Malware detection method and device

Abstract

The present application provides a malware detection method and device, which can obtain the application programming interface of the target software through a decompilation method on the client, and obtain the first adjacency matrix between the application programming interfaces through the relative positions of the various application programming interfaces, so that the third prediction score corresponding to the first adjacency matrix can be obtained through a homomorphic encryption method of additive secret sharing between the client and the server. Finally, the target software can be judged as malicious on the client through the third prediction score and preset variables to obtain a first judgment result. The target software can be detected as malicious while maintaining the data security of the target dynamic weight matrix on the server and the target software on the client, and the first judgment result of the target software can be obtained, thereby avoiding data leakage on the client and the server, and improving the data security of the user privacy data on the client and the target dynamic weight matrix data on the server to a certain extent.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a malware detection method and device. Background Art

[0002] With the rapid development of mobile internet, the use of smart mobile devices has become widespread. This popularity has also been accompanied by a surge in related malware. This malware, encompassing a wide range of types, including those that exploit user data charges, steal privacy, and engage in malicious control, poses a serious threat to user privacy and property. Therefore, efficient and accurate detection and identification of malware on smart devices is crucial.

[0003] In related technologies, deep learning methods can be used to train a deep learning network model using string features in sample software, and the trained deep learning network model can be used to identify malware.

[0004] However, in the above method, there is a risk of leakage of the user's private data and the data of the trained network model, and the security of the user's private data and the data of the trained network model is not high. Summary of the Invention

[0005] In view of the above problems, embodiments of the present application provide a malware detection method, apparatus, electronic device, and readable storage medium to overcome the above problems or at least partially solve the above problems.

[0006] In a first aspect, an embodiment of the present application provides a malware detection method, applied to a client, comprising:

[0007] Decompiling a software file of the target software to obtain a first application programming interface of the target software; wherein the first application programming interface includes at least one sub-function program segment;

[0008] Determining a first sensitive application programming interface from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable;

[0009] generating a first adjacency matrix of the first sensitive application programming interfaces based on relative positions of the first sensitive application programming interfaces in the main function program segment of the target software;

[0010] Calculating a first variable vector based on a preset variable and a first shared value of a first multiplication triplet stored on the client; calculating a second variable vector based on the preset variable and a second shared value of the first multiplication triplet; calculating a first embedding representation based on a first encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; and calculating a second embedding representation based on a second encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; wherein the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key stored in the server;

[0011] Sending the first variable vector, the second variable vector, the first embedded representation, and the second embedded representation to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, calculates a fourth embedded representation based on the third embedded representation and a third shared value in a second multiplication triplet stored on the server, decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculates a sixth embedded representation based on the fifth embedded representation and a fourth shared value in the second multiplication triplet, calculates a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculates an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculates a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet;

[0012] Calculating a tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculating an eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculating a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculating an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation;

[0013] Sending the encrypted prediction score to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score, calculating a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and summing the first prediction score and the second prediction score to obtain a third prediction score;

[0014] Based on the third prediction score and the preset variables sent by the server, the target software is judged to be malicious to obtain a first judgment result.

[0015] Optionally, performing malicious determination on the target software based on the third prediction score and the preset variable sent by the server to obtain a first determination result includes:

[0016] Summing the preset variable and the third prediction score sent by the server to obtain a fourth prediction score;

[0017] When the fourth prediction score is greater than or equal to the first threshold, determining that the first determination result of the target software is malware;

[0018] When the fourth prediction score is less than or equal to the first threshold, the first determination result is determined to be normal software.

[0019] In a second aspect, an embodiment of the present application provides a malware detection method, applied to a server, comprising:

[0020] Based on the target dynamic weight matrix and the encryption key, a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix are generated respectively, and the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are sent to the client, so that the client calculates a first embedding representation based on the first encrypted dynamic weight matrix, preset variables and the first adjacency matrix, and calculates a second embedding representation based on the second encrypted dynamic weight matrix, the preset variables and the first adjacency matrix; wherein the first adjacency matrix is ​​generated based on the relative position of each first sensitive application programming interface in the main function program segment of the target software; the first sensitive application programming interface is determined from the first application programming interface of the target software based on the character string corresponding to the preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable and a user asset data variable; the first application programming interface is obtained by decompiling the software file of the sample software; and the first application programming interface includes at least one sub-function program segment;

[0021] Decrypting the first embedded representation sent by the client based on the encryption key to obtain a third embedded representation; calculating a fourth embedded representation based on the third embedded representation and a third shared value in the second multiplication triplet stored by the server; decrypting the second embedded representation sent by the client based on the encryption key stored by the server to obtain a fifth embedded representation; calculating a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet; calculating a seventh embedded representation based on the first variable vector sent by the client and the fourth embedded representation; and calculating an eighth embedded representation based on the second variable vector sent by the client and the sixth embedded representation. Calculating a ninth embedding representation based on the seventh embedding representation, the eighth embedding representation, and the second multiplication triplet; wherein the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the first variable vector is calculated based on the preset variables and a first shared value of the first multiplication triplet stored in the client; and the second variable vector is calculated based on the preset variables and a second shared value of the first multiplication triplet.

[0022] Sending the fourth embedding representation and the sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculates an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation;

[0023] decrypting the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculating a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and summing the first prediction score and the second prediction score to obtain a third prediction score;

[0024] The third prediction score is sent to the client, so that the client performs a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result.

[0025] Optionally, the sending the third prediction score to the client so that the client performs a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result includes:

[0026] The third prediction score is sent to the client so that the client sums the preset variable and the third prediction score sent by the server to obtain a fourth prediction score. When the fourth prediction score is greater than or equal to the first threshold, the first determination result of the target software is determined to be malware. When the fourth prediction score is less than or equal to the first threshold, the first determination result is determined to be normal software.

[0027] Optionally, the method further includes:

[0028] Decompiling the software file of the sample software to obtain a first sample application programming interface of the sample software; wherein the first sample application programming interface includes at least one sub-function program segment;

[0029] Determining a first sample sensitive application programming interface from the first sample application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable;

[0030] generating a first sample adjacency matrix of the first sample sensitive application programming interfaces based on relative positions of the first sample sensitive application programming interfaces in the main function program segment of the sample software;

[0031] Inputting the first sample adjacency matrix into a first graph neural network model to obtain a sample prediction score of the sample software output by the first graph neural network model;

[0032] Determining a cross entropy loss value of the first graph neural network model based on the sample prediction score and the classification label of the sample software;

[0033] Based on the cross entropy loss value, adjust the model parameters of the first graph neural network model and the first weight values ​​of each network layer of the first graph neural network model to obtain a target graph neural network model;

[0034] Obtain the target weight values ​​corresponding to each network layer in the target graph neural network model to obtain the target dynamic weight matrix.

[0035] Optionally, the first graph neural network model includes a multiple relationship aggregation layer, a multi-layer heterogeneous graph convolution layer, and a prediction layer. Inputting the first sample adjacency matrix and the first sample dynamic weight matrix into the first graph neural network model to obtain the sample prediction score of the sample software output by the first graph neural network model includes:

[0036] Inputting the first sample adjacency matrix into the multiple relationship aggregation layer to perform weighted aggregation on the first sample adjacency matrix to obtain a second sample adjacency matrix output by the multi-layer relationship aggregation layer;

[0037] Inputting the second sample adjacency matrix into the multi-layer heterogeneous graph convolution layer to obtain a final embedded representation of the sample output by the multi-layer heterogeneous graph convolution layer;

[0038] The final embedding representation of the sample is input into the prediction layer to obtain the sample prediction score of the sample software output by the prediction layer.

[0039] In a third aspect, an embodiment of the present application provides a malware detection device, applied to a client, wherein the method includes:

[0040] a decompile module, configured to decompile a software file of the target software to obtain a first application programming interface of the target software; wherein the first application programming interface includes at least one sub-function program segment;

[0041] a determination module, configured to determine a first sensitive application programming interface from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable;

[0042] a generating module, configured to generate a first adjacency matrix of the first sensitive application programming interfaces based on the relative positions of the first sensitive application programming interfaces in the main function program segment of the target software;

[0043] a first calculation module, configured to calculate a first variable vector based on a preset variable and a first shared value of a first multiplication triplet stored on the client, calculate a second variable vector based on the preset variable and a second shared value of the first multiplication triplet, calculate a first embedding representation based on a first encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix, and calculate a second embedding representation based on a second encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; wherein the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key stored in the server;

[0044] a first sending module, configured to send the first variable vector, the second variable vector, the first embedded representation, and the second embedded representation to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, calculates a fourth embedded representation based on the third embedded representation and a third shared value in a second multiplication triplet stored on the server, decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculates a sixth embedded representation based on the fifth embedded representation and a fourth shared value in the second multiplication triplet, calculates a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculates an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculates a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet;

[0045] a second calculation module, configured to calculate a tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculate an eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculate a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculate an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation;

[0046] a second sending module, configured to send the encrypted prediction score to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score, calculates a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sums the first prediction score and the second prediction score to obtain a third prediction score;

[0047] The malicious judgment module is used to perform malicious judgment on the target software based on the third prediction score sent by the server and the preset variable to obtain a first judgment result.

[0048] In a fourth aspect, an embodiment of the present application provides a malware detection device, applied to a server, comprising:

[0049] A first generation module is configured to generate a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix based on a target dynamic weight matrix and an encryption key, and send the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix to a client, so that the client calculates a first embedding representation based on the first encrypted dynamic weight matrix, preset variables, and a first adjacency matrix, and calculates a second embedding representation based on the second encrypted dynamic weight matrix, the preset variables, and the first adjacency matrix; wherein the first adjacency matrix is ​​generated based on the relative position of each first sensitive application programming interface in a main function program segment of the target software; the first sensitive application programming interface is determined from the first application programming interface of the target software based on a string corresponding to a preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable; the first application programming interface is obtained by decompiling a software file of the sample software; and the first application programming interface includes at least one sub-function program segment;

[0050] The first decryption calculation module is configured to decrypt the first embedded representation sent by the client based on the encryption key to obtain a third embedded representation, calculate a fourth embedded representation based on the third embedded representation and a third shared value in the second multiplication triplet stored by the server, decrypt the second embedded representation sent by the client based on the encryption key stored by the server to obtain a fifth embedded representation, calculate a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet, calculate a seventh embedded representation based on the first variable vector sent by the client and the fourth embedded representation, and calculate a seventh embedded representation based on the second variable vector sent by the client and the sixth embedded representation. Eighth embedding representation, calculating a ninth embedding representation based on the seventh embedding representation, the eighth embedding representation, and the second multiplication triplet; wherein the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the first variable vector is calculated based on the preset variables and a first shared value of the first multiplication triplet stored in the client; and the second variable vector is calculated based on the preset variables and a second shared value of the first multiplication triplet;

[0051] a first sending module, configured to send the fourth embedding representation and the sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculates an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation;

[0052] a second decryption calculation module, configured to decrypt the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculate a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sum the first prediction score and the second prediction score to obtain a third prediction score;

[0053] The second sending module is configured to send the third prediction score to the client, so that the client makes a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result.

[0054] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory, wherein the processor executes the computer program to implement the malware detection method as described in any one of the above.

[0055] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the malware detection method as described in any one of the above items is implemented.

[0056] The specific beneficial effects are:

[0057] In an embodiment of the present application, a first application programming interface of the target software is obtained by decompiling a software file of the target software; wherein the first application programming interface includes at least one sub-function program segment, and a first sensitive application programming interface is determined from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, or a user asset data variable; based on the relative position of each first sensitive application programming interface in the main function program segment of the target software, a first adjacency matrix of the first sensitive application programming interface is generated; a first variable vector is calculated based on the preset variables and a first shared value of a first multiplication triple stored by the client; a second variable vector is calculated based on the preset variables and a second shared value of the first multiplication triple; a first embedded representation is calculated based on a first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; and a second embedded representation is calculated based on a second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix.The encrypted dynamic weight matrix is ​​generated based on the target dynamic weight matrix and the encryption key stored in the server, and the first variable vector, the second variable vector, the first embedded representation and the second embedded representation are sent to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, and calculates the fourth embedded representation based on the third embedded representation and the third shared value in the second multiplication triple stored in the server, and decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, and calculates the sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triple, and calculates the sixth embedded representation based on the first variable vector. and the fourth embedding representation, calculate the seventh embedding representation, calculate the eighth embedding representation based on the second variable vector and the sixth embedding representation, calculate the ninth embedding representation based on the seventh embedding representation, the eighth embedding representation and the second multiplication triplet, calculate the tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculate the eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculate the twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation and the first multiplication triplet, calculate the encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix and the twelfth embedding representation, and send it to the server The encrypted prediction score is sent to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score. A second prediction score is calculated based on the target dynamic weight matrix and the ninth embedding representation, and the first prediction score and the second prediction score are summed to obtain a third prediction score. Based on the third prediction score sent by the server and preset variables, the target software is judged to be malicious, obtaining a first judgment result. The client can obtain the application programming interface of the target software through a decompilation method, and obtain a first adjacency matrix between each application programming interface based on the relative positions of each application programming interface. Thus, the third prediction score corresponding to the first adjacency matrix can be obtained through a homomorphic encryption method using additive secret sharing between the client and the server. Finally, the client can judge the target software to be malicious using the third prediction score and the preset variables to obtain a first judgment result. The target software can be detected for maliciousness while maintaining the data security of the target dynamic weight matrix on the server and the target software on the client, obtaining the first judgment result of the target software. This prevents data leakage on the client and the server, and to a certain extent improves the data security of the client's user privacy data and the server's network model data and target dynamic weight matrix data. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0059] Figure 1 This is a flowchart of a malware detection method provided by an embodiment of the present application;

[0060] Figure 2 This is a flowchart of another malware detection method provided by an embodiment of the present application;

[0061] Figure 3 This is a flow chart of a method for obtaining a target dynamic weight matrix provided in an embodiment of the present application;

[0062] Figure 4 This is a flowchart of a specific implementation of a malware detection method provided in an embodiment of the present application;

[0063] Figure 5 This is a logic block diagram of a malware detection device provided in an embodiment of the present application;

[0064] Figure 6 This is a logic block diagram of another malware detection device provided by an embodiment of the present application;

[0065] Figure 7 This is a schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The exemplary embodiments of the present application will be described in more detail below in conjunction with the accompanying drawings in the embodiments of the present application. Although the accompanying drawings show exemplary embodiments of the present application, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0067] Reference Figure 1 , Figure 1 A flowchart of a malware detection method provided in an embodiment of the present application, applied to a client, includes:

[0068] Step 101 : Decompile the software file of the target software to obtain a first application programming interface of the target software; wherein the first application programming interface includes at least one sub-function program segment.

[0069] In the embodiments of this application, decompilation, also known as computer software reverse engineering, refers to the process of reverse analysis and research of a target program (such as an executable program) in another's software to derive the design elements, principles, structure, algorithms, processing procedures, and operating methods used by the software product. In certain cases, the source code may be derived. The target software can be an executable program written in a programming language, and the target software's software file can be the target software's executable file. The process of decompiling a software file is the process of converting the executable file to the source code. For example, if the target software is written in Easy Language, the target software can be decompiled using the Easy Format Executable File Analyzer (program name: E-Code Explorer.exe) to obtain the source code. If the target software is an Android application installation package (usually in APK format), the target software can be decompiled using common decompilation tools such as SMALI / BAKSMAL editing tools or APKTOOL. After decompilation, all function program segments of the target software can be obtained, represented by the Application Programming Interface (API). Typically, a main function segment does not form an application programming interface (API), but rather serves as an API dispatcher. Therefore, the first API of the target software may include at least one sub-function segment, wherein the sub-functions may be nested with one another.

[0070] Step 102: Determine a first sensitive application programming interface from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable.

[0071] In an embodiment of the present application, some of the target software's application programming interfaces (APIs) may have functions such as accessing user personal information, using sensitive data input devices, or consuming user assets. These APIs may be defined as sensitive APIs. Based on this, at least one of the user personal information variable, the sensitive data input device, and the user asset data variable may be set as a preset sensitive variable. This allows for string recognition of the first API. If a string corresponding to the preset sensitive variable exists within the program segment of the first API, the first API may be identified as a first sensitive API.

[0072] Step 103: Generate a first adjacency matrix of the first sensitive application programming interfaces based on the relative positions of the first sensitive application programming interfaces in the main function program segment of the target software.

[0073] In an embodiment of the present application, each first sensitive application programming interface can be embodied in the form of a function call in the main function program segment of the target software, and is classified and defined according to the common function call behavior of malware. The relative position of each first sensitive application programming interface in the main function program segment of the target software can refer to the relative position of the called code of each first sensitive application programming interface in the main function program segment. The relative position can include the following: if the first sensitive application programming interface in the same code block is directly adjacent to another sensitive application programming interface, then the relative position between the above two first sensitive application programming interfaces can be defined as directly adjacent, represented by R0, where the code block can refer to the code contained in a set of complete symbols "{}"; if the first sensitive application programming interface in the same code block is adjacent to another sensitive application programming interface through code that does not involve function calls, then the relative position between the above two first sensitive application programming interfaces can be defined as first interval code adjacent, represented by R1; if the two first sensitive application programming interfaces are adjacent to each other through code that does not involve function calls, then the relative position between the above two first sensitive application programming interfaces can be defined as first interval code adjacent, represented by R1; If the interface appears in two adjacent code blocks and there is only code that does not involve function calls in between, then the relative position between the two first sensitive application programming interfaces can be defined as second interval code adjacency, represented by R2; if the two first sensitive application programming interfaces are adjacent through a user-defined function of a non-application programming interface type and there is only code that does not involve function calls in between, then the relative position between the two first sensitive application programming interfaces can be defined as third interval code adjacency, represented by R3; if the two first sensitive application programming interfaces belong to the same class (which can be determined by the call name of the interface call; if the first segment of the call name is the same, then the two first sensitive application programming interfaces can be considered to belong to the same class), then the relative position between the two first sensitive application programming interfaces can be defined as same-type adjacency, represented by R4; if the relative position between the two first sensitive application programming interfaces does not meet any of the above conditions, then the relative position between the two first sensitive application programming interfaces can be defined as no relative position, represented by 0. Thus, based on the relative positions of the first sensitive application programming interfaces in the main function segment of the target software, the generated first sensitive application programming interface first adjacency matrix may include six elements, namely "0, R0, R1, R2, R3, R4". The first adjacency matrix can represent the relative positional relationships between the first sensitive application programming interfaces.

[0074] Step 104: Calculate a first variable vector based on a preset variable and a first shared value of a first multiplication triplet stored in the client; calculate a second variable vector based on the preset variable and a second shared value of the first multiplication triplet; calculate a first embedding representation based on a first encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; and calculate a second embedding representation based on a second encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; wherein the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key stored in the server.

[0075] In an embodiment of the present application, the preset variables are private data held by the client and can be generated in the client by a random algorithm. Multiplication triples are a form of data used in two-party secure computing, and are usually generated by each party independently. For example, the first multiplication triple in the client can be generated by the client, and the first multiplication triple includes three shared values, wherein the product of the first shared value and the second shared value is equal to the product shared value. In this way, the following calculations can be carried out in the client: calculate the first variable vector based on the preset variables and the first shared value of the first multiplication triple; calculate the second variable vector based on the preset variables and the second shared value of the first multiplication triple; calculate the second adjacency matrix based on the preset variables and the first adjacency matrix. In addition, the client can also receive the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix sent by the server, so that the first embedded representation can be calculated based on the first encrypted dynamic weight matrix, combined with the preset variables and the first adjacency matrix, and the second embedded representation can be calculated based on the second encrypted dynamic weight matrix, combined with the preset variables and the first adjacency matrix. Among them, the encrypted dynamic weight matrix can be generated by the server based on the target dynamic weight matrix and encryption key stored in the server. The first encrypted dynamic weight matrix can be obtained through an encryption algorithm based on the first column elements of the target dynamic weight matrix, and the second encrypted dynamic weight matrix can be obtained through an encryption algorithm based on all elements of the target dynamic weight matrix. The encryption key referred to here can be any homomorphic encryption key that supports additive secret sharing, and another encryption key that matches the encryption key is also held in the client, so that the client can perform a certain degree of calculation on the encrypted ciphertext sent by the server. The target dynamic weight matrix stored in the server can be obtained by training the first graph neural network model on the server, and the dimension of the target dynamic weight matrix can be determined based on the number of training samples and the number of network layers of the first graph neural network model.

[0076] For example, let the first multiplication triple be ( ), the default variable is , the first encrypted dynamic weight matrix is , the second encrypted dynamic weight matrix is , , then the first variable vector can be expressed as , the second variable vector can be expressed as , the first embedding representation can be , the second embedding representation can be , where M represents the number of columns of the target dynamic weight matrix, = Among them, the first sharing value is , the second sharing value is .

[0077] Step 105: Send the first variable vector, the second variable vector, the first embedded representation, and the second embedded representation to the server, so that the server calculates a fourth embedded representation based on the first embedded representation and a third shared value in a second multiplication triplet stored on the server, decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculates a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet, calculates a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculates an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculates a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet.

[0078] In an embodiment of the present application, the client can send a first variable vector, a second variable vector, a first embedded representation, and a second embedded representation to the server, so that the server can calculate a fourth embedded representation based on the first embedded representation and the third shared value in the second multiplication triplet stored by the server, decrypt the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculate a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet, calculate a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculate an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculate a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet.

[0079] Continuing with the above example, if the second multiplication triplet held by the server is ( ), Represents the first embedding representation The third embedding representation obtained after decryption is, Represents the second embedding representation The fifth embedded representation obtained after decryption, then the fourth embedded representation can be expressed as , the sixth embedding representation can be expressed as , the seventh embedding representation can be , the eighth embedding representation can be expressed as , the ninth embedding representation can be expressed as ,in, , , the third sharing value is , the fourth share value is .

[0080] Step 106: Calculate a tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server; calculate an eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server; calculate a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet; and calculate an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation.

[0081] In an embodiment of the present application, the client can receive the fourth embedding representation and the sixth embedding representation sent by the server, so that the tenth embedding representation can be calculated based on the first variable vector and the fourth embedding representation, the eleventh embedding representation can be calculated based on the second variable vector and the sixth embedding representation, the twelfth embedding representation can be calculated based on the tenth embedding representation, the eleventh embedding representation and the first multiplication triplet, and the encrypted prediction score can be calculated based on the preset variables, the encrypted dynamic weight matrix and the twelfth embedding representation.

[0082] Continuing with the above example, the tenth embedding representation can be , the eleventh embedding representation can be , the twelfth embedding representation can be ,in, The encrypted prediction score can be expressed as .

[0083] Step 107: Send the encrypted prediction score to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score, calculates a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sums the first prediction score and the second prediction score to obtain a third prediction score.

[0084] In an embodiment of the present application, an encrypted prediction score can be sent to the server so that the server can decrypt the encrypted prediction score based on the encryption key to obtain a first prediction score, calculate a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sum the first prediction score and the second prediction score to obtain a third prediction score.

[0085] Continuing with the above example, the first prediction score can be expressed as , by encrypted prediction score The second prediction score can be obtained by decryption. , the third prediction score can be expressed as ,in Represents the target dynamic weight matrix.

[0086] Step 108: Based on the third prediction score sent by the server and the preset variables, the target software is judged to be malicious, and a first judgment result is obtained.

[0087] In an embodiment of the present application, the server can send a third prediction score to the client, and the client can make a malicious determination on the target software based on the third prediction score and a preset variable, thereby obtaining a first determination result. For example, another prediction score corresponding to the third prediction score and the preset variable can be calculated, and the target software can be determined to be malicious based on the relationship between the prediction score and a preset threshold, thereby obtaining a first determination result. If the prediction score is greater than or equal to the preset threshold, the first determination result can be "the target software is malware", and if the prediction score is less than the preset threshold, the first determination result can be "the target software is normal software".

[0088] Optionally, step 108 may include the following sub-steps:

[0089] Sub-step 1081: summing the preset variable and the third prediction score sent by the server to obtain a fourth prediction score.

[0090] In an embodiment of the present application, since the preset variables and the third prediction score have the same expression form, the client can sum the preset variables and the third prediction score after receiving the third prediction score sent by the server, and thus the summation result can be used as the fourth prediction score.

[0091] Sub-step 1082: If the fourth prediction score is greater than or equal to a first threshold, determine that the first determination result of the target software is malware.

[0092] In an embodiment of the present application, a first threshold can be manually set, and when the fourth prediction score is greater than or equal to the first threshold, the first determination result of the target software can be determined to be malware. Since detecting malware in the target software is actually a binary classification process, the first threshold can be set to 50%. Furthermore, to appropriately improve the accuracy of determining the target software as malware, the value of the first threshold can be appropriately adjusted to be greater than 50%.

[0093] Sub-step 1083 , when the fourth prediction score is less than or equal to the first threshold, determining that the first determination result is normal software.

[0094] In an embodiment of the present application, when the fourth prediction score is less than or equal to the first threshold, it can be determined that the first determination result of the target software is normal software.

[0095] In an embodiment of the present application, a fourth prediction score is obtained by summing the preset variables and the third prediction score sent by the server. When the fourth prediction score is greater than or equal to the first threshold, the first judgment result of the target software is determined to be malware. When the fourth prediction score is less than or equal to the first threshold, the first judgment result is determined to be normal software. The target software can be judged as malicious on the client by the relationship between the sum of the preset variables and the third prediction score and the first threshold. This can avoid the leakage of the detection data of the target software to a certain extent, improve the data security of the target software to a certain extent, and at the same time improve the detection efficiency of the target software.

[0096] In an embodiment of the present application, a first application programming interface of the target software is obtained by decompiling a software file of the target software; wherein the first application programming interface includes at least one sub-function program segment, and a first sensitive application programming interface is determined from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, or a user asset data variable; based on the relative position of each first sensitive application programming interface in the main function program segment of the target software, a first adjacency matrix of the first sensitive application programming interface is generated; based on the preset variables and a first shared value of a first multiplication triple stored by the client, a first variable vector is calculated; based on the preset variables and a second shared value of the first multiplication triple, a second variable vector is calculated; based on the first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix, a first embedding representation is calculated; and based on the second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix, a second embedding representation is calculated;The encrypted dynamic weight matrix is ​​generated based on the target dynamic weight matrix and the encryption key stored in the server, and the first variable vector, the second variable vector, the first embedded representation and the second embedded representation are sent to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, and calculates the fourth embedded representation based on the third embedded representation and the third shared value in the second multiplication triple stored in the server, and decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, and calculates the sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triple, and calculates the sixth embedded representation based on the first variable vector. and the fourth embedding representation, calculate the seventh embedding representation, calculate the eighth embedding representation based on the second variable vector and the sixth embedding representation, calculate the ninth embedding representation based on the seventh embedding representation, the eighth embedding representation and the second multiplication triplet, calculate the tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculate the eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculate the twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation and the first multiplication triplet, calculate the encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix and the twelfth embedding representation, and send it to the server The encrypted prediction score is sent to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score. A second prediction score is calculated based on the target dynamic weight matrix and the ninth embedding representation, and the first prediction score and the second prediction score are summed to obtain a third prediction score. Based on the third prediction score sent by the server and preset variables, the target software is judged to be malicious, obtaining a first judgment result. The client can obtain the application programming interface of the target software through a decompilation method, and obtain a first adjacency matrix between each application programming interface based on the relative positions of each application programming interface. Thus, the third prediction score corresponding to the first adjacency matrix can be obtained through a homomorphic encryption method using additive secret sharing between the client and the server. Finally, the client can judge the target software to be malicious using the third prediction score and the preset variables to obtain a first judgment result. The target software can be detected for maliciousness while maintaining the data security of the target dynamic weight matrix on the server and the target software on the client, obtaining the first judgment result of the target software. This prevents data leakage on the client and the server, and to a certain extent improves the data security of the client's user privacy data and the server's network model data and target dynamic weight matrix data.

[0097] Reference Figure 2 , Figure 2 A flowchart of another malware detection method provided in an embodiment of the present application, applied to a server, may include:

[0098] Step 201: Based on the target dynamic weight matrix and the encryption key, a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix are generated respectively, and the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are sent to the client, so that the client calculates a first embedded representation based on the first encrypted dynamic weight matrix, preset variables and a first adjacency matrix, and calculates a second embedded representation based on the second encrypted dynamic weight matrix, the preset variables and the first adjacency matrix; wherein the first adjacency matrix is ​​generated based on the relative position of each first sensitive application programming interface in the main function program segment of the target software; the first sensitive application programming interface is determined from the first application programming interface of the target software based on the character string corresponding to the preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable and a user asset data variable; the first application programming interface is obtained by decompiling the software file of the sample software; and the first application programming interface includes at least one sub-function program segment.

[0099] In the embodiments of this application, decompilation, also known as computer software reverse engineering, refers to the process of reverse analysis and research of a target program (such as an executable program) in another's software to derive the design elements, principles, structure, algorithms, processing procedures, and operating methods used by the software product. In certain cases, the source code may be derived. The target software can be an executable program written in a programming language, and the target software's software file can be the target software's executable file. The process of decompiling a software file is the process of converting the executable file to the source code. For example, if the target software is written in Easy Language, the target software can be decompiled using the Easy Format Executable File Analyzer (program name: E-Code Explorer.exe) to obtain the source code. If the target software is an Android application installation package (usually in APK format), the target software can be decompiled using common decompilation tools such as SMALI / BAKSMAL editing tools or APKTOOL. After decompilation, all function program segments of the target software can be obtained, represented by the Application Programming Interface (API). Typically, a main function segment does not form an application programming interface (API), but rather serves as an API dispatcher. Therefore, the first API of the target software may include at least one sub-function segment, wherein the sub-functions may be nested with one another.

[0100] In an embodiment of the present application, some of the target software's application programming interfaces (APIs) may have functions such as accessing user personal information, using sensitive data input devices, or consuming user assets. These APIs may be defined as sensitive APIs. Based on this, at least one of the user personal information variable, the sensitive data input device, and the user asset data variable may be set as a preset sensitive variable. This allows for string recognition of the first API. If a string corresponding to the preset sensitive variable exists within the program segment of the first API, the first API may be identified as a first sensitive API.

[0101] In an embodiment of the present application, each first sensitive application programming interface can be embodied in the form of a function call in the main function program segment of the target software. According to the classification definition of the common function call behavior of malware, the relative position of each first sensitive application programming interface being called may include the following: If the first sensitive application programming interface in the same code block is directly adjacent to another sensitive application programming interface, then the relative position between the above two first sensitive application programming interfaces can be defined as directly adjacent, represented by R0, where the code block can refer to a set of complete symbols "{}" contained in the code; if the first sensitive application programming interface in the same code block is adjacent to another sensitive application programming interface through code that does not involve function calls, then the relative position between the above two first sensitive application programming interfaces can be defined as first interval code adjacent, represented by R1; if two first sensitive application programming interfaces appear in two adjacent code blocks and there is only code that does not involve function calls in between. If the two first-sensitive APIs are adjacent via a non-API user-defined function and only contain code that does not involve a function call, the relative position between the two first-sensitive APIs can be defined as third-interval code adjacency, denoted by R2. If the two first-sensitive APIs are adjacent via a non-API user-defined function and only contain code that does not involve a function call, the relative position between the two first-sensitive APIs can be defined as third-interval code adjacency, denoted by R3. If the two first-sensitive APIs belong to the same class (this can be determined by the call names of the interface calls; if the first segment of the call names are the same, the two first-sensitive APIs can be considered to belong to the same class), the relative position between the two first-sensitive APIs can be defined as same-class adjacency, denoted by R4. If the relative position between the two first-sensitive APIs does not meet any of the above conditions, the relative position between the two first-sensitive APIs can be defined as no relative position, denoted by 0. Thus, based on the relative position of each first-sensitive API in the main function segment of the target software, the generated first-sensitive API adjacency matrix can contain six elements, namely "0, R0, R1, R2, R3, and R4." The first adjacency matrix may represent the relative positional relationship between the first sensitive application programming interfaces.

[0102] In an embodiment of the present application, the server can generate a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix based on the target dynamic weight matrix and encryption key stored in itself. The first encrypted dynamic weight matrix can be a matrix obtained by encrypting the weight values ​​of the first column of the target dynamic weight matrix based on the encryption key, and the second encrypted dynamic weight matrix can be a matrix obtained by encrypting the weight values ​​of at least two consecutive columns of the target dynamic weight matrix starting from the first column of weight values ​​based on the encryption key. That is, if the target weight matrix has N columns of weight values, there are N-1 second encrypted dynamic weight matrices and N first encrypted dynamic weight matrices. The encryption key referred to here can be any homomorphic encryption key that supports additive secret sharing, and another encryption key that matches the encryption key is also held in the client, so that the client can perform a certain degree of operation on the encrypted ciphertext sent by the server. The target dynamic weight matrix stored in the server can be obtained by training the first graph neural network model by the server, and the dimension of the target dynamic weight matrix can be determined based on the number of training samples and the number of network layers of the first graph neural network model. The server can send the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix to the client, so that the client can calculate the first embedded representation based on the first encrypted dynamic weight matrix, the preset variables, and the first adjacency matrix, and calculate the second embedded representation based on the second encrypted dynamic weight matrix, the preset variables, and the first adjacency matrix. The preset variables are private data held by the client and can be generated by a random algorithm in the client. The calculation methods of the first embedded representation and the second embedded representation can be referred to the embodiment and examples of step 104 and will not be repeated here.

[0103] Step 202: Decrypt the first embedded representation sent by the client based on the encryption key to obtain a third embedded representation; calculate a fourth embedded representation based on the third embedded representation and the third shared value in the second multiplication triple stored by the server; decrypt the second embedded representation sent by the client based on the encryption key stored by the server to obtain a fifth embedded representation; calculate a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triple; calculate a seventh embedded representation based on the first variable vector sent by the client and the fourth embedded representation; and calculate an eighth embedded representation based on the second variable vector sent by the client and the sixth embedded representation. Representation, based on the seventh embedding representation, the eighth embedding representation and the second multiplication triplet, a ninth embedding representation is calculated; wherein, the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix sent by the server, the preset variables and the first adjacency matrix; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix sent by the server, the preset variables and the first adjacency matrix; the first variable vector is calculated based on the preset variables and the first shared value of the first multiplication triplet stored in the client; the second variable vector is calculated based on the preset variables and the second shared value of the first multiplication triplet.

[0104] In an embodiment of the present application, a server can receive a first variable vector, a second variable vector, a first embedded representation, and a second embedded representation sent by a client, and thereby calculate a fourth embedded representation based on the first embedded representation and the third shared value in the second multiplication triple stored by the server, decrypt the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculate a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triple, calculate a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculate an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculate a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triple. A multiplication triple is a data format used in two-party secure computation and is typically generated independently by each party. For example, the first multiplication triple in the client can be generated by the client, and the first multiplication triple includes three shared values, wherein the product of the first shared value and the second shared value is equal to the product shared value. In this way, the client can perform the following calculations: a first variable vector is calculated based on the preset variable and the first shared value of the first multiplication triple; and a second variable vector is calculated based on the preset variable and the second shared value of the first multiplication triple. For details about the first multiplication triple, the first shared value, the second shared value, the first variable vector, and the second variable vector, refer to the example section under step 104 and are not further described here.

[0105] Continuing with the above example, if the second multiplication triplet held by the server is ( ), Represents the first embedding representation The third embedding representation obtained after decryption is, Represents the second embedding representation The fifth embedded representation obtained after decryption, then the fourth embedded representation can be expressed as , the sixth embedding representation can be expressed as , the seventh embedding representation can be , the eighth embedding representation can be expressed as , the ninth embedding representation can be expressed as ,in, , , the third sharing value is , the fourth share value is .

[0106] Step 203: Send the fourth embedding representation and the sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculates an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation.

[0107] In an embodiment of the present application, the server may send the fourth embedding representation and the sixth embedding representation to the client, so that the client can calculate the tenth embedding representation based on the first variable vector and the fourth embedding representation, calculate the eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculate the twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation and the first multiplication triplet, and calculate the encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix and the twelfth embedding representation.

[0108] Continuing with the above example, the tenth embedding representation can be , the eleventh embedding representation can be , the twelfth embedding representation can be ,in, The encrypted prediction score can be expressed as .

[0109] Step 204: Decrypt the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculate a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sum the first prediction score and the second prediction score to obtain a third prediction score.

[0110] In an embodiment of the present application, the server can receive the encrypted prediction score sent by the client, and thus can decrypt the encrypted prediction score based on the encryption key to obtain a first prediction score, calculate the second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sum the first prediction score and the second prediction score to obtain a third prediction score.

[0111] Continuing with the above example, the first prediction score can be expressed as , by encrypted prediction score The second prediction score can be obtained by decryption. , the third prediction score can be expressed as ,in Represents the target dynamic weight matrix.

[0112] Step 205 : Send the third prediction score to the client, so that the client performs a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result.

[0113] In an embodiment of the present application, the server may send a third prediction score to the client, so that the client may make a malicious determination on the target software based on the third prediction score and preset variables to obtain a first determination result.

[0114] Optionally, step 205 may include the following sub-steps:

[0115] Sub-step 2051: Send the third prediction score to the client, so that the client sums the preset variable and the third prediction score sent by the server to obtain a fourth prediction score. When the fourth prediction score is greater than or equal to the first threshold, determine that the first judgment result of the target software is malware; when the fourth prediction score is less than or equal to the first threshold, determine that the first judgment result is normal software.

[0116] In an embodiment of the present application, the server can send a third prediction score to the client. Since the preset variable and the third prediction score have the same form of expression, the client can sum the preset variable and the third prediction score after receiving the third prediction score sent by the server, so that the result of the summation can be used as the fourth prediction score. The first threshold can be set manually, and when the fourth prediction score is greater than or equal to the first threshold, it can be determined that the first judgment result of the target software is malware. When the fourth prediction score is less than or equal to the first threshold, it can be determined that the first judgment result of the target software is normal software. Among them, since malicious detection of target software is actually a two-classification process, the first threshold can be set to 50%. In addition, in order to appropriately improve the accuracy of determining the target software as malware, the value of the first threshold can be appropriately adjusted to be greater than 50%.

[0117] In an embodiment of the present application, a third prediction score is sent to the client, so that the client sums the preset variables and the third prediction score sent by the server to obtain a fourth prediction score. When the fourth prediction score is greater than or equal to the first threshold, the first judgment result of the target software is determined to be malware. When the fourth prediction score is less than or equal to the first threshold, the first judgment result is determined to be normal software. The target software can be judged as malicious on the client through the relationship between the sum of the preset variables and the third prediction score and the first threshold. This can avoid the leakage of the detection data of the target software to a certain extent, improve the data security of the target software to a certain extent, and at the same time improve the detection efficiency of the target software.

[0118] In an embodiment of the present application, a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key, and the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are sent to the client, so that the client calculates a first embedding representation based on the first encrypted dynamic weight matrix, a preset variable and a first adjacency matrix, calculates a second embedding representation based on the second encrypted dynamic weight matrix, the preset variable and the first adjacency matrix, decrypts the first embedding representation sent by the client based on the encryption key to obtain a third embedding representation, calculates a fourth embedding representation based on the third embedding representation and the third shared value in the second multiplication triple stored on the server, decrypts the second embedding representation sent by the client based on the encryption key stored on the server to obtain a fifth embedding representation, calculates a sixth embedding representation based on the fifth embedding representation and the fourth shared value in the second multiplication triple, calculates a seventh embedding representation based on the first variable vector sent by the client and the fourth embedding representation, calculates an eighth embedding representation based on the second variable vector sent by the client and the sixth embedding representation, and calculates an eighth embedding representation based on the seventh embedding representation, the eighth embedding representation and the eighth embedding representation. The method comprises the following steps: an embedding representation and a second multiplication triplet, and calculating a ninth embedding representation; wherein the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix, preset variables, and first adjacency matrix sent by the server; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix, preset variables, and first adjacency matrix sent by the server; the first variable vector is calculated based on the preset variables and the first shared value of the first multiplication triplet stored in the client; the second variable vector is calculated based on the preset variables and the second shared value of the first multiplication triplet; the first adjacency matrix is ​​generated based on the relative positions of each first sensitive application programming interface in the main function program segment of the target software; the first dynamic weight matrix is ​​generated based on the preset weight values ​​corresponding to each relative position; the first sensitive application programming interface is determined from the first application programming interface of the target software based on the character string corresponding to the preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, or a user asset data variable; the first application programming interface is obtained by decompiling the software file of the sample software;The first application programming interface includes at least one sub-function program segment, which sends a fourth embedding representation and a sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation and the first multiplication triplet, calculates an encrypted prediction score based on preset variables, the encrypted dynamic weight matrix and the twelfth embedding representation, decrypts the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculates a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sums the first prediction score and the second prediction score to obtain a third prediction score, and sends the third prediction score to the client, so that the client performs an evaluation of the target software based on the third prediction score and the preset variables. To determine if the software is malicious and obtain a first determination result, the client can decompile the target software's application programming interface (API) and, based on the relative positions of the APIs, obtain a first adjacency matrix between the APIs. This allows the client to obtain a third prediction score corresponding to the first adjacency matrix using a homomorphic encryption method using additive secret sharing between the client and the server. Finally, the client can use the third prediction score and preset variables to determine if the software is malicious and obtain the first determination result. This allows the target software to be detected for maliciousness while maintaining the data security of the target dynamic weight matrix on the server and the target software on the client, thereby preventing data leakage on the client and server, and to a certain extent improving the data security of user privacy data on the client and network model data and the target dynamic weight matrix data on the server.

[0119] Based on the above implementation, Figure 3 , Figure 3 This is a flow chart of a method for obtaining a target dynamic weight matrix provided in an embodiment of the present application. Before step 201, the method may further include:

[0120] Step 206 : Decompile the software file of the sample software to obtain a first sample application programming interface of the sample software; wherein the first sample application programming interface includes at least one sub-function program segment.

[0121] In an embodiment of the present application, the server can decompile the sample software's software files to obtain a first sample application programming interface (API) of the sample software. The first sample API includes at least one sub-function program segment. For details on the decompilation process, refer to the embodiment of step 101. The first sample API is similar to the first API, and reference is made to the embodiment of step 101, which will not be further described here.

[0122] Step 207: Determine a first sample sensitive application programming interface from the first sample application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable.

[0123] In an embodiment of the present application, some APIs within the sample software may have functions such as accessing user personal information, using sensitive data input devices, or consuming user assets. These APIs may be defined as sensitive APIs. Based on this, at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable may be set as a preset sensitive variable. Thus, the server may determine the first sample sensitive API from the first sample API based on the string corresponding to the preset sensitive variable. The preset sensitive variable may include at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable.

[0124] Step 208: Generate a first sample adjacency matrix of the first sample-sensitive application programming interfaces based on the relative positions of the first sample-sensitive application programming interfaces in the main function program segment of the sample software.

[0125] In an embodiment of the present application, the server can generate a first sample adjacency matrix for each first sample-sensitive application programming interface based on the relative position of each first sample-sensitive application programming interface in the main function program segment of the sample software. The process of generating the first sample adjacency matrix is ​​similar to the process of generating the first adjacency matrix, and can be referred to the embodiment of step 103, which is not repeated here.

[0126] Step 209: Input the first sample adjacency matrix into the first graph neural network model to obtain the sample prediction score of the sample software output by the first graph neural network model.

[0127] In an embodiment of the present application, the first graph neural network model can be any common graph model, such as lightGCN, SGL, NCL, SimGCL, etc. The first sample adjacency matrix can be input into the first graph neural network model for propagation, so as to obtain the sample prediction score of the sample software output by the first graph neural network model. Each propagation layer of the first graph neural network model can have an initial weight value, which can participate in the propagation process of the first graph neural network model and can be adjusted as a model parameter through the training process of the first graph neural network model.

[0128] Optionally, step 209 may include the following sub-steps:

[0129] Sub-step 2091: input the first sample adjacency matrix into the multiple relationship aggregation layer to perform weighted aggregation on the first sample adjacency matrix to obtain a second sample adjacency matrix output by the multi-layer relationship aggregation layer.

[0130] In an embodiment of the present application, the first graph neural network model includes a multi-relation aggregation layer, a multi-layer heterogeneous graph convolution layer, and a prediction layer. In the multi-relation aggregation layer, weighted aggregation can be performed based on the first sample adjacency matrix and combined with the weights of each layer of the multi-relation aggregation layer. Thus, after the first sample adjacency matrix is ​​input into the multi-relation aggregation layer, a second sample adjacency matrix output by the multi-layer relationship aggregation layer can be obtained.

[0131] Sub-step 2092: input the second sample adjacency matrix into the multi-layer heterogeneous graph convolution layer to obtain the final embedded representation of the sample output by the multi-layer heterogeneous graph convolution layer.

[0132] In an embodiment of the present application, the multi-layer heterogeneous graph convolution layer can take the second sample adjacency matrix as input and perform matrix operations with the dynamic weight matrix of the model to obtain the sample embedding representation ,in Indicates the The dynamic weight matrix of the convolutional layer, Representative The node features output by the convolutional layer are obtained through neighborhood aggregation calculation. , and so on, each convolutional layer models the paths of different lengths and types in the heterogeneous graph, thereby generating a new sample embedding representation Finally, the weighted sum of these sample embedding representations is used to obtain the final sample embedding representation .

[0133] Sub-step 2093: input the final embedded representation of the sample into the prediction layer to obtain the sample prediction score of the sample software output by the prediction layer.

[0134] In the embodiment of the present application, the sample can be finally embedded into the representation input prediction layer, so that the sample prediction score of the sample software output by the prediction layer can be obtained. Specifically, the activation function of the prediction layer can be a softmax function, and the prediction layer uses a linear transformation to calculate the sample prediction score. ,in represents the sample prediction score, are the model parameters of the prediction layer, is the bias vector, which can be set manually. The final embedding representation of samples corresponding to all first sample-sensitive application programming interfaces is represented, where N represents the number of first sample-sensitive application programming interfaces.

[0135] In an embodiment of the present application, the first sample adjacency matrix is ​​input into a multiple relationship aggregation layer to perform weighted aggregation on the first sample adjacency matrix to obtain a second sample adjacency matrix output by the multi-layer relationship aggregation layer, the second sample adjacency matrix is ​​input into a multi-layer heterogeneous graph convolution layer to obtain a final embedded representation of the sample output by the multi-layer heterogeneous graph convolution layer, the final embedded representation of the sample is input into a prediction layer to obtain a sample prediction score of the sample software output by the prediction layer, the first sample adjacency data can be processed by different types of network layers of the first graph neural network model to obtain a sample prediction score, which improves the accuracy of the sample prediction score to a certain extent.

[0136] Step 210: Determine the cross entropy loss value of the first graph neural network model based on the sample prediction score and the classification label of the sample software.

[0137] In an embodiment of the present application, the cross entropy loss value may be calculated as shown in the following formula 1:

[0138] (Formula 1)

[0139] In the above formula 1, L represents the cross entropy loss value, N represents the number of training samples, and j represents the classification category. represents the sample prediction score, Indicates the The samples belong to kind, 0 means the The sample does not belong to Classification can be determined based on the sample prediction score and the classification label of the sample software. For example, if the sample prediction score is greater than 50%, and the classification label of sample i is j=2, indicating that it is malware, then =1. In other cases, 0.

[0140] Step 211: Based on the cross entropy loss value, adjust the model parameters of the first graph neural network model and the first weight values ​​of each network layer of the first graph neural network model to obtain a target graph neural network model.

[0141] In an embodiment of the present application, the model parameters of the first graph neural network model and the first weight values ​​of each network layer can be adjusted according to the cross-entropy loss value, thereby obtaining a target graph neural network model. The model parameters and the first weight values ​​can be adjusted in a direction that reduces the cross-entropy loss value.

[0142] Step 212: Obtain the target weight values ​​corresponding to each network layer in the target graph neural network model to obtain the target dynamic weight matrix.

[0143] In an embodiment of the present application, the weight values ​​corresponding to each network layer in the target graph neural network model can be obtained, thereby obtaining a target dynamic weight matrix. Specifically, the weight values ​​corresponding to each network layer can be arranged in the order of propagation in the target graph neural network model to obtain the target dynamic weight matrix.

[0144] In an embodiment of the present application, a first sample application programming interface of the sample software is obtained by decompiling the software file of the sample software; wherein the first sample application programming interface includes at least one sub-function program segment, and based on the character string corresponding to the preset sensitive variable, the first sample sensitive application programming interface is determined from the first sample application programming interface; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable and a user asset data variable, and based on the relative position of each first sample sensitive application programming interface in the main function program segment of the sample software, a first sample adjacency matrix of the first sample sensitive application programming interface is generated, and the first sample adjacency matrix is ​​input into the first graph neural network model to obtain the sample prediction score of the sample software output by the first graph neural network model, and based on the sample prediction score and the classification label of the sample software, the cross entropy loss value of the first graph neural network model is determined, and based on the cross entropy loss value, the model parameters of the first graph neural network model are adjusted to obtain the target graph neural network model, and the weight values ​​corresponding to each network layer in the target graph neural network model are obtained to obtain the target dynamic weight matrix. The target dynamic weight matrix can be obtained by the graph neural network training method, which improves the accuracy of the target dynamic weight matrix to a certain extent.

[0145] Reference Figure 4 , Figure 4A flowchart of a specific implementation method of a malware detection method provided by an embodiment of the present application. In the figure, in the client, the software to be detected can be decompiled to obtain multiple API interfaces, and then the API interface can be subjected to sensitivity detection to obtain sensitive APIs, and then the first adjacency matrix is ​​generated based on the relative positions between the sensitive API call statements in the main function program. In the server, the sample software data can be decompiled to obtain a sample API interface, and then the sample API interface can be subjected to sensitivity detection to obtain a sample sensitive API interface, and then the first sample adjacency matrix can be generated based on the relative positions between the various sample sensitive API call statements in the main function program, and the first graph neural network model is trained by the first sample adjacency matrix to obtain a target graph neural network model, and then the weight values ​​of each network layer of the target graph neural network model can be obtained, thereby obtaining a target dynamic weight matrix. Afterwards, a secure two-party cooperative malicious detection can be carried out between the client and the server, that is, the encryption method of additive secret sharing provided by the embodiment of the present application is used for calculation to obtain a malicious score, and a malicious detection result is generated by the malicious score. If the malicious score is greater than or equal to the preset threshold, the malicious detection result is malware, and if the malicious score is less than the preset threshold, the malicious detection result is normal software.

[0146] Reference Figure 5 , Figure 5 This is a logic block diagram of a malware detection device provided in an embodiment of the present application, which is applied to a client. The malware detection device 500 may include:

[0147] A decompile module 501 is configured to decompile a software file of a target software to obtain a first application programming interface of the target software; wherein the first application programming interface includes at least one sub-function program segment;

[0148] Determining module 502, configured to determine a first sensitive application programming interface from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable;

[0149] A generating module 503 is configured to generate a first adjacency matrix of the first sensitive application programming interfaces based on the relative positions of the first sensitive application programming interfaces in the main function program segment of the target software;

[0150] A first calculation module 504 is configured to calculate a first variable vector based on a preset variable and a first shared value of a first multiplication triple stored on the client, calculate a second variable vector based on the preset variable and a second shared value of the first multiplication triple, calculate a first embedding representation based on a first encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix, and calculate a second embedding representation based on a second encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; wherein the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key stored in the server;

[0151] A first sending module 505 is configured to send the first variable vector, the second variable vector, the first embedded representation, and the second embedded representation to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, calculates a fourth embedded representation based on the third embedded representation and a third shared value in a second multiplication triplet stored on the server, decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculates a sixth embedded representation based on the fifth embedded representation and a fourth shared value in the second multiplication triplet, calculates a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculates an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculates a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet;

[0152] a second calculation module 506, configured to calculate a tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculate an eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculate a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculate an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation;

[0153] A second sending module 507 is configured to send the encrypted prediction score to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score, calculates a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sums the first prediction score and the second prediction score to obtain a third prediction score;

[0154] The malicious determination module 508 is configured to perform a malicious determination on the target software based on the third prediction score and the preset variables sent by the server to obtain a first determination result.

[0155] Optionally, the malicious determination module 508 includes:

[0156] a summing submodule, configured to sum the preset variable and the third prediction score sent by the server to obtain a fourth prediction score;

[0157] a first determination submodule, configured to determine, when the fourth prediction score is greater than or equal to a first threshold, that the first determination result of the target software is malware;

[0158] The second determining submodule is configured to determine that the first determination result is normal software when the fourth prediction score is less than or equal to a first threshold.

[0159] The malware detection device in the embodiments of the present application can be an electronic device or a component of an electronic device, such as an integrated circuit or chip. The electronic device can be a terminal or other device other than a terminal. For example, the electronic device can be a GPU box, a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. It can also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., and the embodiments of the present application do not specifically limit this.

[0160] The malware detection device in the embodiments of the present application may be a device having an operating system. The operating system may be an Android operating system, a Linux operating system, a Windows operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.

[0161] The malware detection device provided in the embodiment of the present application can achieve Figures 1 to 4 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0162] Reference Figure 6 , Figure 6A malware detection device provided in an embodiment of the present application is applied to a server. The malware detection device 600 includes:

[0163] A first generation module 601 is configured to generate a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix based on a target dynamic weight matrix and an encryption key, respectively, and send the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix to a client, so that the client calculates a first embedding representation based on the first encrypted dynamic weight matrix, preset variables, and a first adjacency matrix, and calculates a second embedding representation based on the second encrypted dynamic weight matrix, the preset variables, and the first adjacency matrix; wherein the first adjacency matrix is ​​generated based on the relative positions of each first sensitive application programming interface in the main function program segment of the target software; the first sensitive application programming interface is determined from the first application programming interface of the target software based on a string corresponding to a preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable; the first application programming interface is obtained by decompiling a software file of the sample software; and the first application programming interface includes at least one sub-function program segment;

[0164] The first decryption calculation module 602 is configured to decrypt the first embedded representation sent by the client based on the encryption key to obtain a third embedded representation, calculate a fourth embedded representation based on the third embedded representation and a third shared value in the second multiplication triplet stored by the server, decrypt the second embedded representation sent by the client based on the encryption key stored by the server to obtain a fifth embedded representation, calculate a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet, calculate a seventh embedded representation based on the first variable vector sent by the client and the fourth embedded representation, and calculate a seventh embedded representation based on the second variable vector sent by the client and the sixth embedded representation. an eighth embedding representation, calculating a ninth embedding representation based on the seventh embedding representation, the eighth embedding representation, and the second multiplication triplet; wherein the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the first variable vector is calculated based on the preset variables and a first shared value of the first multiplication triplet stored on the client; and the second variable vector is calculated based on the preset variables and a second shared value of the first multiplication triplet;

[0165] A first sending module 603 is configured to send the fourth embedding representation and the sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculates an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation;

[0166] a second decryption calculation module 604, configured to decrypt the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculate a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sum the first prediction score and the second prediction score to obtain a third prediction score;

[0167] The second sending module 605 is configured to send the third prediction score to the client, so that the client performs a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result.

[0168] Optionally, the second sending module 605 includes:

[0169] a sending submodule, configured to send the third prediction score to the client, so that the client sums the preset variable and the third prediction score sent by the server to obtain a fourth prediction score; and when the fourth prediction score is greater than or equal to a first threshold, determining that the first judgment result of the target software is malware; and when the fourth prediction score is less than or equal to the first threshold, determining that the first judgment result is normal software.

[0170] Optionally, the apparatus 600 further includes:

[0171] a decompile module, configured to decompile a software file of the sample software to obtain a first sample application programming interface of the sample software; wherein the first sample application programming interface includes at least one sub-function program segment;

[0172] a first determining module, configured to determine a first sample sensitive application programming interface from the first sample application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable;

[0173] a second generating module, configured to generate a first sample adjacency matrix of the first sample sensitive application programming interface based on the relative position of each of the first sample sensitive application programming interface in the main function program segment of the sample software;

[0174] an input / output module, configured to input the first sample adjacency matrix into a first graph neural network model, and obtain a sample prediction score of the sample software output by the first graph neural network model;

[0175] A second determination module is configured to determine a cross entropy loss value of the first graph neural network model based on the sample prediction score and the classification label of the sample software;

[0176] An adjustment module, configured to adjust model parameters of the first graph neural network model and first weight values ​​of each network layer of the first graph neural network model based on the cross entropy loss value to obtain a target graph neural network model;

[0177] The acquisition module is used to obtain the target weight value corresponding to each network layer in the target graph neural network model to obtain the target dynamic weight matrix.

[0178] Optionally, the first graph neural network model includes a multi-relation aggregation layer, a multi-layer heterogeneous graph convolution layer and a prediction layer, and the input and output module includes:

[0179] a first input-output submodule, configured to input the first sample adjacency matrix into the multi-relationship aggregation layer to perform weighted aggregation on the first sample adjacency matrix to obtain a second sample adjacency matrix output by the multi-relationship aggregation layer;

[0180] A second input-output submodule, configured to input the second sample adjacency matrix into the multi-layer heterogeneous graph convolutional layer to obtain a final embedded representation of the sample output by the multi-layer heterogeneous graph convolutional layer;

[0181] The third input-output submodule is used to input the final embedded representation of the sample into the prediction layer, and obtain the sample prediction score of the sample software output by the prediction layer.

[0182] The malware detection device in the embodiments of the present application can be an electronic device or a component of an electronic device, such as an integrated circuit or chip. The electronic device can be a terminal or other device other than a terminal. For example, the electronic device can be a GPU box, a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a mobile internet device (MID), an augmented reality (AR) / virtual reality (VR) device, a robot, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. It can also be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine, or a self-service machine, etc., and the embodiments of the present application do not specifically limit this.

[0183] The malware detection device in the embodiments of the present application may be a device having an operating system. The operating system may be an Android operating system, a Linux operating system, a Windows operating system, or other possible operating systems, which are not specifically limited in the embodiments of the present application.

[0184] The malware detection device provided in the embodiment of the present application can achieve Figures 1 to 3 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0185] The present application provides an electronic device. Figure 7 The electronic device 70 includes: a processor 701, a memory 702, and a computer program 7021 stored in the memory 702 and executable on the processor 701. When the processor 701 executes the program, the malware detection method of the aforementioned embodiment is implemented.

[0186] An embodiment of the present application further provides a computer-readable storage medium having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, the steps in the malware detection method disclosed in the embodiment of the present application are implemented.

[0187] The embodiment of the present application further provides a computer program product, which, when executed on an electronic device, enables a processor to implement the steps of the malware detection method disclosed in the embodiment of the present application.

[0188] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0189] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, apparatuses, electronic devices, and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0190] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0191] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0192] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0193] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "includes," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements that are inherent to such process, method, article, or terminal device. In the absence of further restrictions, an element defined by the phrase "comprises a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0194] The above is a detailed introduction to the malware detection method and device provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core ideas of the present application. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present application.

Claims

1. A malware detection method, characterized in that: Applied to a client, the method includes: Decompiling a software file of the target software to obtain a first application programming interface of the target software; wherein the first application programming interface includes at least one sub-function program segment; Determining a first sensitive application programming interface from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable; generating a first adjacency matrix of the first sensitive application programming interfaces based on relative positions of the first sensitive application programming interfaces in the main function program segment of the target software; Calculating a first variable vector based on a preset variable and a first shared value of a first multiplication triplet stored on the client; calculating a second variable vector based on the preset variable and a second shared value of the first multiplication triplet; calculating a first embedding representation based on a first encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; and calculating a second embedding representation based on a second encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; wherein the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key stored in the server; Sending the first variable vector, the second variable vector, the first embedded representation, and the second embedded representation to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, calculates a fourth embedded representation based on the third embedded representation and a third shared value in a second multiplication triplet stored on the server, decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculates a sixth embedded representation based on the fifth embedded representation and a fourth shared value in the second multiplication triplet, calculates a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculates an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculates a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet; Calculating a tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculating an eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculating a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculating an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation; Sending the encrypted prediction score to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score, calculating a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and summing the first prediction score and the second prediction score to obtain a third prediction score; Based on the third prediction score and the preset variables sent by the server, the target software is judged to be malicious to obtain a first judgment result.

2. The method according to claim 1, characterized in that The step of determining the target software to be malicious based on the third prediction score and the preset variable sent by the server to obtain a first determination result includes: Summing the preset variable and the third prediction score sent by the server to obtain a fourth prediction score; When the fourth prediction score is greater than or equal to the first threshold, determining that the first determination result of the target software is malware; When the fourth prediction score is less than or equal to the first threshold, the first determination result is determined to be normal software.

3. A malware detection method, characterized in that: Applied to the server, the method includes: Based on the target dynamic weight matrix and the encryption key, a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix are generated respectively, and the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are sent to the client, so that the client calculates a first embedding representation based on the first encrypted dynamic weight matrix, preset variables and the first adjacency matrix, and calculates a second embedding representation based on the second encrypted dynamic weight matrix, the preset variables and the first adjacency matrix; wherein the first adjacency matrix is ​​generated based on the relative position of each first sensitive application programming interface in the main function program segment of the target software; the first sensitive application programming interface is determined from the first application programming interface of the target software based on the character string corresponding to the preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable and a user asset data variable; the first application programming interface is obtained by decompiling the software file of the sample software; and the first application programming interface includes at least one sub-function program segment; Decrypting the first embedded representation sent by the client based on the encryption key to obtain a third embedded representation; calculating a fourth embedded representation based on the third embedded representation and a third shared value in the second multiplication triplet stored by the server; decrypting the second embedded representation sent by the client based on the encryption key stored by the server to obtain a fifth embedded representation; calculating a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet; calculating a seventh embedded representation based on the first variable vector sent by the client and the fourth embedded representation; and calculating an eighth embedded representation based on the second variable vector sent by the client and the sixth embedded representation. Calculating a ninth embedding representation based on the seventh embedding representation, the eighth embedding representation, and the second multiplication triplet; wherein the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the first variable vector is calculated based on the preset variables and a first shared value of the first multiplication triplet stored in the client; and the second variable vector is calculated based on the preset variables and a second shared value of the first multiplication triplet. Sending the fourth embedding representation and the sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculates an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation; decrypting the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculating a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and summing the first prediction score and the second prediction score to obtain a third prediction score; The third prediction score is sent to the client, so that the client performs a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result.

4. The method according to claim 3, characterized in that The sending the third prediction score to the client, so that the client performs a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result, includes: The third prediction score is sent to the client so that the client sums the preset variable and the third prediction score sent by the server to obtain a fourth prediction score. When the fourth prediction score is greater than or equal to the first threshold, the first determination result of the target software is determined to be malware. When the fourth prediction score is less than or equal to the first threshold, the first determination result is determined to be normal software.

5. The method according to claim 3, characterized in that The method further comprises: Decompiling the software file of the sample software to obtain a first sample application programming interface of the sample software; wherein the first sample application programming interface includes at least one sub-function program segment; Determining a first sample sensitive application programming interface from the first sample application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable; generating a first sample adjacency matrix of the first sample sensitive application programming interfaces based on relative positions of the first sample sensitive application programming interfaces in the main function program segment of the sample software; Inputting the first sample adjacency matrix into a first graph neural network model to obtain a sample prediction score of the sample software output by the first graph neural network model; Determining a cross entropy loss value of the first graph neural network model based on the sample prediction score and the classification label of the sample software; Based on the cross entropy loss value, adjust the model parameters of the first graph neural network model and the first weight values ​​of each network layer of the first graph neural network model to obtain a target graph neural network model; Obtain the target weight values ​​corresponding to each network layer in the target graph neural network model to obtain the target dynamic weight matrix.

6. The method according to claim 5, characterized in that The first graph neural network model includes a multi-relation aggregation layer, a multi-layer heterogeneous graph convolution layer, and a prediction layer. Inputting the first sample adjacency matrix and the first sample dynamic weight matrix into the first graph neural network model to obtain a sample prediction score of the sample software output by the first graph neural network model includes: Inputting the first sample adjacency matrix into the multiple relationship aggregation layer to perform weighted aggregation on the first sample adjacency matrix to obtain a second sample adjacency matrix output by the multiple relationship aggregation layer; Inputting the second sample adjacency matrix into the multi-layer heterogeneous graph convolution layer to obtain a final embedded representation of the sample output by the multi-layer heterogeneous graph convolution layer; The final embedding representation of the sample is input into the prediction layer to obtain the sample prediction score of the sample software output by the prediction layer.

7. A malware detection device, characterized in that: Applied to a client, the device includes: a decompile module, configured to decompile a software file of the target software to obtain a first application programming interface of the target software; wherein the first application programming interface includes at least one sub-function program segment; a determination module, configured to determine a first sensitive application programming interface from the first application programming interface based on a character string corresponding to a preset sensitive variable; wherein the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable; a generating module, configured to generate a first adjacency matrix of the first sensitive application programming interfaces based on the relative positions of the first sensitive application programming interfaces in the main function program segment of the target software; a first calculation module, configured to calculate a first variable vector based on a preset variable and a first shared value of a first multiplication triplet stored on the client, calculate a second variable vector based on the preset variable and a second shared value of the first multiplication triplet, calculate a first embedding representation based on a first encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix, and calculate a second embedding representation based on a second encrypted dynamic weight matrix sent by the server, the preset variable, and the first adjacency matrix; wherein the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix are generated based on a target dynamic weight matrix and an encryption key stored in the server; a first sending module, configured to send the first variable vector, the second variable vector, the first embedded representation, and the second embedded representation to the server, so that the server decrypts the first embedded representation based on the encryption key to obtain a third embedded representation, calculates a fourth embedded representation based on the third embedded representation and a third shared value in a second multiplication triplet stored on the server, decrypts the second embedded representation based on the encryption key to obtain a fifth embedded representation, calculates a sixth embedded representation based on the fifth embedded representation and a fourth shared value in the second multiplication triplet, calculates a seventh embedded representation based on the first variable vector and the fourth embedded representation, calculates an eighth embedded representation based on the second variable vector and the sixth embedded representation, and calculates a ninth embedded representation based on the seventh embedded representation, the eighth embedded representation, and the second multiplication triplet; a second calculation module, configured to calculate a tenth embedding representation based on the first variable vector and the fourth embedding representation sent by the server, calculate an eleventh embedding representation based on the second variable vector and the sixth embedding representation sent by the server, calculate a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculate an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation; a second sending module, configured to send the encrypted prediction score to the server, so that the server decrypts the encrypted prediction score based on the encryption key to obtain a first prediction score, calculates a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sums the first prediction score and the second prediction score to obtain a third prediction score; The malicious judgment module is used to perform malicious judgment on the target software based on the third prediction score sent by the server and the preset variable to obtain a first judgment result.

8. A malware detection device, characterized in that: Applied to the server, the device includes: A first generation module is configured to generate a first encrypted dynamic weight matrix and a second encrypted dynamic weight matrix based on a target dynamic weight matrix and an encryption key, and send the first encrypted dynamic weight matrix and the second encrypted dynamic weight matrix to a client, so that the client calculates a first embedding representation based on the first encrypted dynamic weight matrix, preset variables, and a first adjacency matrix, and calculates a second embedding representation based on the second encrypted dynamic weight matrix, the preset variables, and the first adjacency matrix; wherein the first adjacency matrix is ​​generated based on the relative position of each first sensitive application programming interface in a main function program segment of the target software; the first sensitive application programming interface is determined from the first application programming interface of the target software based on a string corresponding to a preset sensitive variable; the preset sensitive variable includes at least one of a user personal information variable, a sensitive data input device variable, and a user asset data variable; the first application programming interface is obtained by decompiling a software file of the sample software; and the first application programming interface includes at least one sub-function program segment; The first decryption calculation module is configured to decrypt the first embedded representation sent by the client based on the encryption key to obtain a third embedded representation, calculate a fourth embedded representation based on the third embedded representation and a third shared value in the second multiplication triplet stored by the server, decrypt the second embedded representation sent by the client based on the encryption key stored by the server to obtain a fifth embedded representation, calculate a sixth embedded representation based on the fifth embedded representation and the fourth shared value in the second multiplication triplet, calculate a seventh embedded representation based on the first variable vector sent by the client and the fourth embedded representation, and calculate a seventh embedded representation based on the second variable vector sent by the client and the sixth embedded representation. Eighth embedding representation, calculating a ninth embedding representation based on the seventh embedding representation, the eighth embedding representation, and the second multiplication triplet; wherein the first embedding representation is calculated in the client based on the first encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the second embedding representation is calculated in the client based on the second encrypted dynamic weight matrix sent by the server, the preset variables, and the first adjacency matrix; the first variable vector is calculated based on the preset variables and a first shared value of the first multiplication triplet stored in the client; and the second variable vector is calculated based on the preset variables and a second shared value of the first multiplication triplet; a first sending module, configured to send the fourth embedding representation and the sixth embedding representation to the client, so that the client calculates a tenth embedding representation based on the first variable vector and the fourth embedding representation, calculates an eleventh embedding representation based on the second variable vector and the sixth embedding representation, calculates a twelfth embedding representation based on the tenth embedding representation, the eleventh embedding representation, and the first multiplication triplet, and calculates an encrypted prediction score based on the preset variables, the encrypted dynamic weight matrix, and the twelfth embedding representation; a second decryption calculation module, configured to decrypt the encrypted prediction score sent by the client based on the encryption key to obtain a first prediction score, calculate a second prediction score based on the target dynamic weight matrix and the ninth embedding representation, and sum the first prediction score and the second prediction score to obtain a third prediction score; The second sending module is configured to send the third prediction score to the client, so that the client makes a malicious determination on the target software based on the third prediction score and the preset variable to obtain a first determination result.

Images