Malware identification method, system, computer device and readable storage medium

Abstract

The application belongs to the field of software security, and discloses a malware identification method and system, computer equipment and a readable storage medium, which comprises obtaining a plurality of malware to be identified, and constructing a function call graph of each malware according to the functions and the function call relationship between the functions of each malware; according to the function call graph of each malware, graph representation learning is performed through a graph convolution network to generate a feature vector representation of each malware; according to the feature vector representation of each malware, a pre-trained semi-supervised classifier is used to classify each malware into malware of a known category and malware of an unknown category, and the malware of the unknown category is clustered, and classification is performed according to the clustering result. The feature representation learning at the behavior structure level of the malware is realized, the complementary advantages of semi-supervised classification and clustering are fully utilized, and the accuracy and robustness of the malware category identification are improved.

Description

Technical Field

[0001] This invention belongs to the field of software security and relates to a method, system, computer device, and readable storage medium for identifying malicious software. Background Technology

[0002] With the rapid development of smartphones, mobile applications have become an indispensable part of daily life. Android, as the most popular smartphone platform, holds a market share of over 85%. However, Android's openness has attracted not only legitimate developers but also attackers who spread malware. Malware generates variants and forms categories through obfuscation techniques such as polymorphism and metamorphism, leading to an explosive growth in the number of malware programs. This poses a serious threat to user security, such as increased data usage, privacy theft, and remote control.

[0003] Existing Android malware category analysis methods are mainly divided into two categories: (1) supervised learning methods based on graph similarity analysis or application syntax features (such as permission requests and key API calls); and (2) unsupervised learning methods based on clustering, such as GefDroid, GroupDroid, and ANDRE. However, these methods have the following limitations: supervised learning requires a large number of labeled samples and is difficult to handle unknown categories; unsupervised learning cannot utilize existing label information; and graph similarity analysis has high computational costs and requires a large amount of resources. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, system, computer device and readable storage medium for identifying malicious software.

[0005] To achieve the above objectives, the present invention employs the following technical solution: In a first aspect, the present invention provides a method for identifying malware, comprising: acquiring several malware to be identified, and constructing a function call graph of each malware based on the functions of each malware and the call relationships between functions; generating feature vector representations of each malware by performing graph representation learning through a graph convolutional network based on the function call graphs of each malware; classifying each malware into malware of known categories and malware of unknown categories by a pre-trained semi-supervised classifier based on the feature vector representations of each malware, and clustering malware of unknown categories and classifying it based on the clustering results.

[0006] Optionally, constructing the function call graph of each piece of malware based on its functions and the call relationships between functions includes: obtaining the Dalvik code of the malware by decompiling the application package file of the malware; obtaining the functions and the call relationships between functions of the malware based on the Dalvik code of the malware, and constructing the function call graph by using the functions as nodes and the call relationships between functions as edges.

[0007] Optionally, constructing the function call graph of each malware further includes: obtaining the target function from the functions of each malware that involve sensitive operations, and performing sensitive operation semantic marking on the nodes corresponding to the target function in the function call graph.

[0008] Optionally, the sensitive operations include one or more of the following: network communication, location acquisition, file reading and writing, and SMS sending.

[0009] Optionally, the graph convolutional network includes an input layer, a first graph convolutional module, a first graph pooling layer, a second graph convolutional module, a second graph pooling layer, a third graph convolutional module, and an output layer connected in sequence; wherein the first graph convolutional module, the second graph convolutional module, and the third graph convolutional module each include a graph convolutional layer, a ReLU activation layer, and a node-level batch normalization layer connected in sequence.

[0010] Optionally, the step of generating feature vector representations of each malware by learning graph representations through graph convolutional networks based on the function call graphs of each malware includes: traversing each malware, inputting the function call graph of the malware into a graph convolutional network for feature extraction, obtaining the feature representations of each node in the function call graph of the malware and performing max pooling to obtain the global graph vector of each malware, and standardizing the global graph vector of each malware using a z-score-inspired normalization method to generate the feature vector representation of the malware.

[0011] Optionally, the pre-trained semi-supervised classifier is constructed based on a semi-supervised support vector machine; the clustering of malware of unknown categories includes: using density-based noisy spatial clustering, spectral clustering, or K-Means clustering to cluster malware of unknown categories.

[0012] In a second aspect, the present invention provides a malware identification system, comprising: a graph construction module for acquiring several malware to be identified and constructing a function call graph of each malware based on the functions of each malware and the call relationships between functions; a feature extraction module for generating feature vector representations of each malware by performing graph representation learning through a graph convolutional network based on the function call graphs of each malware; and an identification module for classifying each malware into known-category malware and unknown-category malware using a pre-trained semi-supervised classifier based on the feature vector representations of each malware, and for clustering the unknown-category malware and classifying it based on the clustering results.

[0013] In a third aspect, the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described malware identification method.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described malware identification method.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This invention's malware identification method first constructs a function call graph for each malware, elevating malware behavior modeling from a single instruction or API call level to a structured, semantic function interaction level, fundamentally enhancing the depth and discriminative power of feature representation. Then, a graph convolutional network is used to perform embedded feature extraction on the call graph, generating feature vector representations for each malware. This automatically captures the topological relationships and higher-order semantics between function nodes, making the generated feature vector representations inherently robust against common adversarial techniques such as code renaming and control flow obfuscation. Finally, a two-stage semi-supervised identification mechanism integrating classification and clustering is employed. On one hand, a pre-trained semi-supervised classifier can efficiently identify known categories; on the other hand, cluster analysis is performed on high-uncertainty samples that are difficult for the semi-supervised classifier to determine, thereby achieving effective discovery and classification of unknown categories. This not only overcomes the limitations of traditional supervised learning relying on extensive annotations and unsupervised methods ignoring known information, but also significantly improves the system's perception and adaptation capabilities to new and variant malware while maintaining high identification accuracy, demonstrating good scalability and engineering application prospects. The method of this invention realizes feature representation learning at the behavioral structure level of malware, and makes full use of the complementary advantages of semi-supervised classification and clustering to improve the accuracy and robustness of malware category identification. It is especially suitable for practical application scenarios with a large number of unlabeled malware and unknown malware categories. Attached Figure Description

[0016] Figure 1 This is a flowchart of a malware identification method according to an embodiment of the present invention.

[0017] Figure 2 This is a block diagram of the graph convolutional network structure according to an embodiment of the present invention.

[0018] Figure 3 This is a block diagram of the malware identification system according to an embodiment of the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] The present invention will now be described in further detail with reference to the accompanying drawings: See Figure 1 In one embodiment of the present invention, a malware identification method is provided. For malware on platforms such as Android, behavior modeling is performed by constructing a function call graph, and graph neural networks and semi-supervised learning frameworks are combined to achieve automatic identification and clustering analysis of malware categories.

[0022] Specifically, the malware identification method of the present invention includes the following steps: S1: Obtain several malware samples to be identified, and construct a function call graph for each malware based on its functions and the call relationships between them.

[0023] S2: Based on the function call graphs of each malware, graph representation learning is performed through graph convolutional networks to generate feature vector representations for each malware.

[0024] S3: Based on the feature vector representation of each malware, a pre-trained semi-supervised classifier is used to classify each malware into known categories and unknown categories, and the malware of unknown categories is clustered and classified according to the clustering results.

[0025] This invention's malware identification method first constructs a function call graph for each malware, elevating malware behavior modeling from a single instruction or API call level to a structured, semantic function interaction level, fundamentally enhancing the depth and discriminative power of feature representation. Then, a graph convolutional network is used to perform embedded feature extraction on the call graph, generating feature vector representations for each malware. This automatically captures the topological relationships and higher-order semantics between function nodes, making the generated feature vector representations inherently robust against common adversarial techniques such as code renaming and control flow obfuscation. Finally, a two-stage semi-supervised identification mechanism integrating classification and clustering is employed. On one hand, a pre-trained semi-supervised classifier can efficiently identify known categories; on the other hand, cluster analysis is performed on high-uncertainty samples that are difficult for the semi-supervised classifier to determine, thereby achieving effective discovery and classification of unknown categories. This not only overcomes the limitations of traditional supervised learning relying on extensive annotations and unsupervised methods ignoring known information, but also significantly improves the system's perception and adaptation capabilities to new and variant malware while maintaining high identification accuracy, demonstrating good scalability and engineering application prospects. The method of this invention realizes feature representation learning at the behavioral structure level of malware, and makes full use of the complementary advantages of semi-supervised classification and clustering to improve the accuracy and robustness of malware category identification. It is especially suitable for practical application scenarios with a large number of unlabeled malware and unknown malware categories.

[0026] In one possible implementation, constructing the function call graph of each piece of malware based on its functions and the call relationships between functions includes: obtaining the Dalvik code of the malware by decompiling the application package file of the malware; obtaining the functions and the call relationships between functions of the malware based on the Dalvik code of the malware, and constructing the function call graph by using the functions as nodes and the call relationships between functions as edges.

[0027] This approach, specifically targeting malware, extracts the Function Call Graph (FCG) as behavioral characteristics from the overall program structure. The fundamental principle is that malicious behavior in malware is often achieved through a series of coordinated function calls, rather than a single instruction or API call. Therefore, traditional methods relying solely on permissions, instruction sequences, or string features are insufficient to characterize behavioral semantics. In this implementation, the APK file is decompiled, its DEX bytecode is analyzed, and the sets of functions and their call relationships are identified. Functions are treated as nodes in the graph, and the call relationships between functions are treated as edges, thus constructing the FCG.

[0028] In FCG, the graph structure not only depicts the static topological connections between functions but also implicitly contains behavioral dependencies and execution path information, enabling the internal behavioral logic of malware to be modeled holistically in graph form. Therefore, through FCG representation, this invention elevates single-point features at the instruction or API level to function-level graph structure features, achieving a structured and semantic representation of malware behavior patterns and providing rich structural inputs for subsequent feature vector representation generation based on graph neural networks.

[0029] In one possible implementation, the construction of the function call graph of each malware further includes: obtaining the target function by acquiring the functions involving sensitive operations in each function of the malware, and performing sensitive operation semantic marking on the nodes corresponding to the target function in the function call graph.

[0030] Optionally, the sensitive operations include one or more of the following: network communication, location acquisition, file reading and writing, and SMS sending.

[0031] Interpretive features are provided by identifying function nodes involved in sensitive operations within the FCG, such as key APIs for network communication, location acquisition, file reading and writing, and SMS sending. This identification offers higher behavioral indicativeness and provides key anchor points for malicious behavior in graph convolutional networks (GCNs). It significantly enhances the learning efficiency and discriminative ability of GCNs by strengthening the information weights of key nodes during graph convolution, allowing the GCN to focus its attention on function interaction paths that truly reflect malicious intent, effectively suppressing noise interference from numerous irrelevant code nodes. This improves the purity of feature vector representations in representing core malicious behaviors, making classification and clustering results more interpretable and intuitively linked to specific harmful behavior patterns, thus improving identification accuracy and robustness against obfuscated code.

[0032] In one possible implementation, see Figure 2The graph convolutional network includes an input layer, a first graph convolutional module, a first graph pooling layer, a second graph convolutional module, a second graph pooling layer, a third graph convolutional module, and an output layer connected in sequence; wherein the first graph convolutional module, the second graph convolutional module, and the third graph convolutional module each include a graph convolutional layer, a ReLU activation layer, and a node-level batch normalization layer connected in sequence.

[0033] Explained, this invention utilizes Graph Convolutional Networks (GCNs) to learn graph representations of Graph Collective Geometry (FCGs), achieving embedded representations of nodes and the overall graph structure. The principle is to treat FCGs as non-Euclidean structured data, propagating and aggregating information within the node's neighborhood through graph convolution operations. This ensures that each node representation includes not only its own attribute information but also higher-order semantic information about neighboring nodes and their connections. The adopted GCN structure consists of a sequentially connected input layer, a first graph convolutional module, a first graph pooling layer, a second graph convolutional module, a second graph pooling layer, a third graph convolutional module, and an output layer. Graph pooling operations are performed by alternately introducing the first and second graph pooling layers, compressing the graph structure layer by layer to form a graph-level semantic representation. Through multiple convolution and pooling operations, subgraph structure patterns at different scales can be captured, such as function chains, call clusters, and control structures involved in common malicious behaviors. The first, second, and third graph convolutional modules are all composed of sequentially connected graph convolutional layers, ReLU activation layers, and node-level batch normalization layers. The introduction of node-level batch normalization layers improves training stability and alleviates the gradient vanishing problem.

[0034] In one possible implementation, the step of generating feature vector representations of each malware by learning graph representations through a graph convolutional network based on the function call graphs of each malware includes: traversing each malware, inputting the function call graph of the malware into a graph convolutional network for feature extraction, obtaining the feature representations of each node in the function call graph of the malware and performing max pooling to obtain the global graph vector of each malware, and standardizing the global graph vector of each malware using a z-score-inspired normalization method to generate the feature vector representation of the malware.

[0035] Interpretively, after obtaining the node embeddings, a max pooling operation is further performed to generate global graph vectors, and a z-score-inspired normalization method is used to standardize the global graph vectors, thereby obtaining a stable, low-dimensional, and dense feature vector representation of the malware. This feature vector representation not only preserves the function call structure relationship but also has good separability, which is the basis for subsequent classification and clustering analysis.

[0036] In one possible implementation, the pre-trained semi-supervised classifier is built based on a semi-supervised support vector machine; the clustering of malware of unknown categories includes: using density-based noisy spatial clustering, spectral clustering, or K-Means clustering to cluster malware of unknown categories.

[0037] This paper interprets a two-stage semi-supervised category analysis method for malware identification and category classification. First, in the first stage, a small number of malware samples with known category labels are introduced and combined with a large number of unlabeled malware samples to pre-train a semi-supervised classifier. This pre-trained classifier performs preliminary category classification on the malware to be identified. In this stage, the semi-supervised classifier not only learns the category discrimination boundary from the label information but also enhances the model's generalization ability by utilizing the distribution structure information of unlabeled samples, thus making it suitable for real-world malware environments where labels are scarce. In the second stage, based on the output confidence of the semi-supervised classifier from the first stage, malware with low classification confidence (e.g., classification confidence below a preset classification confidence threshold) is filtered out and automatically clustered. Malware with high uncertainty often includes unknown categories, variants, or malware with ambiguous boundaries; therefore, clustering can be used to mine their inherent similarities from the feature space structure, enabling automatic identification of potential new malware categories. The two-stage joint analysis mechanism combines the ideas of classification and clustering, ensuring the accuracy of known category identification while also having the ability to discover unknown and variant categories.

[0038] In one possible implementation, the malware identification method of the present invention is illustrated using a set of malware samples from the Android platform as an example.

[0039] Specifically, the APK files of each malware in the malware sample set are first decompiled to extract DEX code and perform static analysis. Corresponding function call relationships are established, and functions are used as nodes, with these relationships forming edges to construct a function call graph. Simultaneously, functions involving sensitive permissions or dangerous operations in the function call graph are marked as sensitive nodes, creating a semantically annotated function call graph. Subsequently, the function call graph is input into a graph convolutional network, where multi-level feature extraction and embedding learning are performed through a three-layer graph convolutional module and a two-layer graph pooling layer. This yields a low-dimensional feature vector for each malware, which is then processed by max pooling and normalization to obtain a stable and consistent feature vector representation. Finally, a semi-supervised classifier is used to perform preliminary category classification of the samples. Cluster analysis is performed on samples with classification confidence below a preset threshold to discover hidden variant categories and unknown categories. Experimental results show that the method of this invention can effectively identify malware categories. Even when facing code obfuscation, polymorphic variants, and novel malicious categories, it still exhibits high recognition rate and robustness, verifying the feasibility and effectiveness of the technical solution of this invention.

[0040] In summary, the malware identification method of this invention first extracts functions and function call relationships from malware to form a function call graph that reflects the internal behavioral structure of malware, serving as the basic representation of malware behavioral semantic features. Second, it utilizes a graph convolutional neural network to learn the graph representation, embedding and encoding nodes in the graph to generate low-dimensional, dense feature vector representations, thereby obtaining malware feature representations for global malicious behavior analysis. Finally, it proposes a two-stage semi-supervised category analysis method for joint classification and clustering identification of malware: in the first stage, a pre-trained semi-supervised classifier is used to perform preliminary category classification of malware; in the second stage, clustering operations are introduced for malware with low confidence output by the semi-supervised classifier, automatically clustering such malware to achieve category analysis of malware of unknown categories.

[0041] Compared with existing methods, the malware identification method of this invention has at least the following advantages: First, the shift from instruction-level to function call graph-level behavioral modeling enhances feature representation capabilities. This invention moves beyond the shallow feature modeling methods employed in traditional malware identification, such as single instruction sequences, API frequency statistics, or permission combinations. Instead, it constructs a function call graph by treating functions within the malware as nodes and the call relationships between functions as edges, providing a holistic characterization of the malware's internal structural relationships and behavioral logic. This graph-structured modeling approach not only preserves function-level semantic information but also simultaneously describes the call dependencies, execution paths, and contextual relationships between multiple functions. This elevates the feature representation from the instruction-level or linear sequence-level to a structured behavioral representation at the function call graph level, significantly enhancing the ability to express the true semantics of malware behavior and providing a richer, more stable, and discriminative feature foundation for subsequent identification and analysis.

[0042] Secondly, the introduction of graph convolutional networks for embedding learning improves robustness against code obfuscation and polymorphic variants. Based on the construction of a function call graph, this invention introduces graph convolutional neural networks to learn embeddings from graph structure data. By propagating and aggregating neighborhood information of nodes on the graph structure, it achieves automatic modeling of high-order structural relationships and behavioral semantics of function nodes. Graph convolutional networks can learn low-dimensional dense vector representations from the overall call graph without relying on manually designed features, making malware with similar behavioral patterns more clustered in the embedding space. Even if malware is obfuscated through renaming, instruction insertion, code rearrangement, or simple control flow transformations, its function call topology usually remains essentially unchanged. Therefore, the embedding features learned by this invention remain stable and effective, thus exhibiting stronger robustness and generalization ability when facing polymorphic variants, code obfuscation, and repackaged malware.

[0043] Third, a two-stage semi-supervised category analysis method is adopted to improve the recognition capability in scenarios with insufficient labels. This invention addresses the problem of severe label shortages in malware samples in real-world scenarios by proposing a two-stage semi-supervised category analysis method. In the first stage, this invention trains a semi-supervised classifier using a small number of labeled malware samples, while simultaneously combining this with the distribution information of a large number of unlabeled malware samples for joint learning, thereby improving the generalization ability of the semi-supervised classifier in label-scarce environments. In the second stage, for malware whose predictions by the semi-supervised classifier have low confidence, are at the decision boundary, or are difficult to classify clearly, this invention further introduces a clustering analysis method to automatically cluster such malware, thereby identifying potential unknown malware categories or variants. Through the above two-stage joint analysis mechanism, this invention can still complete the malware category identification task under conditions of limited labels, effectively solving the problem of significant performance degradation in existing methods under insufficient label conditions.

[0044] Fourth, the fusion of classification and clustering results improves the accuracy and stability of malware category identification. This invention does not simply rely on a single classification or clustering algorithm, but proposes a decision-making mechanism that fuses classification and clustering results. For malware with high confidence from a semi-supervised classifier, the classification result is directly used as the category identification output; for malware with low classification confidence or exhibiting strong uncertainty, clustering analysis is used for further fine-grained segmentation, and the results are combined with the classification results for fusion judgment, thereby avoiding systematic biases caused by a single model. This fusion strategy fully leverages the advantages of supervised learning in identifying known categories and unsupervised clustering in discovering unknown categories, resulting in higher accuracy and stability in malware category identification and effectively reducing the probability of false positives and false negatives.

[0045] Fifth, it supports large-scale malware processing and has promising engineering application prospects. This invention transforms complex malware behavior representations into low-dimensional dense vector representations through function call graph modeling and graph convolutional network embedding learning, thereby significantly reducing feature dimensionality and improving processing efficiency. The proposed two-stage semi-supervised identification framework can be implemented on distributed or parallel computing platforms and can adapt to the real-world environment of continuously and rapidly increasing malware numbers. The method of this invention has a clear structure, controllable computational complexity, and is easy to deploy and apply in existing malware analysis systems, security audit platforms, and cloud security service environments. It can achieve efficient processing and real-time identification of large-scale malware in engineering practice, demonstrating good practical application value and promising prospects for widespread adoption.

[0046] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0047] See Figure 3 In another embodiment of the present invention, a malware identification system is provided, which can be used to implement the above-mentioned malware identification method. Specifically, the malware identification system includes a graph construction module, a feature extraction module, and an identification module.

[0048] The graph construction module is used to acquire several malware to be identified and construct the function call graph of each malware based on the functions of each malware and the call relationships between functions. The feature extraction module is used to learn the graph representation of each malware through a graph convolutional network based on the function call graph of each malware to generate the feature vector representation of each malware. The identification module is used to classify each malware into known categories and unknown categories of malware through a pre-trained semi-supervised classifier based on the feature vector representation of each malware, and to cluster the malware of unknown categories and classify it based on the clustering results.

[0049] In one possible implementation, constructing the function call graph of each piece of malware based on its functions and the call relationships between functions includes: obtaining the Dalvik code of the malware by decompiling the application package file of the malware; obtaining the functions and the call relationships between functions of the malware based on the Dalvik code of the malware, and constructing the function call graph by using the functions as nodes and the call relationships between functions as edges.

[0050] In one possible implementation, the construction of the function call graph of each malware further includes: obtaining the target function by acquiring the functions involving sensitive operations in each function of the malware, and performing sensitive operation semantic marking on the nodes corresponding to the target function in the function call graph.

[0051] In one possible implementation, the sensitive operations include one or more of the following: network communication, location acquisition, file reading and writing, and SMS sending.

[0052] In one possible implementation, the graph convolutional network includes an input layer, a first graph convolutional module, a first graph pooling layer, a second graph convolutional module, a second graph pooling layer, a third graph convolutional module, and an output layer connected in sequence; wherein the first graph convolutional module, the second graph convolutional module, and the third graph convolutional module each include a graph convolutional layer, a ReLU activation layer, and a node-level batch normalization layer connected in sequence.

[0053] In one possible implementation, the step of generating feature vector representations of each malware by learning graph representations through a graph convolutional network based on the function call graphs of each malware includes: traversing each malware, inputting the function call graph of the malware into a graph convolutional network for feature extraction, obtaining the feature representations of each node in the function call graph of the malware and performing max pooling to obtain the global graph vector of each malware, and standardizing the global graph vector of each malware using a z-score-inspired normalization method to generate the feature vector representation of the malware.

[0054] In one possible implementation, the pre-trained semi-supervised classifier is built based on a semi-supervised support vector machine; the clustering of malware of unknown categories includes: using density-based noisy spatial clustering, spectral clustering, or K-Means clustering to cluster malware of unknown categories.

[0055] All relevant content of each step involved in the aforementioned embodiments of the malware identification method can be referenced to the functional description of the corresponding functional module of the malware identification system in the embodiments of the present invention, and will not be repeated here.

[0056] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0057] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of a malicious software identification method.

[0058] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the malware identification method in the above embodiments.

[0059] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0060] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0061] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0062] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0063] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying malicious software, characterized in that, include: Obtain several malware samples to be identified, and construct a function call graph for each malware based on its functions and the call relationships between functions. Based on the function call graphs of each malware, graph representation learning is performed through graph convolutional networks to generate feature vector representations for each malware. Based on the feature vector representation of each malware, a pre-trained semi-supervised classifier is used to classify each malware into known categories and unknown categories. Furthermore, malware of unknown categories is clustered, and classification is performed based on the clustering results.

2. The malware identification method according to claim 1, characterized in that, The construction of the function call graph for each piece of malware, based on its functions and the call relationships between them, includes: By decompiling the application package file of the malware, the Dalvik code of the malware can be obtained; Based on the Dalvik code of the malware, we obtained the functions of the malware and the call relationships between them, and constructed a function call graph by treating the functions as nodes and the call relationships between them as edges.

3. The malware identification method according to claim 2, characterized in that, The function call graphs for constructing each piece of malware also include: The target function is obtained by identifying the functions involving sensitive operations among the functions of the malware, and the nodes corresponding to the target function are semantically labeled with sensitive operations in the function call graph.

4. The malware identification method according to claim 3, characterized in that, The sensitive operations include one or more of the following: network communication, location acquisition, file reading and writing, and SMS sending.

5. The malware identification method according to claim 1, characterized in that, The graph convolutional network includes an input layer, a first graph convolutional module, a first graph pooling layer, a second graph convolutional module, a second graph pooling layer, a third graph convolutional module, and an output layer connected in sequence. The first graph convolution module, the second graph convolution module, and the third graph convolution module each include a graph convolution layer, a ReLU activation layer, and a node-level batch normalization layer connected in sequence.

6. The malware identification method according to claim 1, characterized in that, The step of generating feature vector representations for each malware by learning graph representations through graph convolutional networks based on the function call graphs of each malware includes: The algorithm iterates through each malware, inputs the malware's function call graph into a graph convolutional network for feature extraction, obtains the feature representation of each node in the malware's function call graph, performs max pooling to obtain the global graph vector of each malware, and then normalizes the global graph vector of each malware using a z-score-inspired normalization method to generate the feature vector representation of the malware.

7. The malware identification method according to claim 1, characterized in that, The pre-trained semi-supervised classifier is built based on a semi-supervised support vector machine; The clustering of unknown categories of malware includes: using density-based noisy spatial clustering, spectral clustering, or K-Means clustering to cluster unknown categories of malware.

8. A malware identification system, characterized in that, include: The graph construction module is used to acquire several malware samples to be identified and construct a function call graph for each malware based on the functions of each malware and the call relationships between functions. The feature extraction module is used to learn graph representations of each malware by using a graph convolutional network based on the function call graphs of each malware. The identification module is used to classify malware into known and unknown categories based on the feature vector representation of each malware using a pre-trained semi-supervised classifier, and to cluster the malware of unknown categories and classify it based on the clustering results.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the malware identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the malware identification method as described in any one of claims 1 to 7.

Images