The invention discloses a multi-view fusion cloud native malicious
software detection method and
system based on high-speed introspection of a
virtual machine, and the method comprises the steps: 1), deploying a high-speed introspection module in a monitoring layer of the
virtual machine, capturing an API call sequence of an internal process of a target
virtual machine from the outside in a safe and low-invasion manner, and structuring the API call sequence into a runtime log; (2) the API calling sequence is regarded as a
sentence, and a Word2Vec model is used for training to generate a structure embedding vector of the API; then, constructing a directed heterogeneous graph containing a file, a thread and API calling for each sample, taking the structure embedded vector as an initial feature of an API node, encoding the graph by using a graph
attention network, and extracting a structure context
feature vector; 3) extracting an API official function description text by utilizing the pre-training
language model to generate a semantic embedding vector; constructing a directed heterogeneous graph for each sample, replacing the initial features of the API nodes in the graph with the semantic embedding vector, coding the graph by using the graph
attention network again, and extracting a functional
semantic feature vector; 4) firstly performing function classification on the APIs, and performing
dimensionality reduction on the complete API calling sequence to obtain a limited function
state sequence; constructing a
Markov transition probability matrix for the
state sequence of each sample, and selectively stacking a multi-order transition matrix to form a multi-channel feature
tensor; inputting the feature
tensor into a
convolutional neural network for coding, and extracting a macroscopic behavior evolution
feature vector; 5) splicing the structure context
feature vector, the function
semantic feature vector and the behavior evolution feature vector to form a final comprehensive feature vector; and inputting the comprehensive feature vector into a multi-layer
perceptron classifier, and training the classifier in an end-to-end manner to enable an output sample of the classifier to be a
classification result of malicious
software or benign
software.