Suppr超能文献

基于图卷积网络的智能恶意软件检测

Intelligent malware detection based on graph convolutional network.

作者信息

Li Shanxi, Zhou Qingguo, Zhou Rui, Lv Qingquan

机构信息

School of Information Science and Engineering, Lanzhou University, Lanzhou, People's Republic of China.

出版信息

J Supercomput. 2022;78(3):4182-4198. doi: 10.1007/s11227-021-04020-y. Epub 2021 Aug 24.

Abstract

Malware has seriously threatened the safety of computer systems for a long time. Due to the rapid development of anti-detection technology, traditional detection methods based on static analysis and dynamic analysis have limited effects. With its better predictive performance, AI-based malware detection has been increasingly used to deal with malware in recent years. However, due to the diversity of malware, it is difficult to extract feature from malware, which make malware detection not conductive to the application of AI technology. To solve the problem, a malware classifier based on graph convolutional network is designed to adapt to the difference of malware characteristics. The specific method is to firstly extract the API call sequence from the malware code and generate a directed cycle graph, then use the Markov chain and principal component analysis method to extract the feature map of the graph, and design a classifier based on graph convolutional network, and finally analyze and compare the performance of the method. The results show that the method has better performance in most detection, and the highest accuracy is , compared with existing methods, our model is superior to other methods in terms of FPR and accuracy. It is also stable to deal with the development and growth of malware.

摘要

长期以来,恶意软件严重威胁着计算机系统的安全。由于反检测技术的快速发展,基于静态分析和动态分析的传统检测方法效果有限。基于人工智能的恶意软件检测具有更好的预测性能,近年来越来越多地用于处理恶意软件。然而,由于恶意软件的多样性,难以从恶意软件中提取特征,这使得恶意软件检测不利于人工智能技术的应用。为了解决这个问题,设计了一种基于图卷积网络的恶意软件分类器,以适应恶意软件特征的差异。具体方法是首先从恶意软件代码中提取API调用序列并生成有向循环图,然后使用马尔可夫链和主成分分析方法提取图的特征图,设计基于图卷积网络的分类器,最后分析和比较该方法的性能。结果表明,该方法在大多数检测中具有较好的性能,最高准确率为 ,与现有方法相比,我们的模型在误报率和准确率方面优于其他方法。在处理恶意软件的发展和增长方面也很稳定。

https://cdn.ncbi.nlm.nih.gov/pmc/blobs/5dfd/8383728/b4d83387a96e/11227_2021_4020_Fig1_HTML.jpg

文献AI研究员

20分钟写一篇综述,助力文献阅读效率提升50倍。

立即体验

用中文搜PubMed

大模型驱动的PubMed中文搜索引擎

马上搜索

文档翻译

学术文献翻译模型,支持多种主流文档格式。

立即体验