A malware packer identification method based on a heterogeneous graph neural network

Abstract

The application discloses a malware packer identification method based on a heterogeneous graph neural network, and performs preprocessing on packed malware, including executable file format verification and standardization, static feature preliminary extraction, execution environment configuration and noise filtering; multi-dimensional behavior features of samples before and after packing are extracted through dynamic analysis technology; a heterogeneous graph structure containing seven types of nodes and ten types of edges is constructed, twelve semantic-rich meta-paths are designed, and four types of change features along the same meta-paths before and after packing are calculated; a heterogeneous graph neural network based on the meta-path is used for node representation learning, multi-meta-path information is fused through a semantic-level attention mechanism, and the change features are combined to realize accurate identification of the packer type. The application effectively solves the problem that existing methods do not fully utilize the correlation information of samples before and after packing, and improves the accuracy and robustness of the packer identification.

Description

Technical Field

[0001] This invention relates to software security technology, specifically to a method for identifying malware packagers based on heterogeneous graph neural networks. Background Technology

[0002] In today's information age, cybersecurity has become a major issue in the development of internet technology. Since a large number of functions and applications on the network are implemented in software, software security plays a crucial role in cybersecurity research and practice. The number of malicious software programs is growing exponentially, and to evade detection, malware authors often use software packaging techniques to conceal and protect their malicious code.

[0003] Packaging techniques pose multiple challenges to malware detection. First, the packaging process encrypts, compresses, or obfuscates the original code, making it difficult for static analysis to obtain effective features. Second, many packagers integrate anti-debugging and anti-virtual machine techniques, further increasing the difficulty of analysis. Furthermore, malware may use multiple packagers for nested packaging, significantly increasing the difficulty of detection.

[0004] Existing methods for identifying malware packagers mainly include feature-matching methods and machine learning-based methods. For example, feature-matching methods identify packagers by extracting signature features of specific packagers, but the recognition rate drops when faced with variations and obfuscation techniques. Machine learning-based methods identify packager types by training classifiers, but feature extraction is insufficient, resulting in limited effectiveness in identifying complex packagers.

[0005] Furthermore, with the development of deep learning technology, some research has begun to apply graph neural networks to the field of malware analysis, but most of these studies focus on malware detection and classification, while graph neural network methods for packager identification are still in their infancy. Existing graph neural network methods are mainly based on homogeneous graph structures, making it difficult to effectively model heterogeneous entity relationships and complex semantic associations in malware ecosystems, especially in handling the association information between samples before and after packaging.

[0006] Chinese patent application CN114329468A discloses an adversarial Android malware detection method based on mapping relationships. This method proposes establishing a mapping relationship library between APIs and permissions, integrating hardware features for multi-dimensional analysis, and improving detection accuracy through feature visualization combined with CNN. However, this method requires the establishment and maintenance of multiple feature libraries, resulting in significant system overhead. Furthermore, the mapping library needs frequent updates to address rapidly evolving malware and new packer techniques, leading to high maintenance costs. This method primarily targets Android malware detection and has limited ability to identify and classify the types of packagers used by malware.

[0007] Chinese patent application CN119256308A discloses an automatic detection method for unknown packers. This method proposes an automatic detection approach based on packer filtering, simulation analysis, and clustering, which can identify previously unknown packer families. However, this method mainly relies on static feature analysis and a single simulation environment, and its adaptability in complex packing scenarios is still insufficient.

[0008] However, existing methods for identifying malware packagers still have the following technical limitations:

[0009] (1) The correlation information between samples before and after packaging is not fully utilized. Existing methods often treat samples before and after packaging as independent individuals when identifying the type of packer, without considering the changes and correlations in behavior patterns during the packaging process, resulting in low recognition accuracy.

[0010] (2) Limited feature representation dimensions. Existing methods mainly rely on single-dimensional features, such as static or dynamic features, and fail to comprehensively model the features and behaviors of packaged samples from the perspective of graph structure, thus failing to effectively capture the complex correlation information in the packaging process.

[0011] (3) Insufficient adaptability to complex packers. Existing methods often perform poorly when faced with complex packing technologies such as multi-layer packing and virtualization protection, and lack effective semantic modeling and deep feature learning capabilities. Summary of the Invention

[0012] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a method for identifying malware packagers based on heterogeneous graph neural networks. This method can effectively solve the problem of not fully utilizing the correlation information between samples before and after packaging in current malware packager identification, and can also improve the comprehensiveness of feature representation and enhance adaptability to complex packagers. The packager identification tool implemented based on this invention can also perform relevant identification based on specific packaged malware, and finally accurately identify the packager type.

[0013] Technical solution: The present invention provides a method for identifying malware packagers based on heterogeneous graph neural networks, comprising the following steps:

[0014] Step 1: Preprocess the input packaged malware. Preprocessing operations include executable file format verification and standardization, extraction of static features (such as basic file attribute features, file structure features, entropy value features, hash fingerprint features), execution environment configuration, and noise filtering.

[0015] Step 2: Execute the pre-packaging and post-packaging samples in an isolated virtualization environment, monitor and record all behavioral activities during sample execution; then, extract multi-dimensional behavioral features of the pre-packaging and post-packaging samples respectively through dynamic analysis technology, and establish a one-to-many mapping relationship between the pre-packaging and post-packaging samples. This one-to-many mapping relationship means that for each original sample, multiple corresponding packaged samples are generated using multiple different packagers, establishing a mapping relationship between 1 original sample and N packaged samples, forming a structured behavioral feature dataset.

[0016] The aforementioned multi-dimensional behaviors include key behavioral data such as API call sequences, file operations, registry operations, and network connections;

[0017] Extract dynamic key features from behavior logs, including API call sequences and their parameter information, file operation records, registry operation records, network connection information, process creation relationships, and other dynamic behavioral features; (static methods extract basic file features, dynamic methods extract runtime features, and a combination of static and dynamic methods extracts features at different stages).

[0018] Step 3: Construct a heterogeneous graph structure containing seven types of nodes and ten types of edges, design twelve semantically rich meta-paths, and calculate four types of variation features of the same meta-path before and after packaging.

[0019] First, obtain seven types of nodes, including the original sample node OS, the packaged sample node PS, the file node F, the registry node R, the network node N, the process node Proc, and the packaging process node P.

[0020] Then, seven different types of nodes are connected through ten edge types, including packaging and transformation edges, process creation edges, file operation edges, registry operation edges, network connection edges, etc.

[0021] Next, twelve meta-paths are constructed, including basic packaging and conversion paths, file operation associated paths, registry operation associated paths, network behavior associated paths, etc.

[0022] Finally, four types of change features along the same meta-path before and after packaging are calculated. These four types of change features include behavior frequency change features, sequence pattern change features, operation target change features, and complexity change features.

[0023] Step 4: Use a heterogeneous graph neural network based on meta-paths to learn node representations, fuse multi-path information through a semantic-level attention mechanism, and combine variation features to achieve accurate identification of packer types.

[0024] Furthermore, the detailed method of step 1 is as follows:

[0025] Step 1.1: Use PE / ELF format parsing technology to check the format integrity of the input executable file and verify the validity of key structures such as the file header and section table;

[0026] Step 1.2: Calculate the multi-dimensional static features of the executable file using file attribute statistics methods, and calculate the entropy value of each segment of the file using the Shannon entropy algorithm;

[0027] Step 1.3: Configure key parameters of the dynamic analysis environment, and set the granularity and time window for behavior monitoring;

[0028] Step 1.4: Remove invalid samples by filtering using multi-dimensional rules and deduplicatize based on hash values.

[0029] Furthermore, the calculation method for the four types of change characteristics in step 3 is as follows:

[0030] The behavioral frequency change characteristics This refers to calculating the difference in the frequency of a specific behavior before and after packaging using statistical analysis methods. The formula is:

[0031] ;

[0032] in, Indicates the meta-path. Indicates a specific action; and These represent the samples along the metapath before and after packaging, respectively. behavior The frequency;

[0033] The sequence pattern change characteristics This refers to the degree of pattern preservation in behavioral sequences calculated using a sequence similarity algorithm. The formula is:

[0034] ;

[0035] in, Represents the sequence similarity function. and These represent the samples after packaging and the samples before packaging along the meta-path, respectively. The sequence of behaviors;

[0036] The operational target change characteristics This refers to calculating the degree of change in the target set through set similarity analysis. The formula is:

[0037] ;

[0038] in, and These represent the samples after packaging and the samples before packaging along the meta-path, respectively. The set of operational targets;

[0039] The complexity variation characteristics This refers to calculating the difference in complexity before and after packaging using graph theory complexity metrics. The formula is:

[0040] ;

[0041] and These respectively represent the complexity values ​​of the sample after packaging and the sample before packaging.

[0042] Furthermore, the detailed method of step 4 is as follows:

[0043] Step 4.1: Input each meta-path obtained in Step 3 into the heterogeneous graph neural network, use its convolutional layer to aggregate information, and update the node representation by weighted fusion of neighbor node information;

[0044] The update formula for the above convolutional layer is as follows:

[0045] ;

[0046] in, Indicates the first Layer nodes The expression, Represents a node The set of neighboring nodes, Represents the normalization constant. and They represent the first The weight matrix and bias vector of the layer, This represents the activation function, and the final output is obtained. ;

[0047] Step 4.2: Employ a semantic-level attention mechanism to calculate the importance weights of different meta-paths. The calculation formula is as follows:

[0048] ;

[0049] in, Represents the attention parameter vector. This indicates a splicing operation. This represents the activation function. and These represent the path along the metapaths P and P, respectively, from node i. The learned representation vector, and These represent the path along the metapaths P and P, respectively. The learned representation vector;

[0050] Step 4.3: Map the four types of change features (behavior frequency change features, sequence pattern change features, operation target change features, and complexity change features) to a unified feature space using a multilayer perceptron. The mapping formula is as follows:

[0051] ;

[0052] in, This represents a multilayer perceptron, which includes multiple fully connected layers, batch normalization layers, activation functions, and regularization components. These refer to, in order, the characteristics of behavioral frequency variation, sequence pattern variation, operational target variation, and complexity variation;

[0053] Then, feature fusion is performed with the node representations learned by the heterogeneous graph neural network to obtain fused features. The formula is as follows: ;

[0054] It is the l-th convolutional layer, obtained after multiple convolutional layers. ;

[0055] Step 4.4: Output the packer type identification results through a classifier. The classifier uses a fully connected neural network with multiple hidden layers, and finally outputs the probability distribution of each packer type through a softmax layer.

[0056] ;

[0057] in, and These represent the weight matrix and bias vector of the classifier, respectively. This indicates the type of packager.

[0058] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0059] (1) Effectively utilizes the correlation information between samples before and after packaging. This invention innovatively solves the limitation of existing methods that treat samples before and after packaging as independent individuals by constructing a heterogeneous graph model containing correlation information between samples before and after packaging. Through the careful design of seven types of nodes, ten edge types and twelve meta-paths, it effectively captures the changes in behavioral patterns and deep semantic relationships during the packaging process, significantly improving the accuracy of packer recognition.

[0060] (2) Achieves a more comprehensive feature representation. This invention deeply mines the behavioral differences and structured associations of samples before and after packaging by quantifying four types of changing features and using deep feature learning of heterogeneous graph neural networks. Compared with existing methods that only focus on single-dimensional features or simple feature combinations, this invention can better understand the technical mechanism of the packager and its impact on the behavior of malicious software, thereby achieving a more accurate identification effect.

[0061] (3) Enhanced adaptability to complex packers. Through semantic-level attention mechanism and carefully designed meta-path, this invention can effectively handle complex packing technologies such as multi-layer packing and virtualization protection. Compared with the performance degradation problem of existing methods when facing complex packers, this invention has stronger semantic modeling and deep feature learning capabilities, significantly improving the accuracy and robustness of complex packer identification. Attached Figure Description

[0062] Figure 1 This is a schematic diagram of the overall process of the present invention;

[0063] Figure 2 This is a schematic diagram of the heterogeneous graph structure and meta-path in the embodiment;

[0064] Figure 3 The diagram below is a schematic representation of the neural network architecture in the embodiment. Detailed Implementation

[0065] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0066] like Figure 1 As shown, the malware packager identification method based on heterogeneous graph neural networks of the present invention includes the following steps:

[0067] Step 1: Preprocess the input packaged malware. Preprocessing operations include executable file format verification and standardization, static feature extraction, execution environment configuration, and noise filtering.

[0068] Step 2: Execute the pre-packaging and post-packaging samples in an isolated virtualization environment, monitor and record all behavioral activities during sample execution; then, extract multi-dimensional behavioral features of the pre-packaging and post-packaging samples respectively through dynamic analysis technology, and establish a one-to-many mapping relationship between the pre-packaging and post-packaging samples. This one-to-many mapping relationship means that for each original sample, multiple corresponding packaged samples are generated using multiple different packagers, establishing a mapping relationship between 1 original sample and N packaged samples, forming a structured behavioral feature dataset.

[0069] Extract dynamic key features from behavior logs, including API call sequences and their parameter information, file operation records, registry operation records, network connection information, process creation relationships, and other dynamic behavioral features; (static methods extract basic file features, dynamic methods extract runtime features, and a combination of static and dynamic methods extracts features at different stages).

[0070] Step 3: Construct a heterogeneous graph structure containing seven types of nodes and ten types of edges, design twelve semantically rich meta-paths, and calculate four types of variation features of the same meta-path before and after packaging.

[0071] First, obtain seven types of nodes, including the original sample node OS, the packaged sample node PS, the file node F, the registry node R, the network node N, the process node Proc, and the packaging process node P.

[0072] Then, seven different types of nodes are connected through ten edge types, including packaging and transformation edges, process creation edges, file operation edges, registry operation edges, network connection edges, etc.

[0073] Next, twelve meta-paths are constructed, including basic packaging and conversion paths, file operation associated paths, registry operation associated paths, network behavior associated paths, etc.

[0074] Finally, four types of change features along the same meta-path before and after packaging are calculated. These four types of change features include behavior frequency change features, sequence pattern change features, operation target change features, and complexity change features.

[0075] Step 4: Use a heterogeneous graph neural network based on meta-paths to learn node representations, fuse multi-path information through a semantic-level attention mechanism, and combine variation features to achieve accurate identification of packer types.

[0076] Step 1 of this embodiment preprocesses the input packaged malicious software, including executable file format verification and standardization, preliminary extraction of static features, execution environment configuration, and noise filtering. The detailed method is as follows:

[0077] Step 1.1: Use PE / ELF format parsing technology to perform a format integrity check on the input executable file, verifying the validity of key structures such as the file header and section table; such as the DOS header, PE header, and section table of Windows PE files, and the ELF header, program header table, and section header table of Linux ELF files, to ensure that the file structure conforms to the corresponding format specifications.

[0078] Step 1.2: Calculate the multi-dimensional static features of the executable file (including basic attributes such as file size, number of sections, number of imported functions, and number of exported functions) using file attribute statistical methods. Calculate the entropy value of each segment of the file using the Shannon entropy algorithm. Perform preliminary packaging detection based on the entropy value distribution characteristics. The calculation formula is:

[0079] ;

[0080] in, This represents the probability of byte value i appearing in the file, where n is the number of possible byte values.

[0081] Extract the hash fingerprint information of the file, including multiple hash values ​​such as MD5, SHA1, and SHA256, for subsequent similarity analysis;

[0082] Step 1.3: Configure key parameters of the dynamic analysis environment (e.g., configure key parameters of the dynamic analysis environment, including virtual machine configuration, network environment settings, monitoring component initialization, etc.), set the granularity and time window of behavior monitoring to determine the monitoring scope of behaviors such as API calls, file operations, and registry operations;

[0083] Step 1.4: Remove invalid samples by filtering using multi-dimensional rules and deduplicatize based on hash values.

[0084] Step 2 of this embodiment extracts multi-dimensional behavioral features of the samples before and after packaging using dynamic analysis technology, including key behavioral data such as API call sequences, file operations, registry operations, and network connections. Specifically, the samples before and after packaging are executed in an isolated virtualization environment, and all behavioral activities during sample execution are monitored and recorded. Through various techniques such as system-level API hooks, kernel-mode monitoring, and network traffic capture, the behavior of the samples is monitored comprehensively, including key behaviors such as process creation and termination, thread operations, file system access, registry modification, network communication, and memory operations. Key features are extracted from the behavioral logs, specifically including: API call sequences and their parameter information, recording the timing relationship and parameter values ​​of function calls; file operation records, including file creation, deletion, modification, and reading operation types and target paths; registry operation records, including registry key value reading, writing, and deletion operations and corresponding registry paths; network connection information, including network protocols, port numbers, target addresses, and other network communication characteristics; and process creation relationships, including parent-child process dependencies and permission level information. A one-to-many mapping relationship is established between the samples before and after packaging, and sample pairs are constructed through comparative analysis to form a structured behavioral feature dataset. For each original sample, multiple packers are used to generate corresponding packed samples, establishing a 1:N mapping relationship to provide a data foundation for subsequent association analysis.

[0085] like Figure 2 As shown, in step 3 of this embodiment, a heterogeneous graph structure containing seven types of nodes and ten types of edges is constructed. At the same time, twelve semantically rich meta-paths are designed, and then four types of variation features along the same meta-path before and after packaging are calculated.

[0086] Specifically, seven types of nodes are defined to construct a heterogeneous graph node set, such as Figure 2 As shown: (1) Original sample node (OS): Represents the sample before packaging, carrying the static and behavioral characteristics of the original sample; (2) Packaged sample node (PS): Represents the sample after packaging, carrying the static and behavioral characteristics of the packaged sample; (3) File node (F): Represents the object of file operation, recording file path, type, size and other attributes; (4) Registry node (R): Represents the object of registry operation, recording registry key value, path, permissions and other information; (5) Network node (N): Represents the object of network connection, recording network characteristics such as IP address, port, protocol and other network characteristics; (6) Process node (Proc): Represents the process entity, recording process information such as process ID, name, permission level and other process information; (7) Packaging process node (P): Represents the packaging conversion process, recording information such as packager type and parameter configuration.

[0087] The twelve specific meta-paths include: Basic Transformation Path: 1. OS→P→PS: Basic packaging transformation path. Unidirectional Behavior Path Path: 2. OS→Proc→F: Original sample file operation path; 3. PS→Proc→F: Packaged sample file operation path; 4. OS→Proc→R: Original sample registry operation path; 5. PS→Proc→R: Packaged sample registry operation path; 6. OS→Proc→N: Original sample network operation path; 7. PS→Proc→N: Packaged sample network operation path. Composite Association Path: 8. OS→Proc→F→PS: File-mediated association path; 9. OS→Proc→R→PS: Registry-mediated association path; 10. OS→Proc→N→PS: Network-mediated association path; 11. OS→P→PS→Proc: Packaged process creation path; 12. OS→Proc→P→PS→Proc: Process-Packaging-Process chain path.

[0088] This implementation connects different types of nodes through ten edge types, with each edge carrying specific semantic relationships and temporal information. It then constructs twelve meta-paths to capture multi-level semantic associations and calculates four types of change features of the same meta-path before and after packaging.

[0089] The calculation methods for the four types of change characteristics are as follows:

[0090] Characteristics of behavioral frequency changes This refers to calculating the difference in the frequency of a specific behavior before and after packaging using statistical analysis methods. The formula is:

[0091] ;

[0092] in, Indicates the meta-path. Indicates a specific action; and These represent the samples along the metapath before and after packaging, respectively. behavior The frequency.

[0093] Sequence pattern change characteristics This refers to the degree of pattern preservation in behavioral sequences calculated using a sequence similarity algorithm. The formula is:

[0094] ;

[0095] in, Represents the sequence similarity function. and These represent the samples after packaging and the samples before packaging along the meta-path, respectively. The sequence of behaviors.

[0096] Operational target change characteristics This refers to calculating the degree of change in the target set through set similarity analysis. The formula is:

[0097] ;

[0098] in, and These represent the samples after packaging and the samples before packaging along the meta-path, respectively. The set of operational targets.

[0099] Complexity variation characteristics This refers to calculating the difference in complexity before and after packaging using graph theory complexity metrics. The formula is:

[0100] ;

[0101] and These respectively represent the complexity values ​​of the sample after packaging and the sample before packaging.

[0102] The heterogeneous graph neural network model in this embodiment is as follows: Figure 3 As shown, the detailed execution method for step 4 is as follows:

[0103] Step 4.1: Input each meta-path obtained in Step 3 into the heterogeneous graph neural network, use its convolutional layer to aggregate information, and update the node representation by weighted fusion of neighbor node information;

[0104] The update formula for the above convolutional layer is as follows:

[0105] ;

[0106] in, Indicates the first Layer nodes The expression, Represents a node The set of neighboring nodes, Represents the normalization constant. and They represent the first The weight matrix and bias vector of the layer, Indicates the activation function;

[0107] Step 4.2: Employ a semantic-level attention mechanism to calculate the importance weights of different meta-paths. The calculation formula is as follows:

[0108] ;

[0109] in, Represents the attention parameter vector. This indicates a splicing operation. Indicates the activation function;

[0110] Step 4.3: Map the four obtained change features to a unified feature space using a multilayer perceptron. The mapping formula is as follows:

[0111] ;

[0112] in, This represents a multilayer perceptron, which includes multiple fully connected layers, batch normalization layers, activation functions, and regularization components.

[0113] Then, feature fusion is performed with the node representations learned by the heterogeneous graph neural network to obtain fused features. The formula is as follows: ;

[0114] Step 4.4: Output the packer type identification results through a classifier. The classifier uses a fully connected neural network with multiple hidden layers, and finally outputs the probability distribution of each packer type through a softmax layer.

[0115] ;

[0116] in, and These represent the weight matrix and bias vector of the classifier, respectively. This indicates the type of packager.

[0117] This invention achieves accurate identification of the packager type of packaged malware. To further verify the technical effect of this invention, this embodiment is validated on a dataset of 5000 samples containing 8 common packager types such as UPX, ASPack, and PECompact. The method of this invention can accurately identify various packagers and shows good adaptability to complex multi-layer packaging scenarios.

[0118] Compared to existing PEiD methods based on feature signature matching, the accuracy of this invention is improved by approximately 13%; compared to traditional machine learning packer detection methods such as support vector machines and random forests, the overall accuracy is improved by approximately 6%; in complex packer detection tasks, the improvement over traditional methods is even more significant, with an accuracy improvement of 18.6%.

[0119] This invention effectively solves the problem that existing technologies do not fully utilize the correlation information between samples before and after packaging, and significantly improves the accuracy and robustness of identification.

Claims

1. A method for identifying malware packagers based on heterogeneous graph neural networks, characterized in that, Includes the following steps: Step 1: Preprocess the input packaged malware. Preprocessing operations include executable file format verification and standardization, static feature extraction, execution environment configuration, and noise filtering. Step 2: Execute the pre-packaging and post-packaging samples in an isolated virtualization environment, monitor and record all behavioral activities during sample execution; then, extract multi-dimensional behavioral features of the pre-packaging and post-packaging samples respectively through dynamic analysis technology, and establish a one-to-many mapping relationship between the pre-packaging and post-packaging samples. This one-to-many mapping relationship means that for each original sample, multiple corresponding packaged samples are generated using multiple different packagers, establishing a mapping relationship between 1 original sample and N packaged samples, forming a structured behavioral feature dataset. Extract dynamic key features from behavior logs, including API call sequences and their parameter information, file operation records, registry operation records, network connection information, and dynamic behavior features of process creation relationships; Step 3: Construct a heterogeneous graph structure containing seven types of nodes and ten types of edges, design twelve semantically rich meta-paths, and calculate four types of variation features of the same meta-path before and after packaging. First, obtain seven types of nodes, including the original sample node OS, the packaged sample node PS, the file node F, the registry node R, the network node N, the process node Proc, and the packaging process node P. Then, seven different types of nodes are connected through ten edge types, including packaging and transformation edges, process creation edges, file operation edges, registry operation edges, and network connection edges; Next, twelve meta-paths are constructed, including basic packaging and conversion paths, file operation associated paths, registry operation associated paths, and network behavior associated paths. Finally, four types of change features along the same meta-path before and after packaging are calculated. These four types of change features include behavior frequency change features, sequence pattern change features, operation target change features, and complexity change features. Step 4: Use a heterogeneous graph neural network based on meta-paths to learn node representations, fuse multi-path information through a semantic-level attention mechanism, and combine it with the change features obtained in Step 3 to achieve accurate identification of packer types.

2. The malware packager identification method based on heterogeneous graph neural networks according to claim 1, characterized in that, The detailed method for step 1 is as follows: Step 1.1: Use PE / ELF format parsing technology to check the format integrity of the input executable file and verify the validity of key structures; Step 1.2: Calculate the multi-dimensional static features of the executable file using file attribute statistics methods, and calculate the entropy value of each segment of the file using the Shannon entropy algorithm; Step 1.3: Configure key parameters of the dynamic analysis environment, and set the granularity and time window for behavior monitoring; Step 1.4: Remove invalid samples by filtering using multi-dimensional rules and deduplicatize based on hash values.

3. The malware packager identification method based on heterogeneous graph neural networks according to claim 1, characterized in that, The calculation methods for the four types of change characteristics in step 3 are as follows: The behavioral frequency change characteristics This refers to calculating the difference in the frequency of a specific behavior before and after packaging using statistical analysis methods. The formula is: ； in, Indicates the meta-path. Indicates a specific action; and These represent the samples along the metapath before and after packaging, respectively. behavior The frequency; The sequence pattern change characteristics This refers to the degree of pattern preservation in behavioral sequences calculated using a sequence similarity algorithm. The formula is: ； in, Represents the sequence similarity function. and These represent the samples after packaging and the samples before packaging along the meta-path, respectively. The sequence of behaviors; The operational target change characteristics This refers to calculating the degree of change in the target set through set similarity analysis. The formula is: ； in, and These represent the samples after packaging and the samples before packaging along the meta-path, respectively. The set of operational targets; The complexity variation characteristics This refers to calculating the difference in complexity before and after packaging using graph theory complexity metrics. The formula is: ； and These respectively represent the complexity values ​​of the sample after packaging and the sample before packaging.

4. The malware packager identification method based on heterogeneous graph neural networks according to claim 1, characterized in that, The detailed method for step 4 is as follows: Step 4.1: Input each meta-path obtained in Step 3 into the heterogeneous graph neural network, use its convolutional layer to aggregate information, and update the node representation by weighted fusion of neighbor node information; The update formula for the above convolutional layer is as follows: ； in, Indicates the first Layer nodes The expression, Represents a node The set of neighboring nodes, Represents the normalization constant. and They represent the first The weight matrix and bias vector of the layer, This represents the activation function, and the final output is obtained. ; Step 4.2: Employ a semantic-level attention mechanism to calculate the importance weights of different meta-paths. The calculation formula is as follows: ； in, Represents the attention parameter vector. This indicates a splicing operation. This represents the activation function. and These represent the path along the metapaths P and P, respectively. The learned representation vector, and These represent the path along the metapaths P and P, respectively. The learned representation vector; Step 4.3: Map the four obtained change features to a unified feature space through a multilayer perceptron, the mapping formula is: ； in, This represents a multilayer perceptron, which includes multiple fully connected layers, batch normalization layers, activation functions, and regularization components. These refer to, in order, the characteristics of behavioral frequency variation, sequence pattern variation, operational target variation, and complexity variation; Then, feature fusion is performed with the node representations learned by the heterogeneous graph neural network to obtain fused features. The formula is as follows: ; Step 4.4: Output the packer type identification results through a classifier. The classifier uses a fully connected neural network with multiple hidden layers, and finally outputs the probability distribution of each packer type through a softmax layer. ； in, and These represent the weight matrix and bias vector of the classifier, respectively. This indicates the type of packager.

Images