子图相似性的恶意程序检测方法  

Malware Detection Method Based on Subgraph Similarity

作　　者：汪洁[1] 王长青 WANG Jie;WANG Chang-Qing(School of Computer Science and Engineering,Central South University,Changsha 410083,China)

机构地区：[1]中南大学计算机学院,湖南长沙410083

出　　处：《软件学报》2020年第11期3436-3447,共12页Journal of Software

基　　金：国家自然科学基金(61202495)。

摘　　要：动态行为分析是一种常见的恶意程序分析方法,常用图来表示恶意程序系统调用或资源依赖等,通过图挖掘算法找出已知恶意程序样本中公共的恶意特征子图,并通过这些特征子图对恶意程序进行检测.然而这些方法往往依赖于图匹配算法,且图匹配不可避免计算慢,同时,算法中还忽视了子图之间的关系,而考虑子图间的关系有助于提高模型检测效果.为了解决这两个问题,提出了一种基于子图相似性恶意程序检测方法,即DMBSS.该方法使用数据流图来表示恶意程序运行时的系统行为或事件,再从数据流图中提取出恶意行为特征子图,并使用"逆拓扑标识"算法将特征子图表示成字符串,字符串蕴含了子图的结构信息,使用字符串替代图的匹配.然后,通过神经网络来计算子图间的相似性即将子图结构表示成高维向量,使得相似子图在向量空间的距离也较近.最后,使用子图向量构建恶意程序的相似性函数,并在此基础上,结合SVM分类器对恶意程序进行检测.实验结果显示,与其他方法相比,DMBSS在检测恶意程序时速度较快,且准确率较高.Dynamic behavior analysis is a common method of malware detection.It uses graphs to represent malware’s system calls or resource dependencies.It uses graph mining algorithms to find common malicious feature subgraphs in known malware samples,and detect unknown programs through these features.However,these methods often rely on the graph matching algorithm,and the inevitable calculation of the graph matching is slow,and the relationship between the subgraphs is also neglected in the algorithm.It can improve the detection accuracy of the model if the subgraphs’relationship is considered.In order to solve these two problems,a sub-graph similarity malware detection method called DMBSS is proposed.It uses the data flow graph to represent the system behavior or event of the running malicious program,and then extracts the malicious behavior feature subgraph from the data flow graph,and uses"inverse topology identification"algorithm to represent the feature subgraph as a string,and the string implied the structural information of the subgraph,using a string instead of the matching of the graph.The neural network is then used to calculate the similarity between the subgraphs and to represent the subgraph structure as a high dimensional vector,so that the similar subgraphs’distance is also shorter in the vector space.Finally,the subgraph vector is used to construct the similarity function of the malicious program,and based on this,the SVM classifier is used to detect the malicious program.The experimental results show that compared with other methods,DMBSS is faster in detecting malicious programs and has higher accuracy.

关 键 词：恶意程序检测 神经网络 子图分布式表示 图相似函数 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]