A method for detecting software that maliciously acquires computing resources based on big data

Abstract

This invention relates to big data processing technology, and particularly to a method for detecting software that maliciously acquires computing resources based on big data. The method includes: acquiring the executable file of the target software and constructing graph data from this data; filtering instruction segments from the graph data and extracting context features from the filtered instruction segments using a Transformer encoder; using the context features as initial features for nodes and a graph attention network to aggregate node features to obtain static features; acquiring the protocol fingerprint and traffic statistics features of the target software and extracting dynamic features from the acquired features using a bidirectional LSTM network; fusing the static and dynamic features through an attention mechanism, and inputting the fused features into a random forest classifier to detect whether the target software is maliciously acquiring computing resources. This invention comprehensively captures both static and dynamic behavioral features, overcoming the limitations of traditional single-feature detection.

Description

Technical Field

[0001] This invention relates to big data processing technology, and in particular to a method for detecting software that maliciously acquires computing resources based on big data. Background Technology

[0002] According to Gartner, in 2023, direct economic losses caused by software maliciously acquiring computing resources exceeded $32 billion globally, surpassing traditional ransomware to become the leading cyber threat. This type of software illegally intrudes into computer systems, hijacking computing resources to obtain cryptocurrency, leading to decreased system performance, increased energy consumption, and even hardware damage. Existing malware detection technologies face the following key challenges:

[0003] 1. Static features have poor generalization ability: Traditional methods rely on code hashing or rule matching, which are difficult to deal with variant samples and code obfuscation techniques;

[0004] 2. Inefficient dynamic analysis: Sandbox monitoring struggles to handle terabyte-level network traffic in real time, and its ability to parse encrypted traffic is insufficient;

[0005] 3. Insufficient graph modeling: Existing graph neural networks provide coarse modeling of the topological relationships of control flow graphs (CFG / FCG), failing to capture deep malicious logic;

[0006] 4. Weak defense: Lacks effective defense mechanisms against attacks such as traffic disturbances and command injection. Summary of the Invention

[0007] To address the problems existing in current technologies and achieve high-precision and high-efficiency threat detection, this invention proposes a method for detecting malicious software that acquires computing resources based on big data, specifically including the following steps:

[0008] Obtain the executable file of the target software, and use the basic blocks in the executable file as nodes and the call functions for task scheduling and communication management when acquiring computing resources as edges to construct graph data;

[0009] Nodes with a number of instructions and an in-degree greater than a set threshold are obtained from the graph data. From these nodes, instruction segments with significant differences in distribution between positive and negative samples are further filtered out. For example, a filtering module is trained using KL divergence to measure the difference. During training, this filtering module is used to filter instruction segments from the node's instruction segments whose KL divergence between the distribution in positive samples and the distribution in negative samples is greater than a set threshold. Here, positive samples are the graph data of malicious software, and negative samples are the graph data of normal software. The trained filtering module can filter out samples from the software to be detected that have significant differences from the positive and negative samples.

[0010] Contextual features are extracted from the filtered instruction segments using a Transformer encoder;

[0011] The dimensionality of the constructed graph data is reduced, and weights are assigned to different types of edges. Context features are used as the initial features of nodes, and the node features are aggregated through a graph attention network to obtain static features.

[0012] The protocol fingerprint and traffic statistics features of the target software are obtained, and dynamic features are extracted from the obtained features through a bidirectional LSTM network.

[0013] Static and dynamic features are concatenated and fused using an attention mechanism. The fused features are then input into a random forest classifier to detect whether the target software is maliciously acquiring computing resources.

[0014] This invention also proposes a system for detecting malicious software that acquires computing resources based on big data, and a method for implementing a method for detecting malicious software that acquires computing resources based on big data, comprising:

[0015] The data acquisition module is used to acquire the executable file, protocol fingerprint, and traffic statistics characteristics of the target software.

[0016] The graph data construction module is used to construct graph data using basic blocks in the executable file as nodes and call functions for task scheduling and communication management when acquiring computing resources as edges.

[0017] The key filtering module is used to obtain nodes from graph data whose instruction count and in-degree are greater than set thresholds. From these nodes, nodes whose divergence with positive samples is greater than a set threshold and whose divergence with negative samples is less than a set threshold are filtered out. Positive samples are graph data of malicious software, and negative samples are graph data of normal software.

[0018] The static feature extraction module first uses the Transformer encoder to extract context features from the selected nodes, then reduces the dimensionality of the constructed graph data and assigns weights to different types of edges. The context features are used as the initial features of the nodes, and the node features are aggregated through the graph attention network to obtain static features.

[0019] The dynamic feature extraction module is used to extract dynamic features from the protocol fingerprint and traffic statistics features of the target software using a bidirectional LSTM network.

[0020] The feature fusion module is used to combine static features with static features through an attention mechanism;

[0021] The classification module is used to input the fused features into a random forest classifier to detect whether the target software is maliciously acquiring computing resources.

[0022] The present invention also proposes a device for detecting malicious software that acquires computing resources based on big data. The device includes a memory and a processor, wherein the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement a method for detecting malicious software that acquires computing resources based on big data.

[0023] The present invention also proposes a detection device for detecting malicious software that acquires computing resources based on big data. The device includes a memory and a processor, wherein the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to realize a method for detecting malicious software that acquires computing resources based on big data.

[0024] The present invention also proposes a computer storage medium for a computer device, wherein the computer storage medium stores computer execution instructions, which, when executed by a processor, are used to implement a method for detecting malicious software that acquires computing resources based on big data.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. This invention uses a three-level embedding model—instruction-level, functional module-level, and program-level—to comprehensively capture the static and dynamic behavioral characteristics of malware, overcoming the limitations of traditional single-feature detection.

[0027] 2. This invention, based on statistical analysis and dynamic compression (such as CSR storage), solves the memory bottleneck of large-scale graph modeling (compatible with NVIDIA V100 32GB memory), improving computing efficiency by more than 30%.

[0028] 3. Key instruction segments are screened using KL divergence differences, and the sliding window algorithm is used to preserve encryption and mining pool communication characteristics, with an information density ≥0.85, significantly reducing noise interference;

[0029] 4. The model supports deployment in multiple architectures (x86 / 64) and multiple scenarios (cloud platform, terminal device), with a detection time of ≤1.5 seconds per sample. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating a method for detecting malicious software that acquires computing resources based on big data, according to an embodiment of the present invention.

[0031] Figure 2 This is a model architecture diagram of a method for detecting malicious software that acquires computing resources based on big data, according to the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] This invention proposes a method for detecting software that maliciously acquires computing resources based on big data, such as... Figures 1-2 Specifically, it includes the following steps:

[0034] Obtain the executable file of the target software, use a disassembler to extract the binary file, generate assembly code from it, analyze the assembly code to obtain code blocks and control flow information, then use the code blocks as nodes and the control flow information as edges to transform it into a graph structure to obtain graph data;

[0035] Nodes with a number of instructions and an in-degree greater than a set threshold are obtained from the graph data. A pre-trained filtering module is used to filter instruction segments from the nodes. During training, the filtering module filters samples with a KL divergence between positive and negative samples that is greater than a set threshold.

[0036] Contextual features are extracted from the filtered instruction segments using a Transformer encoder;

[0037] The dimensionality of the constructed graph data is reduced, and weights are assigned to different types of edges. Context features are used as the initial features of nodes, and the node features are aggregated through a graph attention network to obtain static features.

[0038] The protocol fingerprint and traffic statistics features of the target software are obtained, and dynamic features are extracted from the obtained features through a bidirectional LSTM network.

[0039] Static features are concatenated and fused using an attention mechanism. The fused features are then input into a random forest classifier to detect whether the target software is maliciously acquiring computing resources.

[0040] Specifically, the high-discrimination instructions of this invention, i.e., key instruction segments, include mining pool communication chains (e.g., the gethostbyname→connect→send instruction sequence) and instruction segments annotating encryption operations (e.g., matching AES / SHA3 and other encryption instructions through Opcodes). These are input into a Transformer encoder to obtain contextual features. In this invention, nodes with an instruction length greater than or equal to 20 and an in-degree greater than or equal to 3 are considered key nodes. When filtering instruction segments, a pre-trained filtering module is used to filter instruction segments from key nodes. As an optional implementation, when training the filtering module, the node feature instruction segments are mapped to the feature space, so that the features of the output sample points satisfy the positive sample node... The KL divergence between positive and negative sample nodes is greater than 0.47 and the instruction segment length is 20-100 (in this invention, positive sample nodes are graph data belonging to malicious software, and negative samples are graph data belonging to normal software). The pre-trained screening module can filter out instruction segments from the software to be detected that are similar to those that satisfy the feature of KL divergence between positive and negative sample nodes being greater than 0.47 and instruction segment length being 20-100. This application includes at least mining pool communication chains and instruction segments for annotated encryption operations. The context features obtained by the Transformer encoder have context awareness capabilities, enabling the model to distinguish the logical order between instructions. Moreover, in the subsequent static-dynamic feature fusion module, it helps to align dynamic and static features.

[0041] This embodiment describes the steps of a method for detecting malicious software that acquires computing resources based on big data from the perspective of model training. Figure 1 Specifically, it includes the following steps:

[0042] S1. Obtain the required positive and negative sample datasets from the Datacon series of competitions, and divide them into training and validation sets according to a preset ratio, including static code and dynamic behavior logs;

[0043] S2. Multimodal feature extraction is performed on the training set samples. The original static features include extracting the parsed program control flow graph (CFG / FCG), screening key nodes with dense instructions and complex structures, and further screening instruction segments with large differences in distribution between positive and negative samples from these nodes. The Transformer encoder extracts context features from the screened instruction segments and uses the context features as the initial features of the nodes. The node features are aggregated through a graph attention network to obtain static features. The original dynamic features include capturing mining pool protocol traffic (Stratum / XMRig protocol fingerprint) and network traffic statistical characteristics (screening network traffic with a small packet rate >70% and an uplink traffic ratio >60% as samples). The collected raw data is processed through a bidirectional LSTM network to extract dynamic features from the acquired features.

[0044] S3. Construct a multimodal graph embedding model: Construct a joint encoding model of instruction-level Transformer and graph attention network (GAT). Specifically, in this embodiment, static features and dynamic features are fused using an attention mechanism.

[0045] S4. The fused features are input into a random forest classifier to detect whether the target software is maliciously acquiring computing resources.

[0046] As an optional implementation, in this embodiment, when selecting static and dynamic data, the official datasets from DataCon2020 and DataCon2022 are input into the processing pipeline, and the following operations are performed:

[0047] 1. Static data selection: The Windows PE format sample set released at DataCon2020 will be used as the selection pool. Data that meets the following criteria will be selected from this pool:

[0048] File type: Standard PE32 / PE32+ executable file (extensions .exe, dll, sys); Tag label: Officially marked as "malware" (mining_malware tag);

[0049] The static sample set obtained through screening is represented as:

[0050] S static ={s i |label(s i ) = mining m alware}

[0051] Among them, S static Let s represent a static sample set. i To represent a static sample, label(s) i ) represents the label of a static sample.

[0052] 2. Dynamic data selection: The pcap format network traffic logs released at DataCon2022 will be used as the selection pool to select data that meets the following criteria:

[0053] Protocol type: Contains mining pool protocol traffic (in this embodiment, traffic from Stratum protocol port 3333 or XMRig protocol port 4244 can be selected);

[0054] Traffic statistics: Small packet rate (64-256 byte data packets account for ≥70%);

[0055] The resulting dynamic sample set is represented as:

[0056] D dyamic ={dj |proto(d j )∈{3333,4244}}

[0057] Among them, D dynamic Denotes the static and dynamic sample sets, d j Denotes a dynamic sample, proto(d) j ) indicates the port to which the dynamic sample belongs.

[0058] During training, the detection model of this invention divides the overall number of positive and negative samples in a 7:3 ratio, i.e., positive samples |M malware |: Negative samples|N non-malware If | = 7:3, in a training set, if the number of positive samples is P = | M malware If |×0.7, then the number of negative samples N=P×(2.5±0.3).

[0059] In this invention, during static feature extraction, the PE file is input into the reverse analysis engine and processed according to the following steps:

[0060] 1. Reverse analyze the executable file and use IDA Pro 7.7 disassembler to generate a control flow graph (CFG). In the graph, the attributes of the nodes must include at least the number of basic block instructions L, in-degree D_in, and out-degree D_out. Then call the function to calculate the edge relationship between the nodes.

[0061] 2. Select key nodes, that is, nodes with instruction number L≥20 and in-degree D_in≥3 are selected as key nodes. The set of key nodes is represented as K_nodes={nk|key_node(nk)=1}, where nk represents a node in the control flow graph (CFG) and key_node(nk) represents a Boolean function to determine whether node nk is a key node.

[0062] 3. Select instruction segments with high discrimination. First, calculate the distribution P of each instruction segment in the positive sample. positive With the probability distribution P in the negative sample negative Then calculate P positive With P negative KL divergence between:

[0063] D KL (P positive ||P negative )

[0064] In this invention, instruction segments with a KL divergence greater than 0.47 are selected, meaning that the distribution of these instruction segments differs significantly between positive and negative samples.

[0065] 4. Compressed graph structure, including the following three compression cases:

[0066] A. When the number of nodes in the graph data is greater than a set threshold (for example, in this embodiment, it is set to be greater than 700), nodes with an in-degree less than the set threshold are pruned.

[0067] B. Convert the adjacency matrix to CSR sparse format;

[0068] C. Compression ratio verification: Compression ratio = 1 - number of non-zero elements / N^2 > 0.8.

[0069] This invention processes dynamic feature extraction according to the following steps:

[0070] 1. Capture the protocol fingerprint by entering the following command in the command line:

[0071] A: tshark -r traffic.pcap -Y "tcp.port==3333&&json.value.method=="mining.submit"

[0072] B: T json-e json.value.params

[0073] Obtain the Stratum protocol parameters (wallet address, computing power value);

[0074] Extract encryption features and calculate the JA3 fingerprint: JA3 = MD5(TLS version + cipher suite + extended list); anonymize the SNI field: SNI_anon = SHA256(raw SNI)[0:16].

[0075] 2. Analyze traffic statistics characteristics. When the following conditions are met, the characteristic is used as the traffic statistics characteristic of the node, including:

[0076] A: Calculate the small packet rate: Small packet rate = ∑(I(64<packet length<=256)) / total number of packets. When the small packet rate is greater than 0.7, the small packet rate is used as one of the traffic statistics characteristics of the node.

[0077] B: Detect the heartbeat packet period, that is, perform FFT transformation to locate the main peak of the spectrum: f_peak∈[0.015,0.017]Hz (corresponding to a period of 58.8~66.7 seconds). That is, when the main peak of the spectrum belongs to [0.015,0.017]Hz, the heartbeat packet period is used as one of the flow statistics characteristics of the node.

[0078] C: Uplink traffic percentage: Uplink percentage = Uplink bytes / Total bytes. When the uplink traffic percentage is greater than 0.6, the uplink traffic percentage is used as one of the node's traffic statistics characteristics.

[0079] The small packet rate, detection heartbeat packet cycle, and uplink traffic ratio of the target software are concatenated together as traffic statistics features. If a feature does not meet the above conditions, it is filled with 0.

[0080] The filtered instruction segment is input into the Transformer encoder to obtain the context-aware semantic vector H. inst Specifically, the filtered instruction segments are input into the Transformer encoder and processed according to the following steps:

[0081] 1. Input preprocessing, including: filtered instruction segments X = [x1, x2, ..., x... L (Length L∈[20,100]); Perform word embedding mapping on the instruction segment, E=Embedding(X)∈R L×256 Embedding() represents word embedding mapping operation; the vocabulary size is set to 2000, covering x86 / 64 instruction sets and common API calls.

[0082] 2. Perform relative position encoding. The encoding process is represented as follows:

[0083] PE (pos,2i) =sin(pos / 10000) 2i / d ),PE (pos,2i+1) =cos(pos / 10000) 2i+1 / d )

[0084] Among them, PE (pos,2i) PE (pos,2i+1) This indicates the encoded position when pos is odd or even, where pos represents the instruction position and d represents the vector dimension.

[0085] The positional encoding and the embedding vector are fused by addition, i.e., E' = E + PE.

[0086] 3. Transformer encoding: This embodiment uses a 12-layer Transformer network with 12 attention heads (64 dimensions per head). The feedforward network has a dimension of 3072 (using the GeLU activation function). The Transformer network outputs a context vector H. inst ∈R L×256 ;

[0087] 4. As an optional approach, the position encoding is expected to calculate the error tolerance cosine similarity ≥ 0.99 (aligned with the original sequence), and updating the parameters of the first 6 layers is prohibited during the fine-tuning stage (to prevent overfitting).

[0088] Specifically, as an optional implementation, in this embodiment, the Transformer encoder uses CodeBERT as the base model. During training, a temporary fully connected layer is added after the CodeBERT output layer to transfer the context vector H. inst The mapping is divided into two categories: positive and negative samples. The Transformer encoder is trained using the cross-entropy loss of the classification results. After training, the fully connected layers are removed. The context vector H extracted by the trained Transformer encoder is then obtained. inst Compared to the context vector H extracted by training the Transformer encoder using a general method inst Compared to other methods, it exhibits superior performance in subsequent classification tasks.

[0089] The constructed graph data is input into the heterogeneous graph attention network, and the context vector H of each node is... inst Using this node as the initial feature, the nodes in the graph structure are updated to obtain the node embedding matrix H. graph Please follow these steps:

[0090] 1. In this embodiment, the edge weights of nodes include three types, each with different edge weights, including:

[0091] A: Control flow jump. When there is a jmp / call instruction between nodes, the edge relationship exists, and the edge weight is 0.6.

[0092] B: Data dependency. When there is register or memory read / write between nodes, this edge relationship exists, and when this edge relationship exists, the edge weight is 0.3.

[0093] C: Exception handling. When there is an associated try / catch or interruption handling logic between nodes, this edge relationship exists, and the edge weight is 0.1.

[0094] 2. The node update process in a heterogeneous graph attention network is represented as follows:

[0095]

[0096] in, Let represent the embedding representation of the i-th node at the output of the (l+1)-th layer of the heterogeneous graph attention network; σ(·) represents the activation function. Let represent the set of neighboring nodes of type e that are related to the i-th node; Let e ​​represent the weight matrix of the l-th layer of the heterogeneous graph attention network; w represents the embedding representation of the j-th node in the output of the l-th layer of a heterogeneous graph attention network. eThis represents the edge weight of type e. When e is a control flow jump, its value is 0.6; when e is a data dependency, its value is 0.3; and when e is exception handling, its value is 0.1. h represents the learnable parameters in the attention mechanism for edge type e. i h represents the embedding vector of node i; k The embedding vector of node i's neighbor node k;

[0097] During the graph node update process, the edge weights of each node are normalized, that is, let Additionally, if the number of nodes exceeds 700, truncate nodes with low in-degree, for example, remove nodes with an in-degree less than 2.

[0098] Input the static code vector and dynamic flow vector into the fusion module and process them according to the following steps:

[0099] 1. Dynamic traffic timing coding involves inputting traffic statistics features, such as small packet rate, heartbeat cycle, and uplink ratio, into a bidirectional LSTM network for encoding. In this embodiment, the bidirectional LSTM network uses a 128-dimensional hidden layer and a time step of 50. The feature vector output by the bidirectional LSTM network is represented as follows:

[0100]

[0101] Among them, H flow This represents the feature vector obtained by encoding traffic statistics features through a bidirectional LSTM network; X flow This represents the traffic statistics characteristics consisting of small packet rate, heartbeat cycle, and uplink percentage; BiLSTM(·) represents a bidirectional LSTM network.

[0102] 2. Feature vector alignment via multi-head attention, specifically including:

[0103] Projecting the feature vectors yields the query vector, key vector, and value vector in the attention mechanism, i.e.:

[0104] Q = H flow W Q K = H graph W K V=H graph W V

[0105] Among them, W Q W K W V These are the projection matrices of the query vector, key vector, and value vector, respectively, H. graph Indicates dynamic characteristics;

[0106] Perform attention calculations, that is:

[0107]

[0108] Here, Attention(Q,K,V) represents the output of an attention head. In this embodiment, four attention heads are used, and the outputs of all attention heads are concatenated together to obtain the attention vector H. attn ∈R L×64 .

[0109] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting software that maliciously acquires computing resources based on big data, characterized in that, Specifically, the following steps are included: Obtain the executable file of the target software, use a disassembler to extract the binary file, generate assembly code from it, analyze the assembly code to obtain code blocks and control flow information, then use the code blocks as nodes and the control flow information as edges to transform it into a graph structure to obtain graph data; Nodes with both the number of instructions and the in-degree greater than a set threshold are obtained from the graph data. A pre-trained filtering module is used to filter instruction segments from the nodes. During training, the filtering module filters samples whose KL divergence between positive and negative samples is greater than a set threshold. Contextual features are extracted from the filtered instruction segments using a Transformer encoder; The dimensionality of the constructed graph data is reduced, and weights are assigned to different types of edges. Contextual features are used as the initial features of nodes, and the node features are aggregated through a graph attention network to obtain static features. The aggregation process in the l-th layer of the graph attention network is represented as follows: in, This represents the feature obtained by aggregating the i-th node through the l-th layer of the graph attention network; E represents the activation function; E represents the set of edge relation types, E= , This represents the set of neighboring nodes that have an edge relationship of type e with the i-th node; The features obtained after aggregation at layer l-1 of the neighbor node graph attention network for the j-th node are represented. This represents the learnable weight matrix of the (l-1)th layer of the graph attention network for edge type e; Attention weights between the i-th node and the j-th node based on edge type Represented as: in, This represents the edge weight of type 'e', ​​which occurs when a jmp / call instruction exists, i.e., an edge of control flow jump type exists. The value is 0.6; when there are register or memory read / write operations between nodes, i.e., there are data-dependent edges, The value is 0.3; when a node is associated with try / catch or interrupt handling logic, i.e., there is an edge relationship for exception handling, It is 0.1; Represents the learnable edge weights of type e; This represents the concatenation of two feature vectors; This represents the feature of the current i-th node. This represents the feature of the current k-th node; The protocol fingerprint and traffic statistics features of the target software are obtained, and dynamic features are extracted from the obtained features through a bidirectional LSTM network. Static features are concatenated and fused using an attention mechanism. The fused features are then input into a random forest classifier to detect whether the target software is maliciously acquiring computing resources.

2. The method according to claim 1, characterized in that, When retrieving nodes from graph data whose instruction count and in-degree are both greater than a set threshold, select nodes with an instruction count greater than or equal to 20 and an in-degree greater than or equal to 3.

3. The method according to claim 1, characterized in that, Dimensionality reduction of the constructed graph data includes: determining the number of nodes in the graph data; if the number of nodes is greater than 700, then performing sparse adjacency matrix compression.

4. The method according to claim 1, characterized in that, When acquiring the traffic statistics features of the target software, the feature is included as one of the traffic statistics features of the target software only if the small packet rate of the target software is greater than 70%, the feature is included as one of the traffic statistics features of the target software only if the main peak of the detected heartbeat packet period spectrum belongs to the specified frequency band, and the feature is included as one of the traffic statistics features only if the uplink traffic ratio is greater than 60%.

5. The method according to claim 1, characterized in that, A multi-head attention mechanism is used to fuse static and dynamic features, specifically including: Dynamic features are mapped to query vectors using a mapping matrix, while static features are mapped to key vectors and value vectors using the same mapping matrix. Attention weights are calculated using the query vector, key vector, and value vector of each single head; After concatenating all the single-head attention weights together, a linear transformation is performed to obtain the fused features.

6. A system for detecting software that maliciously acquires computing resources based on big data, characterized in that, A method for detecting malicious acquisition of computing resources based on big data, as described in claim 1, includes: The data acquisition module is used to acquire the executable file, protocol fingerprint, and traffic statistics characteristics of the target software. The graph data construction module is used to construct graph data using basic blocks in the executable file as nodes and call functions for task scheduling and communication management when acquiring computing resources as edges. The key filtering module is used to extract nodes from graph data whose number of instructions and in-degree are greater than set thresholds, calculate the KL divergence between the distribution of each instruction segment in positive samples and the distribution in negative samples, and select instruction segments whose KL divergence is greater than set thresholds. Positive samples are graph data of malicious software, and negative samples are graph data of normal software. The static feature extraction module first uses the Transformer encoder to extract context features from the selected instruction segments, then reduces the dimensionality of the constructed graph data, assigns weights to different types of edges, uses the context features as the initial features of the nodes, and aggregates the node features through the graph attention network to obtain static features. The dynamic feature extraction module is used to extract dynamic features from the protocol fingerprint and traffic statistics features of the target software using a bidirectional LSTM network. The feature fusion module is used to combine dynamic and static features through an attention mechanism. The classification module is used to input the fused features into a random forest classifier to detect whether the target software is maliciously acquiring computing resources.

7. A device for detecting software that maliciously acquires computing resources based on big data, characterized in that, The device includes a memory and a processor, wherein the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method for detecting malicious software that obtains computing resources based on big data as described in any one of claims 1 to 5.

Images