Container malicious behavior detection method and system based on graph convolutional network

Abstract

The invention discloses a container malicious behavior detection method and system based on a graph convolutional network, and the method comprises the steps: collecting time series data of a hardware performance counter when a container of an installation operation system operates benign and malicious sample programs, and generating a time series data set; respectively generating corresponding node features and node adjacency matrixes according to the content of the time sequence data set; and then building a graph convolution model according to the node features and the node adjacency matrix, and setting a loss function corresponding to the graph convolution model to obtain a container malicious behavior detection model based on a graph convolution network so as to detect the malicious behavior of the container according to the container malicious behavior detection model. Therefore, the adjacency matrix is generated through dynamic time warping, fusion of the time sequence and the graph structure is achieved, the complex dependency relationship and dynamic change characteristics of malicious behaviors can be captured from the time sequence, semantic information richer than that of single time sequence analysis is provided, and the detection rate higher than that of a traditional detection method can be obtained.

Description

Technical Field

[0001] The present invention relates to the technical field of computer information security, and in particular to a method and system for detecting malicious behavior of containers based on a graph convolutional network. Background Art

[0002] With the increasing popularity of the Internet of Things (IoT), IoT security has become crucial for individuals and businesses. IoT malware has grown exponentially in recent years and is currently a major threat to information systems. Malicious behavior can occur briefly at specific times, making traditional malware detection methods unable to detect it in a timely manner. Traditional container-based detection techniques rely on extracting internal container files or runtime feature data to detect malware. These methods can be categorized as static or dynamic, depending on how feature data is extracted.

[0003] Static detection methods primarily analyze the code, configuration files, and dependent packages of malware or programs when they are not running. This method identifies known malicious behavior patterns or characteristics by examining the malicious code in the file system, analyzing binary files and library files, and so on. For example, characteristic signatures of malware, the use of encryption algorithms, and suspicious code fragments after decompilation can all be discovered through static analysis tools. The advantage of this method is that it can detect malicious behavior before the program is started, helping to prevent potential threats in advance. In addition, static detection generally does not affect system performance because it does not require real-time monitoring of the program's running status. However, static detection also has limitations, especially when faced with changing attack methods, such as code obfuscation, encryption, or deformation techniques. Static methods may not be able to identify new or unseen malware.

[0004] Dynamic detection monitors program behavior and system calls during execution to identify potential malicious behavior. By collecting hardware events, system logs, memory status, or network traffic generated by the program during execution, dynamic detection can identify malicious behavior that is triggered only under specific conditions. In IoT systems, malware may remain dormant for a period of time, waiting for specific events or conditions to trigger before executing malicious actions. This situation is particularly well-suited for capture through dynamic detection. The advantage of dynamic detection is its ability to capture unknown or volatile malicious behavior, especially when dealing with malware with advanced stealth techniques, which can be identified through behavioral signatures. However, dynamic detection requires continuous monitoring of running programs, which consumes significant system resources and may impact system performance. Furthermore, dynamic detection methods require effective strategies and models to determine whether behavior is normal or not, to avoid false positives or false negatives. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a method and system for detecting malicious behavior of containers based on graph convolutional networks, which can effectively improve the generalization ability and detection accuracy of the detection model.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] A method for detecting malicious container behavior based on a graph convolutional network, comprising the following steps:

[0008] S1. Collecting time series data of hardware performance counters when a container in which an operating system is installed runs a sample program, and generating a time series data set, wherein the sample program includes a benign sample program and a malicious sample program;

[0009] S2. Generate corresponding node features through a residual network according to the content of the time series dataset;

[0010] S3. Calculate the similarity of the time series sequence by dynamic time warping according to the content of the time series data set, and generate a corresponding node adjacency matrix;

[0011] S4. Build a graph convolution model based on the node features and the node adjacency matrix, and set a loss function corresponding to the graph convolution model to obtain a container malicious behavior detection model based on a graph convolution network, so as to detect malicious behavior of the container according to the container malicious behavior detection model.

[0012] In order to solve the above technical problems, another technical solution adopted by the present invention is:

[0013] A container malicious behavior detection system based on a graph convolutional network includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the processor implements the various steps of the above-mentioned container malicious behavior detection method based on a graph convolutional network.

[0014] The beneficial effects of the present invention are: collecting the time series data of the hardware performance counters when the container with the operating system installed runs benign and malicious sample programs, and generating a time series data set; generating corresponding node features and node adjacency matrices according to the content of the time series data set; then building a graph convolution model based on the node features and the node adjacency matrix, and setting the loss function corresponding to the graph convolution model, to obtain a container malicious behavior detection model based on the graph convolution network, so as to detect the malicious behavior of the container according to the container malicious behavior detection model. Therefore, by collecting hardware-level data instead of relying on software logs or behavior patterns, many common circumvention techniques such as code obfuscation or anti-sandboxing can be avoided, and the time series features are combined with graph convolution, and the adjacency matrix is ​​generated using dynamic time warping to achieve the fusion of time series and graph structure. This cross-domain combination can capture complex dependencies and dynamic change characteristics of malicious behavior from the time series, provides richer semantic information than time series analysis alone, and can obtain a higher detection rate than traditional detection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flowchart of a method for detecting malicious container behavior based on a graph convolutional network according to an embodiment of the present invention.

[0016] Figure 2 Schematic diagram of a container malicious behavior detection system based on graph convolutional network according to an embodiment of the present invention;

[0017] Figure 3 This is a flow chart of the container malicious behavior detection method based on graph convolutional network in this embodiment;

[0018] Figure 4 Schematic diagram of the graph convolutional network in this embodiment;

[0019] Description of labels:

[0020] 1. A container malicious behavior detection system based on graph convolutional networks; 2. Memory; 3. Processor. DETAILED DESCRIPTION

[0021] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following description is given in conjunction with the embodiments and accompanying drawings.

[0022] Please refer to Figure 1 , an embodiment of the present invention provides a container malicious behavior detection method based on graph convolutional network, comprising the steps of:

[0023] S1. Collecting time series data of hardware performance counters when a container in which an operating system is installed runs a sample program, and generating a time series data set, wherein the sample program includes a benign sample program and a malicious sample program;

[0024] S2. Generate corresponding node features through a residual network according to the content of the time series dataset;

[0025] S3. Calculate the similarity of the time series sequence by dynamic time warping according to the content of the time series data set, and generate a corresponding node adjacency matrix;

[0026] S4. Build a graph convolution model based on the node features and the node adjacency matrix, and set a loss function corresponding to the graph convolution model to obtain a container malicious behavior detection model based on a graph convolution network, so as to detect malicious behavior of the container according to the container malicious behavior detection model.

[0027] From the above description, it can be seen that the beneficial effects of the present invention are: collecting the time series data of the hardware performance counters when the container with the operating system installed runs benign and malicious sample programs, and generating a time series data set; generating corresponding node features and node adjacency matrices according to the content of the time series data set; then building a graph convolution model based on the node features and the node adjacency matrix, and setting the loss function corresponding to the graph convolution model, to obtain a container malicious behavior detection model based on the graph convolution network, so as to detect the malicious behavior of the container according to the container malicious behavior detection model. Therefore, by collecting hardware-level data instead of relying on software logs or behavior patterns, many common circumvention techniques such as code obfuscation or anti-sandboxing can be avoided, and the time series features are combined with graph convolution, and the adjacency matrix is ​​generated using dynamic time warping to achieve the fusion of time series and graph structure. This cross-domain combination can capture complex dependencies and dynamic change characteristics of malicious behavior from the time series, provides richer semantic information than time series analysis alone, and can obtain a higher detection rate than traditional detection methods.

[0028] Furthermore, step S1 includes:

[0029] Saving a memory snapshot of a container in which an operating system is installed, delivering benign sample programs and malicious sample programs to the container one by one, and causing the container to run the delivered sample programs;

[0030] After the container is running, collecting time series data of the hardware performance counter corresponding to the container;

[0031] The time series data is preprocessed, and invalid data in the time series data is cleaned to obtain a time series data set.

[0032] As can be seen from the above description, after the sample program is run in the container, the hardware characteristics of the container are directly collected. This method does not require understanding the kernel information of the container and is not affected by the container system. The obtained data is also lightweight, versatile, and efficient.

[0033] Furthermore, step S2 includes:

[0034] According to the time series dataset X, a residual network containing a residual block is used to generate node features

[0035] H1=Relu(BatchNorm(Conv1d(X)))

[0036] H2=Relu(BatchNorm(Conv1d(H1)))

[0037] H3=Relu(BatchNorm(Conv1d(H2)))

[0038]

[0039] Where Conv1d represents one-dimensional convolution, BatchNorm represents batch normalization, Relu represents activation function, X={X1,X2,……,X m}, X m Represents the time series data of the mth sample in the dataset.

[0040] As can be seen from the above description, since general time series data does not have a predefined graph structure, we start by demonstrating a general graph construction module that generates an adjacency matrix to create an initial association of dimensions. To generate node attribute embeddings associated with the adjacency matrix, a residual network containing three residual blocks is used to generate node features.

[0041] Furthermore, step S3 includes:

[0042] Use dynamic time warping to calculate the time series similarity matrix D between the time series data of each sample in the time series dataset:

[0043]

[0044] Where, d function is the calculation formula of dynamic time warping algorithm;

[0045] The node adjacency matrix A is calculated by combining the temporal similarity matrix and the scale hyperparameter α∈[0,∞):

[0046]

[0047] And the adjacency matrix is ​​normalized.

[0048] From the above description, it can be seen that by establishing a similarity matrix between time series data and introducing a scale super coefficient, an adjacency matrix can be obtained, and irrelevant neighbors can be filtered out through normalization.

[0049] Furthermore, step S4 includes:

[0050] Constructing a graph convolutional neural network according to the features and the node adjacency matrix, and performing backpropagation optimization on parameters of the graph convolutional neural network;

[0051] The loss function is constructed by minimizing the cross entropy on the labeled time series;

[0052] The graph convolutional neural network and the loss function are combined to obtain a container malicious behavior detection model based on a graph convolutional network.

[0053] From the above description, we can see that combining graph convolutional networks can more effectively capture the global features of time series by constructing a graph structure of time points, improve prediction results, and more effectively improve the generalization ability and detection accuracy of the detection model.

[0054] Please refer to Figure 2 Another embodiment of the present invention provides a container malicious behavior detection system based on a graph convolutional network, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the processor implements the various steps of the above-mentioned container malicious behavior detection method based on a graph convolutional network.

[0055] The above-mentioned method and system for detecting malicious container behavior based on a graph convolutional network are suitable for effectively improving the generalization ability and detection accuracy of the detection model. The following is an explanation of the specific implementation methods:

[0056] Please refer to Figure 1 、 Figure 3 and Figure 4 , embodiment 1 of the present invention is:

[0057] A method for detecting malicious container behavior based on a graph convolutional network, comprising the following steps:

[0058] S1. Collecting time series data of hardware performance counters when a container with an operating system installed runs a sample program, and generating a time series data set, wherein the sample program includes a benign sample program and a malicious sample program.

[0059] S11. Save a memory snapshot of the container in which the operating system is installed.

[0060] Specifically, an LXC virtualization platform is built on the experimental physical host, and a container with the corresponding Linux operating system is created and installed on the LXC virtualization platform. After the installation is complete, the current system environment of the container is saved in the form of a memory snapshot through the lxc-snapshot command. This can ensure the consistency of the system experimental environment when each sample is running.

[0061] S12: delivering benign sample programs and malicious sample programs to the container one by one, and instructing the container to run the delivered sample programs.

[0062] Specifically, use the lxc file command to drop benign and malicious samples into the container, then use the lxc exec command to have the container automatically run the corresponding sample programs. Samples must be dropped one by one. After the previous sample program completes, the container must be closed and the memory snapshot restored before running the next sample program.

[0063] S13. After the container is running, collect time series data of the hardware performance counter corresponding to the container.

[0064] Specifically, the agent program is used to run the sample program in the container, and then the perf tool provided by the physical host system is used to collect the hardware performance counter time series data of the container process. Finally, the data is preprocessed through the Python program to obtain the time series data set.

[0065] In this embodiment, after the container runs the sample program, the automated data collection script will automatically obtain the corresponding hardware performance counter timing data; the specific command for collecting data in the script is: perfstat -e [specific hardware event to be collected] -p [container PID number] -I [sampling interval] -o [path to the output data file].

[0066] The parameters after "-e" are the hardware events that need to be collected. To avoid the impact of time-division multiplexing, five hardware events are expected to be collected: LLC-stores (number of last-level cache stores, pointing to the number of operations that write data in the last-level cache, indicating how many times data has been written to the cache), cache-misses (number of cache misses, this event counts all types of cache misses, including instruction cache and data cache), LLC-misses (number of last-level cache misses, refers to the number of times the processor fails to find data when trying to read data from the cache), dTLB-loads (number of data page table cache loads, indicating the number of times the processor looks up a page table entry from the data page table cache), and branch-instructions (number of branch instructions, refers to the number of branch instructions executed by the processor).

[0067] The parameter option after "-p" specifies the process ID to monitor the corresponding events generated by the container process. The parameter option after "-i" specifies the sampling interval in milliseconds. If it is followed by 200, it means that performance event statistics are reported every 200 milliseconds. This parameter can be used to display performance event counts over time. The parameter option after "-o" specifies the output file path. perf will write the statistical results to the specified file instead of outputting them to the terminal. For example, the parameter / home / data / 1.txt means that the results will be saved to the file 1.txt in the / home / data / directory.

[0068] After the preceding command is executed, the script uses the sleep command to control the collection duration of the perf tool. When the specified duration is reached, the kill command is used to forcibly terminate the perf process and obtain the corresponding event data.

[0069] S14: preprocess the time series data and clean invalid data in the time series data to obtain a time series data set.

[0070] Specifically, the obtained data is preprocessed, that is, the raw data is cleaned through the Python program, invalid words or information such as time and events are deleted, and saved in the form of a CSV file to obtain a time series dataset.

[0071] S2. Generate corresponding node features through a residual network according to the content of the time series dataset.

[0072] S21. Multivariate Time Series Represents the value of a multivariate variable in a time series, where m∈M is the number of samples contained in the dataset, N is the number of features contained in each sample, T is the length of the time series, and each feature contains a unary time series of length T.

[0073] According to step S1, benign samples and malicious samples can be obtained, where each sample Contains time series information s∈T and multivariate time series feature value X with dimension n∈N i ={x1,x2,...,x n}, where is the set of real numbers;

[0074] Each time series variable x contains equidistant time slots T = T1, T2, ..., T s , that is, the univariate time series x can be expressed as

[0075] S22. Construct a time series diagram G = (V, E) from a multivariate time series, where V = {v1, v2, ..., v l} is a set of nodes with number l, and E is a set of edges. Nodes represent samples, and edges represent the relationship between different variables, defined as similarity or some structural learning results.

[0076] S23. Since there is no predefined graph structure for general time series data, we will start by demonstrating a general graph construction module that generates an adjacency matrix to create an initial association of dimensions. The associated node attribute embedding uses a ResNet network containing three residual blocks. According to the time series dataset X, the node features are generated using a residual network containing residual blocks.

[0077] H1=Relu(BatchNorm(Conv1d(X)))

[0078] H2=Relu(BatchNorm(Conv1d(H1)))

[0079] H3=Relu(BatchNorm(Conv1d(H2)))

[0080]

[0081] Where Conv1d represents one-dimensional convolution, BatchNorm represents batch normalization, Relu represents activation function, X={X1,X2,……,X m}, X m Represents the time series data of the mth sample in the dataset.

[0082] S3. Calculate the time series similarity through dynamic time warping according to the content of the time series data set and generate a corresponding node adjacency matrix.

[0083] S31. Use dynamic time warping (DTW) to calculate the time series similarity matrix D between the time series data of each sample in the time series dataset:

[0084]

[0085] Where, the d function is the calculation formula of dynamic time warping (DTW).

[0086] Among them, regarding the specific calculation formula of DTW, it is assumed that the two time series are X1=[x 11 ,x 12 ,…,x 1n ] and X2=[x 21 ,x 22 ,…,x 2n ];

[0087] First, calculate the distance matrix D(i,j)=||x 1i -x 2i ||, then define a cumulative distance matrix C to store the minimum cumulative distance from the starting point to any location. The calculation formula is:

[0088]

[0089] Finally, we find the path W by backtracking from the lower right corner C(T,S) of the cumulative distance matrix, with a path length of L:

[0090] W=[(i1,j1),(i2,j2),…,(i L ,j L )]

[0091] Minimize the cumulative distance of the path, which is defined as:

[0092]

[0093] S32. Introduce a scale hyperparameter α∈[0,∞) to control the importance of neighbors. Specifically, let Dij represent the (i,j)th entry of D. Combine the temporal similarity matrix and the scale hyperparameter α∈[0,∞) to calculate the node adjacency matrix A:

[0094]

[0095] Where D ij Indicates that X in the DTW algorithm i and X j The similarity of A ij Indicated by D ij The calculated similarity is converted into sample X i (node ​​i) and sample X j Whether there is an edge structure between (node ​​j).

[0096] S33. Normalize the adjacency matrix.

[0097]

[0098] S4. Build a graph convolution model based on the node features and the node adjacency matrix, and set a loss function corresponding to the graph convolution model to obtain a container malicious behavior detection model based on a graph convolution network, so as to detect malicious behavior of the container according to the container malicious behavior detection model.

[0099] S41. Construct a graph convolutional neural network based on the features and the node adjacency matrix.

[0100] According to the adjacency matrix of the time series graph and feature embedding The graph neural convolutional network is constructed as follows:

[0101]

[0102] in, Each node aggregates information from its neighboring nodes (including itself), and X is the output of the residual network resnet Perform weighted average of the features of neighboring nodes. (0) and W (1) Both linearly map the features of each node to a higher dimensional space.

[0103] S42. For classification tasks, the output layer of GCN is usually combined with Softmax for sample classification.

[0104] Z = softmax(E)

[0105] S43. Perform backpropagation optimization on the parameters of the graph convolutional neural network.

[0106] Specifically, the embedding z of node u is obtained through forward propagation u , and then gradient descent (implemented using the Adam optimizer) is back-propagated to optimize the parameters W and the parameters within the aggregation function.

[0107] S44. Construct a loss function by minimizing the cross entropy on the labeled time series.

[0108] Specifically, minimize the cross entropy on the labeled time series and construct the loss function:

[0109]

[0110] Where C is the sample type, represents the true label, represents the predicted label, and the goal is to minimize the cross entropy on the labeled time series, N train Represents the number of sample sets used for training. The weights of the backbone and GCN modules can be jointly optimized using gradient descent to improve the accuracy of sample classification.

[0111] S45. Combining the graph convolutional neural network and the loss function to obtain a container malicious behavior detection model based on a graph convolutional network.

[0112] Furthermore, an experiment was conducted by creating time series data containing 2,200 benign samples and 3,300 malicious samples, where malicious samples were positive samples and benign samples were negative samples. Finally, the detection model proposed in this embodiment was compared with the traditional detection model. The comparison results are shown in Table 1.

[0113] Table 1 Test results of each model

[0114]

[0115] It can be seen that the method of this embodiment directly obtains the hardware characteristics of the container outside the container, does not need to understand the kernel information of the container, and is not affected by the container system. The acquired data is also lightweight, universal and efficient. Then, combined with the graph convolutional network, it can construct a graph structure of time points to more effectively capture the global characteristics of the time series, thereby improving the prediction effect, and can more effectively improve the generalization ability and detection accuracy of the detection model.

[0116] Please refer to Figure 2 , the second embodiment of the present invention is:

[0117] A container malicious behavior detection system 1 based on a graph convolutional network includes a memory 2, a processor 3, and a computer program stored on the memory 2 and executable on the processor 3. When the processor 3 executes the computer program, each step of a container malicious behavior detection method based on a graph convolutional network in embodiment 1 is implemented.

[0118] In summary, the present invention provides a method and system for detecting malicious behavior of containers based on graph convolutional networks, which enables containers running on LXC to automatically run benign and malicious sample programs; the automatic data acquisition script uses the perfstat command through the perf tool provided by the physical host system to automatically obtain the hardware performance counter time series data of the container process; the Python program is used to perform data cleaning and other preprocessing on the acquired time series data, and save it in the form of a csv file to obtain a time series data set. According to the content of the time series data set, the ResNet network is constructed to generate the corresponding feature embedding; the DTW algorithm is used to calculate the similarity of the time series features and generate the corresponding node adjacency matrix; the Graph Convolutional Neural Networks (GCN) module is constructed, and the loss function of the model is designed, and finally a container anomaly detection model based on GCN is obtained. Therefore, detection is performed at the hardware event level instead of relying on software logs or behavior patterns, which innovatively avoids many common circumvention techniques, such as code obfuscation or anti-sandboxing, combines time series features with GCN, and uses DTW to generate an adjacency matrix to achieve the fusion of time series and graph structure. This cross-domain combination can capture complex dependencies and dynamic changes in malicious behavior from time series, providing richer semantic information than time series analysis alone, and achieving a higher detection rate than traditional detection methods.

[0119] The above descriptions are merely embodiments of the present invention and are not intended to limit the scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the scope of the present invention's patent protection.

Claims

1. A container malicious behavior detection method based on graph convolutional network, characterized in that: Includes steps: S1. Collecting time series data of hardware performance counters when a container in which an operating system is installed runs a sample program, and generating a time series data set, wherein the sample program includes a benign sample program and a malicious sample program; S2. Generate corresponding node features through a residual network according to the content of the time series data set; S3, calculating the similarity of the time series according to the content of the time series data set through dynamic time warping, and generating a corresponding node adjacency matrix; S4. Build a graph convolution model according to the node features and the node adjacency matrix, and set a loss function corresponding to the graph convolution model to obtain a container malicious behavior detection model based on a graph convolution network, so as to detect the malicious behavior of the container according to the container malicious behavior detection model.

2. According to claim 1, a method for detecting malicious behavior of containers based on graph convolutional networks is characterized in that: Step S1 includes: Saving a memory snapshot of a container in which an operating system is installed, delivering benign sample programs and malicious sample programs to the container one by one, and causing the container to run the delivered sample programs; After the container is running, collecting time series data of the hardware performance counter corresponding to the container; The time series data is preprocessed, and invalid data in the time series data is cleaned to obtain a time series data set.

3. According to claim 1, a method for detecting malicious behavior of containers based on graph convolutional networks is characterized in that: Step S2 includes: According to the time series dataset X, a residual network including a residual block is used to generate node features H1=Relu(BatchNorm(Conv1d(X))) H2=Relu(BatchNorm(Conv1d(H1))) H3=Relu(BatchNorm(Conv1d(H2))) Where Conv1d represents one-dimensional convolution, BatchNorm represents batch normalization, Relu represents activation function, X = {X1, X2, ..., X m }, X m Represents the time series data of the mth sample in the dataset.

4. According to claim 3, a method for detecting malicious behavior of containers based on graph convolutional networks is characterized in that: Step S3 includes: Dynamic time warping is used to calculate the time series similarity matrix D between the time series data of each sample in the time series data set: Wherein, d function is the calculation formula of dynamic time warping algorithm; The node adjacency matrix A is calculated by combining the temporal similarity matrix and the scale hyperparameter α∈[0,∞): And the adjacency matrix is ​​normalized.

5. According to claim 1, a method for detecting malicious behavior of containers based on graph convolutional networks is characterized in that: Step S4 includes: Constructing a graph convolutional neural network according to the features and the node adjacency matrix, and performing back propagation optimization on parameters of the graph convolutional neural network; The loss function is constructed by minimizing the cross entropy over the labeled time series; The graph convolutional neural network and the loss function are combined to obtain a container malicious behavior detection model based on a graph convolutional network.

6. A container malicious behavior detection system based on a graph convolutional network, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the following steps are implemented: S1. Collecting time series data of hardware performance counters when a container in which an operating system is installed runs a sample program, and generating a time series data set, wherein the sample program includes a benign sample program and a malicious sample program; S2. Generate corresponding node features through a residual network according to the content of the time series data set; S3, calculating the similarity of the time series according to the content of the time series data set through dynamic time warping, and generating a corresponding node adjacency matrix; S4. Build a graph convolution model according to the node features and the node adjacency matrix, and set a loss function corresponding to the graph convolution model to obtain a container malicious behavior detection model based on a graph convolution network, so as to detect the malicious behavior of the container according to the container malicious behavior detection model.

7. According to claim 6, a container malicious behavior detection system based on graph convolutional network is characterized in that: Step S1 includes: Saving a memory snapshot of a container in which an operating system is installed, delivering benign sample programs and malicious sample programs to the container one by one, and causing the container to run the delivered sample programs; After the container is running, collecting time series data of the hardware performance counter corresponding to the container; The time series data is preprocessed, and invalid data in the time series data is cleaned to obtain a time series data set.

8. According to claim 6, a container malicious behavior detection system based on graph convolutional network is characterized in that: Step S2 includes: According to the time series dataset X, a residual network including a residual block is used to generate node features H1=Relu(BatchNorm(Conv1d(X))) H2=Relu(BatchNorm(Conv1d(H1))) H3=Re1u(BatchNorm(Conv1d(H2))) Where Conv1d represents one-dimensional convolution, BatchNorm represents batch normalization, Relu represents activation function, X = {X1, X2, ..., X m }, X m Represents the time series data of the mth sample in the dataset.

9. According to claim 8, a container malicious behavior detection system based on graph convolutional network is characterized in that: Step S3 includes: Dynamic time warping is used to calculate the time series similarity matrix D between the time series data of each sample in the time series data set: Wherein, d function is the calculation formula of dynamic time warping algorithm; The node adjacency matrix A is calculated by combining the temporal similarity matrix and the scale hyperparameter α∈[0,∞): And the adjacency matrix is ​​normalized.

10. The container malicious behavior detection system based on graph convolutional network according to claim 6 is characterized in that: Step S4 includes: Constructing a graph convolutional neural network according to the features and the node adjacency matrix, and performing back propagation optimization on parameters of the graph convolutional neural network; The loss function is constructed by minimizing the cross entropy over the labeled time series; The graph convolutional neural network and the loss function are combined to obtain a container malicious behavior detection model based on a graph convolutional network.

Images