Malicious behavior detection method and system based on data mining

Abstract

The invention discloses a malicious behavior detection method and system based on data mining, and relates to the technical field of information security, and the method comprises the steps: mining malicious behavior modes of which the occurrence frequency exceeds a preset threshold value from a malicious software sample based on an attribute behavior map, and forming a malicious behavior mode library; performing graph structure matching operation on each attack sub-graph mode in the malicious behavior mode library and the attribute behavior graph of the to-be-tested software, counting the occurrence frequency of each attack sub-graph mode in the attribute behavior graph of the to-be-tested software, and generating a high-dimensional graph structure feature vector; and performing causal association analysis on the graph structure feature vector by adopting a causal reasoning algorithm, quantitatively evaluating the causal action intensity between each feature dimension and the malicious behavior, and selecting the feature dimensions with clear causal association to form an optimized feature subset. According to the method, feature screening mechanism innovation from statistical correlation to causal correlation is realized.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for detecting malicious behavior based on data mining. Background Technology

[0002] With the widespread adoption of technologies such as cloud computing and the Internet of Things, the global data volume is growing exponentially. Behavioral data generated during software operation has become a crucial asset for understanding cyber threats. Against this backdrop, big data mining technology has made it possible to analyze massive amounts of multi-source software behavioral data, driving a shift in security analysis models from "passive defense" to "proactive prediction." Traditional malware detection technologies primarily rely on signature-based static detection and behavior rule-based dynamic detection. Static detection achieves rapid identification by comparing signatures with known malware databases, but its essence is post-incident defense, making it difficult to deal with zero-day attacks and variant malware. Dynamic detection technology identifies malicious intent by monitoring the runtime behavior of software (such as API call sequences, file operations, and network communications). While it possesses some ability to discover unknown threats, in a big data environment, it struggles to automatically and efficiently extract effective features from massive, high-dimensional behavioral data.

[0003] While detection methods based on big data mining hold significant potential, they still face two major bottlenecks: data security and depth of data mining. First, at the feature mining level, existing technologies rely excessively on traditional big data mining algorithms (such as frequent pattern discovery) to extract statistical correlation features, making it difficult to distinguish between causal features that truly lead to malicious behavior and accidental false associations. This makes the model vulnerable to adversarial examples contaminating the training data, reducing detection robustness and introducing new data security risks due to the potential for model "poisoning." Second, at the data fusion level, existing methods often handle multi-source heterogeneous data (such as API sequences and network traffic) with simple concatenation, failing to utilize deep big data mining techniques such as graph neural networks to model their inherent relationships. This shallow fusion not only misses crucial attack evidence but also exacerbates data security risks due to privacy leaks during data integration, making it difficult to meet the detection requirements that prioritize both high accuracy and high security. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a malicious behavior detection method based on data mining to solve the problems of insufficient model robustness due to the lack of causality in feature mining and the limited security due to shallow data fusion in existing technologies.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a malicious behavior detection method based on data mining, comprising: collecting multi-source behavioral data during software runtime and constructing an attribute behavior graph for each software; based on the attribute behavior graph, mining malicious behavior patterns that occur more frequently than a preset threshold from malware samples to form a malicious behavior pattern library; performing graph structure matching operations on each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test, and counting the frequency of each attack subgraph pattern in the attribute behavior graph of the software under test to generate a high-dimensional graph structure feature vector; using a causal inference algorithm to perform causal association analysis on the graph structure feature vector, quantifying and evaluating the causal effect strength between each feature dimension and malicious behavior, and selecting feature dimensions with clear causal associations to form an optimized feature subset; training a malicious behavior classification model based on the optimized feature subset, and applying the malicious behavior classification model to the attribute behavior graph features of unknown software to detect malicious behavior, generating a malicious behavior detection report.

[0008] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the multi-source behavioral data includes application programming interface call sequences, kernel-level operation parameters, configuration item modification records, and network communication behavior data.

[0009] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the specific steps for constructing the attribute behavior graph of each software are as follows:

[0010] For each software sample, it is run and monitored in real time in an isolated environment, while collecting multi-source behavioral data.

[0011] The system parses and processes multi-source behavioral data, extracts call instances and call timestamp sequences from application programming interface call sequences, and establishes temporal dependencies between call instances based on the call timestamp sequences.

[0012] The call instances are mapped to graph nodes, and temporal dependencies are mapped to directed edges, thus constructing an initial behavioral graph for each software.

[0013] Based on the initial behavior graph, kernel-level operation parameters, configuration item modification records, and network communication behavior data are used as attribute features and attached to the corresponding graph nodes and directed edges to form the attribute behavior graph of each software.

[0014] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the specific steps for forming the malicious behavior pattern library are as follows:

[0015] Based on the attribute behavior graph, a depth-first search strategy is used to traverse the graph structure of each malware sample and extract all connected subgraphs that meet the minimum number of nodes requirement as a candidate subgraph set.

[0016] For each connected subgraph in the candidate subgraph set, calculate the weighted frequency score in the malware sample set;

[0017] The weighted frequency score is compared with a preset threshold to filter out all malicious behavior patterns that exceed the threshold.

[0018] Malicious behavior patterns are sorted in descending order according to their weighted frequency scores and then labeled with attribute features to form a malicious behavior pattern library.

[0019] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the step of performing graph structure matching operation between each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test refers to using a graph isomorphic matching algorithm to perform multi-level structure matching between the attack subgraph patterns in the malicious behavior pattern library and the attribute behavior graph of the software under test, and combining node attribute similarity and edge structure constraints to calculate the matching degree score of each attack subgraph pattern in the attribute behavior graph of the software under test.

[0020] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the specific steps for generating the high-dimensional graph structure feature vector are as follows:

[0021] The number of matches with a statistical matching score greater than the multi-factor weight threshold is taken as the effective occurrence frequency;

[0022] Based on the effective occurrence frequency and combined with the weight allocation mechanism of the matching degree score, a high-dimensional feature vector with the same dimension as the number of attack subgraph patterns in the malicious behavior pattern library is constructed.

[0023] Principal component analysis (PCA) is used to perform dimensionality reduction and visualization verification on high-dimensional feature vectors, generating graph-structured feature vectors.

[0024] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the method employs a causal reasoning algorithm to perform causal correlation analysis on the graph structure feature vectors, quantitatively evaluates the strength of the causal relationship between each feature dimension and malicious behavior, and selects feature dimensions with clear causal relationships to form an optimized feature subset. The specific steps are as follows:

[0025] Causal inference algorithms are used to perform causal correlation analysis on graph structure feature vectors to generate a causal relationship graph between feature dimensions and malicious behavior.

[0026] Based on the causal relationship graph, the causal effect estimation method is used to quantify the causal effect strength of each feature dimension and generate a causal effect strength index.

[0027] The feature dimensions whose causal effect strength index exceeds the causal weight threshold are used as the initial optimization set, and consistency verification and contribution ranking are performed to form an optimized feature subset.

[0028] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the specific steps of training the malicious behavior classification model based on an optimized feature subset are as follows:

[0029] Based on the optimized feature subset, graph structure feature vectors are extracted from the software sample set with known classification labels and assigned causal importance weights to generate a weighted training dataset.

[0030] Based on the weighted training dataset, a loss function incorporating causal regularization terms is constructed and the parameters of the malicious behavior classification model are initialized.

[0031] Based on the loss function and the parameters of the malicious behavior classification model, the malicious behavior classification model is iteratively trained using a meta-learning optimization algorithm to obtain the trained malicious behavior classification model.

[0032] As a preferred embodiment of the malicious behavior detection method based on data mining described in this invention, the specific steps for generating the malicious behavior detection report are as follows:

[0033] Input the attribute behavior graph feature vector of the unknown software into the trained malicious behavior classification model, and output the confidence probability of the malicious behavior;

[0034] The confidence probability of malicious behavior is dynamically analyzed from multiple dimensions, and combined with the importance assessment of causal features, a malicious behavior detection report is generated.

[0035] Secondly, this invention provides a malicious behavior detection system based on data mining, comprising: a data acquisition module for collecting multi-source behavioral data during software runtime and constructing an attribute behavior graph for each software; a pattern mining module for mining malicious behavior patterns that occur more frequently than a preset threshold from malware samples based on the attribute behavior graph, forming a malicious behavior pattern library; a matching and quantification module for performing graph structure matching operations on each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test, and counting the frequency of each attack subgraph pattern in the attribute behavior graph of the software under test, generating a high-dimensional graph structure feature vector; a causal analysis module for performing causal association analysis on the graph structure feature vector using a causal inference algorithm, quantifying and evaluating the causal effect strength between each feature dimension and malicious behavior, and selecting feature dimensions with clear causal associations to form an optimized feature subset; and a report generation module for training a malicious behavior classification model based on the optimized feature subset, applying the malicious behavior classification model to the attribute behavior graph features of unknown software to detect malicious behavior, and generating a malicious behavior detection report.

[0036] The beneficial effects of this invention are as follows: By conducting in-depth analysis of multi-source behavioral data through big data mining, a breakthrough in feature representation from linear sequences to multi-dimensional graph structures is achieved within the data security framework, enabling precise capture of complex attack chains. Furthermore, by quantifying the feature association strength through causal inference algorithms, an innovative feature selection mechanism from statistical correlation to causal association is realized, enhancing both the robustness and interpretability of the model. Attached Figure Description

[0037] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a flowchart of a data mining-based malicious behavior detection method.

[0039] Figure 2 A flowchart for constructing an attribute behavior graph.

[0040] Figure 3 A flowchart for creating a library of malicious behavior patterns.

[0041] Figure 4 A flowchart for generating feature vectors of a high-dimensional graph structure. Detailed Implementation

[0042] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0043] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0044] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0045] Reference Figures 1-4 This is one embodiment of the present invention, which provides a malicious behavior detection method based on data mining, including the following steps:

[0046] S1. Collect multi-source behavioral data during software runtime and construct an attribute behavior map for each software.

[0047] For each software sample, it is run and monitored in real time in an isolated environment, while collecting multi-source behavioral data.

[0048] The specific process includes: running and monitoring each software sample in an isolated environment in real time; capturing the operation interface functions called by the software sample during execution and their call order using behavior monitoring tools to form an application programming interface call sequence; recording the low-level operation details of the software sample on resources such as files, processes, and memory using the event tracing mechanism provided by the kernel to form kernel-level operation parameters; continuously monitoring changes in registry entries or configuration files, recording the content of configuration items modified by the software sample and the time of modification to form a configuration item modification record; and intercepting communication requests sent or received by the software sample using network traffic monitoring technology, including target address, port, protocol type, and data transmission direction to form network communication behavior data.

[0049] It should be noted that the software samples include known-classified malware samples and normal software samples, with the malware samples sourced from a pre-built malware database.

[0050] The malware database is primarily built upon global threat intelligence and historical attack data, employing methods such as multi-source sample collection, dynamic behavior verification, and standardized classification and labeling to provide a high-quality sample foundation for malicious behavior detection.

[0051] The system parses and processes multi-source behavioral data, extracts call instances and call timestamp sequences from the application programming interface call sequence, and establishes temporal dependencies between call instances based on the call timestamp sequences.

[0052] The multi-source behavioral data is parsed and processed, specifically including: identifying each application programming interface call sequence, extracting each actual function call as a call instance, and simultaneously extracting the precise timestamp corresponding to the call instance to form a call timestamp; performing structured parsing of kernel-level operation parameters, separating fields such as operation type, target resource path, access permissions, and operation result; performing semantic parsing of configuration item modification records, identifying information such as modified registry keys or configuration file paths, original and new values, and modification trigger time; performing protocol parsing of network communication behavioral data, extracting elements such as communication direction, target address, target port, transmission protocol type, data packet size, and communication frequency; and then converting the parsing results into a unified structured format to provide standardized input for subsequent construction of attribute behavior graphs.

[0053] By mapping call instances to graph nodes and temporal dependencies to directed edges, an initial behavioral graph is constructed for each software.

[0054] The specific process includes treating each call instance as an independent node in the graph, with each node corresponding to a function call extracted from the application programming interface call sequence; for any two call instances with a sequential execution order, if the call timestamp of one call instance is earlier than that of the other, a directed edge is drawn from the node corresponding to the earlier call instance to the node corresponding to the later call instance, and the direction of the directed edge indicates the flow of execution time; by organizing all call instances and their temporal dependencies in the form of nodes and directed edges, the initial behavior graph of each software is finally constructed.

[0055] Based on the initial behavior graph, kernel-level operation parameters, configuration item modification records, and network communication behavior data are used as attribute features and attached to the corresponding graph nodes and directed edges to form the attribute behavior graph of each software.

[0056] The specific process includes, based on the initial behavior graph, using kernel-level operation parameters, configuration item modification records, and network communication behavior data as attribute features, and according to the association between the attribute features and specific calling instances or the interactions between calling instances during software operation, appending kernel-level operation parameters to the graph nodes mapped to the corresponding calling instances, appending configuration item modification records to the graph nodes corresponding to the calling instances that triggered the configuration change, and appending network communication behavior data to the graph nodes corresponding to the calling instances involved in network operations or the directed edges between the calling instances and other calling instances. This enhances the semantic information of nodes and directed edges on the basis of the initial behavior graph, forming an attribute behavior graph for each software.

[0057] S2. Based on attribute behavior graphs, malicious behavior patterns that occur more frequently than a preset threshold are mined from malware samples to form a malicious behavior pattern library.

[0058] Based on attribute behavior graphs, a depth-first search strategy is used to traverse the graph structure of each malware sample and extract all connected subgraphs that meet the minimum number of nodes requirement as a set of candidate subgraphs.

[0059] The specific process includes traversing the graph structure of each malware sample based on the attribute behavior graph using a depth-first search strategy. During the traversal, starting from any starting node, the system continuously visits adjacent nodes along directed edges until it can no longer expand. After backtracking, it tries other unvisited paths, thereby comprehensively exploring all possible connected structures in the graph. During the traversal, each discovered connected subgraph is recorded, and only connected subgraphs containing at least a preset minimum number of nodes are retained. These connected subgraphs that meet the conditions are then gathered together to form a candidate subgraph set.

[0060] It should be noted that the depth-first search strategy is a graph traversal method. Starting from a certain starting node in the attribute behavior graph, it visits adjacent nodes as deeply as possible along a path. Each time a new node is reached, it immediately continues to explore forward from that starting point until there are no unvisited adjacent nodes on the current path. At this point, it backtracks to the previous node and tries other unvisited branches starting from that node. This process is repeated until all reachable nodes in the attribute behavior graph have been visited.

[0061] The preset minimum number of nodes is set according to the actual detection requirements and is used to filter connected subgraphs with sufficient structural complexity.

[0062] For each connected subgraph in the candidate subgraph set, calculate the weighted frequency score in the malware sample set, expressed as:

[0063] ;

[0064] in, Representing a connected subgraph The weighted frequency score, Represents a connected subgraph. This represents a collection of malware samples. This represents a single malware sample. This represents the natural exponential function. This represents the total dimension of the feature vector. The dimension index number of the feature vector. Representing a connected subgraph In the Attribute values ​​on each feature dimension This indicates that the malware sample is in the... Attribute values ​​on each feature dimension Indicates the first Standard deviation of each feature dimension.

[0065] It should be noted that the attribute values ​​of each dimension in the feature vector are standardized so that the mean of that dimension is zero and the standard deviation is one, so as to eliminate the influence of the difference in the dimensions of different feature dimensions when calculating the weighted frequency score.

[0066] The specific process includes calculating the weighted frequency score of each connected subgraph in the candidate subgraph set within the malware sample set. The weighted frequency score is calculated by traversing each sample in the malware sample set, determining whether the current connected subgraph is a subgraph structure of the sample attribute behavior graph, and if so, including it in the matching item. Based on the difference in attribute values ​​between the connected subgraph and each malware sample in the feature dimension, exponential decay processing is performed using the standard deviation of the corresponding feature dimension. Finally, the exponential terms of all matching samples are summed to obtain the weighted frequency score of the connected subgraph.

[0067] The weighted frequency score is compared with a preset threshold to filter out all malicious behavior patterns that exceed the threshold.

[0068] The specific process involves comparing the weighted frequency score of each connected subgraph in the malware sample set with a preset threshold value. If the weighted frequency score of a connected subgraph is higher than the preset threshold value, the connected subgraph is considered to appear frequently and be representative in the malware samples, and is thus identified as a malicious behavior pattern.

[0069] It should be noted that the preset threshold is set manually based on the statistical analysis of the malware sample set and the actual detection needs. It is used as a criterion to measure the frequency of occurrence of connected subgraphs in malware. The preset threshold is usually determined by observing the weighted frequency score distribution of malicious behavior patterns and achieving a balance between high recall and precision. Its specific value range is generally between zero and the total number of malware samples.

[0070] Malicious behavior patterns are sorted in descending order according to their weighted frequency scores and then labeled with attribute features to form a malicious behavior pattern library.

[0071] The specific process includes sorting all the selected malicious behavior patterns in descending order according to their weighted frequency scores calculated in the malware sample set, and attaching attribute feature tags to each malicious behavior pattern, which consist of kernel-level operation parameters, configuration modification records, and network communication behavior data associated with its nodes and directed edges, ultimately forming a malicious behavior pattern library.

[0072] S3. Perform graph structure matching operation on each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test, and count the frequency of each attack subgraph pattern in the attribute behavior graph of the software under test to generate a high-dimensional graph structure feature vector.

[0073] A graph isomorphic matching algorithm is used to perform multi-level structural matching between attack subgraph patterns in the malicious behavior pattern library and the attribute behavior graph of the software under test. Combining node attribute similarity and edge structure constraints, the matching degree score of each attack subgraph pattern in the attribute behavior graph of the software under test is calculated. The expression is as follows:

[0074] ;

[0075] in, Indicates attack subgraph pattern Attribute Behavior Map of the Software Under Test The matching score between them Indicates the attack subgraph pattern. This represents the attribute behavior graph of the software under test. This represents the Sigmoid activation function. This represents a single node index variable in the attack subgraph pattern. This represents the index variable of a single node in the attribute behavior graph of the software under test. Indicates the nodes in the attack subgraph pattern Attribute behavior graph nodes of the software under test The relative importance weights between them Indicates the nodes in the attack subgraph pattern The eigenvector representation, Represents nodes in the behavior graph of the software under test. The eigenvector representation, The weighting coefficients represent the similarity of edge structures. Indicates attack subgraph pattern The set of edges, Represents the attribute behavior graph of the software under test The set of edges.

[0076] It should be noted that the weight coefficient of edge structure similarity is a parameter used to adjust the importance of edge structure constraints in the matching score calculation. This parameter is selected to optimize the model performance based on existing parameter tuning methods such as cross-validation or grid search on malware sample sets, according to evaluation indicators such as detection accuracy, recall, or F1 score. The specific value range is usually between zero and one.

[0077] The specific process includes using a graph isomorphism matching algorithm to perform multi-level structural matching between attack subgraph patterns in the malicious behavior pattern library and the attribute behavior graph of the software under test. By comparing the feature vectors of each node in the attack subgraph pattern with the corresponding node in the attribute behavior graph of the software under test, the node attribute similarity is calculated. Combining the correspondence between the edge structure of the attack subgraph pattern and the attribute behavior graph of the software under test, the relative importance weights between nodes and the structural consistency of the edge set are comprehensively considered. The Sigmoid activation function is used to perform a nonlinear mapping on the weighted sum of node attribute similarity and edge structure constraints to obtain the matching degree score of each attack subgraph pattern in the attribute behavior graph of the software under test.

[0078] The number of matches with a statistical matching score greater than the multi-factor weight threshold is taken as the effective occurrence frequency.

[0079] The specific process includes comparing the matching score with the multi-factor weight threshold. If the matching score is greater than the multi-factor weight threshold, it is considered that the attack subgraph pattern has a valid match in the attribute behavior graph of the software under test. All attack subgraph patterns are traversed and the above judgment process is repeated to accumulate the number of matches that meet the conditions. Finally, the accumulated number is taken as the valid occurrence frequency.

[0080] It should be noted that the multi-factor weight threshold is set based on the components of the matching score, including the relative importance of node attribute similarity and edge structure constraints, combined with the actual detection task's need to balance precision and recall. The multi-factor weight threshold is determined through experiments on labeled malware and normal software sample sets, using grid search, cross-validation, or optimization based on validation set performance metrics (such as F1 score). The specific value range is usually between zero and one.

[0081] Based on the effective occurrence frequency and combined with the weighting mechanism of the matching score, a high-dimensional feature vector with the same dimension as the number of attack subgraph patterns in the malicious behavior pattern library is constructed.

[0082] The specific process includes: statistically analyzing the effective occurrence frequency of each attack subgraph pattern in the attribute behavior graph of the software under test, combining it with the matching score corresponding to the attack subgraph pattern, assigning different weights according to the matching score, multiplying the effective occurrence frequency by the corresponding weight as the feature value of the attack subgraph pattern, generating a feature value for each attack subgraph pattern in the malicious behavior pattern library, and finally combining them into a high-dimensional feature vector with a dimension equal to the number of attack subgraph patterns in the malicious behavior pattern library.

[0083] Principal component analysis (PCA) is used to perform dimensionality reduction and visualization verification on high-dimensional feature vectors, generating graph-structured feature vectors.

[0084] The specific process includes: using principal component analysis to reduce the dimensionality of high-dimensional feature vectors, converting them into low-dimensional representations, reducing the number of dimensions while retaining the main structural information, and visualizing the low-dimensional representations to verify the separability of the feature distributions. Finally, the low-dimensional representations are used as graph structure feature vectors.

[0085] It should be noted that principal component analysis (PCA) is an existing data processing method used for dimensionality reduction. By analyzing the covariance relationship between the dimensions in high-dimensional data, a set of orthogonal directions that can retain the variance information of the data to the greatest extent are identified, which are called principal components. The principal components are sorted according to the magnitude of the variance explained by the principal components, and the top few principal components are selected to form a new low-dimensional coordinate system. The original high-dimensional data is projected onto this coordinate system, thereby obtaining a new representation with lower dimensionality but retaining the main structural information.

[0086] S4. Use a causal reasoning algorithm to perform causal correlation analysis on the graph structure feature vectors, quantitatively evaluate the causal effect strength between each feature dimension and malicious behavior, and select feature dimensions with clear causal correlation to form an optimized feature subset.

[0087] Causal reasoning algorithms are used to perform causal correlation analysis on graph structure feature vectors to generate a causal relationship graph between feature dimensions and malicious behavior.

[0088] The specific process includes using a causal inference algorithm to perform causal association analysis on the graph structure feature vector. By examining the causal dependency between each feature dimension in the graph structure feature vector and the malicious behavior label, it identifies which feature dimension changes will trigger the occurrence of malicious behavior, rather than just statistical co-occurrence relationships. Based on these causal dependencies, a causal relationship graph is constructed with feature dimensions and malicious behavior as nodes and causal action directions as directed edges, thereby generating a causal relationship graph between feature dimensions and malicious behavior.

[0089] It should be noted that causal inference algorithms are methods used to identify and analyze causal relationships between variables in data by identifying confounding factors and estimating the effects of interventions. Unlike traditional methods that can only reveal statistical correlations between variables, causal inference algorithms can quantify the extent to which a change in one variable affects another, thereby helping to understand the causal mechanisms behind the data.

[0090] Based on the causal relationship graph, the causal effect estimation method is used to quantify the causal effect strength of each feature dimension and generate a causal effect strength index.

[0091] The specific process includes: determining possible causal directions and dependencies based on the causal paths between each feature dimension and malicious behavior in the causal relationship diagram; obtaining the average treatment effect on the outcome of malicious behavior under intervention conditions (such as forcing the feature dimension to a specific value or perturbing its original distribution) for each feature dimension using causal effect estimation methods, that is, measuring the expected change in the probability of malicious behavior when the value of the feature dimension changes, and adjusting it according to the conditional independence assumption in the causal relationship diagram; and using the average treatment effect value corresponding to each feature dimension as a causal strength index to reflect the degree of direct or indirect causal influence of each feature dimension on malicious behavior.

[0092] The feature dimensions whose causal effect strength index exceeds the causal weight threshold are used as the initial optimization set, and consistency verification and contribution ranking are performed to form an optimized feature subset.

[0093] The specific process includes selecting feature dimensions whose causal effect strength index exceeds the causal weight threshold into the primary optimization set, and performing consistency verification on all feature dimensions in the primary optimization set to confirm whether the influence direction and strength of each feature dimension on the judgment of malicious behavior are stable and reliable in different samples or different operating environments. Based on this, the feature dimensions in the primary optimization set are ranked according to their contribution based on the magnitude of the causal effect strength index, and finally forming an optimized feature subset.

[0094] It should be noted that the causal weight threshold is preset based on the statistical analysis of the distribution of causal effect strength indicators of each feature dimension in the labeled software sample set, and in combination with the actual malicious behavior detection task's need to balance detection accuracy and false alarm rate; the exemplary value range is usually between zero and one.

[0095] S5. Train a malicious behavior classification model based on an optimized feature subset, and apply the malicious behavior classification model to the attribute behavior graph features of unknown software to detect malicious behavior and generate a malicious behavior detection report.

[0096] Based on the optimized feature subset, graph structure feature vectors are extracted from the software sample set with known classification labels and assigned causal importance weights to generate a weighted training dataset.

[0097] The specific process includes: selecting the graph structure feature vector corresponding to each software sample from the set of software samples with known classification labels based on the optimized feature subset, and retaining only the feature dimensions belonging to the optimized feature subset to form a simplified feature vector; using the specific value of each retained feature dimension in the causal effect strength index as the causal importance weight of the feature dimension; multiplying each dimension in the simplified feature vector of each software sample by its corresponding causal importance weight to perform weighted adjustment of the feature vector; and combining all the weighted feature vectors with the corresponding software classification labels to generate a weighted training dataset.

[0098] It should be noted that the set of software samples with known classification labels is obtained by integrating verified malware samples (from a pre-built malware database) and benign software samples from trusted sources, and then labeling them with classification labels after dynamic behavior analysis and authoritative certification.

[0099] Based on the weighted training dataset, a loss function incorporating causal regularization terms is constructed and the parameters of the malicious behavior classification model are initialized.

[0100] The specific process includes: constructing a loss function with causal regularization term based on the weighted training dataset; adding a causal regularization term to the traditional classification loss to constrain the parameters of the malicious behavior classification model; the causal regularization term incorporates the causal importance weights of each feature dimension into the regularization process, making the training process tend to retain the influence of feature dimensions with strong causal effects on the prediction results; after completing the construction of the loss function with causal regularization term, initializing the parameters of the malicious behavior classification model to give it a trainable initial state, providing a starting point for subsequent iterative optimization.

[0101] Based on the loss function and the parameters of the malicious behavior classification model, the malicious behavior classification model is iteratively trained using a meta-learning optimization algorithm to obtain the trained malicious behavior classification model.

[0102] The specific process includes iteratively training the malicious behavior classification model using a meta-learning optimization algorithm based on the loss function of the fused causal regularization term and the parameters of the malicious behavior classification model. In each iteration, the loss function value is obtained using a weighted training dataset, and the parameters of the malicious behavior classification model are adjusted according to the update rules of the meta-learning optimization algorithm to gradually reduce the loss function. After multiple iterations, the model converges to a stable state, and finally the trained malicious behavior classification model is obtained.

[0103] Input the attribute behavior graph feature vector of the unknown software into the trained malicious behavior classification model, and output the confidence probability of the malicious behavior.

[0104] The specific process includes: based on the trained malicious behavior classification model, inputting the attribute behavior graph feature vector of the unknown software into the malicious behavior classification model; the malicious behavior classification model performs weighted calculations and nonlinear transformations on each dimension of the input attribute behavior graph feature vector according to the parameters learned during training and the feature weight distribution guided by the causal regularization term; comprehensively evaluates the degree of matching between the behavior pattern of the unknown software and known malicious behaviors; and outputs a value between zero and one, which represents the confidence probability that the unknown software has malicious behavior.

[0105] The confidence probability of malicious behavior is dynamically analyzed from multiple dimensions, and combined with the importance assessment of causal features, a malicious behavior detection report is generated.

[0106] The specific process includes observing the trend of confidence probability changes with the software's running process in the time dimension, evaluating the differences in the contribution of different feature subsets to confidence probability in the feature dimension, analyzing the impact of the software's operating environment or operation sequence on confidence probability in the context dimension, and combining the causal effect strength index corresponding to each feature dimension in the causal feature importance assessment to clearly identify which nodes or edges in the attribute behavior graph dominate the current judgment result due to their strong causal associations. Finally, the dynamic change law of confidence probability, key causal features and their action paths, and comprehensive judgment criteria are integrated to form a malicious behavior detection report.

[0107] This embodiment also provides a malicious behavior detection system based on data mining, including: a data acquisition module for collecting multi-source behavioral data during software runtime and constructing an attribute behavior graph for each software; a pattern mining module for mining malicious behavior patterns that occur more frequently than a preset threshold from malware samples based on the attribute behavior graph, forming a malicious behavior pattern library; a matching and quantification module for performing graph structure matching operations on each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test, and counting the frequency of each attack subgraph pattern in the attribute behavior graph of the software under test, generating a high-dimensional graph structure feature vector; a causal analysis module for performing causal association analysis on the graph structure feature vector using a causal inference algorithm, quantifying and evaluating the causal effect strength between each feature dimension and malicious behavior, and selecting feature dimensions with clear causal associations to form an optimized feature subset; and a report generation module for training a malicious behavior classification model based on the optimized feature subset, applying the malicious behavior classification model to the attribute behavior graph features of unknown software to detect malicious behavior, and generating a malicious behavior detection report.

[0108] In summary, this invention achieves a breakthrough in feature representation from linear sequences to multi-dimensional graph structures within a data security framework by using big data mining for in-depth analysis of multi-source behavioral data, thus accurately capturing complex attack chains. Furthermore, it innovates the feature selection mechanism from statistical correlation to causal association by quantifying the strength of feature associations through causal inference algorithms, thereby improving both the robustness and interpretability of the model.

[0109] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A malicious behavior detection method based on data mining, characterized in that: include, Collect multi-source behavioral data during software runtime and construct attribute behavior graphs for each software application; Based on attribute behavior graphs, malicious behavior patterns that occur more frequently than a preset threshold are mined from malware samples to form a malicious behavior pattern library. Each attack subgraph pattern in the malicious behavior pattern library is matched with the attribute behavior graph of the software under test, and the frequency of each attack subgraph pattern in the attribute behavior graph of the software under test is counted to generate a high-dimensional graph structure feature vector. A causal reasoning algorithm is used to perform causal association analysis on graph structure feature vectors, quantitatively evaluate the strength of the causal effect between each feature dimension and malicious behavior, and select feature dimensions with clear causal associations to form an optimized feature subset; A malicious behavior classification model is trained based on an optimized feature subset, and then applied to the attribute behavior graph features of unknown software to detect malicious behavior and generate a malicious behavior detection report.

2. The malicious behavior detection method based on data mining as described in claim 1, characterized in that: The multi-source behavioral data includes application programming interface call sequences, kernel-level operation parameters, configuration item modification records, and network communication behavioral data.

3. The malicious behavior detection method based on data mining as described in claim 2, characterized in that: The specific steps for constructing the attribute behavior graph for each software are as follows. For each software sample, it is run and monitored in real time in an isolated environment, while collecting multi-source behavioral data. The system parses and processes multi-source behavioral data, extracts call instances and call timestamp sequences from application programming interface call sequences, and establishes temporal dependencies between call instances based on the call timestamp sequences. The call instances are mapped to graph nodes, and temporal dependencies are mapped to directed edges, thus constructing an initial behavioral graph for each software. Based on the initial behavior graph, kernel-level operation parameters, configuration item modification records, and network communication behavior data are used as attribute features and attached to the corresponding graph nodes and directed edges to form the attribute behavior graph of each software.

4. The malicious behavior detection method based on data mining as described in claim 3, characterized in that: The specific steps for forming the malicious behavior pattern library are as follows: Based on the attribute behavior graph, a depth-first search strategy is used to traverse the graph structure of each malware sample and extract all connected subgraphs that meet the minimum number of nodes requirement as a candidate subgraph set. For each connected subgraph in the candidate subgraph set, calculate the weighted frequency score in the malware sample set; The weighted frequency score is compared with a preset threshold to filter out all malicious behavior patterns that exceed the threshold. Malicious behavior patterns are sorted in descending order according to their weighted frequency scores and then labeled with attribute features to form a malicious behavior pattern library.

5. The malicious behavior detection method based on data mining as described in claim 4, characterized in that: The step of performing graph structure matching operation between each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test refers to using a graph isomorphic matching algorithm to perform multi-level structural matching between the attack subgraph patterns in the malicious behavior pattern library and the attribute behavior graph of the software under test, and combining node attribute similarity and edge structure constraints to calculate the matching degree score of each attack subgraph pattern in the attribute behavior graph of the software under test.

6. The malicious behavior detection method based on data mining as described in claim 5, characterized in that: The specific steps for generating the high-dimensional graph structure feature vector are as follows: The number of matches with a statistical matching score greater than the multi-factor weight threshold is taken as the effective occurrence frequency; Based on the effective occurrence frequency and combined with the weight allocation mechanism of the matching degree score, a high-dimensional feature vector with the same dimension as the number of attack subgraph patterns in the malicious behavior pattern library is constructed. Principal component analysis (PCA) is used to perform dimensionality reduction and visualization verification on high-dimensional feature vectors, generating graph-structured feature vectors.

7. The malicious behavior detection method based on data mining as described in claim 6, characterized in that: The method employs a causal reasoning algorithm to perform causal correlation analysis on the graph structure feature vectors, quantitatively assesses the strength of the causal relationship between each feature dimension and malicious behavior, and selects feature dimensions with clear causal relationships to form an optimized feature subset. The specific steps are as follows. Causal inference algorithms are used to perform causal correlation analysis on graph structure feature vectors to generate a causal relationship graph between feature dimensions and malicious behavior. Based on the causal relationship graph, the causal effect estimation method is used to quantify the causal effect strength of each feature dimension and generate a causal effect strength index. The feature dimensions whose causal effect strength index exceeds the causal weight threshold are used as the initial optimization set, and consistency verification and contribution ranking are performed to form an optimized feature subset.

8. The malicious behavior detection method based on data mining as described in claim 7, characterized in that: The specific steps for training the malicious behavior classification model based on optimized feature subsets are as follows. Based on the optimized feature subset, graph structure feature vectors are extracted from the software sample set with known classification labels and assigned causal importance weights to generate a weighted training dataset. Based on the weighted training dataset, a loss function incorporating causal regularization terms is constructed and the parameters of the malicious behavior classification model are initialized. Based on the loss function and the parameters of the malicious behavior classification model, the malicious behavior classification model is iteratively trained using a meta-learning optimization algorithm to obtain the trained malicious behavior classification model.

9. The malicious behavior detection method based on data mining as described in claim 8, characterized in that: The specific steps for generating the malicious behavior detection report are as follows: Input the attribute behavior graph feature vector of the unknown software into the trained malicious behavior classification model, and output the confidence probability of the malicious behavior; The confidence probability of malicious behavior is dynamically analyzed from multiple dimensions, and combined with the importance assessment of causal features, a malicious behavior detection report is generated.

10. A malicious behavior detection system based on data mining, based on the malicious behavior detection method based on data mining as described in any one of claims 1 to 9, characterized in that: include, The data acquisition module is used to collect multi-source behavioral data during software runtime and construct attribute behavior maps for each software application. The pattern mining module is used to mine malicious behavior patterns that occur more frequently than a preset threshold from malware samples based on attribute behavior graphs, forming a malicious behavior pattern library. The matching and quantization module is used to perform graph structure matching operations on each attack subgraph pattern in the malicious behavior pattern library and the attribute behavior graph of the software under test, and to count the frequency of each attack subgraph pattern in the attribute behavior graph of the software under test, and generate a high-dimensional graph structure feature vector. The causal analysis module is used to perform causal association analysis on graph structure feature vectors using causal inference algorithms, quantitatively evaluate the strength of the causal effect between each feature dimension and malicious behavior, and select feature dimensions with clear causal associations to form an optimized feature subset. The report generation module is used to train a malicious behavior classification model based on an optimized feature subset, and then apply the malicious behavior classification model to the attribute behavior graph features of unknown software to detect malicious behavior and generate a malicious behavior detection report.

Images