Low-intrusive multi-view malicious software detection method and system in virtualization environment

Abstract

The invention discloses a low-intrusive multi-view malicious detection method and system in a virtualization environment. The method comprises the following steps: 1) collecting a software sample under a Windows platform, marking the software sample according to a multi-engine detection result, running sample software in a KVM (Keyboard Video Mouse) virtualization environment, intercepting and capturing dynamic behaviors such as system calling, memory access and abnormal triggering through a high-speed introspection technology, and forming a dynamic behavior database; 2) extracting an API sequence in the dynamic behavior for preprocessing, and respectively mapping the API sequence into an API sequence based on structure role clustering and an API sequence based on function classification; 3) based on the structure role clustering sequence, constructing a thread-aware hierarchical graph structure, and based on the function classification sequence, constructing a third-order Markov function transfer matrix under frequency sorting and transfer sorting; (4) feature extraction and classification are conducted on the samples through a classification model, a malicious software detection model is composed of a graph feature extractor, a function transfer matrix feature extractor, a function feature comparison part and a classifier, and graph features and function features are combined to serve as a classification basis; and 5) training the malicious software model through the API sequence in the dynamic behavior database to obtain a final malicious software detection model.

Description

Technical Field

[0001] This invention belongs to the field of cloud computing security technology, and particularly relates to a system and method for low-intrusion API call collection based on high-speed introspection technology in a virtualized environment, combined with multi-perspective behavioral modeling for malware detection. KVM-based high-speed virtual machine introspection technology is preferably used to reduce performance overhead and increase security when extracting dynamic behavior from sample software. A layered graph structure and multi-perspective functional transition are used to detect whether malicious behavior is present, making it particularly suitable for virtual machine security monitoring in multi-tenant cloud platforms. Background Technology

[0002] In recent years, cloud computing has become a core infrastructure of modern information technology, widely used in data storage, application deployment, resource sharing, and distributed collaboration. Virtualization technology, as the cornerstone of cloud computing, achieves resource isolation and scheduling in multi-tenant environments through virtual machines. However, virtualization environments also bring new security challenges. Malware such as viruses, worms, Trojans, ransomware, and botnets often exploit the shared nature of cloud environments to launch attacks, seriously affecting tenant data security and service availability. In malware detection in cloud environments, API call sequences are widely used as a key feature for identifying malicious behavior.

[0003] Existing solutions mostly employ in-band data capture, which involves deploying agents or hooks within the client's virtual machine to capture call data. This method is intrusive and operates within the same trusted domain as malicious code, making it vulnerable to circumvention or tampering by anti-detection techniques such as rootkits. Furthermore, the agent itself can become an attack surface, leading to monitoring failure and data corruption. While conventional out-of-band data capture, i.e., virtual machine introspection, avoids the intrusiveness issue, it faces semantic reconstruction problems, resulting in significant performance overhead.

[0004] In terms of modeling, most existing methods are based on the original API call sequence. However, due to the large number of API calls made by malware, there is a significant computational overhead, and these methods fail to effectively handle the high concurrency and multi-threaded behavior in cloud environments. For example, some studies construct the entire API call sequence as a single graph structure, which can describe the call relationships between APIs, but often fails to accurately capture the independent execution logic and collaborative relationships between different threads. Another type of method models the API sequence as a Markov transition matrix, but it only divides the state based on the original API names, ignoring the overlap and redundancy of functional semantics, resulting in state space redundancy, which in turn affects the model's generalization ability and computational efficiency.

[0005] In summary, existing methods for detecting malware in cloud environments still have room for improvement in the following aspects: First, when dealing with API sequences, in-band collection methods are weak in security and susceptible to interference, while out-of-band collection faces high performance overhead, and a good balance between security and efficiency has not yet been achieved; Second, modeling methods based on the original API names suffer from semantic redundancy and high computational overhead, making it difficult to adapt to the lightweight and real-time requirements of cloud environments; Third, most detection methods struggle to effectively model complex behavioral patterns in multi-threaded, high-concurrency environments. Summary of the Invention

[0006] This invention aims to address the problems in existing malware detection methods in cloud environments, such as the highly invasive nature of API call sequence collection, high performance overhead, semantic redundancy and high computational overhead in behavioral modeling, and the difficulty in effectively characterizing multi-threaded high-concurrency behaviors. It proposes a low-intrusion, multi-perspective malware detection method and system in a virtualized environment.

[0007] This invention utilizes high-speed introspection technology with shared memory snapshots and Delta-Copy techniques at the virtualization layer to reduce performance overhead and enhance security during API extraction. Furthermore, it abstracts and reconstructs the original API sequence from two perspectives: structural role clustering and functional classification. This involves constructing a thread-aware hierarchical graph structure and a multi-order functional transition matrix to extract collaboration patterns and functional evolution characteristics between APIs. Finally, through multimodal feature fusion and comparative learning mechanisms, it achieves high-precision, low-false-positive malware detection. This method is suitable for virtual machine security monitoring in multi-tenant cloud platforms and can effectively identify and classify malware with complex multi-threaded behavior.

[0008] The present invention provides a low-intrusion, multi-view malicious detection method in a virtualized environment, comprising the following steps: S1: Collect software samples on the Windows platform and label them based on the multi-engine detection results. Run the sample software in the KVM virtualization environment and intercept and capture its dynamic behaviors such as system calls, memory access and abnormal triggers through high-speed introspection technology to form a dynamic behavior database. S2: Extract the API sequences from the dynamic behavior and preprocess them, mapping them into API sequences based on structural role clustering and API sequences based on function classification, respectively. S3: Based on the structural role clustering sequence, construct a thread-aware hierarchical graph structure; based on the functional classification sequence, construct a third-order Markov functional transition matrix under frequency sorting and transition sorting. S4: Use a classification model to extract and classify features from samples. The malware detection model consists of four parts: a graph feature extractor, a function transition matrix feature extractor, a function feature comparison part, and a classifier. Graph features and function features are combined as the basis for classification. S5: The malware model is trained using API sequences from the dynamic behavior database to obtain the final malware detection model; Preferably, step S1 includes: S1.1: Obtain different types of portable malware and benign software from multiple security forums, and put these software into the VirusToal platform for tagging. If half of the more than 60 antivirus engines in the VirusToal platform consider the malicious sample to be of the same category, the tag is valid. If all antivirus engines consider the sample to be a benign sample, the benign sample is valid. S1.2: Run the tagged portable software sample in a KVM virtual machine; S1.3: In the KVM environment, call the dedicated interface for high-speed introspection to obtain a JSON file containing the dynamic characteristics of the sample software (such as system calls, memory accesses, and exception triggers) to form a dynamic behavior database; Preferably, step S2 includes: S2.1: Clean the JSON file in the database, retain only the dynamic characteristics of the API, arrange them into API group call sequences according to the call order under the same TID, and only take the first 5000 API call sequences under the same TID; S2.2: The API group call sequences under the same TID are converted into 128-dimensional feature vectors using the Word2Vec model. KMeans clustering is applied to the feature vectors, and the number of clusters is determined using the Elbow method. APIs of the same class are assigned the same label, and the average value of the vectors of APIs of the same class is calculated as the class vector of that class of APIs. An API structure role clustering table is obtained, which contains API name, API category, and average vector of API category. The API group call sequences are mapped to sequences based on API role clustering. S2.3: Categorize APIs according to Microsoft's official documentation, and map APIs of the same functional category to the same label, mapping API grouping call sequences to API sequences based on functional categories; Preferably, step S3 includes: S3.1: Based on the clustering sequence from step S2, map API calls within the same cluster to graph nodes, using the mean of the API vectors for that cluster as node features. Within the same TID, if two cluster nodes appear adjacently, establish a directed edge with the edge weight being the cumulative occurrence count, allowing self-loops to characterize repeated call behavior. Call sequences from different threads are modeled as independent subgraphs and merged into a global hierarchical graph, without establishing inter-thread edges to ensure independence. The output graph is... ,in This is the node feature matrix. Further, edge weight normalization is performed on each thread subgraph to reduce the interference of high-frequency edges on attention aggregation; the node feature dimension is 128. S3.2: Statistically analyze the API functions during the operation of the sample software in the database to obtain the frequency of API function occurrence and the probability of API function transfer; S3.3: Based on the functional classification API sequence in step S2, construct a third-order Markov matrix in descending order of the frequency of API functions. S3.4: Starting from any function in the functional classification API sequence in step S2, iteratively select the functional category with the highest transition probability in the current row as the next position to construct a third-order Markov matrix; Preferably, step S4 includes: S4.1: Input the hierarchical graph structure into the graph feature extractor for feature extraction. The extractor uses two layers of GAT to aggregate subgraph nodes. After completing the two node aggregations, the TopKpooling layer and Globalpooling layer are used to pool the large graph. The two pooled vectors are concatenated to obtain the graph structure features. S4.2: Input two function transfer matrices with different orders into the function transfer feature extractor for feature extraction. The feature extractor uses an input matrix of 100×100, passes it through a 3×3×16 convolutional layer, then through a ReLU activation function, then through a 2×2 max pooling layer, then through a 3×3×32 convolutional layer, again through a ReLU activation function, then through a 2×2 max pooling layer, and finally through a fully connected layer to obtain the final output features. S4.3: In the functional feature comparison section, perspective contrastive learning is used to constrain the functional transfer features, thereby obtaining stable and perspective-independent functional evolution features. S4.4: Combine structural features and functional evolution features to form a joint representation feature. Input this feature into a classifier. The classifier uses a two-layer fully connected neural network and a Softmax activation function in the output layer to obtain the probability distribution of each category and output the detection results. Preferably, step S5 includes: S5.1: Divide the data in the dynamic behavior database into training and validation sets, respectively, and then input them into the model to obtain graph structure features. Markov function transfer characteristics splicing together to form a joint feature ; S5.2: Use the cross-entropy loss function to calculate classification accuracy; S5.3: Treat the features extracted from the same sample under different sorted Markov matrices as positive sample pairs, and the features from different samples as negative sample pairs, and use InfoNCE loss to calculate the contrastive loss; S5.4: The classification loss and contrastive loss are weighted and combined to form the total loss function; S5.5: Perform gradient backpropagation and update the parameters of the graph neural network, convolutional neural network, and classifier. After each training cycle, input the validation set into the model and evaluate metrics such as accuracy and F1 score. If the validation performance does not improve, adjust the learning rate and regularization parameters to avoid overfitting. If the validation performance does not improve within several consecutive cycles, terminate the training early and save the best-performing model as the final malware detection model. The present invention also includes a low-intrusion, multi-view malware detection system in a virtualized environment for implementing the method of the present invention.

[0009] Compared with existing technologies, this invention proposes a low-intrusion, multi-view malware detection method and system in a virtualized environment. Existing methods rely on in-band acquisition, which is highly invasive and susceptible to malware anti-detection interference, while out-of-band acquisition incurs excessive performance overhead. Furthermore, modeling based on the original API name suffers from semantic redundancy and excessive computational overhead, making it difficult to adapt to multi-threaded, high-concurrency scenarios.

[0010] This invention achieves high-speed, introspective, and low-intrusive dynamic behavior sequence acquisition at the virtualization layer using shared memory snapshots and Delta-Copy technology. It combines structural role clustering and functional classification to construct a hierarchical graph structure and a third-order function transition matrix, and employs multimodal feature fusion and contrastive learning mechanisms. This improves detection accuracy while reducing false positive rates and computational costs, effectively overcoming the shortcomings of existing technologies. Based on these advantages, this invention designs a low-intrusive, multi-view malware detection method in a virtualized environment, consisting of sequentially connected high-speed introspective dynamic feature extraction, API call sequence preprocessing, and multi-feature fusion and classification. These three components work together to complete the entire detection process. The data extraction module is deployed at the virtualization layer. High-speed introspection technology allows for real-time acquisition of dynamic features of samples without interfering with virtual machine operation, achieving low-intrusion acquisition of malicious features and ensuring the security and transparency of data collection. API call sequence preprocessing cleans and abstracts the original call sequences, dividing them according to thread identifiers. It combines Word2Vec clustering and Microsoft's official function classification to generate dual-sequence inputs suitable for graph structure and Markov transition matrix modeling, thereby reducing redundancy and highlighting inter-thread logic and functional collaboration. The multi-feature fusion and classification module receives the aforementioned graph structure features and Markov function transition features, extracts deep representations through graph neural networks and convolutional neural networks respectively, and achieves cross-view alignment through contrastive learning. Finally, feature fusion and category determination are completed in the classifier. Through the synergistic effect of these three modules, this invention can achieve high-precision, low-overhead malware detection in complex multi-threaded scenarios, balancing the security of non-intrusive acquisition with the robustness of multi-view modeling, providing an effective technical solution for large-scale security protection in cloud environments. Attached Figure Description

[0011] To more clearly illustrate the specific embodiments of the present invention, the accompanying drawings used in the specific embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0012] Figure 1 This invention provides a low-intrusion, multi-perspective malware detection method and system flowchart in a virtualized environment. Figure 2 A detailed flowchart of training a low-intrusion, multi-view malicious detection model in a virtualized environment, as provided in an embodiment of the present invention; Figure 3 This invention provides a core architecture diagram of a low-intrusion, multi-view malware detection system in a virtualized environment. Detailed Implementation

[0013] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] See attached document Figure 1 As shown, this embodiment provides a low-intrusion, multi-perspective malware detection method in a virtualized environment, including the following steps: S1: Collect software samples on the Windows platform and label them based on the multi-engine detection results. Run the sample software in the KVM virtualization environment and intercept and capture its dynamic behaviors such as system calls, memory access and abnormal triggers through high-speed introspection technology to form a dynamic behavior database. S2: Extract the API sequences from the dynamic behavior and preprocess them, mapping them into API sequences based on structural role clustering and API sequences based on function classification, respectively. S3: Based on the structural role clustering sequence, construct a thread-aware hierarchical graph structure; based on the functional classification sequence, construct a third-order Markov functional transition matrix under frequency sorting and transition sorting. S4: Use a classification model to extract and classify features from samples. The malware detection model consists of four parts: a graph feature extractor, a function transition matrix feature extractor, a function feature comparison part, and a classifier. Graph features and function features are combined as the basis for classification. S5: The malware model is trained using API sequences from the dynamic behavior database to obtain the final malware detection model; See attached document Figure 2 As shown, this embodiment provides a detailed process for training a low-intrusion, multi-view malware detection model in a virtualized environment, including the following steps: S1: Place the tagged executable samples in a KVM virtualization environment and run them in parallel. Use a high-speed introspection interface to obtain their dynamic features and generate JSON files to form a dynamic behavior database. S2: Clean the contents of the JSON file in the dynamic behavior database, retain only the API call features, and arrange them into API group call sequences according to the thread identifier order. Process the API group call sequences by mapping them to API cluster sequences based on structural role clustering on the one hand, and to API function classification sequences based on the functional classification system on the other hand. S3: Use the API clustering sequence for hierarchical graph construction, and use the API function classification sequence for dual-view Markov matrix modeling. S4: Extract and fuse features from the two models of the labeled executable sample, and then predict and classify the final features; S5: By predicting the loss value between the classification result and the actual result, the parameters of the feature extractor and classifier are updated to obtain the malware detection model; For ease of understanding, the following is a detailed process of model training in the method of this invention.

[0016] S1.1: Install the Ubuntu 16.04 operating system on a physical machine, build a KVM virtualization environment on it, and collect and label malicious samples.

[0017] S1.2: Run the tagged sample software in a virtual machine for 2 minutes and call the dedicated interface for high-speed introspection in KVM to obtain dynamic behavior.

[0018] S1.3: Generate a JSON file that records the dynamic behavior of the sample in the host Ubuntu environment, and form a dynamic behavior database.

[0019] S2.1: Use a Python script to process the JSON file, divide it by thread identifier (TID) and convert it into the format {[“API1”, “API2”, …, “APIn”], …}, where n ≤ 5000, and each bracket represents a call sequence within a thread, thus forming an API group call sequence.

[0020] S2.2: Map the APIs in the API grouping call sequence according to the pre-established structure role clustering table to obtain the API clustering sequence, such as {[“1”, “2”, …, “5”, “6”], [“4”, “6”, “18”, …, “1”],…}.

[0021] S2.3: Map the APIs in the original sequence according to the functional classification table to obtain the API functional classification sequence, for example, {[“1”, “8”, …, “4”, “7”], [“3”, “7”, “8”, …, “3”], …}.

[0022] S3.1: For the clustering sequence ["1","2",…"5","6"] of thread T1, instantiate the node {(t1,1),(t1,2),(t1,5),(t1,6)} and sequentially establish directed edges (t1,1→t1,2), (t1,2→t1,5), and (t1,5→t1,6) within the same thread. The edge weights are the cumulative occurrence counts, and self-loops are allowed. Thread T2 is the same as T1. The subgraphs of each thread are merged into a global hierarchical graph of the samples. No edges are established between different threads. The features of all nodes are taken as the mean of the corresponding cluster class vectors. The cumulative edge weights are normalized within each subgraph to reduce high-frequency edge interference, and finally, the graph structure G=(V,E,X) is obtained.

[0023] S3.2: Statistically analyze the API functions during the operation of the sample software in the database to obtain the frequency of API function occurrence and the probability of API function transfer.

[0024] S3.3: Construct a probability transition matrix from the function classification sequence {["1", "8", …, "4", "7"], ["3", "7", "8", …, "3"], …}. Arrange the matrix dimensions according to the frequency of API functions, construct a first-order transition probability matrix according to this order, and construct a third-order transition matrix through matrix operations. .

[0025] S3.4: Starting from any function category in the functional classification sequence {["1", "8", …, "4", "7"], ["3", "7", "8", …, "3"], …}, iteratively select the category with the highest API function transition probability as the next position. Similarly, obtain the result through matrix operations. .

[0026] S4.1: The hierarchical graph structure G=(V,E,X) is input into the graph feature extractor for feature extraction. This extractor uses two layers of GAT to aggregate subgraph nodes. After completing the two node aggregations, the large graph is pooled using TopKpooling and Globalpooling layers. The two pooled vectors are concatenated to obtain the graph structure feature representation. .

[0027] S4.2: Two function transfer matrices with different orderings are input into a function transfer feature extractor for feature extraction. This feature extractor uses an input matrix of 100×100, passes it through a 3×3×16 convolutional layer, then through a ReLU activation function, followed by a 2×2 max pooling layer, then through a 3×3×32 convolutional layer, again through a ReLU activation function, then through a 2×2 max pooling layer, and finally through a fully connected layer to obtain the final output, which is the function transfer feature representation. and .

[0028] S4.3: Perspective-contrast learning is used to constrain function transfer features. Features of the same sample in frequency ranking and transfer ranking are used as positive sample pairs, and features of different samples are used as negative samples. The contrastive loss function maximizes the similarity of positive samples and minimizes the similarity of negative samples, thereby obtaining a stable and perspective-independent representation of function evolution features. .

[0029] S4.4: Structural features With functional evolution characteristics A joint representation is formed by splicing together dimensions. ,Will The input is a classifier, which uses a two-layer fully connected neural network and a softmax activation function in the output layer to obtain the probability distribution of each class and output the prediction results. .

[0030] S5.1: The data in the dynamic behavior database are modeled sequentially, and then input into the model to obtain graph structure features. Markov function transfer characteristics splicing together to form a joint feature And output the class probability distribution through the classifier. .

[0031] S5.2: Based on prediction results Authentic Labels The cross-entropy loss function is used:

[0032] Used to measure classification accuracy.

[0033] S5.3: Presenting the same sample from different perspectives Features extracted from different samples are treated as positive sample pairs, and features from different samples are treated as negative sample pairs. InfoNCE loss is used.

[0034] in For temperature parameters, Let be the cosine similarity.

[0035] S5.4: Weight the classification loss and contrastive loss to obtain the total loss function:

[0036] S5.5: Perform gradient backpropagation and update the parameters of graph neural networks, convolutional neural networks and classifiers. After each training cycle, if the model performance does not improve within a certain number of consecutive cycles, terminate the training early and save the best performing model as the final malware detection model.

[0037] See attached document Figure 3 As shown, this embodiment provides a low-intrusion, multi-perspective malware detection system architecture in a virtualized environment, which mainly involves two parts: a user interaction layer and a core business logic layer.

[0038] The user interaction layer is dedicated to providing one-stop testing, with core functions including: convenient sample uploading, efficient testing, intuitive result display, complete historical traceability, and centralized sample data management.

[0039] The core business logic layer is responsible for executing efficient detection tasks. Its core consists of five modules: data interaction module, dynamic feature extraction module, API sequence preprocessing module, API sequence modeling module, and feature extraction and classification module.

[0040] The data interaction module serves as the unified entry and exit point for the core business layer. All detection requests from the user interaction layer are handled by this module, and the detection results are uniformly encapsulated and sent back to the front end after the feature extraction and classification modules have completed their execution.

[0041] The dynamic feature extraction module uses high-speed introspection technology to collect dynamic features of samples in real time without interfering with the normal operation of the virtual machine. This enables non-intrusive acquisition of malicious behavior features and ensures the security and transparency of data collection, providing basic data for subsequent modeling.

[0042] The API sequence preprocessing module cleans and abstracts the API calls in the JSON file transmitted by the dynamic feature extraction module, divides them according to thread identifiers, and combines embedding learning and clustering methods with the official functional classification system to map the sequences into structural role clustering sequences and functional classification sequences, forming a dual input suitable for graph structure modeling and Markov transition matrix modeling, thereby reducing redundancy and highlighting the thread logic and functional coordination relationship.

[0043] The API sequence modeling module models structural clustering sequences and functional classification sequences. For structural role clustering sequences, based on thread partitioning, the API clustering sequence is instantiated into nodes, and directed edges are sequentially established to construct a global hierarchical graph structure that preserves thread locality. For functional classification sequences, two third-order transition probability matrices based on frequency sorting and greedy paths are constructed through matrix operations.

[0044] The multi-feature fusion and classification module receives the above-mentioned graph construction and the third-order Markov matrix with different orderings, extracts deep representations through graph neural networks and convolutional neural networks respectively, and introduces a contrastive learning mechanism to achieve cross-view feature alignment. Finally, the multi-modal feature fusion and category determination are completed in the classifier, and the malware detection result is output.

[0045] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made to the technical solutions of the present invention by those skilled in the art without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A low-intrusion, multi-view malware detection method in a virtualized environment, comprising the following steps: S1: Collect software samples on the Windows platform and label them based on the multi-engine detection results. Run the sample software in the KVM virtualization environment and intercept and capture its dynamic behaviors such as system calls, memory access and abnormal triggers through high-speed introspection technology to form a dynamic behavior database. S2: Extract the API sequences from the dynamic behavior and preprocess them, mapping them into API sequences based on structural role clustering and API sequences based on function classification, respectively. S3: Based on the structural role clustering sequence, construct a thread-aware hierarchical graph structure; based on the functional classification sequence, construct a third-order Markov functional transition matrix under frequency sorting and transition sorting. S4: Use a classification model to extract and classify features from samples. The malware detection model consists of four parts: a graph feature extractor, a function transition matrix feature extractor, a function feature comparison part, and a classifier. Graph features and function features are combined as the basis for classification. S5: The malware model is trained using API sequences from the dynamic behavior database to obtain the final malware detection model.

2. The low-intrusion, multi-view malicious detection method in a virtualized environment as described in claim 1, characterized in that, Step S1 includes: S1.1: Obtain different types of portable malware and benign software from multiple security forums, and put these software into the VirusToal platform for tagging. If half of the more than 60 antivirus engines in the VirusToal platform consider the malicious sample to be of the same category, the tag is valid. If all antivirus engines consider the sample to be a benign sample, the benign sample is valid. S1.2: Run the tagged portable software sample in a KVM virtual machine; S1.3: In the KVM environment, call the dedicated interface for high-speed introspection to obtain a JSON file containing the dynamic features of the sample software.

3. The low-intrusion, multi-view malicious detection method in a virtualized environment as described in claim 1, characterized in that, Step S2 includes: S2.1: Clean the data in the JSON file containing the dynamic features, retain only the API dynamic features, arrange them into API group call sequences according to the call order under the same TID, and only take the first 5000 API call sequences under the same TID. S2.2: The API group call sequences under the same TID are converted into 128-dimensional feature vectors using the Word2Vec model. KMeans clustering is applied to the feature vectors, and the number of clusters is determined using the Elbow method. APIs of the same class are assigned the same label, and the average value of the vectors of APIs of the same class is calculated as the class vector of that class of APIs. An API structure role clustering table is obtained, which contains API name, API category, and average vector of API category. The API group call sequences are mapped to sequences based on API role clustering. S2.3: Categorize APIs according to Microsoft's official documentation, and map APIs of the same functional category to the same label, mapping API grouping call sequences to API sequences based on functional categories.

4. The low-intrusion, multi-view malicious detection method in a virtualized environment as described in claim 1, characterized in that, Step S3 includes: S3.1: Based on the clustering sequence in step S2, map API calls within the same cluster to graph nodes, using the mean of the API vectors for that cluster as node features; within the same TID, if two cluster nodes appear adjacently, establish a directed edge with the edge weight being the cumulative occurrence count, allowing self-loops to characterize repeated call behavior; call sequences from different threads are modeled as independent subgraphs and merged into a global hierarchical graph, without establishing inter-thread edges to ensure independence; the output graph is... ,in The node feature matrix is ​​used; further, the edge weights of each thread subgraph are normalized to reduce the interference of high-frequency edges on attention aggregation. The node feature dimension is 128. S3.2: Statistically analyze the API functions during the operation of the sample software in the database to obtain the frequency of API function occurrence and the probability of API function transfer; S3.3: Based on the functional classification API sequence in step S2, construct a third-order Markov matrix in descending order of the frequency of API functions. S3.4: Starting from any function in the functional classification API sequence in step S2, iteratively select the functional category with the highest transition probability in the current row as the next position to construct a third-order Markov matrix.

5. The low-intrusion, multi-view malicious detection method in a virtualized environment as described in claim 1, characterized in that, Step S4 includes: S4.1: Input the hierarchical graph structure into the graph feature extractor for feature extraction. The extractor uses two layers of GAT to aggregate subgraph nodes. After completing the two node aggregations, the TopKpooling layer and Globalpooling layer are used to pool the large graph. The two pooled vectors are concatenated to obtain the graph structure features. S4.2: Input two function transfer matrices with different orders into the function transfer feature extractor for feature extraction. The feature extractor uses an input matrix of 100×100, passes it through a 3×3×16 convolutional layer, then through a ReLU activation function, then through a 2×2 max pooling layer, then through a 3×3×32 convolutional layer, again through a ReLU activation function, then through a 2×2 max pooling layer, and finally through a fully connected layer to obtain the final output features. S4.3: In the functional feature comparison section, perspective contrastive learning is used to constrain the functional transfer features, thereby obtaining stable and perspective-independent functional evolution features. S4.4: Combine structural features and functional evolution features to form a joint representation feature. Input this feature into a classifier. The classifier uses a two-layer fully connected neural network and applies the Softmax activation function in the output layer to obtain the probability distribution of each category and output the detection results.

6. The low-intrusion, multi-view malicious detection method in a virtualized environment as described in claim 1, characterized in that, Step S5 includes: S5.1: The data in the dynamic behavior database are modeled sequentially, and then input into the model to obtain graph structure features. Markov function transfer characteristics splicing together to form a joint feature ; S5.2: Use the cross-entropy loss function to calculate classification accuracy; S5.3: Treat the features extracted from the same sample under different sorted Markov matrices as positive sample pairs, and the features from different samples as negative sample pairs, and use InfoNCE loss to calculate the contrastive loss; S5.4: The classification loss and contrastive loss are weighted and combined to form the total loss function; S5.5: Perform gradient backpropagation and update the parameters of the graph neural network, convolutional neural network, and classifier; evaluate metrics such as accuracy and F1 score after each training cycle; if performance improves, adjust the learning rate and regularization parameters to avoid overfitting; if the performance does not improve within several consecutive cycles, terminate training early and save the best-performing model as the final malware detection model.

7. A low-intrusion, multi-view malware detection system in a virtualized environment, characterized in that, This includes the user interaction layer and the core business logic layer; The user interaction layer provides a one-stop testing experience, including: convenient sample uploading, efficient testing, intuitive result display, complete historical traceability, and centralized sample data management; The core business logic layer is responsible for executing efficient detection tasks, including: data interaction module, dynamic feature extraction module, API sequence preprocessing module, API sequence modeling module, and feature extraction and classification module; The data interaction module is the unified entry and exit point of the core business layer. All detection requests from the user interaction layer are handled by this module. After the feature extraction and classification module has finished executing, the detection results are also uniformly packaged by this module and sent back to the front end. The dynamic feature extraction module uses high-speed introspection technology to collect dynamic features of samples in real time without interfering with the normal operation of the virtual machine, thereby achieving non-intrusive acquisition of malicious behavior features and ensuring the security and transparency of data collection, providing basic data for subsequent modeling. The API sequence preprocessing module cleans and abstracts the API calls in the JSON file transmitted by the dynamic feature extraction module, divides them according to thread identifiers, and combines embedding learning and clustering methods with the official functional classification system to map the sequences into structural role clustering sequences and functional classification sequences respectively, forming a dual input suitable for graph structure modeling and Markov transition matrix modeling, thereby reducing redundancy and highlighting the thread logic and functional coordination relationship. The API sequence modeling module models structural clustering sequences and functional classification sequences. For structural role clustering sequences, based on thread partitioning, the API clustering sequence is instantiated into nodes, and directed edges are established sequentially to construct a global hierarchical graph structure that preserves thread locality. For functional classification sequences, two third-order transition probability matrices based on frequency sorting and greedy path are constructed through matrix operations. The multi-feature fusion and classification module receives the above-mentioned graph construction and the third-order Markov matrix with different orderings, extracts deep representations through graph neural networks and convolutional neural networks respectively, and introduces a contrastive learning mechanism to achieve cross-view feature alignment. Finally, the multi-modal feature fusion and category determination are completed in the classifier, and the malware detection result is output.

Images