existence characteristics of malicious behaviors by constructing a node mutual information graph and an embedded graph according to an interface related to possible malicious behaviors and an interface calling sequence; according to the interface related to the possible malicious behavior and the interface calling sequence, constructing a transition probability matrix through a K-means algorithm, and extracting the transferability characteristics of the possible malicious behavior; and determining whether the possible malicious behavior is a malicious behavior or not according to the extracted existence features and the extracted transferability features. According to the method, the calling relation and similarity of the interfaces are represented by existence features, then the calling association relation between different interfaces of possible malicious behaviors is represented by extracting transfer features, and the two fused features are identified, so that the accuracy of a malicious behavior detection result can be effectively improved; therefore, the malicious network attack behaviors can be identified and classified.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a method and system for detecting network malicious attacks by integrating multi-view features. Background Art

[0002] Currently, network security issues have attracted much attention, and the detection method of malicious network attacks such as viruses and Trojans has always been a hot issue in the field of network security. In the era of popular network applications, users need reliable network malicious attack detection technology to fight against unsafe factors in the network, such as viruses, Trojans and other unsafe factors. With the development of network technology, viruses and Trojans are becoming more and more latent, hidden and destructive, and more and more difficult to detect. The invasion and destruction of networks by malicious network attacks such as viruses and Trojans has become a key issue that needs to be solved urgently.

[0003] At present, the detection methods for network malicious attack behaviors such as viruses and Trojans mainly include static detection technology and dynamic detection methods. Among them, the static detection method parses the malicious code in PE file format, extracts binary, string, byte sequence, etc. as feature codes, and matches the feature code to be tested with the feature library to detect whether there is network malicious attack behavior. The dynamic analysis detection method detects network malicious attack behaviors based on the calling behavior of the application programming interface. According to the differences in detection methods, it can be divided into sequence-based virus and Trojan detection, graph-based virus and Trojan detection, and transfer-based virus and Trojan detection.

[0004] However, the existing detection methods for malicious network attacks such as viruses and Trojans extract single features from the sequence information of application program interfaces for security detection, and their security detection performance cannot meet the usage requirements. Summary of the invention

[0005] The purpose of this specification is to provide a network malicious attack detection method with multi-view feature fusion, which can solve the problem of poor security detection performance in existing network malicious attack behavior detection methods.

[0006] The embodiments of this specification are implemented as follows: On the one hand, this specification provides a network malicious attack detection method with multi-view feature fusion, which mainly includes: Based on the network operation records of key network communication facilities, determine possible malicious behaviors and the interfaces and interface call sequences involved; According to the interface and interface call sequence involved in the possible malicious behavior, by constructing a node mutual information graph and an embedded graph, the existence characteristics of the malicious behavior are extracted, and the nodes of the node mutual information graph and the embedded graph are the interfaces involved in the possible malicious behavior, including: The interfaces involved in the possible malicious behavior are used as nodes, and the correlation between the two nodes is used as the correlation edge; Determine the call matrix of the system interface set according to the call order and call distance of each node in the interface call sequence; the call distance represents the number of nodes between two nodes in the interface call sequence; Determine, according to the call matrix, a call vector of the call node and a weight of the first associated edge; Constructing the node mutual information graph according to the weight of the first associated edge; Interfaces are grouped by 2-gram of interface call sequences, and the node function similarity threshold is determined by the L2 paradigm between node embedding vectors. ; If the functional similarity between nodes is greater than There is a second associated edge for the node, otherwise there is no second associated edge; Determine neighbor nodes with similar functions to each node through the L2 norm between node embedding vectors; Calculate the functional similarity between each node and its neighboring nodes with similar functions; Adding a second associated edge between each node and its neighboring nodes with similar functions and determining the weight of the second associated edge; Determining the embedded graph according to the weight of the second associated edge; Determine a first adjacency matrix according to the node mutual information graph; Determining a second adjacency matrix according to the embedded graph; According to the first adjacency matrix and the second adjacency matrix, extracting a first behavior feature and a second behavior feature respectively through a multi-layer Transformer network, wherein the first behavior feature and the second behavior feature correspond to the node mutual information graph and the embedded graph respectively; Determining, based on the first behavior feature and the second behavior feature, an existence feature of the possible malicious behavior; According to the interfaces and interface call sequences involved in the possible malicious behavior, a transition probability matrix is ​​constructed by using a K-means algorithm to extract the transfer characteristics of the possible malicious behavior; Whether the possible malicious behavior is a malicious behavior is determined based on the extracted existence feature and the transfer feature.

[0007] In this specification, the determination of possible malicious behavior and its related interfaces and interface call sequences based on the network operation records of key network communication facilities obtained includes: Determine whether the network operation behavior complies with the network security protection strategy based on the network operation records of key network communication facilities obtained; If not, the network operation behavior that does not comply with the network security protection strategy is determined to be the possible malicious behavior.

[0008] In this specification, the determination of possible malicious behavior and its related interfaces and interface call sequences based on the network operation records of key network communication facilities obtained includes: Based on the network operation records of key network communication facilities, a malicious behavior threat association graph is constructed using the KeyGraph algorithm; Determining the key threat correlation strength according to the malicious behavior threat correlation diagram; Determine a malicious behavior interface path calling model according to the key threat correlation strength; According to the possible malicious behavior and the malicious behavior interface path calling model, the interface and interface calling sequence involved in the possible malicious behavior are determined.

[0009] In this specification, before determining the existence feature of the possible malicious behavior according to the first behavior feature and the second behavior feature, the method includes: The graph convolutional neural network is iteratively updated through a graph convolutional neural network loss function until the accuracy of the first behavior feature and the second behavior feature output by the updated graph convolutional neural network meets the extraction condition.

[0010] In this specification, the transition probability matrix is ​​constructed by the K-means algorithm according to the interface and interface call sequence involved in the possible malicious behavior to extract the transfer characteristics of the possible malicious behavior, including: Using the K-means algorithm, cluster the interfaces involved in the possible malicious behavior, and determine the clusters and the centers of the clusters. Constructing an interface call cluster sequence according to the interface call sequence involved in the possible malicious behavior and the cluster to which the interface belongs; The interface call cluster sequence is used as a Markov chain, each cluster is used as the state of the interface, and a transition probability matrix is ​​generated through state transition statistics probability; The transition probability matrix is ​​used as input, and the transition characteristics of the possible malicious behavior are extracted through a convolutional neural network.

[0011] In this specification, determining whether the possible malicious behavior is a malicious behavior based on the extracted existence feature and the transfer feature includes: fusing the existence feature and the transfer feature to obtain a fusion feature; The fused features are used as input, and the possible malicious behavior is identified through a one-dimensional convolutional neural network to determine whether the possible malicious behavior is a malicious behavior.

[0012] On the other hand, this specification provides a network malicious attack detection system with multi-view feature fusion, which mainly includes: A determination module, used to determine possible malicious behaviors and the interfaces and interface call sequences involved therein based on the network operation records of the acquired key network communication facilities; An existence feature extraction module is used to extract the existence feature of the malicious behavior by constructing a node mutual information graph and an embedded graph according to the interface and interface call sequence involved in the possible malicious behavior, wherein the nodes of the node mutual information graph and the embedded graph are the interfaces involved in the possible malicious behavior; A transfer feature extraction module, used to construct a transfer probability matrix through a K-means algorithm according to the interfaces and interface call sequences involved in the possible malicious behavior, and extract the transfer features of the possible malicious behavior; The identification module is used to determine whether the possible malicious behavior is a malicious behavior based on the extracted existence feature and the transfer feature.

[0013] The embodiments of this specification have at least the following advantages or beneficial effects: This network malicious behavior detection method can accurately obtain the correlation relationship and functional similarity between interfaces, and represent the calling relationship and similarity of the above interfaces with node mutual information graph and embedded graph, and then represent the calling correlation relationship between different interfaces of possible malicious behavior by extracting transfer features. The above two features after fusion are identified, which can effectively improve the accuracy of malicious behavior detection results, thereby realizing the identification and classification of network malicious attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present specification and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 A flowchart of a network malicious attack detection method using multi-view feature fusion provided in this specification; Figure 2 A flowchart of another network malicious attack detection method using multi-view feature fusion provided in this specification; Figure 3 This is a schematic diagram of the network malicious attack detection system with multi-view feature fusion provided in this manual. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the embodiments of this specification more clear, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are part of the embodiments of this specification, not all of the embodiments. Generally, the components of the embodiments of this specification described and shown in the drawings here can be arranged and designed in various different configurations.

[0017] Please refer to Figure 1 and Figure 2 An embodiment of the present specification provides a network malicious attack detection method with multi-view feature fusion, which mainly includes: Step 102: Determine possible malicious behaviors and the interfaces and interface call sequences involved therein based on the network operation records of the acquired key network communication facilities; Step 104: extract the existence characteristics of the malicious behavior by constructing a node mutual information graph and an embedded graph according to the interface and interface call sequence involved in the possible malicious behavior, wherein the nodes of the node mutual information graph and the embedded graph are the interfaces involved in the possible malicious behavior; Step 106: construct a transition probability matrix through a K-means algorithm according to the interfaces and interface call sequences involved in the possible malicious behavior, and extract the transfer characteristics of the possible malicious behavior; Step 108: Determine whether the possible malicious behavior is a malicious behavior based on the extracted existence feature and the transfer feature.

[0018] In this embodiment, the above-mentioned key network communication facilities refer to facilities that are vulnerable to threats, such as servers, routers, computer terminals and other equipment.

[0019] In this embodiment, the above method can accurately obtain the correlation relationship and functional similarity between interfaces, and use the node mutual information graph and the embedded graph to represent the calling relationship and similarity of the above interfaces. Then, by extracting the transfer feature, the calling correlation relationship between different interfaces of possible malicious behaviors is represented. The above two features after fusion are identified, which can effectively improve the accuracy of malicious behavior detection results, thereby realizing the identification and classification of network malicious attack behaviors.

[0020] In this embodiment, by optimizing the existence characteristics in the above manner and fully exploring the transfer characteristics of malicious behaviors, the reliability of network malicious attack behavior detection can be effectively improved.

[0021] In this embodiment, one implementation of step 102 is as follows: Step 112: Determine whether the network operation behavior complies with the network security protection strategy based on the network operation records of the key network communication facilities obtained; Step 114: If not, determine that the network operation behavior that does not comply with the network security protection strategy is the possible malicious behavior.

[0022] In this embodiment, if so, the current network operation behavior is considered to be normal network behavior, not malicious behavior.

[0023] In this embodiment, the above-mentioned network communication key facilities are used as security ontology instances to determine whether part or all of the network operation behaviors of the security ontology instance violate the security protection strategy. If so, the current network operation behavior is determined to be a possible malicious behavior.

[0024] In this embodiment, the above-mentioned network operation record may be a network operation log.

[0025] In this embodiment, through the above method, the network malicious behavior can be specifically formalized to facilitate the extraction of relevant features of the network malicious behavior for analysis.

[0026] In this embodiment, one implementation of step 102 is as follows: Step 122: construct a malicious behavior threat association graph through a KeyGraph algorithm based on the network operation records of the acquired key network communication facilities; Step 124: Determine the key threat correlation strength according to the malicious behavior threat correlation graph; Step 126: Determine a malicious behavior interface path call model according to the key threat association strength; Step 128: Determine the interface and interface calling sequence involved in the possible malicious behavior based on the possible malicious behavior and the malicious behavior interface path calling model.

[0027] In this embodiment, by constructing a malicious behavior threat level association graph, the implicit threat of network malicious attacks can be quantitatively evaluated.

[0028] In this embodiment, the malicious behavior threat association diagram extracts key threat association strengths based on malicious behavior relevance and probability theory, that is, determines the threat behaviors implied by network malicious attack behaviors in the above manner.

[0029] In this embodiment, based on the above-mentioned malicious behavior threat association graph, the key threat association strength is determined through an initial interface call model (initial parameters are determined based on prior knowledge), and the initial parameters are iterated based on the key threat association strength to determine the precise malicious behavior interface path call model corresponding to the current malicious behavior threat association graph.

[0030] In this embodiment, the initial interface calling model parameter setting range or parameter setting has a wide characteristic.

[0031] In this embodiment, the above malicious behavior interface path calling model Specifically:

[0032] in, This is a malicious behavior threat association diagram. It is a key cluster in the malicious behavior threat association graph. They are security metric set, security metric, threat association directed graph, threat association vertex set, and threat association vertex. Indicates the vertex in the threat association directed graph The number of arrows.

[0033] In this embodiment, one implementation of step 104 is as follows: Step 132: taking the interface involved in the possible malicious behavior as a node, and taking the correlation degree between two nodes as an association edge; Step 134: Determine a call matrix of the system interface set according to the call order and call distance of each node in the interface call sequence; the call distance represents the number of nodes between two nodes in the interface call sequence; Step 136: Determine the call vector of the call node and the weight of the first associated edge according to the call matrix; Step 138: construct the node mutual information graph according to the weight of the first associated edge.

[0034] In this embodiment, the system interface set represents the complete set of interfaces provided by the operating system, which can be expressed as .by Representation Node and The calling relationship, Representation Node The call vector of PMI represents the correlation between interfaces. If PMI is a positive value, it means that the correlation between interfaces is high, while if PMI is a negative value, it means that there is no correlation between the interfaces, that is, there is no first association edge between the two nodes.

[0035] In this embodiment, and The calculation method is:

[0036]

[0037] The weight of the first incident edge The calculation method is:

[0038]

[0039]

[0040] in, For any two different nodes, Representation Node Call vector elements, Represents any node Calling vector mean, Call any node in the interface call sequence The calling frequency, Any node in the interface call sequence The frequency of occurrence, Indicates the total length of the interface call sequence.

[0041] In this embodiment, the above interface refers to the calling interface of the application program.

[0042] In this embodiment, one implementation of step 104 is as follows: Step 142: Group interfaces by 2-gram of interface call sequence, and determine node function similarity threshold by L2 normal form between node embedding vectors . The functional similarity between nodes is greater than There is a second associated edge for the node, otherwise there is no second associated edge; Step 144, determining neighbor nodes with similar functions to each node through the L2 normal form between node embedding vectors; Step 146, calculating the functional similarity between each node and its neighboring nodes with similar functions; Step 146: adding a second associated edge between each node and its neighboring nodes with similar functions and determining the weight of the second associated edge; Step 148: Determine the embedded graph according to the weight of the second associated edge.

[0043] In this embodiment, the interface call sequence may be embeddedly encoded according to its context, and the neighboring nodes with similar functions to each node may be determined through the L2 paradigm between node embedding vectors.

[0044] In this embodiment, interfaces in the interface call sequence that are adjacent to each other are grouped into one interface. The interface group set is denoted as U. The node function similarity threshold The calculation method is:

[0045]

[0046] The weight of the second incident edge above The specific calculation method is:

[0047]

[0048] in, Indicates the length of the interface group set. Representation Node L2 normalized distance of word embeddings, Representation Node Node embedding vector obtained based on word2vec.

[0049] In this embodiment, one implementation of step 104 is as follows: Step 152: determining a first adjacency matrix according to the node mutual information graph; Step 154: Determine a second adjacency matrix according to the embedded graph; Step 156: extracting a first behavior feature and a second behavior feature respectively through a multi-layer Transformer network according to the first adjacency matrix and the second adjacency matrix, wherein the first behavior feature and the second behavior feature respectively correspond to the node mutual information graph and the embedded graph; Step 158: Determine the existence feature of the possible malicious behavior based on the first behavior feature and the second behavior feature.

[0050] In this embodiment, the calling relationship between software and interfaces can be integrated into the constructed node mutual information graph and embedded graph through the above method, thereby effectively enhancing the semantic information of network malicious attack behavior.

[0051] In this embodiment, Represents the node mutual information graph For middle nodes, based on the node mutual information graph The constructed adjacency matrix is ​​recorded as :

[0052] Representing Embedding-Based Graphs The nodes are based on the embedded graph The constructed adjacency matrix is ​​recorded as :

[0053] In this embodiment, the first behavior feature and the second behavioral characteristic They are:

[0054]

[0055]

[0056]

[0057]

[0058]

[0059]

[0060]

[0061] in, Indicates The first-level Transformer block is integrated through the multi-head attention mechanism to obtain the first-level behavior features. and the second behavioral characteristic , Indicates The learnable weights of the layer Transformer block, Table The query features, key features and value features of each attention head, Indicates The learnable weights of query features, key features, and value features of the attention heads, * represents or .

[0062] In this embodiment, the first behavior feature and the second behavior feature are compressed by a one-dimensional convolutional neural network, that is:

[0063]

[0064] in, represents the dimension reduction convolutional network, Represents a concatenation operation.

[0065] In this embodiment, the above method can be used to enable the existence feature to characterize the associative calling relationship and similar calling relationship between the software and the interface.

[0066] In this embodiment, it also includes: Step 162: Iteratively update the Transformer network through a loss function until the accuracy of the first behavior feature and the second behavior feature output by the updated Transformer network meets the extraction condition.

[0067] Specifically, in this embodiment, in order to optimize and obtain the first behavior feature and the second behavior feature that meet the detection accuracy, the following methods can be used in detail: According to the node mutual information graph and the embedded graph Behavioral characteristics Mapping to feature loss space:

[0068]

[0069] in, Represents a multi-layer perceptron.

[0070] The loss function is used to back-propagate and update the model parameters, supervising the model to learn more important behavioral features, denoted as :

[0071] in, represents the set of software samples in the training batch, represents the temperature coefficient, It is a positive sample set and a negative sample set (that is, a set of similar software samples and a set of different software samples) constructed based on the cosine similarity of the interface call sequence.

[0072] In this embodiment, by determining the loss function of the above-mentioned Transformer network, the Transformer network can be iteratively optimized, so that the accuracy of the output first behavior feature and the second behavior feature is higher.

[0073] In this embodiment, the existence feature is enhanced and fused through the channel attention mechanism of the first behavior feature and the second behavior feature. The fusion method of the existence feature is:

[0074]

[0075] in, represents a multi-layer perceptron, represents the average pooling operation in the channel direction, Indicates the maximum pooling operation in the channel direction, * indicates or .

[0076] In this embodiment, one implementation of step 106 is as follows: Step 172: cluster the interfaces involved in the possible malicious behavior using a K-means algorithm, and determine the clusters and the centers of the clusters. Step 174: construct an interface call cluster sequence according to the interface call sequence involved in the possible malicious behavior and the cluster to which the interface belongs; Step 176: Taking the interface call cluster sequence as a Markov chain, taking each cluster as the state of the interface, and generating a transition probability matrix through state transition statistical probability; Step 178: Using the transition probability matrix as input, extract the transition features of the possible malicious behavior through a convolutional neural network.

[0077] In this embodiment, the interface set is , through the above K-means algorithm, the interface set is clustered, that is: Set the cluster center of the above interface set to , the clusters corresponding to the cluster centers are marked as ,but:

[0078]

[0079] Update cluster center word embedding:

[0080] Iterate through the above steps until the cluster center No longer changes.

[0081] For the API call sequence , according to the cluster to which the interface belongs, construct the application interface call cluster sequence :

[0082] in. The length of the sequence of API calls.

[0083] In this embodiment, the cluster sequence is called by the interface As a Markov chain, each of the above clusters Indicates the state of the interface. According to the statistical probability of interface state transition, a transition probability matrix is ​​generated. :

[0084] in, Indicates status To status The transition probability, , .

[0085] In this embodiment, according to the above transition probability matrix generate Order transition probability matrix .

[0086] In this embodiment, two rounds of clustering are performed on the interface call sequence. In the second round of clustering, the cluster with the highest frequency in the first round of clustering is deleted from the cluster set, thereby obtaining two different groups of interface call cluster sequences. The two different groups of interface call cluster sequences are used as two different views to construct two groups. Order transition probability matrix .

[0087] Then the transfer features are extracted through convolutional neural network:

[0088]

[0089] in, represents the weight parameter of the fully connected layer, The weight parameter is Convolutional network.

[0090] It can be seen that the transfer features extracted by the above method can fully characterize the association relationship between different interfaces. Moreover, the reliability of Trojan and virus detection can be effectively improved through the above two perspectives (i.e., two different views).

[0091] In this embodiment, in order to make the extraction accuracy of the above-mentioned transfer features meet the detection and recognition requirements, a loss function corresponding to the above-mentioned convolutional neural network is constructed, and the above-mentioned convolutional neural network model is optimized, that is: Map the transferred features of two different views into the feature loss space:

[0092]

[0093] The convolutional neural network loss function is used to back-propagate and update the model parameters, supervising the model to learn more important transfer features, denoted as :

[0094] in, represents the set of software samples in the training batch, Represents the temperature coefficient.

[0095] In this embodiment, the metastatic characteristics Splicing to obtain the transfer characteristics of possible malicious behavior :

[0096] In this embodiment, the interface call sequence can be converted into an interface call cluster sequence through the above method, so as to mine the interface call subsequence.

[0097] In this embodiment, the above interface call sequence may be an interface call sequence of software, thereby mining the interface call subsequence of the software.

[0098] In this embodiment, one implementation of step 108 is as follows: Step 182: Fusing the existence feature and the transfer feature to obtain a fused feature; Step 184: Using the fused features as input, a one-dimensional convolutional neural network is used to identify the possible malicious behavior and determine whether the possible malicious behavior is a malicious behavior.

[0099] In this embodiment, the network malicious attack behavior characteristics can be activated through feature fusion.

[0100] In this embodiment, the above fusion features can be identified by a network malicious attack detector, namely:

[0101] Indicates the identification result, that is, the attack type of possible malicious behavior. Represents the weight matrix and bias vector of the network malicious attack detector.

[0102] Please refer to Figure 3 Another embodiment of the present specification provides a network malicious attack detection system with multi-view feature fusion, which mainly includes: A determination module 202, for determining possible malicious behaviors and the interfaces and interface call sequences involved therein, based on the acquired network operation records of the key network communication facilities; An existence feature extraction module 204 is used to extract the existence feature of the malicious behavior by constructing a node mutual information graph and an embedded graph according to the interface and interface call sequence involved in the possible malicious behavior, wherein the nodes of the node mutual information graph and the embedded graph are the interfaces involved in the possible malicious behavior; The transfer feature extraction module 206 is used to construct a transfer probability matrix through a K-means algorithm according to the interface and interface call sequence involved in the possible malicious behavior, and extract the transfer feature of the possible malicious behavior; The identification module 208 is used to determine whether the possible malicious behavior is a malicious behavior based on the extracted existence feature and the transfer feature.

[0103] Specifically, the above method can accurately obtain the correlation relationship and functional similarity between interfaces, and use the node mutual information graph and the embedded graph to represent the calling relationship and similarity of the above interfaces. Then, by extracting the transfer feature, the calling correlation relationship between different interfaces of possible malicious behaviors can be represented. The above two features after fusion can be identified, which can effectively improve the accuracy of malicious behavior detection results, thereby realizing the identification and classification of network malicious attack behaviors.

[0104] In this embodiment, the above-mentioned determination module 202 is used to determine whether the network operation behavior complies with the network security protection strategy based on the network operation records of the obtained key network communication facilities; if not, the network operation behavior that does not comply with the network security protection strategy is determined to be the possible malicious behavior. According to the network operation records of the key network communication facilities obtained, a malicious behavior threat association graph is constructed by the KeyGraph algorithm; according to the malicious behavior threat association graph, the key threat association strength is determined; according to the key threat association strength, the malicious behavior interface path call model is determined; according to the possible malicious behavior and the malicious behavior interface path call model, the interface and interface call sequence involved in the possible malicious behavior are determined. Through the above method, the network malicious behavior can be specifically formalized to facilitate the extraction of relevant features of the network malicious behavior for analysis. Moreover, by constructing a malicious behavior threat degree association graph, the implicit threat of network malicious attacks can be quantitatively evaluated.

[0105] In this embodiment, the existence feature extraction module 204 is used to use the interface involved in the possible malicious behavior as a node and the Pearson frequency coefficient between two nodes as an associated edge; determine the correlation between nodes based on the Pearson coefficient of the call vector of each node and the frequency coefficient of the call sequence; determine the weight of the first associated edge based on the correlation between the nodes; and construct the node mutual information graph based on the weight of the first associated edge. Interfaces are grouped by 2-gram of the interface call sequence, and the node function similarity threshold is determined by the L2 paradigm between the node embedding vectors. . The functional similarity between nodes is greater than The node has a second associated edge, otherwise there is no second associated edge; determine the neighboring nodes with similar functions to each node through the L2 norm between the node embedding vectors; calculate the functional similarity between each node and its neighboring nodes with similar functions; add a second associated edge between each node and its neighboring nodes with similar functions and determine the weight of the second associated edge; determine the embedded graph according to the weight of the second associated edge. According to the node mutual information graph, determine the first adjacency matrix; according to the embedded graph, determine the second adjacency matrix; according to the first adjacency matrix and the second adjacency matrix, extract the first behavior feature and the second behavior feature through the Transformer network respectively, and the first behavior feature and the second behavior feature correspond to the node mutual information graph and the embedded graph respectively; according to the first behavior feature and the second behavior feature, determine the existence feature of the possible malicious behavior. Iteratively update the Transformer network through the Transformer network loss function until the accuracy of the first behavior feature and the second behavior feature output by the updated Transformer network meets the extraction conditions. Through the above method, the existence feature can characterize the association calling relationship and similarity calling relationship between software and interface, and through the above method, the calling relationship between software and interface can be integrated into the constructed node mutual information graph and embedded graph, thereby effectively enhancing the semantic information of network malicious attack behavior.

[0106] In this embodiment, the transfer feature extraction module 206 is used to cluster the interfaces involved in the possible malicious behavior through the K-means algorithm, determine the clusters and the centers of the clusters; construct an interface call cluster sequence according to the interface call sequence involved in the possible malicious behavior and the cluster to which the interface belongs; use the interface call cluster sequence as a Markov chain, each cluster as the state of the interface, and generate a transfer probability matrix through state transition statistical probability; use the transfer probability matrix as input, and extract the transfer features of the possible malicious behavior through a convolutional neural network. In the above manner, the interface call sequence can be converted into an interface call cluster sequence, thereby mining the interface call subsequence. And the transfer feature can accurately characterize the association between interfaces.

[0107] In this embodiment, the identification module 208 is used to fuse the existence feature and the transfer feature to obtain a fusion feature; using the fusion feature as input, a one-dimensional convolutional neural network is used to identify the possible malicious behavior and determine whether the possible malicious behavior is a malicious behavior.

[0108] Based on the same invention, another embodiment of the present specification further provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 1 The corresponding embodiment provides a network malicious attack detection method using multi-view feature fusion.

[0109] In this specification, each embodiment is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0110] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0111] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that has the function specified in a box.

[0112] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0113] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0114] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0115] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0116] The above is only an embodiment of the present application and is not intended to limit this specification. For those skilled in the art, this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification should be included in the scope of the claims of this specification.

Claims

1. A network malicious attack detection method based on multi-view feature fusion, characterized in that: include: Based on the network operation records of key network communication facilities, determine possible malicious behaviors and the interfaces and interface call sequences involved; According to the interface and interface call sequence involved in the possible malicious behavior, by constructing a node mutual information graph and an embedded graph, the existence characteristics of the malicious behavior are extracted, and the nodes of the node mutual information graph and the embedded graph are the interfaces involved in the possible malicious behavior, including: The interfaces involved in the possible malicious behavior are used as nodes, and the correlation between the two nodes is used as the correlation edge; Determine the call matrix of the system interface set according to the call order and call distance of each node in the interface call sequence; the call distance represents the number of nodes between two nodes in the interface call sequence; Determine, according to the call matrix, a call vector of the call node and a weight of the first associated edge; Constructing the node mutual information graph according to the weight of the first associated edge; Interfaces are grouped by 2-gram of interface call sequences, and the node function similarity threshold is determined by the L2 paradigm between node embedding vectors. ; If the functional similarity between nodes is greater than There is a second associated edge for the node, otherwise there is no second associated edge; Determine neighbor nodes with similar functions to each node through the L2 norm between node embedding vectors; Calculate the functional similarity between each node and its neighboring nodes with similar functions; Adding a second associated edge between each node and its neighboring nodes with similar functions and determining the weight of the second associated edge; Determining the embedded graph according to the weight of the second associated edge; Determine a first adjacency matrix according to the node mutual information graph; Determining a second adjacency matrix according to the embedded graph; According to the first adjacency matrix and the second adjacency matrix, extracting a first behavior feature and a second behavior feature respectively through a multi-layer Transformer network, wherein the first behavior feature and the second behavior feature correspond to the node mutual information graph and the embedded graph respectively; Determining, based on the first behavior feature and the second behavior feature, an existence feature of the possible malicious behavior; According to the interfaces and interface call sequences involved in the possible malicious behavior, a transition probability matrix is ​​constructed by using a K-means algorithm to extract the transfer characteristics of the possible malicious behavior; Whether the possible malicious behavior is a malicious behavior is determined based on the extracted existence feature and the transfer feature.

2. The network malicious attack detection method based on multi-view feature fusion according to claim 1 is characterized in that: The method of determining possible malicious behaviors and the interfaces and interface call sequences involved therein based on the network operation records of the key network communication facilities obtained includes: Determine whether the network operation behavior complies with the network security protection strategy based on the network operation records of key network communication facilities obtained; If not, the network operation behavior that does not comply with the network security protection strategy is determined to be the possible malicious behavior.

3. The network malicious attack detection method based on multi-view feature fusion according to claim 1 is characterized in that: The method of determining possible malicious behaviors and the interfaces and interface call sequences involved therein based on the network operation records of the key network communication facilities obtained includes: Based on the network operation records of key network communication facilities, a malicious behavior threat association graph is constructed using the KeyGraph algorithm; Determining the key threat correlation strength according to the malicious behavior threat correlation diagram; Determine a malicious behavior interface path calling model according to the key threat association strength, and the malicious behavior interface path calling model Specifically: ； in, This is a malicious behavior threat association diagram. It is a key cluster in the malicious behavior threat association graph. They are security metric set, security metric, threat association directed graph, threat association vertex set, and threat association vertex. Indicates the vertex in the threat association directed graph The number of arrows; According to the possible malicious behavior and the malicious behavior interface path calling model, the interface and interface calling sequence involved in the possible malicious behavior are determined.

4. The network malicious attack detection method based on multi-view feature fusion according to claim 1 is characterized in that: Before determining the existence feature of the possible malicious behavior according to the first behavior feature and the second behavior feature, the method includes: The graph convolutional neural network is iteratively updated through a graph convolutional neural network loss function until the accuracy of the first behavior feature and the second behavior feature output by the updated graph convolutional neural network meets the extraction condition.

5. The network malicious attack detection method based on multi-view feature fusion according to claim 1 is characterized in that: The method of constructing a transition probability matrix by using a K-means algorithm based on the interfaces and interface call sequences involved in the possible malicious behavior to extract the transfer characteristics of the possible malicious behavior includes: Using the K-means algorithm, cluster the interfaces involved in the possible malicious behavior, and determine the clusters and the centers of the clusters. Constructing an interface call cluster sequence according to the interface call sequence involved in the possible malicious behavior and the cluster to which the interface belongs; The interface call cluster sequence is used as a Markov chain, each cluster is used as the state of the interface, and a transition probability matrix is ​​generated through state transition statistics probability; The transition probability matrix is ​​used as input, and the transition characteristics of the possible malicious behavior are extracted through a convolutional neural network.

6. The network malicious attack detection method based on multi-view feature fusion according to claim 1 is characterized in that: The step of determining whether the possible malicious behavior is a malicious behavior based on the extracted existence feature and the transfer feature includes: fusing the existence feature and the transfer feature to obtain a fusion feature; The fused features are used as input, and the possible malicious behavior is identified through a one-dimensional convolutional neural network to determine whether the possible malicious behavior is a malicious behavior.

7. A network malicious attack detection system with multi-view feature fusion, characterized in that: include: A determination module, used to determine possible malicious behaviors and the interfaces and interface call sequences involved therein based on the network operation records of the acquired key network communication facilities; An existence feature extraction module is used to extract the existence feature of the malicious behavior by constructing a node mutual information graph and an embedded graph according to the interface and interface call sequence involved in the possible malicious behavior, wherein the nodes of the node mutual information graph and the embedded graph are the interfaces involved in the possible malicious behavior, including: The interfaces involved in the possible malicious behavior are used as nodes, and the correlation between the two nodes is used as the correlation edge; Determine the call matrix of the system interface set according to the call order and call distance of each node in the interface call sequence; the call distance represents the number of nodes between two nodes in the interface call sequence; Determine, according to the call matrix, a call vector of the call node and a weight of the first associated edge; Constructing the node mutual information graph according to the weight of the first associated edge; Interfaces are grouped by 2-gram of interface call sequences, and the node function similarity threshold is determined by the L2 paradigm between node embedding vectors. ; If the functional similarity between nodes is greater than There is a second associated edge for the node, otherwise there is no second associated edge; Determine neighbor nodes with similar functions to each node through the L2 norm between node embedding vectors; Calculate the functional similarity between each node and its neighboring nodes with similar functions; Adding a second associated edge between each node and its neighboring nodes with similar functions and determining the weight of the second associated edge; Determining the embedded graph according to the weight of the second associated edge; Determine a first adjacency matrix according to the node mutual information graph; Determining a second adjacency matrix according to the embedded graph; According to the first adjacency matrix and the second adjacency matrix, extracting a first behavior feature and a second behavior feature respectively through a multi-layer Transformer network, wherein the first behavior feature and the second behavior feature correspond to the node mutual information graph and the embedded graph respectively; Determining, based on the first behavior feature and the second behavior feature, an existence feature of the possible malicious behavior; A transfer feature extraction module, used to construct a transfer probability matrix through a K-means algorithm according to the interfaces and interface call sequences involved in the possible malicious behavior, and extract the transfer features of the possible malicious behavior; The identification module is used to determine whether the possible malicious behavior is a malicious behavior based on the extracted existence feature and the transfer feature.

Images