Malicious code control flow feature extraction method and system based on graph neural network

Abstract

The invention discloses a malicious code control flow feature extraction method based on a graph neural network. The method comprises the following steps: constructing a control flow graph, a data flow graph and a function call graph; designing a drawing neural network architecture; training a graph-level classifier; performing graph interpretation by using a GNNExplainer algorithm, attention mechanism analysis and a gradient analysis method; converting the extracted control flow mode into a structured detection signature, and mapping the structured detection signature to an original binary code; and integrating with a static analysis tool through a standardized interface. The invention further discloses a malicious code control flow feature extraction system based on the graph neural network. Multi-level graph structure representation is constructed, important information such as a control flow structure and a data dependency relationship is fully reserved, the deep structure similarity of malicious codes can be recognized, the deformation resistance is higher, and therefore the malicious code detection precision is improved; according to the method, key sub-graphs can be recognized, graph structure features are converted into detection rules, then the detection rules are integrated with existing static analysis tools, and practicability is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for extracting malicious code control flow features based on graph neural networks. Background Technology

[0002] Traditional malware detection methods primarily rely on linear features such as byte sequences and API call sequences. However, since a program's execution logic is often reflected in the topology of its control flow graph, simple serialization cannot capture these structural features. Furthermore, attackers frequently use techniques such as control flow flattening, spoofed control flow insertion, and instruction substitution to alter the program's surface characteristics, making it difficult for existing methods to identify deep structural similarities and handle complex program structures.

[0003] To address the aforementioned technical problems, those skilled in the art have proposed using graph structures to represent programs, that is, representing program structures such as control flow graphs and abstract syntax trees as graphs, and then using graph neural networks for analysis. However, existing methods still have the following shortcomings: the graph construction methods are limited, and feature extraction is not precise enough. There is a lack of effective methods to extract interpretable structural features from graph neural networks, meaning it is difficult to directly map them to specific code structures or behavioral patterns. As a result, existing graph neural network-based program analysis cannot fully utilize graph structure information for malicious code detection, thus affecting the accuracy of malicious code detection. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a method and system for extracting malicious code control flow features based on graph neural networks.

[0005] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or to describe the scope of protection of these embodiments. Its sole purpose is to present some concepts in a simple form as a prelude to the detailed description that follows.

[0006] The present invention adopts the following technical solution:

[0007] Firstly, a method for extracting malicious code control flow features based on graph neural networks is provided, including:

[0008] Construct control flow graphs, data flow graphs, and function call graphs from malicious code binaries and convert them into a unified graph data format that can be processed by graph neural networks;

[0009] Design a graph neural network architecture and perform self-supervised pre-training on large-scale unlabeled program graph data;

[0010] Based on the pre-trained graph neural network model, supervised fine-tuning is performed using labeled program graph data to train a graph-level classifier.

[0011] The GNNExplainer algorithm, attention mechanism analysis, and gradient analysis methods are used to interpret graphs and identify the subgraph structures that contribute the most to the classification results.

[0012] The extracted control flow pattern is converted into a structured detection signature and mapped to the original binary code;

[0013] It integrates with static analysis tools through a standardized interface.

[0014] Furthermore, the process of constructing the control flow graph includes:

[0015] The instruction sequence of a binary file is analyzed using a disassembler, and basic blocks are divided with control transfer instructions as boundaries. These basic blocks are consecutive instruction sequences.

[0016] Extract the attributes of each basic block as node attributes. Node attributes include: instruction type, register read / write status, and memory access mode.

[0017] Analyze the target address and jump type of the jump instruction, and construct the control transfer edges between basic blocks. The edge attributes include: jump condition and execution frequency attribute.

[0018] The process of constructing the data flow graph includes: parsing the operands and operation types in the instructions, identifying the definition and usage of variables, using variables or operations as nodes, and using the data flow direction and type as edges;

[0019] The process of constructing the function call graph includes: dividing function boundaries, identifying direct and indirect call points, extracting function attributes as node attributes, and constructing call relationship edges. The node attributes include function type and parameter information, while the edge attributes include call frequency and parameter passing.

[0020] Furthermore, the graph neural network architecture includes: graph convolutional layers and graph pooling layers;

[0021] The design process of the graph convolutional layer includes: using a multi-layer graph convolutional network, updating the node representation by aggregating neighbor node information in each layer, and using aggregation functions to process directed edges and multiple types of nodes;

[0022] The graph pooling strategy adopted by the graph pooling layer includes: using a hierarchical pooling method to gradually abstract the graph structure in the order from the basic block level to the function level and then to the program level;

[0023] The self-supervised pre-training refers to pre-training on large-scale unlabeled procedural graph data through self-supervised tasks such as graph structure prediction, node attribute prediction, and edge prediction.

[0024] Furthermore, the process of training the graph-level classifier also includes: converting the program graph into a fixed-dimensional vector representation through graph pooling and graph-level aggregation operations; adopting a multi-task learning framework to simultaneously perform malicious detection, family classification, and behavior classification tasks; and enhancing the model's ability to distinguish different malicious families through contrastive learning, thereby narrowing the representation distance between samples of the same family.

[0025] Furthermore, the process of using the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis to interpret graphs and identify the subgraph structure that contributes most to the classification results includes: optimizing the objective function using the GNNExplainer algorithm to extract the minimum interpretable subgraph; locating important nodes and edges through the attention weight distribution in the graph neural network; calculating the gradient of the classification results with respect to the graph structure to quantify the sensitivity of nodes and edges to the prediction results; fusing the results of the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis to generate a comprehensive importance score for nodes and edges; extracting the minimum interpretable subgraph based on the importance score; and verifying semantic integrity.

[0026] Furthermore, the method for extracting malicious code control flow features based on graph neural networks further includes: extracting key control flow patterns and structural features from the original program based on the results of graph interpretation, and performing step-by-step decomposition to generate a structured execution sequence; integrating the step-by-step call subgraph with the sandbox environment for dynamic verification and behavior confirmation.

[0027] Furthermore, the process of extracting the control flow pattern, converting it into a structured detection signature, and mapping it to the original binary code includes: extracting the control flow pattern from the program's binary code, converting the extracted control flow subgraph into a canonical form and generating a unique hash value, mapping the subgraph hash to a specific instruction location in the original binary code; using a graph isomorphism detection algorithm to calculate the structural similarity between the new sample and known malicious patterns; and converting the graph structure pattern into executable detection rules, including control flow constraints and API call sequences.

[0028] Furthermore, the process of integrating with static analysis tools through standardized interfaces includes: designing standardized interfaces that provide interfaces for data exchange and function calls with static analysis tools, and adopting a unified data format and security authentication protocol; developing plug-in interfaces for static analysis tools, and integrating graph neural networks into these plug-in interfaces; and providing a visual representation of the graph structure.

[0029] Secondly, a malicious code control flow feature extraction system based on graph neural networks is provided, including:

[0030] The graph construction layer is used to construct control flow graphs, data flow graphs, and function call graphs from malicious code binaries and convert them into a unified graph data format that can be processed by graph neural networks.

[0031] The graph neural network layer is used to design the graph neural network architecture. It performs self-supervised pre-training on large-scale unlabeled program graph data. Based on the pre-trained graph neural network model, it performs supervised fine-tuning using labeled program graph data to train a graph-level classifier.

[0032] The graph interpretation layer is used to interpret graphs using the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis methods, and to identify the subgraph structures that contribute the most to the classification results.

[0033] The signature generation layer is used to convert the extracted control flow pattern into a structured detection signature and map it to the original binary code;

[0034] The tool integration layer is used to integrate with static analysis tools through standardized interfaces.

[0035] Furthermore, the malicious code control flow feature extraction system based on graph neural networks further includes: a pattern extraction layer, used to extract key control flow patterns and structural features from the original program based on the results of graph interpretation, and to perform step-by-step decomposition to generate a structured execution sequence, integrating the step-by-step call subgraph with the sandbox environment for dynamic verification and behavior confirmation.

[0036] The beneficial effects of this invention are as follows:

[0037] 1. Constructing a multi-level graph structure representation fully preserves important information such as control flow structure and data dependencies, which can identify the deep structural similarity of malicious code, has stronger resistance to deformation, and thus improves the accuracy of malicious code detection;

[0038] 2. It can identify specific malicious control flow patterns and structural features, identify key subgraphs, convert graph structural features into detection rules, and then integrate them with existing static analysis tools to improve usability. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating a method for extracting malicious code control flow features based on graph neural networks according to the present invention. Detailed Implementation

[0041] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0042] like Figure 1 As shown in some illustrative embodiments, a method for extracting malicious code control flow features based on graph neural networks is provided, including the following steps:

[0043] 101: Obtaining malicious code binary files. Binary files include formats such as PE, ELF, and Mach-O.

[0044] 102: Static analysis and graph structure construction, i.e., constructing control flow graphs, data flow graphs, and function call graphs from malicious code binaries.

[0045] After obtaining the malicious code binary file, the first step is to disassemble and perform static analysis on the binary file to extract the program's structural information. This structural information includes: instruction sequences, basic blocks, control transfer instructions, data dependencies, and function call relationships.

[0046] The process of constructing the control flow graph includes: parsing the instruction sequence of the binary file using a disassembler, dividing it into basic blocks with control transfer instructions as boundaries, and each basic block being a continuous sequence of instructions; extracting the attributes of each basic block as node attributes, including instruction type, register read / write status, and memory access mode; analyzing the target address and jump type of jump instructions, and constructing control transfer edges between basic blocks, with edge attributes including jump condition and execution frequency.

[0047] By disassembling and analyzing malicious code binary files, a disassembler engine is used to parse the machine code, generating a sequence of assembly instructions. Basic blocks are then defined using control transfer instructions as boundaries to identify control transfer relationships and generate a directed graph with basic blocks as nodes and control flow paths as edges. This clearly describes the execution path of the malicious code, demonstrating branching logic and loop structures, which helps in identifying obfuscated code.

[0048] The process of constructing a data flow graph includes: parsing operands and operation types in instructions, identifying the definition and usage of variables, using variables or operations as nodes, and data flow direction and type as edges. By analyzing the relationship between variable definitions and usage in the program, a directed graph is generated with variables or operations as nodes and data dependencies as edges. The edge attributes include the data flow direction and type, thereby revealing the dependencies between variables and facilitating the tracking of the flow path of sensitive data such as encryption keys and network addresses.

[0049] The process of constructing a function call graph includes: defining function boundaries, identifying direct and indirect call points, extracting function attributes as node attributes, and constructing call relationship edges. Node attributes include function type and parameter information, while edge attributes include call frequency and parameter passing. Extracting function boundary and call point information generates a directed graph with functions as nodes and call relationships as edges, which can display the interaction relationships between modules and quickly locate key functions.

[0050] 103: Graph preprocessing, which involves converting the constructed control flow graph, data flow graph, and function call graph into a unified graph data format that can be processed by graph neural networks, and transforming the original code graph into a data format that can be learned by machines.

[0051] Specifically, the first step is node feature extraction, which involves converting node attributes in the original graph into numerical feature vectors. The next step is edge feature extraction, such as encoding edge attributes into numerical or categorical features. Finally, graph structure standardization is performed to unify the graph representation, such as converting the edge relationships of the graph structure into a sparse adjacency matrix, processing isolated nodes / edges, and generating adjacency matrices or edge indices.

[0052] 104: Graph Neural Network Pre-training, which involves designing a graph neural network architecture and performing self-supervised pre-training on large-scale unlabeled program graph data. Graph neural network architectures include graph convolutional layers and graph pooling layers.

[0053] The design process of the graph convolutional layer includes: using a multi-layer graph convolutional network, each layer updates the node representation by aggregating neighbor node information, using an attention mechanism to calculate the importance weights of neighbor nodes, using an aggregation function to process directed edges and multiple types of nodes, using a multi-layer graph convolutional network to iteratively update the node representation, each layer aggregating one-hop neighbor information, and deep networks capturing multi-order neighborhood information.

[0054] The graph pooling strategy employed by the graph pooling layer includes: using a hierarchical pooling approach to progressively abstract the graph structure in the order from the basic block level to the function level and then to the program level; adopting a node selection strategy based on topological importance to retain key nodes and merge similar nodes; and maintaining the key structural attributes of the graph during the pooling process, thereby reducing computational complexity while preserving semantic information.

[0055] Self-supervised pre-training refers to pre-training the model on large-scale unlabeled program graph data through self-supervised tasks such as graph structure prediction, node attribute prediction, and edge prediction, enabling the model to learn the inherent patterns and rules of the program graph. Specific self-supervised learning tasks include:

[0056] Graph structure prediction task: By masking part of the graph structure, the model can predict the masked part, and a contrastive learning framework is used to distinguish between similar and dissimilar graph structures.

[0057] Node attribute prediction task: Randomly masking node attributes allows the model to predict the masked attributes based on context, enhancing the understanding of node semantics;

[0058] Edge prediction task: Randomly masked edges allow the model to predict connections between nodes, learning program control flow and data flow patterns.

[0059] Simultaneously, training samples are generated by randomly adding / removing edges, masking node attributes, and sampling subgraphs to maintain program semantic invariance and achieve graph data augmentation. Multi-level representation learning is achieved through collaborative learning of node-level, function-level, and program-level representations using graph convolutional and pooling layers.

[0060] 105: Graph classifier training, which is to train a graph-level classifier by using labeled graph data for supervised fine-tuning based on a pre-trained graph neural network model.

[0061] The labeled program graph data refers to labeled malicious / benign program graph data. The pre-trained model has already learned the general feature representation of program graphs. Further training using the labeled program graph data allows the model to adapt to specific classification tasks.

[0062] The process of training a map-level classifier also includes:

[0063] First, the program graph is converted into a fixed-dimensional vector representation through graph pooling and graph-level aggregation operations for subsequent classification tasks. Common graph pooling methods include global pooling, hierarchical pooling, and attention pooling.

[0064] Second, a multi-task learning framework is adopted, simultaneously performing malware detection, family classification, and behavior classification tasks to improve the model's generalization ability and efficiency. Malware detection is a binary classification problem, determining whether a program is malicious or benign; family classification is a multi-classification problem, further classifying malware into different families; and behavior classification is a multi-label classification problem, as malware may possess multiple behavioral characteristics, such as ransomware, cryptocurrency mining, and data theft. Through shared representations and joint training, the supervisory signals provided by different tasks can complement each other, regularizing their learning processes and reducing the risk of overfitting. Simultaneously, multi-task learning improves data utilization efficiency, making it particularly suitable for scenarios with limited labeled data.

[0065] Third, contrastive learning enhances the model's ability to distinguish between different malicious families, narrowing the representation distance between samples from the same family and widening the representation distance between dissimilar samples. Specifically, this includes: positive sample pairs coming from the same malicious family, and negative sample pairs coming from different families or benign software; data augmentation using graph structure perturbations, node attribute masks, or edge modifications; using the InfoNCE loss function to narrow the distance between positive sample pairs and widen the distance between negative sample pairs; and improving the model's discriminative ability through hard negative sample mining.

[0066] Based on a pre-trained graph neural network model, fine-tuning is performed using labeled malicious / benign program graph data. Through supervised fine-tuning, graph-level representation learning, multi-task learning, and contrastive learning, the model can accurately identify and classify malware, while distinguishing different malware families and behavior types. This not only improves the accuracy of malware detection but also enhances the model's generalization ability to unknown malware, effectively addressing malware variants and new attack methods.

[0067] 106: Graph interpretation and key subgraph identification, which uses the GNNExplainer algorithm, attention mechanism analysis and gradient analysis methods to interpret graphs and identify the subgraph structures that contribute the most to the classification results.

[0068] Specifically, the GNNExplainer algorithm is used to optimize the objective function and identify and extract the minimum interpretable subgraph. The GNNExplainer algorithm identifies the minimum subgraph structure that contributes most to the classification results by optimizing the mutual information objective function and sparsity constraints. Maximizing mutual information ensures that the subgraph retains key information for prediction, while sparsity constraints guarantee the simplicity of interpretation. The GNNExplainer algorithm extracts the subgraph by learning a soft mask. The optimized mask is then thresholded to obtain a binary mask, from which the minimum interpretable subgraph is extracted.

[0069] By analyzing the attention weight distribution in a graph neural network (Graph Neural Network), important nodes and edges can be located. In a Graph Neural Network, node representations are updated by weighted aggregation of neighbor information. Node importance is evaluated by calculating its attention weight entropy or weight variance; low entropy or high variance indicates concentrated attention and that the node is more important. Edge importance is represented by attention weights; higher weights indicate a greater contribution of the edge to the prediction. Therefore, analyzing the attention weight distribution allows for the localization of attention-concentrated structures.

[0070] The gradient of the classification result with respect to the graph structure is calculated to quantify the sensitivity of nodes and edges to the prediction results. The gradient analysis method is based on backpropagation and calculates the gradient magnitude of the classification result with respect to node features and adjacency matrix as an indicator of the importance of nodes and edges. This helps identify graph elements that are sensitive to the prediction results; the larger the absolute value of the gradient, the more significant its impact on the prediction results.

[0071] The results of the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis are combined to generate a comprehensive importance score for nodes and edges. Based on the importance score, a minimum interpretable subgraph is extracted, and semantic integrity is verified. The results of the three methods can be combined by weighting the GNNExplainer mask value, attention weights, and gradient magnitudes to obtain a unified importance score. The weights are determined through cross-validation or domain knowledge pre-setting.

[0072] The extraction of the least interpretable subgraph can be achieved through importance score thresholding, and the probability difference between the subgraph prediction result and the original classification result does not exceed a preset threshold. Semantic integrity verification is performed through domain rule matching or manual verification to confirm that the subgraph structure conforms to the semantic logic of the actual application scenario.

[0073] By integrating GNNExplainer, attention mechanism and gradient analysis multi-dimensional interpretation techniques, the key subgraph is accurately identified and its importance is quantified. Combined with minimization extraction and semantic verification, the accuracy, sparsity and understandability of the interpretation results are guaranteed, and the reliability of the graph neural network model decision is effectively improved.

[0074] 107: Extract control flow patterns and perform dynamic verification and behavior confirmation.

[0075] Specifically, firstly, based on the results of graph interpretation, key control flow patterns and structural features are extracted from the original program, including API call subgraphs, loop structures, and exception control flow. These are then decomposed into steps to generate structured execution sequences, which facilitates understanding, analysis, and refactoring of program behavior.

[0076] The step-by-step process of API call subgraphs includes: identifying API call points and execution order through control flow graphs and function call graphs, generating a linearized sequence of atomic steps; tracking the source and passed values ​​of API call parameters, and using data flow analysis techniques to ensure parameter accuracy; identifying conditional branch points and generating multi-path sequences, and managing different execution paths through tree structures or path markers; marking key API calls and their parameters, and recording operations that affect system state, such as file writing and network connections.

[0077] The step-by-step process of loop structure includes: identifying the loop structure through back-edge and natural loop analysis, and determining the loop entry, exit and loop body boundary; decomposing the loop into four atomic stages: initialization, condition checking, loop body and update, with each stage as an independent step; estimating the upper limit of the loop iteration number and termination condition through static analysis or dynamic profiling; identifying loop invariants and optimizing their positions, and tracking the changing patterns of key variables; and handling nested loops using hierarchical step-by-step processing, with step sequences generated for the outer and inner loops respectively.

[0078] The step-by-step process of exception control flow includes: decomposing anti-debugging techniques into detection steps (such as calling anti-debugging APIs), judgment steps (condition evaluation), and response steps (such as termination or misdirection); analyzing the deobfuscation process of code obfuscation, including decoding steps, recovery steps, and execution steps; mapping the implementation steps of evasion techniques, including environment detection, authenticity verification, and decision execution; and marking the triggering conditions and response behaviors of exception control flow to generate a linear step sequence.

[0079] Then, the step-by-step call subgraph is integrated with the sandbox environment for dynamic verification and behavior confirmation. Through dynamic execution and behavior verification, the static analysis results are supplemented, corrected, and confirmed, thereby improving the accuracy and credibility of the analysis results.

[0080] The process of sandbox environment integration includes: simulating execution in the sandbox according to the step sequence, recording the execution status of each step, including system calls, register status, stack information, etc.; comparing the actual execution path with the path predicted by static analysis to identify deviation points, such as branches not entered or abnormal jumps, to help discover anti-analysis logic or environment-sensitive behaviors; and confirming whether the behavioral patterns identified in static analysis actually occur in the dynamic environment to verify their effectiveness.

[0081] Dynamic verification refers to capturing and supplementing runtime features in real time during sandbox execution to compensate for the shortcomings of static analysis. Specifically, this includes: recording the actual input parameters and return values ​​of each API call and analyzing whether they are consistent with static predictions; tracking memory changes after key steps, identifying memory allocation, writing, and release operations to assist in detecting buffer overflows, memory leaks, and other behaviors; and monitoring actual file system read / write operations and real data flows in network communication, such as HTTP requests and DNS queries.

[0082] Behavioral verification refers to modifying and enhancing static analysis based on dynamic verification results. For example: removing static features that were not verified during dynamic execution to avoid false positives; generating reproducible dynamic behavioral signatures based on verified behavioral patterns for subsequent detection or tracing; and constructing hybrid detection rules by combining static structural features and dynamic behavioral features to improve the identification capabilities in scenarios such as malicious code detection and behavioral analysis.

[0083] By decomposing complex program control flow patterns into clear sequence of steps, the understandability of program behavior is improved, making it suitable for applications requiring precise tracking of execution paths, identification of critical logic, or resistance to obfuscation and anti-debugging techniques. Furthermore, by combining static step-by-step analysis results with dynamic sandbox execution, it not only verifies and supplements program behavior but also enhances the completeness and reliability of behavioral analysis, making it suitable for scenarios with high security requirements such as malicious code detection, software auditing, and automated testing.

[0084] 108: Generate graph structure signatures, which involves converting the extracted control flow pattern into a structured detection signature and mapping it to the original binary code.

[0085] Subgraph hashing and code mapping: The control flow pattern is extracted from the program's binary code. The extracted control flow subgraph is converted into a canonical form and a unique hash value is generated. The subgraph hash is then mapped to the specific instruction location in the original binary code. Specifically, the subgraph is converted into a canonical representation, and the node order and edge direction are standardized. A cryptographic hash function is used to generate a unique identifier for the canonical subgraph, recording the offset address of the subgraph node in the PE file and the instruction sequence. The start and end positions of basic blocks in the file are marked, locating the precise position of the control flow pattern in the PE file code segment.

[0086] Graph isomorphism detection and pattern matching: Graph isomorphism detection algorithms are used to calculate the structural similarity between new samples and known malicious patterns. For example, the Nauty algorithm or the VFLib library is used for subgraph isomorphism detection; structural fingerprints are generated based on topological features for rapid screening; graph structure similarity scores are calculated, combining topological and semantic information; a hierarchical matching strategy is adopted to improve detection efficiency; and a graph structure library of known malicious patterns is constructed for comparison.

[0087] Structural Pattern Rule Generation: This process converts graph structural patterns into executable detection rules, including control flow constraints and API call sequences. Specifically, it defines control flow constraint rules to express dominance and reachability relationships between nodes; generates behavior detection rules based on API call sequences; optimizes rule conditions to avoid overfitting; and verifies rule effectiveness. The output consists of detection rules in various formats, including YARA and custom DSLs, ensuring the structural integrity and semantic consistency of the generated rules.

[0088] By converting control flow patterns into structured signatures and accurately mapping them to binary code, efficient and accurate malware detection is achieved, effectively identifying obfuscated and transformed malware variants. The use of graph isomorphism detection and structural similarity calculation enables the system to identify unknown threats, while the generated detection rules are both readable and machine-executable, improving malware detection efficiency.

[0089] 109: Integrate with static analysis tools through standardized interfaces.

[0090] A standardized interface is designed to facilitate data exchange and function calls with static analysis tools, employing a unified data format and security authentication protocol. Static analysis tools include IDA Pro and Ghidra. For example, the standardized interface includes a functional abstraction layer and a tool adaptation layer to encapsulate operations such as graph construction, feature extraction, and pattern matching, and supports data structure conversion between different tools.

[0091] Develop a plugin interface for static analysis tools, and integrate graph neural networks. Specifically, integrate graph neural network analysis functions, which can call graph structure analysis, pattern matching, hash generation, node classification, and graph classification.

[0092] It provides a visual representation of graph structures, including graphical rendering of control flow graphs, call graphs, and API subgraphs, and supports interactive operations and result annotation.

[0093] To meet the needs of large-scale sample processing, it supports batch graph structure analysis and pattern matching: built-in task queue and scheduling mechanism to support parallel processing of multiple samples and improve analysis efficiency; automatically summarize analysis results, generate structured reports, and support export to JSON, CSV or visualization charts; during batch analysis, it automatically matches samples with known pattern libraries and outputs similarity scores and matching details.

[0094] By designing standardized interfaces and plug-in systems, graph neural network analysis capabilities are integrated into mainstream static analysis tools. This not only significantly improves the automation and efficiency of program structure analysis and pattern recognition, but also enhances the understandability and scalability of the analysis results through visualization and batch processing functions.

[0095] This invention also provides a malicious code control flow feature extraction system based on graph neural networks, comprising:

[0096] The graph construction layer is used to construct control flow graphs, data flow graphs, and function call graphs from malicious code binaries and convert them into a unified graph data format that can be processed by graph neural networks.

[0097] The graph neural network layer is used to design the graph neural network architecture. It performs self-supervised pre-training on large-scale unlabeled program graph data. Based on the pre-trained graph neural network model, it performs supervised fine-tuning using labeled program graph data to train a graph-level classifier.

[0098] The graph interpretation layer is used to interpret graphs using the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis methods, and to identify the subgraph structures that contribute the most to the classification results.

[0099] The pattern extraction layer is used to extract key control flow patterns and structural features from the original program based on the results of graph interpretation, and to decompose them into steps to generate structured execution sequences. The step-by-step call subgraph is then integrated with the sandbox environment for dynamic verification and behavior confirmation.

[0100] The signature generation layer is used to convert the extracted control flow pattern into a structured detection signature and map it to the original binary code;

[0101] The tool integration layer is used to integrate with static analysis tools through standardized interfaces.

[0102] The graph construction layer includes:

[0103] The control flow graph construction module is used to parse the instruction sequence of a binary file using a disassembler, divide it into basic blocks with control transfer instructions as boundaries, and the basic blocks are consecutive instruction sequences; extract the attributes of each basic block as node attributes, including: instruction type, register read / write status, and memory access mode; analyze the target address and jump type of jump instructions, and construct control transfer edges between basic blocks, with edge attributes including: jump condition and execution frequency.

[0104] The data flow graph construction module is used to parse operands and operation types in instructions, identify the definition and usage of variables, and use variables or operations as nodes and data flow direction and type as edges.

[0105] The function call graph construction module is used to delineate function boundaries, identify direct and indirect call points, extract function attributes as node attributes, and construct call relationship edges. Node attributes include: function type and parameter information, while edge attributes include: call frequency and parameter passing.

[0106] The graph neural network architecture includes graph convolutional layers and graph pooling layers.

[0107] The design process of graph convolutional layers includes: using multi-layer graph convolutional networks, updating node representations by aggregating neighbor node information in each layer, and using aggregation functions to process directed edges and multiple types of nodes;

[0108] The graph pooling strategy adopted by the graph pooling layer includes: using hierarchical pooling to gradually abstract the graph structure in the order from the basic block level to the function level and then to the program level;

[0109] Self-supervised pre-training refers to pre-training on large-scale unlabeled procedural graph data through self-supervised tasks such as graph structure prediction, node attribute prediction, and edge prediction.

[0110] The training of the graph-level classifier also includes: converting the program graph into a fixed-dimensional vector representation through graph pooling and graph-level aggregation operations; adopting a multi-task learning framework to simultaneously perform malicious detection, family classification, and behavior classification tasks; and enhancing the model's ability to distinguish different malicious families through contrastive learning, thereby narrowing the representation distance between samples of the same family.

[0111] The graph interpretation layer includes:

[0112] The first interpretation module is used to optimize the objective function using the GNNExplainer algorithm and extract the minimum interpretable subgraph;

[0113] The second interpretation module is used to locate important nodes and edges by analyzing the attention weight distribution in the graph neural network.

[0114] The third interpretation module is used to calculate the gradient of the classification result with respect to the graph structure and to quantify the sensitivity of nodes and edges to the prediction result.

[0115] The fusion output module is used to fuse the results of the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis methods to generate a comprehensive importance score for nodes and edges. Based on the importance score, the minimum interpretable subgraph is extracted, and semantic integrity is verified.

[0116] The signature generation layer extracts the control flow pattern from the binary code of the program, converts the extracted control flow subgraph into a canonical form and generates a unique hash value, and maps the subgraph hash to the specific instruction location in the original binary code; it uses a graph isomorphism detection algorithm to calculate the structural similarity between the new sample and known malicious patterns; and it converts the graph structure pattern into executable detection rules, including control flow constraints and API call sequences.

[0117] The tool integration layer features a standardized interface designed to facilitate data exchange and function calls with static analysis tools, employing a unified data format and security authentication protocol. It also develops plugin interfaces for static analysis tools, integrating graph neural networks, and provides visualization of graph structures.

[0118] This invention utilizes graph neural network technology to automatically extract control flow and data flow features from malicious code, and generates detection rules based on the graph structure, thereby improving the accuracy of malicious code identification. Through function-level and basic block-level analysis, it not only effectively preserves the program's structural information but also automatically identifies key subgraphs.

[0119] In terms of resistance to deformation, since the graph-based feature extraction method is not sensitive to deformation methods such as code obfuscation, packing, and instruction replacement, even if malicious code has undergone multiple deformation processes, this invention can still accurately identify its potential malicious behavior through topological structure matching, effectively overcoming the limitations of traditional static analysis in resisting code deformation, and significantly enhancing the stability and generalization ability of detection.

[0120] This invention can automatically identify and interpret key control flow patterns, abnormal call structures, and data dependencies in malicious code. Furthermore, this invention designs a standardized interface that supports seamless integration with mainstream static analysis tools such as IDA Pro and Ghidra, improving the system's usability and compatibility.

[0121] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for extracting malicious code control flow features based on graph neural networks, characterized in that, include: Construct control flow graphs, data flow graphs, and function call graphs from malicious code binaries and convert them into a unified graph data format that can be processed by graph neural networks; Design a graph neural network architecture and perform self-supervised pre-training on large-scale unlabeled program graph data; Based on the pre-trained graph neural network model, supervised fine-tuning is performed using labeled program graph data to train a graph-level classifier. The GNNExplainer algorithm, attention mechanism analysis, and gradient analysis methods are used to interpret graphs and identify the subgraph structures that contribute the most to the classification results. The extracted control flow pattern is converted into a structured detection signature and mapped to the original binary code; It integrates with static analysis tools through a standardized interface.

2. The method for extracting malicious code control flow features based on graph neural networks according to claim 1, characterized in that, The process of constructing the control flow graph includes: The instruction sequence of a binary file is analyzed using a disassembler, and basic blocks are divided with control transfer instructions as boundaries. These basic blocks are consecutive instruction sequences. Extract the attributes of each basic block as node attributes. Node attributes include: instruction type, register read / write status, and memory access mode. Analyze the target address and jump type of the jump instruction, and construct the control transfer edges between basic blocks. The edge attributes include: jump condition and execution frequency attribute. The process of constructing the data flow graph includes: parsing the operands and operation types in the instructions, identifying the definition and usage of variables, using variables or operations as nodes, and using the data flow direction and type as edges; The process of constructing the function call graph includes: dividing function boundaries, identifying direct and indirect call points, extracting function attributes as node attributes, and constructing call relationship edges. The node attributes include function type and parameter information, while the edge attributes include call frequency and parameter passing.

3. The method for extracting malicious code control flow features based on graph neural networks according to claim 2, characterized in that, The graph neural network architecture includes: graph convolutional layers and graph pooling layers; The design process of the graph convolutional layer includes: using a multi-layer graph convolutional network, updating the node representation by aggregating neighbor node information in each layer, and using aggregation functions to process directed edges and multiple types of nodes; The graph pooling strategy adopted by the graph pooling layer includes: using a hierarchical pooling method to gradually abstract the graph structure in the order from the basic block level to the function level and then to the program level; The self-supervised pre-training refers to pre-training on large-scale unlabeled procedural graph data through self-supervised tasks such as graph structure prediction, node attribute prediction, and edge prediction.

4. The method for extracting malicious code control flow features based on graph neural networks according to claim 3, characterized in that, The process of training a map-level classifier also includes: The program graph is converted into a fixed-dimensional vector representation through graph pooling and graph-level aggregation operations. A multi-task learning framework is adopted to perform malicious detection, family classification and behavior classification tasks simultaneously; By contrastive learning, the model's ability to distinguish between different malicious families is enhanced, and the representational distance between samples of the same family is narrowed.

5. The method for extracting malicious code control flow features based on graph neural networks according to claim 4, characterized in that, The process of using the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis to interpret graphs and identify the subgraph structures that contribute most to the classification results includes: The GNNExplainer algorithm is used to optimize the objective function and extract the minimum interpretable subgraph. By utilizing the attention weight distribution in the graph neural network, important nodes and edges can be located. Calculate the gradient of the classification result with respect to the graph structure, and quantify the sensitivity of nodes and edges to the prediction results; By integrating the results of the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis, a comprehensive importance score for nodes and edges is generated. Based on the importance score, a minimum interpretable subgraph is extracted, and semantic integrity is verified.

6. The method for extracting malicious code control flow features based on graph neural networks according to claim 5, characterized in that, Also includes: Based on the results of graph interpretation, key control flow patterns and structural features are extracted from the original program and decomposed into steps to generate a structured execution sequence. The step-by-step call subgraph is then integrated with the sandbox environment for dynamic verification and behavior confirmation.

7. The method for extracting malicious code control flow features based on graph neural networks according to claim 6, characterized in that, The process of extracting the control flow pattern, converting it into a structured detection signature, and mapping it to the original binary code includes: Extract the control flow pattern from the binary code of the program, convert the extracted control flow subgraph into a canonical form and generate a unique hash value, and map the subgraph hash to the specific instruction location in the original binary code; The structural similarity between the new sample and known malicious patterns is calculated using a graph isomorphism detection algorithm. Transform graph structure patterns into executable detection rules, including control flow constraints and API call sequences.

8. The method for extracting malicious code control flow features based on graph neural networks according to claim 7, characterized in that, The process of integrating with static analysis tools through a standardized interface includes: The design incorporates a standardized interface that provides a way to exchange data and call functions with static analysis tools, and adopts a unified data format and security authentication protocol. Develop a plugin interface for a static analysis tool, and integrate a graph neural network into this plugin interface; Provides a visual representation of graph structures.

9. A malicious code control flow feature extraction system based on graph neural networks, characterized in that, include: The graph construction layer is used to construct control flow graphs, data flow graphs, and function call graphs from malicious code binaries and convert them into a unified graph data format that can be processed by graph neural networks. The graph neural network layer is used to design the graph neural network architecture. It performs self-supervised pre-training on large-scale unlabeled program graph data. Based on the pre-trained graph neural network model, it performs supervised fine-tuning using labeled program graph data to train a graph-level classifier. The graph interpretation layer is used to interpret graphs using the GNNExplainer algorithm, attention mechanism analysis, and gradient analysis methods, and to identify the subgraph structures that contribute the most to the classification results. The signature generation layer is used to convert the extracted control flow pattern into a structured detection signature and map it to the original binary code; The tool integration layer is used to integrate with static analysis tools through standardized interfaces.

10. A malicious code control flow feature extraction system based on graph neural networks according to claim 9, characterized in that, Also includes: The pattern extraction layer is used to extract key control flow patterns and structural features from the original program based on the results of graph interpretation, and to decompose them into steps to generate structured execution sequences. The step-by-step call subgraph is then integrated with the sandbox environment for dynamic verification and behavior confirmation.

Images