Multi-view malicious software detection method and system based on high-speed introspection of virtual machine
By employing high-speed virtual machine introspection technology and a multi-perspective fusion model, the security risks and high-performance overhead of traditional detection methods are resolved, enabling high-precision malware detection in a cloud-native environment and effectively resisting advanced evasion techniques.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ZHEJIANG UNIV OF TECH
- Filing Date
- 2026-01-15
- Publication Date
- 2026-04-28
Smart Images
Figure CN121935909A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the fields of network security and artificial intelligence technology, and specifically relates to a method, system, and computer-readable storage medium for security data acquisition and multi-view deep learning based on Virtual Machine Introspection (VMI). Background Technology
[0002] With the widespread adoption of containers and microservice frameworks (such as Docker, Kubernetes, and Kata Containers) in cloud-native architectures, workloads on cloud platforms are characterized by high density, short lifecycles, and frequent migrations, posing a serious challenge to traditional security systems that primarily rely on perimeter defense. In this environment, runtime behavior analysis (especially based on the dynamic characteristics of system or API calls) has become one of the key means of detecting malware, intrusions, and abnormal behavior.
[0003] Existing malware detection methods can generally be divided into two data collection approaches: in-band (in-VM) and out-of-band (out-of-VM). In-band detection typically deploys a detection agent inside the monitored virtual machine to collect behavioral data. This method is simple to implement and has low latency, but when malware gains high privileges, the agent itself may be sniffed, tampered with, or disabled, resulting in unreliable data. Out-of-band detection, represented by Virtual Machine Introspection (VMI), deploys monitoring logic outside the virtualization monitoring layer (hypervisor), observing the client state from the host machine's perspective, naturally possessing high isolation and reliability. However, traditional VMI solutions often require suspending the virtual machine or performing heavy memory analysis when extracting deep semantic information, causing business interruptions and high-performance overhead, making it difficult to meet the real-time and availability requirements of cloud-native scenarios.
[0004] Furthermore, existing analysis models often rely on a single perspective (such as only based on sequence models or only based on graph models) to model malicious behavior, making them vulnerable to advanced evasion techniques such as code obfuscation, API replacement, sequence perturbation, and the insertion of junk instructions. While graph models can depict structural co-occurrence relationships, they may ignore temporal logic. Sequence models, on the other hand, are good at temporal relationships but are easily affected by name replacement and irrelevant call insertion, thus failing to identify API replacement attacks that are functionally equivalent but have different names.
[0005] Therefore, there is an urgent need for an end-to-end detection solution that can collect behavioral data with high reliability and low overhead, and can jointly model API behavior from multiple complementary perspectives to improve detection accuracy and robustness to advanced evasion techniques. Summary of the Invention
[0006] This invention aims to address the security risks of traditional in-band data acquisition and the high-performance overhead of traditional out-of-band data acquisition in the current cloud-native environment, as well as the difficulty of malware analysis models to resist advanced evasion techniques due to their reliance on a single perspective. It proposes a cloud-native malware detection method and system based on high-speed self-introspection of virtual machines and multi-perspective fusion.
[0007] This invention utilizes high-speed virtual machine introspection technology at the hypervisor layer to achieve low-intrusive API call sequence capture and constructs a novel multi-perspective fusion detection model. This model collaboratively models and extracts features from API behavior from three complementary dimensions: structural context, functional semantics, and behavioral evolution. By deeply fusing features from these three perspectives, it achieves the construction of a comprehensive and difficult-to-evade behavioral profile of malware, significantly improving detection accuracy and robustness.
[0008] The method of this invention is applicable to cloud-native environments centered on containers and microservices, and can support runtime malware detection and security behavior analysis within cloud platform workloads.
[0009] This invention provides a cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion, comprising the following steps: S1: Deploy a high-speed introspection module in the virtual machine monitoring layer. This module captures the API call sequence of the target virtual machine's internal processes in a secure and low-intrusive manner by parsing the virtual machine's memory and monitoring key functions, and structures the API call sequence into runtime logs.
[0010] S2: Treat the API call sequence captured in S1 as sentences and train a Word2Vec model to generate structural embedding vectors for the APIs. Subsequently, construct a directed heterogeneous graph containing files, threads, and API calls for each sample. Use the structural embedding vectors as the initial features of the API nodes and encode the graph using a graph attention network to extract structural context feature vectors.
[0011] S3: Extract the official API function description text using a pre-trained language model to generate semantic embedding vectors. Construct a directed heterogeneous graph with the same topology as in S2 for each sample, but replace the initial features of the API nodes in the graph with the semantic embedding vectors, and encode the graph again using a graph attention network (GAT) to extract the functional semantic feature vectors.
[0012] S4: First, the APIs captured in S1 are functionally classified, reducing the complete API call sequence to a finite sequence of functional states. Next, a Markov transition probability matrix is constructed for the state sequence of each sample, and multiple-order transition matrices can be stacked to form a multi-channel feature tensor. Finally, this feature tensor is input into a convolutional neural network (CNN) for encoding to extract macroscopic behavioral evolution feature vectors.
[0013] S5: The structural context feature vector extracted in S2, the functional semantic feature vector extracted in S3, and the behavioral evolution feature vector extracted in S4 are concatenated to form a final comprehensive feature vector. This comprehensive feature vector is then input into a multilayer perceptron (MLP) classifier, and the classifier is trained end-to-end to determine whether the output sample is malware or benign software.
[0014] Preferably, step S1 specifically includes the following sub-steps.
[0015] S1.1: Install the KVM platform on the physical machine and deploy the lightweight Kata virtual machine within it. Then, run containers inside the virtual machine. After the environment is configured, save a system restore point to ensure that all subsequent programs under test are executed in a completely consistent software runtime environment.
[0016] S1.2: Before each test, the virtual machine is automatically restored to the baseline restore point saved in S1.1. Then, through an automated script, the malware sample or benign software to be tested is automatically triggered and run inside the target container.
[0017] S1.3: The high-speed introspection module is deployed on the physical host and uses the KVM interface and hardware virtualization extensions (such as Intel EPT or AMD NPT) to efficiently access and monitor the physical memory pages of the target virtual machine without pausing the virtual machine's operation.
[0018] S1.4: The high-speed introspection module monitors the changes in execution permissions of the memory page corresponding to the system call processing entry point of the virtual machine kernel to achieve low-intrusion interception of the control flow, so as to accurately capture API call events.
[0019] S1.5: After an API call event is captured, the high-speed introspection module further parses the relevant CPU registers and memory regions, extracts the API name, call parameters and return value, and combines this information into a structured runtime log.
[0020] Preferably, step S2 is specifically configured as follows: S2.1: Treat the complete API call sequence of each sample captured in S1 as a sentence, and treat each API in the sequence as a word. Train a Word2Vec model on all API call sequences in the training dataset to embed each API into a fixed-dimensional vector space, generating the structure embedding vector of the API.
[0021] S2.2: Construct an independent directed heterogeneous graph for each sample. This graph contains three types of nodes: a root node representing the sample itself, several thread nodes representing execution threads, and API nodes representing specific API calls.
[0022] S2.3: Constructing edge connections in the directed heterogeneous graph specifically includes: connecting the root node to all its derived thread nodes; connecting each thread node to all API nodes called within that thread; and establishing directed edges between adjacent API calls within the same thread, in chronological order.
[0023] S2.4: Use the API structure embedding vector generated in S2.1 as the initial feature of the API node in S2.2, and input the constructed directed heterogeneous graph into the first graph attention network encoder.
[0024] S2.5: After the graph attention network encoder encodes the graph, it aggregates the node features into an embedding vector representing the entire graph through a pooling layer. This vector is the structural context feature vector.
[0025] Optionally, in step S3, the abstract functional description is constructed into functional semantic perspective features, and the specific steps are as follows: S3.1: Take the official function description text of each API as input and feed it into a pre-trained language model.
[0026] S3.2: After processing the functional description text, the pre-trained language model outputs a high-dimensional semantic embedding vector, which encodes the core functional intent of the API and serves as the initial functional semantic feature of the API.
[0027] S3.3: Construct a directed heterogeneous graph for each sample, whose topology is the same as the graph structure defined in steps S2.2 and S2.3 of step S2.
[0028] S3.4: Assign the initial semantic features of the API functions generated in S3.2, i.e. the semantic embedding vector, to the corresponding API node in the graph in S3.3, and input the graph into the second graph attention network encoder. This encoder shares the architecture with the encoder in S2.4 but has independent parameters.
[0029] S3.5: After the graph attention network encoder encodes the graph, it aggregates the node features into an embedding vector representing the entire graph through a pooling layer. This vector is the functional semantic feature vector.
[0030] Preferably, in step S4, constructing the numerous API sequences into behavioral evolution perspective features specifically includes the following sub-steps: S4.1: First, perform functional classification on all APIs captured in S1 to achieve state space reduction. Input the unique API call sequence functional description of the dataset into GPT4o. APIs with similar functions are classified into the same functional state or cluster, thereby transforming the complete API call sequence of each sample into a finite state sequence.
[0031] S4.2: Next, the transition frequency matrix of the finite state sequence for each sample is calculated, and a first-order Markov transition probability matrix is constructed by normalization. , where matrix elements Indicates from state Transition to state The probability of.
[0032] S4.3: Optionally, an n-order transition matrix is calculated based on the first-order transition probability matrix. ( ), and the first-order and multi-order transition matrices Stack along the new dimension to form a multi-channel feature tensor M, with a shape such as... ,in This represents the total number of functional states in S4.1.
[0033] S4.4: Optionally, before constructing the transition matrix, the state activity of each state is calculated based on the average transition probability of all samples, and the states are globally reordered according to the activity, so that the representation of the transition matrix is insensitive to arbitrary arrangement of state labels.
[0034] S4.5: Finally, the feature tensor generated in S4.3 is treated as a multi-channel image and input into a deep convolutional neural network encoder. The deep convolutional neural network encoder processes the tensor through convolutional layers, pooling layers, and fully connected layers, and outputs a compact feature vector, which is the behavior evolution feature vector.
[0035] Optionally, step S5 specifically includes: S5.1: The structural context feature vector extracted in S2, the functional semantic feature vector extracted in S3, and the behavioral evolution feature vector extracted in S4 are concatenated along the vector dimension to form a final, high-dimensional comprehensive feature vector.
[0036] S5.2: Input the integrated feature vector generated in S5.1 into a multilayer perceptron (MLP) classifier.
[0037] S5.3: The multilayer perceptron classifier consists of several fully connected layers, Activation function and Layers are composed of, and through a The probability distribution of whether the output sample of the activation function belongs to malicious or benign software.
[0038] S5.4: The method is trained in an end-to-end manner. Its optimization objective is to minimize the standard cross-entropy loss between the probability distribution of the classifier output and the true label, and to use the gradient descent algorithm to update all parameters of the entire model (including the encoders in S2, S3, and S4 and the classifier in S5).
[0039] The present invention also includes a multi-view learning malware detection system based on high-speed virtual machine introspection, used to implement the method of the present invention.
[0040] The advantages and benefits of this invention compared to existing technologies are as follows: (1) The high-speed virtual machine introspection data acquisition platform proposed in this invention breaks through the inherent bottlenecks of traditional in-band and out-of-band detection. Traditional in-band detection relies on agents inside the virtual machine or container, which is easily tampered with by high-privilege malware; while traditional out-of-band virtual machine introspection methods, although secure, often require pausing the target virtual machine for memory image analysis, resulting in poor real-time performance. In contrast, this invention, based on the Extended Page Table (EPT) event monitoring mechanism and kernel data flow parsing technology, achieves non-suspended, low-latency, and highly reliable real-time data acquisition, which can accurately capture the API call sequence of processes inside the container without affecting the operation of the virtual machine, thus achieving the best balance between security isolation and performance real-time performance.
[0041] (2) Unlike existing detection methods that rely on a single feature or a single modeling perspective, this invention collaboratively models API behavior from three orthogonal and complementary dimensions: structural context, functional semantics, and behavioral evolution. This multi-perspective fusion model extracts structural co-occurrence relationships through graph neural networks, obtains API functional semantic representations through BERT models, and captures macroscopic behavioral chain features through Markov transition matrices and convolutional neural networks. It forms complementary features at the structural, semantic, and temporal levels, achieving strong robustness against advanced avoidance techniques (such as API obfuscation, renaming, and temporal perturbation). Attached Figure Description
[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0043] Figure 1 This is a general framework diagram of the data acquisition platform provided in an embodiment of the present invention; Figure 2 This is a general framework diagram of the malware detection method provided in the embodiments of the present invention; Figure 3 This is an execution diagram of the core functional modules provided in the embodiments of the present invention; Detailed Implementation
[0044] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0045] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0046] See attached document Figure 1 Appendix Figure 2 This embodiment provides a malware detection method based on high-speed virtual machine introspection and multi-view learning, the detailed steps of which are as follows: S1: Deploy a high-speed introspection module in the hypervisor layer. This module captures the API call sequence of the target container or virtual machine internal process in a secure and non-intrusive manner from the outside by parsing virtual machine memory and monitoring key functions, and structures the API call sequence into runtime logs.
[0047] S2: Treat the API call sequence captured in S1 as sentences and train a Word2Vec model to generate structural embedding vectors for the APIs. Subsequently, construct a directed heterogeneous graph containing files, threads, and API calls for each sample. Use the structural embedding vectors as the initial features of the API nodes and encode the graph using a graph attention network to extract structural context feature vectors.
[0048] S3: Extract the official API function description text using a pre-trained language model to generate semantic embedding vectors. Construct a directed heterogeneous graph with the same topology as in S2 for each sample, but replace the initial features of the API nodes in the graph with the semantic embedding vectors, and encode the graph again using a graph attention network (GAT) to extract the functional semantic feature vectors.
[0049] S4: First, the APIs captured in S1 are functionally classified, reducing the complete API call sequence to a finite sequence of functional states. Next, a Markov transition probability matrix is constructed for the state sequence of each sample, and multiple-order transition matrices can be stacked to form a multi-channel feature tensor. Finally, this feature tensor is input into a convolutional neural network for encoding to extract macroscopic behavioral evolution feature vectors.
[0050] S5: The structural context feature vector extracted in S2, the functional semantic feature vector extracted in S3, and the behavioral evolution feature vector extracted in S4 are concatenated to form a final comprehensive feature vector. This comprehensive feature vector is then input into a multilayer perceptron (MLP) classifier, and the classifier is trained end-to-end to determine whether the output sample is malware or benign software.
[0051] See attached document Figure 1 The specific steps for building a low-intrusion data acquisition platform are as follows: S1.1: Deploy a high-speed introspection module based on libVMI and the native KVM interface in the hypervisor of the physical host.
[0052] S1.2: Install the KVM platform on the physical machine and deploy the lightweight Kata virtual machine within it. Then, run containers inside the virtual machine. After the environment is configured, save a system restore point to ensure that all subsequent programs under test are executed in a completely consistent software runtime environment.
[0053] S1.3: Before each test, the virtual machine is automatically restored to the baseline restore point saved in S1.2. Then, through an automated script, the malware sample or benign software to be tested is automatically triggered and run inside the target container.
[0054] S1.4: The introspection module directly accesses and monitors the physical memory pages of the target virtual machine by means of hardware virtualization extensions (such as Intel EPT), and intercepts the control flow by changing the execution permissions of the memory pages corresponding to the system call processing entry point in the virtual machine kernel, thereby capturing API call events.
[0055] S1.5: After capturing an API call event, the introspection module further parses the CPU registers and related memory areas, extracts information such as API name, call parameters and return value, and transmits the data to user space for parsing through a high-speed shared memory mechanism, ultimately generating a structured API call sequence log.
[0056] See attached document Figure 2 As described above, after obtaining the API call sequence, the detection method in this embodiment mainly includes the following steps:
[0057] S2.1: First, treat each API call captured in S1 as a word, treat the complete API call sequence of each sample as a sentence, and train a Word2Vec model on the entire training dataset to generate the initial embedding vector for each API. This vector implies the local co-occurrence relationship of the API.
[0058] S2.2: Next, construct an independent, directed heterogeneous graph for each sample. The nodes V in the graph include: a root node representing the sample itself, several thread nodes representing execution threads, and API nodes representing specific API calls.
[0059] S2.3: The edges E of the heterogeneous graph include: edges from the root node to all thread nodes derived from it; edges from each thread node to all API nodes called within that thread; and directed edges within the same thread connecting adjacent API calls in chronological order. Optionally, all edges are weighted W according to their call frequency.
[0060] S2.4: Embed the API vector generated in S2.1 This serves as the initial node feature of the API node in the heterogeneous graph.
[0061] S2.5: Finally, the heterogeneous graphs constructed in S2.2 to S2.4, carrying the initial features, are... The input is fed into the first graph attention network encoder. The GAT encoder updates the node representation by aggregating neighbor node information (and optionally utilizing edge weights W), and aggregates all node features into a single embedding vector through a pooling layer, which is the structural context feature vector.
[0062] S3.1: First, using a pre-trained language model (e.g., BERT), the functional description text of each API in the official documentation is taken as input, and a vector representation of the text is extracted to generate the functional semantic embedding vector of the API. .
[0063] S3.2: Next, construct an independent, directed heterogeneous graph for each sample. The topology of this graph (i.e., nodes V, edges E, and weights W) is the same as that constructed in steps S2.2 and S2.3. Totally consistent.
[0064] S3.3: Embed the API functional semantics generated in S3.1 into the vector. As the heterogeneous diagram Initial node characteristics of API nodes.
[0065] S3.4: Finally, the heterogeneous graphs carrying semantic features constructed in S3.2 to S3.3 are... The input is fed into a second graph attention network encoder (which can have the same encoder architecture as in S2.5 but with independent parameters), and is encoded into a single embedding vector through a pooling layer, which is the functional semantic feature vector.
[0066] S4.1: First, perform functional classification on all APIs captured in S1 to achieve state space reduction. Input the unique API call sequence functional description of the dataset into GPT4o. APIs with similar functions are classified into the same functional state or cluster, thereby transforming the complete API call sequence of each sample into a finite state sequence.
[0067] S4.2: Next, for each sample, the transition frequency matrix of the finite state sequence is calculated, and a first-order Markov transition probability matrix is constructed by normalization (e.g., row-wise normalization). , where matrix elements Indicates from state Transition to state The probability of.
[0068] S4.3: Optionally, calculate based on the first-order transition probability matrix. Transition matrix ,in The first-order and multi-order transition matrices are stacked along the new dimension to form a multi-channel feature tensor M, the shape of which is, for example, ,in This represents the total number of functional states in S4.1.
[0069] S4.4: Optionally, before constructing the transition matrix, the state activity (e.g., total transition probability) of each state is calculated based on the average transition probability of all samples, and the states are globally reordered according to the activity so that the representation of the transition matrix is insensitive to arbitrary arrangement of state labels, and the feature tensor is constructed using the reordered state sequence.
[0070] S4.5: Finally, the feature tensor generated in S4.3 is treated as a multi-channel image and input into a deep convolutional neural network encoder. The deep convolutional neural network encoder processes the tensor through convolutional layers, pooling layers, and fully connected layers, and outputs a compact feature vector, which is the behavior evolution feature vector.
[0071] S5.1: The structural context feature vector extracted in S2, the functional semantic feature vector extracted in S3, and the behavioral evolution feature vector extracted in S4 are concatenated along the vector dimension to form a final, high-dimensional comprehensive feature vector.
[0072] S5.2: Input the comprehensive feature vector generated in S5.1 into a multilayer perceptron classifier.
[0073] S5.3: The multilayer perceptron classifier consists of several fully connected layers, Activation function and Layers are composed of, and through a The probability distribution of whether the output sample of the activation function belongs to malicious or benign software.
[0074] S5.4: The method is trained in an end-to-end manner. Its optimization objective is to minimize the standard cross-entropy loss between the probability distribution of the classifier output and the true label, and to use the gradient descent algorithm to update all parameters of the entire model (including the encoders in S2, S3, and S4 and the classifier in S5).
[0075] See attached document Figure 3 This embodiment provides a multi-view learning malware detection system based on high-speed virtual machine introspection to implement the method of the present invention, including the following modules: The low-intrusion data acquisition module is designed to address the performance and security risks of traditional in-band monitoring. This module deploys a high-speed introspection module at the virtual machine monitoring layer and uses virtual machine high-speed introspection technology to securely and non-intrusively capture high-trust API call sequences of target containers or internal processes of virtual machines from the outside and output them as structured runtime logs.
[0076] The API behavior feature module is responsible for multi-dimensional initial quantization and representation of the original API sequence. This module calls the Word2Vec model to treat the API call sequence as sentences and learns the local co-occurrence relationship between APIs to generate structural context embeddings. At the same time, it calls the pre-trained language model BERT to extract the official function description of the API to generate functional semantic embeddings that resist code obfuscation. In addition, it reduces the dimensionality of the API sequence to a state sequence through function classification and constructs a Markov transition probability matrix.
[0077] The multi-view feature encoding module is responsible for extracting deep abstract features from the feature-encoded data. This module uses a graph attention network to encode heterogeneous graphs with structural embeddings as initial features to capture malicious behavioral syntax; and another graph attention network to encode heterogeneous graphs with semantic embeddings as initial features to extract the deep functional intent of the API; at the same time, a convolutional neural network is used to encode the Markov transition matrix to identify macroscopic malicious logic chains.
[0078] The fusion detection and decision module is responsible for the final fusion and adjudication of multi-perspective features. This module concatenates the feature vectors output by the encoders from three perspectives: structural context, functional semantics, and behavioral evolution, to generate a three-dimensional and difficult-to-avoid comprehensive behavioral profile. Finally, the fused vector is input into a multilayer perceptron classifier, which outputs the final detection result of whether the sample is malware.
[0079] To demonstrate the effectiveness of this invention, it is compared with the following four common models. The dataset used is the LLMAL2025 dataset generated by the dataset platform built in this patent, and the performance of the classification task is analyzed.
[0080] Table 1. Comparison of results between the method in this embodiment and existing models.
[0081] Table 1 shows a comparison of the classification accuracy of a method implemented according to an embodiment of the present invention with several other models on the dataset. Bold text indicates the highest accuracy on that dataset. As can be seen from the data in Table 1, the method implemented according to an embodiment of the present invention exhibits high classification accuracy on the tested dataset. This result demonstrates that the technical solution proposed in this invention has technical effectiveness in data processing and malware classification, providing a technical solution for malware classification tasks.
[0082] Those skilled in the art will understand that all or part of the steps described in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it includes one or a combination of the steps of the method embodiments.
[0083] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0084] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.
Claims
1. A cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion, comprising the following steps: S1: Deploy a high-speed introspection module in the virtual machine monitoring layer. This high-speed introspection module captures the API call sequence of the target virtual machine's internal processes in a secure and low-intrusive manner from the outside by parsing the virtual machine's memory and monitoring key functions, and structures the API call sequence into runtime logs. S2: Treat the API call sequence captured in S1 as a sentence, and train the Word2Vec model to generate the structural embedding vector of the API; then, construct a directed heterogeneous graph containing files, threads and API calls for each sample, use the structural embedding vector as the initial feature of the API node, and encode the graph using a graph attention network to extract the structural context feature vector. S3: Use a pre-trained language model to extract the official API function description text to generate semantic embedding vectors; construct a directed heterogeneous graph with the same topology as in S2 for each sample, but replace the initial features of the API nodes in the graph with the semantic embedding vectors, and encode the graph again using a graph attention network to extract functional semantic feature vectors. S4: First, the APIs captured in S1 are classified by function, and the complete API call sequence is reduced to a finite sequence of functional states. Next, a Markov transition probability matrix is constructed for the state sequence of each sample, and multiple-order transition matrices can be stacked to form a multi-channel feature tensor. Finally, the feature tensor is input into a convolutional neural network for encoding to extract macroscopic behavioral evolution feature vectors. S5: Concatenate the structural context feature vector extracted in S2, the functional semantic feature vector extracted in S3, and the behavioral evolution feature vector extracted in S4 to form a final comprehensive feature vector; input the comprehensive feature vector into a multilayer perceptron classifier, and train the classifier end-to-end to make its output sample a classification result of malicious software or benign software.
2. The cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion as described in claim 1, characterized in that, Step S1 specifically includes the following sub-steps: S1.1: Install the KVM platform on the physical machine and deploy the lightweight virtual machine Kata within the platform. Then run containers inside the virtual machine. After the environment is configured, save a system restore point to ensure that all subsequent programs under test are executed in a completely consistent software runtime environment. S1.2: Before performing each test, the virtual machine is automatically restored to the baseline restore point saved in S1.1; Subsequently, the malware sample or benign software to be tested is automatically triggered and run inside the target container using automated scripts. S1.3: The high-speed introspection module is deployed on the physical host and uses the KVM interface and hardware virtualization extensions (such as Intel EPT or AMD NPT) to efficiently access and monitor the physical memory pages of the target virtual machine without pausing the virtual machine's operation. S1.4: The high-speed introspection module monitors the changes in execution permissions of the memory page corresponding to the system call processing entry point of the virtual machine kernel to achieve low-intrusion interception of the control flow, so as to accurately capture API call events; S1.5: After an API call event is captured, the high-speed introspection module further parses the relevant CPU registers and memory regions, extracts the API name, call parameters and return value, and combines this information into a structured runtime log.
3. The cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion as described in claim 1, characterized in that, Step S2 includes the following sub-steps: S2.1: Treat the complete API call sequence of each sample captured by S1 as a sentence, and treat each API in the sequence as a word. Train a Word2Vec model on all API call sequences in the training dataset to embed each API into a fixed-dimensional vector space and generate the structure embedding vector of the API. S2.2: Construct an independent directed heterogeneous graph for each sample. This graph contains three types of nodes: a root node representing the sample itself, several thread nodes representing execution threads, and API nodes representing specific API calls. S2.3: Constructing edge connections in the directed heterogeneous graph, specifically including: connecting the root node to all thread nodes derived from it; connecting each thread node to all API nodes called within that thread; And within the same thread, directed edges are established between adjacent API calls in chronological order; S2.4: Use the API structure embedding vector generated in S2.1 as the initial feature of the API node in S2.2, and input the constructed directed heterogeneous graph into the first graph attention network encoder; S2.5: After the graph attention network encoder encodes the graph, it aggregates the node features into an embedding vector representing the entire graph through a pooling layer. This vector is the structural context feature vector.
4. The cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion as described in claim 1, characterized in that, In step S3, the abstract functional description is constructed into functional semantic perspective features, specifically including: S3.1: Take the official function description text of each API as input and feed it into a pre-trained language model; S3.2: After processing the functional description text, the pre-trained language model outputs a high-dimensional semantic embedding vector, which encodes the core functional intent of the API and serves as the initial functional semantic feature of the API. S3.3: Construct a directed heterogeneous graph for each sample, whose topology is the same as the graph structure defined in S2.2 and S2.3 of step S2; S3.4: Assign the initial semantic features of the API functions generated in S3.2, i.e. the semantic embedding vector, to the corresponding API node of the graph in S3.3, and input the graph into the second graph attention network encoder. This encoder shares the architecture with the encoder in S2.4 but has independent parameters. S3.5: After the graph attention network encoder encodes the graph, it aggregates the node features into an embedding vector representing the entire graph through a pooling layer. This vector is the functional semantic feature vector.
5. The cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion as described in claim 1, characterized in that, In step S4, the numerous API sequences are constructed into behavioral evolutionary features, specifically including: S4.1: First, perform functional classification on all APIs captured in S1 to achieve state space reduction. Input the unique API call sequence functional description of the dataset into GPT4o. APIs with similar functions are classified into the same functional state or cluster, thereby transforming the complete API call sequence of each sample into a finite state sequence. S4.2: Next, the transition frequency matrix of the finite state sequence for each sample is calculated, and a first-order Markov transition probability matrix is constructed by normalization. , where matrix elements Indicates from state Transition to state The probability of; S4.3: Calculate the nth-order transition matrix based on the first-order transition probability matrix. ( ), and the first-order and multi-order transition matrices Stack along the new dimension to form a multi-channel feature tensor M, the shape of which is, for example, ,in This represents the total number of functional states in S4.1; S4.4: Optionally, before constructing the transition matrix, calculate the state activity of each state based on the average transition probability of all samples, and globally reorder the states according to the activity so that the representation of the transition matrix is insensitive to arbitrary arrangement of state labels; S4.5: Finally, the feature tensor generated in S4.3 is treated as a multi-channel image and input into a deep convolutional neural network encoder; the deep convolutional neural network encoder processes the tensor through convolutional layers, pooling layers and fully connected layers, and outputs a compact feature vector, which is the behavior evolution feature vector.
6. The cloud-native malware detection method based on high-speed virtual machine introspection and multi-perspective fusion as described in claim 1, characterized in that, Step S5 specifically includes: S5.1: The structural context feature vector extracted in S2, the functional semantic feature vector extracted in S3, and the behavioral evolution feature vector extracted in S4 are concatenated along the vector dimension to form a final, high-dimensional comprehensive feature vector. S5.2: Input the comprehensive feature vector generated in S5.1 into a multilayer perceptron classifier; S5.3: The multilayer perceptron classifier consists of several fully connected layers, Activation function and Layers are composed of, and through a The probability distribution of whether the output sample of the activation function belongs to malicious or benign software; S5.4: The method is trained in an end-to-end manner. Its optimization objective is to minimize the standard cross-entropy loss between the probability distribution of the classifier output and the true label, and to update all parameters of the encoder and classifier using the gradient descent algorithm.
7. A multi-perspective learning malware detection system based on high-speed virtual machine introspection, characterized in that, include: The low-intrusive data acquisition module deploys a high-speed introspection module in the virtual machine monitoring layer. It utilizes high-speed virtual machine introspection technology to securely and non-intrusively capture high-trust API call sequences of target containers or internal processes of virtual machines from the outside and outputs them as structured runtime logs. The API behavior feature module is used to perform multi-dimensional initial quantization and representation of the original API sequence. By calling the Word2Vec model, the API call sequence is treated as a sentence, and the local co-occurrence relationship between APIs is learned to generate structural context embeddings. At the same time, the pre-trained language model BERT is called to extract the official function description of the API to generate functional semantic embeddings that resist code obfuscation. In addition, the API sequence is reduced to a state sequence through function classification, and a Markov transition probability matrix is constructed. The multi-view feature encoding module is used to extract deep abstract features from the featured data. It uses a graph attention network to encode heterogeneous graphs with structural embeddings as initial features to capture malicious behavioral syntax; and another graph attention network to encode heterogeneous graphs with semantic embeddings as initial features to extract the deep functional intent of the API; at the same time, it uses a convolutional neural network to encode the Markov transition matrix to identify macroscopic malicious logic chains. The fusion detection and decision module is used to perform the final fusion and adjudication of multi-perspective features. It concatenates the feature vectors output by the encoders from three perspectives: structural context, functional semantics, and behavioral evolution, to generate a three-dimensional and difficult-to-avoid comprehensive behavioral profile. Finally, the fused vector is input into a multilayer perceptron classifier, which outputs the final detection result of whether the sample is malware.