Malicious software detection method and system based on dynamic behavior analysis and terminal

Abstract

The invention discloses a malicious software detection method and system based on dynamic behavior analysis and a terminal, and the method comprises the steps: obtaining a target API call sequence, enhancing an advanced strategy according to retrieval, generating a target text description, inputting the target text description into a target language model, and obtaining a semantic embedding vector; generating an undirected graph according to the target API call sequence, calculating the weight of the edge of the undirected graph according to the semantic embedding vector, and obtaining a function call graph; performing score calculation on the function call graph according to a target sub-graph cutting algorithm to obtain a plurality of score results, and constructing a target sub-graph according to all the score results; and inputting the target sub-graphs into a classification network for classification to obtain the malicious probability of each piece of software. According to the method, through undirected graph and semantic processing, accurate malicious software detection can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a malware detection method and system based on dynamic behavior analysis, a terminal and a computer readable storage medium. BACKGROUND

[0002] Network has become an indispensable infrastructure for social operation. However, at the same time, the number and varieties of malware are also growing explosively. Malware attackers constantly adopt advanced evasion techniques such as code obfuscation, shell, encryption, etc., so that the traditional, signature-based static detection method is more and more difficult to cope with unknown, rapidly mutating malware.

[0003] Dynamic analysis technology monitors and records the behavior of a suspicious program in real time by executing it in a controlled environment such as a sandbox. Among them, through the recorded API call sequence, the interaction logic between the program and the underlying operating system can be accurately reflected, so the API call sequence is a key feature to reveal its true intention and malicious behavior. Most of the current malware detection methods use API call sequences to achieve corresponding detection.

[0004] However, at present, when performing malware detection, there is a lack of API semantic information mining, the relationship between API calls is not accurately described, and the current graph analysis method may damage the key attack logic, resulting in that the current malware detection cannot be accurately performed.

[0005] Therefore, the prior art still needs to be improved and developed. SUMMARY

[0006] The main purpose of the present application is to provide a malware detection method and system based on dynamic behavior analysis, a terminal and a computer readable storage medium, which aims to solve the problem in the prior art that when performing malware detection, there is a lack of API semantic information mining, the relationship between API calls is not accurately described, and the current graph analysis method may damage the key attack logic, resulting in that the current malware detection cannot be accurately performed.

[0007] To achieve the above-mentioned purpose, the present application provides a malware detection method based on dynamic behavior analysis, which comprises the following steps:

[0008] Obtain a target API call sequence, and generate a target text description according to a search-enhanced advanced strategy, input the target text description into a target language model, and obtain a semantic embedding vector;

[0009] According to the target API call sequence, a directed graph is generated, the weights of edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0010] According to a target subgraph pruning algorithm, score calculation is performed on the function call graph, a plurality of score results are obtained, and a target subgraph is constructed according to all score results;

[0011] The target subgraph is input into a classification network for classification, and a malicious probability of each software is obtained.

[0012] Optionally, the target API call sequence is obtained, and a target text description is generated according to a retrieval enhancement advanced strategy, the target text description is input into a target language model, and a semantic embedding vector is obtained, specifically including:

[0013] The target API call sequence is obtained, and an index, retrieval and answer generation operation is performed on the target API call sequence according to the retrieval enhancement advanced strategy, and a target text description is generated;

[0014] The target text description is input into a pre-trained target language model, and a semantic embedding vector is obtained.

[0015] Optionally, according to the target API call sequence, a directed graph is generated, the weights of edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained, specifically including:

[0016] The API call sequence is converted into the directed graph;

[0017] According to a sliding window, the weights of edges of the directed graph are calculated, and the function call graph is generated according to the weights and the directed graph.

[0018] Optionally, the weights of edges of the directed graph are calculated according to a sliding window, specifically including:

[0019] According to the sliding window, the number of times each edge appears in all windows is obtained;

[0020] According to the sum of the number of times each edge appears and a preset scaling factor, the weights of edges of the directed graph are calculated.

[0021] Optionally, according to a target subgraph pruning algorithm, score calculation is performed on the function call graph, a plurality of score results are obtained, and a target subgraph is constructed according to all score results, specifically including:

[0022] According to a target subgraph pruning algorithm, the importance score of each node in the function call graph is calculated;

[0023] Retain the first preset number of nodes with the highest importance scores in all nodes to obtain first target nodes, and select second target nodes from the nodes with the lowest importance scores in all nodes;

[0024] According to the first target nodes and the second target nodes, a target subgraph is constructed.

[0025] Optionally, the target subgraph is input into a classification network for classification to obtain a malicious probability of each software, specifically including:

[0026] The target subgraph is input into the classification network for attention calculation, weight normalization and information aggregation, and multi-head attention processing to obtain a graph-level representation.

[0027] The graph-level representation is input into a full connection layer and a Softmax layer in the classification network to obtain a malicious probability of each software.

[0028] Optionally, the target subgraph is input into the classification network for attention calculation, weight normalization and information aggregation, and multi-head attention processing to obtain a graph-level representation, specifically including:

[0029] The target subgraph is input into the classification network, and a linear transformation matrix, an attention function and a nonlinear activation function are used for attention calculation on each pair of connected nodes of the target subgraph to obtain importance coefficients of all neighbor nodes.

[0030] According to a Softmax function, the importance coefficients of the neighbor nodes of each node are weight-normalized and information-aggregated to obtain a feature representation.

[0031] Each feature is subjected to multi-head attention processing to obtain a graph-level representation.

[0032] In addition, to achieve the above object, the application further provides a malware detection system based on dynamic behavior analysis, wherein the malware detection system based on dynamic behavior analysis comprises:

[0033] An API embedding module is configured to obtain a target API call sequence, generate a target text description according to a search-enhanced advanced strategy, input the target text description into a target language model, and obtain a semantic embedding vector.

[0034] A graph generation module is configured to generate a directed graph according to the target API call sequence, calculate the weight of the edges of the directed graph according to the semantic embedding vector, and obtain a function call graph.

[0035] The graph enhancement module is used to calculate the score of the function call graph according to the target subgraph pruning algorithm, obtain multiple score results, and construct the target subgraph based on all score results;

[0036] The graph neural network classification module is used to input the target subgraph into the classification network for classification to obtain the malicious probability of each software.

[0037] Furthermore, to achieve the above objectives, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a malware detection program based on dynamic behavior analysis stored in the memory and executable on the processor, wherein when the malware detection program based on dynamic behavior analysis is executed by the processor, it implements the steps of the malware detection method based on dynamic behavior analysis as described above.

[0038] Furthermore, to achieve the above objectives, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a malware detection program based on dynamic behavior analysis, and the malware detection program based on dynamic behavior analysis, when executed by a processor, implements the steps of the malware detection method based on dynamic behavior analysis as described above.

[0039] In this invention, a target API call sequence is obtained, and a target text description is generated based on advanced retrieval enhancement strategies. This target text description is then input into a target language model to obtain a semantic embedding vector. An undirected graph is generated based on the target API call sequence, and the edge weights of the undirected graph are calculated using the semantic embedding vector to obtain a function call graph. The function call graph is scored using a target subgraph pruning algorithm to obtain multiple score results, and a target subgraph is constructed based on all score results. The target subgraph is then input into a classification network for classification to obtain the malicious probability of each piece of software. This invention combines the deep semantic understanding capabilities of large-scale language models with the complex structural representation capabilities of graph neural networks. Instead of treating API calls as isolated symbols, it transforms the dynamic behavior of malware into a graph classification problem by constructing an API function call graph. This allows for a more comprehensive capture and analysis of its behavioral patterns, leading to accurate malware detection results. Attached Figure Description

[0040] Figure 1 This is a flowchart of a preferred embodiment of the malware detection method based on dynamic behavior analysis of the present invention;

[0041] Figure 2 This is a schematic diagram of the overall architecture in a preferred embodiment of the malware detection method based on dynamic behavior analysis of the present invention;

[0042] Figure 3is a workflow diagram of a RAG enhanced API embedding module in an embodiment of the malware detection method based on dynamic behavior analysis of the present application;

[0043] Figure 4 is a classification performance visualization diagram on two datasets in an embodiment of the malware detection method based on dynamic behavior analysis of the present application;

[0044] Figure 5 is a curve diagram of the change of classification accuracy with λ in an embodiment of the malware detection method based on dynamic behavior analysis of the present application;

[0045] Figure 6 is a structure diagram of a preferred embodiment of the malware detection system based on dynamic behavior analysis of the present application;

[0046] Figure 7 is a structure diagram of a preferred embodiment of the terminal of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the present application more clear and definite, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and do not limit the present application.

[0048] With the rapid development of information technology, the network has become an indispensable infrastructure for social operation. However, at the same time, the number and variety of malicious software (Malware) also show an explosive growth, which poses a serious threat to personal privacy and enterprise data. Malware attackers constantly use advanced evasion techniques such as code obfuscation, shell, encryption, etc., making it more and more difficult for traditional, signature-based static detection methods to cope with unknown, rapidly mutating malware.

[0049] In order to cope with this challenge, dynamic analysis technology has emerged. This technology executes suspicious programs in a controlled environment such as a sandbox, monitors and records their behavior in real time during running, such as file operations, registry modifications, network communications and calls to operating system application programming interfaces (APIs). Among them, the API call sequence can accurately reflect the interaction logic between the program and the underlying operating system, and is the key feature to reveal its true intention and malicious behavior. Therefore, how to efficiently and accurately analyze the API call sequence has become the core of the research in the field of modern malware detection.

[0050] The existing main malware detection methods mainly include the following three kinds: 1 based on dynamic behavior analysis: this kind of method will API call sequence generated in the execution process of malware as a kind of time series data or natural language text, utilize long short-term memory network (LSTM), gated recurrent unit (GRU) and other recurrent neural network (RNN) or one-dimensional convolutional neural network (1D-CNN) to learn the time sequence dependence and local mode in API sequence, for example, map each API name to an embedding vector, then input the whole vector sequence into the model, distinguish between malicious and benign behavior by learning sequence features. Semantic modeling based on Transformer, in order to overcome the deficiency of traditional RNN in capturing long distance dependence, the Transformer model based on self-attention mechanism is introduced. This model can process all API calls in the sequence in parallel, and by calculating the association weight of each API with all other APIs in the sequence, it can more effectively capture global context information and learn more complex behavior patterns. Behavior modeling based on graph structure, in order to better represent the complex and nonlinear calling relationship between APIs, the API call sequence is converted into graph structure data, such as function call graph (FCG), in this graph, each unique API call is regarded as a node, while the calling order, co-occurrence relationship or control flow relationship between APIs is defined as the edge connecting the nodes, then, graph convolution network (GCN), graph attention network (GAT) and other graph neural network (GNN) techniques are used to learn the graph, GNN can simultaneously aggregate the feature information of the nodes and the topological structure information of the graph, thereby learning more rich behavior representation than linear sequence, which is used for the final malware classification.

[0051] Although the above methods have made certain progress in malware detection, they still face common challenges and inherent limitations in practical applications, which limit the further improvement of detection performance. The main aspects are as follows: API semantic information mining is insufficient. Both sequence models and graph models usually treat APIs (such as CreateFileW) as an abstract, meaningless symbol or token. Even if pre-trained word embeddings are used, it is difficult to capture the complete semantics of an API call, including its specific function, the meaning of key parameters, typical return values, and specific use in malicious scenarios. This shallow semantic representation makes it difficult for the model to truly "understand" the nature of API behavior, limiting the depth and accuracy of feature extraction. Bottlenecks in behavior pattern representation and processing efficiency. Sequence-based models (LSTM, CNN) have inherent limitations in representation ability. They are difficult to effectively depict complex, non-parallel dependency relationships between API calls, and are prone to losing key information when processing ultra-long API sequences. While the Transformer model has stronger representation ability, its self-attention mechanism has a computational complexity proportional to the square of the sequence length, making the computational overhead and memory consumption extremely large when processing thousands of API calls, making it unsuitable for large-scale, high-time efficiency detection tasks.

[0052] The inherent defects of current graph analysis methods, although the graph structure provides a more optimal paradigm for representing complex relationships, there are still two main problems with existing graph-based methods. First, the quality of node features is not high, which is essentially a manifestation of the aforementioned "insufficient semantic information mining" problem in graph methods. Low-quality node features directly limit the performance ceiling of GNN models. Second, the blindness of graph data augmentation strategies. To alleviate data sparsity and overfitting, existing methods often use general augmentation strategies such as randomly dropping nodes (DropNode) or edges (DropEdge). However, this "one-size-fits-all" random deletion does not consider the importance of API nodes in the malicious behavior chain, and is likely to disrupt critical attack logic (e.g., deleting the key connection between file creation and writing), leading to distorted augmented data that may even contradict the malicious label of the original sample, and negatively affecting model training.

[0053] That is, there is a lack of API semantic information mining in current malware detection, the relationship between API calls is not accurately described, and the current graph analysis method may disrupt the critical attack logic, making it impossible to accurately detect malware.

[0054] To solve one or more of the above problems, the application obtains a target API call sequence, generates a target text description according to a search-enhanced advanced strategy, inputs the target text description into a target language model to obtain a semantic embedding vector, generates an undirected graph according to the target API call sequence, calculates the weight of the edges of the undirected graph according to the semantic embedding vector, and obtains a function call graph, performs score calculation on the function call graph according to a target subgraph pruning algorithm to obtain a plurality of score results, and constructs a target subgraph according to all the score results. The target subgraph is input into a classification network for classification to obtain the malicious probability of each software.

[0055] The malicious software detection method based on dynamic behavior analysis according to the preferred embodiment of the application, as shown in Figure 1 and Figure 2 The malicious software detection method based on dynamic behavior analysis includes the following steps:

[0056] Step S10, obtaining a target API call sequence, and generating a target text description according to a search-enhanced advanced strategy, inputting the target text description into a target language model to obtain a semantic embedding vector.

[0057] It should be noted that the application is not satisfied with the API name itself, but uses the powerful generation and reasoning ability of a large language model (GPT-4) to generate rich, accurate and malicious software analysis-oriented text descriptions for each API. Specifically, through rigorous prompt engineering (Prompt Engineering) and CoT methodology, GPT-4 is guided to search and reference the authoritative Windows API official document knowledge base, thereby generating detailed descriptions containing the main functions, key parameters, return values and (most importantly) common exploitation methods in malicious software of the API. These high-quality description texts are then converted into high-dimensional semantic embedding vectors by the BERT model as the initial features of the graph nodes, realizing unprecedented depth mining of API semantics.

[0058] In addition, before obtaining the target API call sequence in the application, a dynamic analysis tool such as Cuckoo sandbox is used to execute the software sample to be detected, capture the API call sequence during its runtime, and construct an API vocabulary based on this.

[0059] Further, the obtaining of the target API call sequence and the generation of the target text description according to the search-enhanced advanced strategy, the inputting of the target text description into the target language model to obtain the semantic embedding vector, specifically includes:

[0060] An API call sequence is obtained, and a retrieval-augmented generation (RAG) strategy is used to index, retrieve, and answer generation operations on the target API call sequence to generate a target text description.

[0061] The target text description is input into a pre-trained target language model to obtain a semantic embedding vector.

[0062] Specifically, in the present application, a retrieval-augmented generation (RAG) strategy is used to generate detailed semantic description texts for each API by GPT-4, and a pre-trained BERT model is used to convert them into high-dimensional semantic embedding vectors. The purpose is to generate high-quality, semantically rich feature vectors for each API call. Traditional methods only use API names as discrete symbols and cannot capture their complex functions and malicious potential. To solve this problem, the present application adopts an advanced strategy that combines large language models and retrieval-augmented generation (RAG).

[0063] The retrieval-augmented advanced strategy process includes three core steps, as shown in Figure 3 Indexing (Indexing), first, based on the official Windows API documentation of Microsoft, an authoritative and structured knowledge base is constructed. Then, the contents in the knowledge base are indexed for fast retrieval; Retrieval (Retrieval): For each unique API call in the vocabulary, the system retrieves the most relevant document fragments from the indexed knowledge base. These fragments contain the official definition, parameter description, and other authoritative information of the API; Augment Answer Generation (Augment Answer Generation): The retrieved document fragments and API names are integrated into a pre-designed prompt (Prompt) and input into the GPT-4 model. The prompt uses the Chain-of-Thought (CoT) methodology to explicitly guide GPT-4 to play the role of a "Windows malware analysis assistant" and instruct it to use the retrieved context and its own knowledge to generate a comprehensive API description. This description not only covers the main functions, key parameters, and typical return values of the API, but more importantly, it specifically describes how the API is usually exploited in malware.

[0064] Through this RAG strategy, the generated text description is not only accurate and authoritative, but also highly consistent with the specific needs of malware analysis. Finally, the target text description generated for each API is input into a pre-trained BERT model, i.e., a target language model. The embedding vector corresponding to the [CLS] token in the last hidden state of BERT is extracted as the final high-dimensional semantic representation of the API, i.e., the semantic embedding vector. This vector condenses all the semantic information of the API, providing high-quality node features for subsequent graph construction.

[0065] Step S20, according to the target API call sequence, generate an undirected graph, calculate the weight of the edge of the undirected graph according to the semantic embedding vector, and obtain a function call graph.

[0066] It should be noted that the present application designs an intelligent subgraph clipping algorithm based on node importance, which is used to enhance the graph learning method. In view of the blindness of the existing data enhancement method, the present application proposes an intelligent subgraph clipping algorithm. The algorithm first calculates the importance score of each API node in the graph by using personalized page rank (Personalized PageRank) and other methods, and then retains the core nodes and their connections that can best represent the malicious behavior mode according to the score to form a key behavior subgraph. This method ensures that the enhanced subgraph retains the core semantics while maintaining consistency with the labels of the original graph. By feeding the original graph and the generated subgraph into the graph attention network (GAT) for training, the method provides an enhanced view of the data for the model, effectively alleviating the overfitting problem and improving the generalization ability and attention to key features of the model.

[0067] The undirected graph is generated according to the target API call sequence, and the weight of the edge of the undirected graph is calculated according to the semantic embedding vector, and a function call graph is obtained, specifically including:

[0068] The API call sequence is converted into the undirected graph;

[0069] The weight of the edge of the undirected graph is calculated according to the sliding window, and the function call graph is generated according to the weight and the undirected graph.

[0070] Specifically, in the present application, in order to effectively capture the context relationship and execution flow between API calls, the module converts the API call sequence into a weighted undirected graph G=(V,ε), as shown in formula (1):

[0071] G=(V,ε) (1)

[0072] Wherein, V={v1,v2,...,v n}, represents a set of n unique API nodes in the graph, represents a set of edges connecting nodes.

[0073] Further, the weight of the edge of the undirected graph is calculated according to the sliding window, specifically including:

[0074] According to the sliding window, the number of times each edge appears in all windows is obtained;

[0075] According to the sum of the number of times each edge appears and a preset scaling factor, the weight of the edge of the undirected graph is calculated.

[0076] Specifically, a sliding window method is adopted to construct edges and calculate weights. Any two APIs (V i ,V j ) that co-occur in a window are considered to have an edge between them. The weight of an edge is determined by the number of co-occurrences of the two APIs (V i , V j ) in all windows, multiplied by a scaling factor a for normalization, as shown in equation (2):

[0077] A i，j =||(V i , V j )||·a; (2)

[0078] where A i，j is the weight of the corresponding edge in the adjacency matrix. In addition, to preserve the importance information of the API itself, a self-loop (V i , V i ) is added to each node in the graph, and the weight of the self-loop is equal to the frequency of the API appearing in the entire sequence.

[0079] Then, according to the weights and the undirected graph, the function call graph is generated.

[0080] In step S30, the function call graph is scored according to a target subgraph pruning algorithm, a plurality of score results are obtained, and a target subgraph is constructed according to all score results.

[0081] It should be noted that the limited size of the public malware dataset can easily lead to model overfitting. To solve this problem, the present application proposes a novel intelligent subgraph pruning algorithm based on node importance.

[0082] Further, the target subgraph pruning algorithm is used to score the function call graph to obtain a plurality of score results, and a target subgraph is constructed according to all score results, specifically including:

[0083] According to the target subgraph pruning algorithm, the importance score of each node in the function call graph is calculated;

[0084] The first target node is obtained by retaining the nodes with the top first preset number of importance scores among all nodes, and the second target node is selected from the nodes with the second preset number of importance scores among all nodes;

[0085] According to the first target node and the second target node, a target subgraph is constructed.

[0086] Specifically, for each API function call graph (FCG) input, the algorithm first calculates the importance score of each node (API) in the graph using personalized PageRank (PPR), i.e., the target subgraph pruning algorithm. In the specific target subgraph pruning algorithm, the PPR score vector is obtained by iteratively solving formula (3):

[0087] PPR = av + (1-a) W·PPR; (3)

[0088] Where PPR is the node importance vector, a is the probability of random walk returning to the starting node, v is a one-hot vector marking the starting node of PPR calculation, and W is the row-normalized adjacency matrix.

[0089] According to the PPR score, the top-k nodes with the highest score are retained as the core node set, i.e., the first target node, where λ is a preset pruning ratio. In order to increase data diversity, the application will randomly select 2 nodes from the 5 nodes that are ranked immediately after top-k in terms of importance, and add them to the subgraph, i.e., the second target node is selected from the nodes ranked after the second preset number in terms of importance score. Finally, a new subgraph, i.e., the target subgraph, is formed by these selected nodes and all the connection edges between them in the original graph. In the application, the generated subgraph maintains the same labels as the original graph during training. After that, the newly generated subgraphs are combined with the original graph data set and used together for training of the downstream GNN classifier.

[0090] Step S40, inputting the target subgraph into the classification network for classification to obtain the malicious probability of each software.

[0091] It should be noted that the application constructs an efficient malware classification framework integrating semantic enhancement and data enhancement modules. The application organically integrates the above two innovative modules into an end-to-end detection framework based on graph neural network. The framework first generates high-quality node features through the semantic enhancement module, then constructs an API call graph, and then uses the data enhancement module to expand the training data set. Finally, the graph attention network (GAT) is used for efficient graph-level classification. The entire framework works cooperatively, significantly improving the accuracy and robustness of malware detection.

[0092] Further, the inputting the target subgraph into the classification network for classification to obtain the malicious probability of each software specifically includes:

[0093] The target subgraph is input into the classification network to perform attention calculation, weight normalization, information aggregation, and multi-head attention processing to obtain a graph-level representation.

[0094] inputting the graph-level representation into a fully connected layer and a Softmax layer in the classification network to obtain a malicious probability of each software.

[0095] Specifically, the application adopts a graph attention network (GAT) as a core classifier, obtains a graph-level representation through attention calculation, weight normalization and information aggregation and multi-head attention processing, and then inputs the graph-level representation obtained after multi-layer GAT processing into a fully connected layer and a Softmax layer to output a probability of each malware family, thereby completing the classification task.

[0096] Further, the inputting of the target subgraph into the classification network, the attention calculation, the weight normalization and the information aggregation and the multi-head attention processing to obtain the graph-level representation specifically include:

[0097] The target subgraph is input into the classification network, and a linear transformation matrix, an attention function and a nonlinear activation function are used for attention calculation on each pair of connected nodes of the target subgraph to obtain importance coefficients of all neighbor nodes;

[0098] The importance coefficients of the neighbor nodes of each node are subjected to weight normalization and information aggregation according to a Softmax function to obtain a feature representation;

[0099] Each feature is subjected to multi-head attention processing to obtain a graph-level representation.

[0100] Specifically, in the attention calculation process, for any pair of connected nodes i and j in the graph, the feature vectors of the nodes are h i and h j respectively. The GAT calculates an importance coefficient e ij of the node j to the node i through a shared linear transformation matrix W and an attention function att, as shown in formula (4):

[0101] e ij =att(W·h i ,W·h j ); (4)

[0102] The attention function is implemented through a single-layer feedforward network and uses LeakyReLU as a nonlinear activation function. The definition of the LeakyReLU function is as shown in formula (5):

[0103]

[0104] where β is a small normal number. Therefore, the complete calculation process of the importance coefficient e ij is as shown in formula (6):

[0105] e ij = LeakyReLU(a[W·h i ||W·h j ]) (6)

[0106] where || denotes vector concatenation operation, and a is a learnable weight vector.

[0107] While the weight normalization and information aggregation process uses the Softmax function to normalize the importance coefficients of all neighbors of node i (set N i ) to obtain the attention weight a ij , as shown in equation (7):

[0108]

[0109] Then, the transformed features of the neighbor nodes are weighted and summed using these weights to obtain the updated feature representation h' of node i i , as shown in equation (8):

[0110]

[0111] where σ is a nonlinear activation function (such as ReLU).

[0112] In order to enhance the expression ability of the model, the invention adopts a multi-head attention mechanism. In the multi-head attention processing process, K independent attention representations are calculated in parallel, and different weight matrices W k and attention weights a are used for each head. In the middle layer, the outputs of the K heads are concatenated, as shown in equation (9):

[0113]

[0114] In the last layer (output layer), the outputs of the K heads are averaged, and the graph-level representation is obtained, as shown in equation (10):

[0115]

[0116] Further, the training objective of the invention is to minimize the classification loss of the model. The standard Cross-Entropy Loss is used, which is a standard practice in multi-classification tasks. The model parameters are iteratively updated by the Adam optimizer, so that the predicted malware family distribution of the model is as close as possible to the real label distribution.

[0117] Further, to verify the effectiveness of the proposed method, a series of detailed experiments are conducted. Two widely used public malware API call sequence datasets are adopted: the Aliyun dataset and the Catak dataset. The Aliyun dataset, which is one of the commonly used benchmarks in the field of malware detection, contains 4980 malware samples from 8 different families and a large number of benign samples, totaling 13877 samples. These samples are extracted API call sequences after executing in a sandbox environment. The characteristics of this dataset are relatively balanced class distribution, varying API sequence length, and good ability to test the model's recognition ability for different malicious behavior patterns. The Catak dataset is specifically designed for malware family classification tasks and contains 7107 malware samples from the VirusShare database, covering 8 major malware families, including Trojans, Backdoors, Downloaders, Worms, Adware, Spyware, Ransomware, and Droppers. These samples are executed through the Cuckoo sandbox, and the API call sequences are parsed from the generated reports. The characteristics of this dataset are that all samples are malware, focusing on the fine-grained family classification challenge, and are an ideal choice for evaluating the model's ability to distinguish subtle differences between different malicious behaviors.

[0118] wherein the training set and the test set are divided: for the above two datasets, the standard random division strategy is adopted. After randomly shuffling all the data, they are divided according to the ratio of 80% as the training set, 10% as the validation set, and 10% as the test set. It is worth noting that the new data generated by our graph enhancement module is only used to expand the training set, and the validation set and the test set remain original and pure to ensure the fairness of the evaluation results.

[0119] To comprehensively evaluate the performance of the model, four standard classification task evaluation indicators are adopted: accuracy (Accuracy), the proportion of correctly classified samples in the total number of samples; precision (Precision), the proportion of actual positive samples among all samples predicted as positive; recall (Recall), the proportion of successfully predicted positive samples among all actual positive samples; F1 score (F1-score), the harmonic mean of precision and recall, which is an important indicator to measure the comprehensive performance of the model, and its calculation formula is shown in formula (11):

[0120]

[0121] To demonstrate the advancement of the method of the present application, several current mainstream malware detection methods were selected for performance comparison: LiNet, a detection method based on LSTM, which extracts semantic information such as API category, action and operation object from API calls, and uses a Bi-LSTM module to explore the relationship between APIs for classification; CatakNet, a baseline method that treats malware API sequences as text and directly applies LSTM networks for classification and prediction, is the model used by the proposer of the Catak dataset; TS-Mal, a detection method based on graph neural networks, which constructs API sequences into graphs and uses GNN for feature learning and classification; DawnGNN, another advanced detection framework based on GNN, also focuses on learning malicious behavior patterns from API call graphs; Drop Edge and DropNode: The intelligent graph enhancement algorithm is also directly compared with these two general and random graph data enhancement methods to verify the superiority of the method of the present application, and the specific results are shown in the following tables.

[0122] Table 1: Model performance comparison table

[0123]

[0124] Table 2: Semantic enhancement performance comparison table

[0125]

[0126] Table 3: Ablation experiment performance results table

[0127]

[0128]

[0129] For performance, as shown in Table 1, the framework proposed by the present application achieves the best performance on both Catak and Aliyun datasets. On the Catak dataset, the accuracy reaches 68.21%, and on the Aliyun dataset, the accuracy reaches 89.42%, which is a significant improvement of 2.67% and 2.38% respectively compared with current methods such as TS-Mal and DawnGNN. This proves the superiority of the overall framework of the present application. For semantic enhancement effectiveness analysis, as shown in Table 2, by comparing the description text generated by GPT-4 and the description text sorted by official documents, it can be clearly seen that whether using graph data enhancement or not, the semantic description generated by GPT-4 can bring better performance. This proves that the semantic enhancement strategy based on RAG and CoT proposed by the present application can mine more effective and beneficial features for malware detection. For data enhancement effectiveness analysis, as shown in Table 3, the ablation experiment shows that using the semantic enhancement module alone or using the graph enhancement module alone can bring performance improvement, and when the two are used together, the model performance reaches the optimal. This fully illustrates the effectiveness of the two core modules proposed by the present application and their synergistic effect. At the same time, from the comparison with DropEdge and DropNode in Table 1, it can be seen that the intelligent subgraph clipping algorithm based on node importance proposed by the present application is significantly better than the random enhancement method.

[0130] The T-SNE visualization result is shown in Figure 4 , which also intuitively shows that the present method can learn features with high discriminability, so that different families of malware form clear clusters in the feature space. As shown in Figure 5 , we explore the key hyperparameter, subgraph clipping ratio λ, in the data enhancement module. The experimental results show that the model performance has certain robustness to this parameter, and reaches the peak value on both datasets when λ = 0.8. This shows that the model and algorithm design of the present application is robust.

[0131] The application obtains a target API call sequence, generates a target text description according to a search enhanced advanced strategy, inputs the target text description into a target language model to obtain a semantic embedding vector, generates a undirected graph according to the target API call sequence, calculates the weight of the edge of the undirected graph according to the semantic embedding vector, and obtains a function call graph, performs score calculation on the function call graph according to a target subgraph pruning algorithm to obtain a plurality of score results, and constructs a target subgraph according to all the score results. The application inputs the target subgraph into a classification network for classification to obtain the malicious probability of each software. The application combines the deep semantic understanding ability of a large language model with the complex structure representation ability of a graph neural network, does not regard the API call as an isolated symbol, but converts the dynamic behavior of malicious software into a graph classification problem by constructing an API function call graph, so that the behavior mode of the malicious software can be more comprehensively captured and analyzed, and an accurate malicious software detection result can be obtained.

[0132] Further, as shown in Figure 6 Based on the above-mentioned malicious software detection method based on dynamic behavior analysis, the application also correspondingly provides a malicious software detection system based on dynamic behavior analysis, wherein the malicious software detection system based on dynamic behavior analysis comprises:

[0133] An API embedding module 61 is configured to obtain a target API call sequence, generate a target text description according to a search enhanced advanced strategy, input the target text description into a target language model to obtain a semantic embedding vector.

[0134] A graph generation module 62 is configured to generate a undirected graph according to the target API call sequence, calculate the weight of the edge of the undirected graph according to the semantic embedding vector, and obtain a function call graph.

[0135] A graph enhancement module 63 is configured to perform score calculation on the function call graph according to a target subgraph pruning algorithm to obtain a plurality of score results, and construct a target subgraph according to all the score results.

[0136] A graph neural network classification module 64 is configured to input the target subgraph into a classification network for classification to obtain the malicious probability of each software.

[0137] Further, as shown in Figure 7 Based on the above-mentioned malicious software detection method based on dynamic behavior analysis and system, the application also correspondingly provides a terminal, which comprises a processor 10, a memory 20 and a display 30. Figure 7 Only part of the components of the terminal are shown, but it should be understood that all the shown components are not required to be implemented, and more or fewer components can be alternatively implemented.

[0138] The memory 20 can be an internal storage unit of the terminal in some embodiments, such as a hard disk or a memory of the terminal. The memory 20 can also be an external storage device of the terminal in other embodiments, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal. Further, the memory 20 can include both the internal storage unit and the external storage device of the terminal. The memory 20 is used to store application software and various data installed on the terminal, such as program codes of the terminal, etc. The memory 20 can also be used to temporarily store data that has been output or will be output. In an embodiment, the memory 20 stores a malware detection program based on dynamic behavior analysis 40, which can be executed by the processor 10 to implement the malware detection method based on dynamic behavior analysis in the present application.

[0139] The processor 10 can be a central processing unit (CPU), a microprocessor or other data processing chip in some embodiments, which is used to run program codes or process data stored in the memory 20, such as to execute the malware detection method based on dynamic behavior analysis, etc.

[0140] The display 30 can be an LED display, a liquid crystal display, a touch liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, etc. in some embodiments. The display 30 is used to display information of the terminal and to display a visualized user interface.

[0141] In an embodiment, the above malware detection method based on dynamic behavior analysis is implemented when the processor 10 executes the malware detection program based on dynamic behavior analysis 40 in the memory 20.

[0142] The present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a malware detection program based on dynamic behavior analysis, which implements the following steps when executed by a processor:

[0143] Obtaining a target API call sequence, and generating a target text description according to a search enhanced advanced strategy, inputting the target text description into a target language model to obtain a semantic embedding vector;

[0144] According to the target API call sequence, a directed graph is generated, the weights of the edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0145] According to a target subgraph pruning algorithm, score calculation is performed on the function call graph, a plurality of score results are obtained, and a target subgraph is constructed according to all score results;

[0146] The target subgraph is input into a classification network for classification to obtain a malicious probability of each software.

[0147] According to the target API call sequence, a directed graph is generated, the weights of the edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0148] According to the target API call sequence, a directed graph is generated, the weights of the edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0149] The target text description is input into a pre-trained target language model to obtain a semantic embedding vector.

[0150] According to the target API call sequence, a directed graph is generated, the weights of the edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0151] The API call sequence is converted into the directed graph;

[0152] According to the sliding window, the weights of the edges of the directed graph are calculated, and the function call graph is generated according to the weights and the directed graph.

[0153] According to the target API call sequence, a directed graph is generated, the weights of the edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0154] According to the sliding window, the number of times each edge appears in all windows is obtained;

[0155] According to the sum of the number of times each edge appears and a preset scaling factor, the weights of the edges of the directed graph are calculated.

[0156] According to the target API call sequence, a directed graph is generated, the weights of the edges of the directed graph are calculated according to the semantic embedding vectors, and a function call graph is obtained;

[0157] According to the target subgraph pruning algorithm, the importance scores of each node in the function call graph are calculated;

[0158] reserve the first preset number of nodes with the highest importance scores in all nodes to obtain first target nodes, and select second target nodes from the nodes with the second preset number of importance scores in all nodes;

[0159] According to the first target node and the second target node, a target subgraph is constructed.

[0160] The target subgraph is input into the classification network to obtain the malicious probability of each software, and specifically includes:

[0161] The target subgraph is input into the classification network to perform attention calculation, weight normalization and information aggregation, and multi-head attention processing to obtain a graph-level representation.

[0162] The graph-level representation is input into the full connection layer and the Softmax layer in the classification network to obtain the malicious probability of each software.

[0163] The target subgraph is input into the classification network to perform attention calculation, weight normalization and information aggregation, and multi-head attention processing to obtain a graph-level representation, and specifically includes:

[0164] The target subgraph is input into the classification network, and for each pair of connected nodes of the target subgraph, a linear transformation matrix, an attention function and a nonlinear activation function are used to perform attention calculation to obtain importance coefficients of all neighbor nodes.

[0165] According to the Softmax function, the importance coefficients of the neighbor nodes of each node are weight-normalized and information-aggregated to obtain a feature representation.

[0166] Each feature is subjected to multi-head attention processing to obtain a graph-level representation.

[0167] It should be noted that in this paper, the term "includes" "contains" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or terminal including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or terminal. Without more limitations, the element defined by the statement "includes a" does not exclude the presence of another identical element in the process, method, article or terminal including the element.

[0168] Of course, those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware (such as a processor, a controller, etc.) through a computer program. The program can be stored in a computer-readable computer-readable storage medium, and the program can include the processes of the above-mentioned method embodiments when executed. The computer-readable storage medium can be a memory, a disk, an optical disk, etc.

[0169] It should be understood that the application is not limited to the above examples, and those skilled in the art can make improvements or changes according to the above description, and all these improvements and changes shall belong to the protection scope of the appended claims of the application.

Claims

1. A malware detection method based on dynamic behavior analysis, characterized in that, The malware detection method based on dynamic behavior analysis includes: Obtain the target API call sequence and generate a target text description based on advanced retrieval enhancement strategies. Input the target text description into the target language model to obtain a semantic embedding vector. Based on the target API call sequence, an undirected graph is generated. Based on the semantic embedding vector, the weights of the edges of the undirected graph are calculated, and a function call graph is obtained. The function call graph is scored according to the target subgraph pruning algorithm to obtain multiple score results, and a target subgraph is constructed based on all score results; The target subgraph is input into a classification network for classification to obtain the malicious probability of each software.

2. The malware detection method based on dynamic behavior analysis according to claim 1, characterized in that, The process of obtaining the target API call sequence, generating a target text description based on advanced retrieval enhancement strategies, and inputting the target text description into the target language model to obtain a semantic embedding vector specifically includes: Obtain the target API call sequence, and perform indexing, retrieval, and answer generation operations on the target API call sequence according to the advanced retrieval enhancement strategy to generate a target text description; The target text description is input into a pre-trained target language model to obtain a semantic embedding vector.

3. The malware detection method based on dynamic behavior analysis according to claim 1, characterized in that, The process of generating an undirected graph based on the target API call sequence, calculating the edge weights of the undirected graph based on the semantic embedding vector, and obtaining the function call graph specifically includes: Convert the API call sequence into the undirected graph; The weights of the edges in the undirected graph are calculated using a sliding window, and the function call graph is generated based on the weights and the undirected graph.

4. The malware detection method based on dynamic behavior analysis according to claim 3, characterized in that, The step of calculating the edge weights of the undirected graph based on the sliding window specifically includes: The number of times each edge appears in all windows is obtained based on the sliding window; The weights of the edges in the undirected graph are calculated based on the sum of the occurrences of each edge and a preset scaling factor.

5. The malware detection method based on dynamic behavior analysis according to claim 1, characterized in that, The step of calculating a score for the function call graph using the target subgraph pruning algorithm to obtain multiple score results, and constructing a target subgraph based on all score results, specifically includes: Based on the target subgraph pruning algorithm, the importance score of each node in the function call graph is calculated; Retain the first preset number of nodes with the highest importance scores among all nodes to obtain the first target node, and select the second target node from the nodes with the highest importance scores after the second preset number of nodes among all nodes; Construct a target subgraph based on the first target node and the second target node.

6. The malware detection method based on dynamic behavior analysis according to claim 1, characterized in that, The step of inputting the target subgraph into a classification network for classification to obtain the malicious probability of each software specifically includes: The target subgraph is input into the classification network, where attention calculation, weight normalization and information aggregation, and multi-head attention processing are performed to obtain a graph-level representation. The graph-level representation is input into the fully connected layer and Softmax layer of the classification network to obtain the malicious probability of each software.

7. The malware detection method based on dynamic behavior analysis according to claim 6, characterized in that, The process of inputting the target subgraph into the classification network, performing attention calculation, weight normalization and information aggregation, and multi-head attention processing to obtain a graph-level representation specifically includes: The target subgraph is input into the classification network. For each pair of connected nodes in the target subgraph, attention is calculated using a linear transformation matrix, attention function, and nonlinear activation function to obtain the importance coefficients of all neighboring nodes. The importance coefficients of each node's neighboring nodes are weighted and normalized using the Softmax function, and information is aggregated to obtain the feature representation. Multi-head attention processing is applied to each feature to obtain a graph-level representation.

8. A malware detection system based on dynamic behavior analysis, characterized in that, The malware detection system based on dynamic behavior analysis includes: The API embedding module is used to obtain the target API call sequence, generate a target text description based on the advanced retrieval enhancement strategy, and input the target text description into the target language model to obtain a semantic embedding vector. The graph generation module is used to generate an undirected graph based on the target API call sequence, calculate the edge weights of the undirected graph based on the semantic embedding vector, and obtain the function call graph. The graph enhancement module is used to calculate the score of the function call graph according to the target subgraph pruning algorithm, obtain multiple score results, and construct the target subgraph based on all score results; The graph neural network classification module is used to input the target subgraph into the classification network for classification to obtain the malicious probability of each software.

9. A terminal, characterized in that, The terminal includes: a memory, a processor, and a malware detection program based on dynamic behavior analysis stored in the memory and executable on the processor. When the malware detection program based on dynamic behavior analysis is executed by the processor, it implements the steps of the malware detection method based on dynamic behavior analysis as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a malware detection program based on dynamic behavior analysis, which, when executed by a processor, implements the steps of the malware detection method based on dynamic behavior analysis as described in any one of claims 1-7.

Images