恶意软件的时序对偶数据流图挖掘及其检测方法  

Mining of dual data flow graph combined with sequence information and detection method of malwares

作　　者：鲁法明 江婷婷 包云霞 崔海东 蔡朝阳 Lu Faming;Jiang Tingting;Bao Yunxia;Cui Haidong;Cai Chaoyang(College of Computer Science&Engineering,Shandong University of Science&Technology,Qingdao Shandong 266590,China;Tai-shan Information Technology Co.,Ltd.,Tai’an Shandong 271000,China)

机构地区：[1]山东科技大学计算机科学与工程学院,山东青岛266590 [2]泰山信息科技有限公司,山东泰安271000

出　　处：《计算机应用研究》2023年第6期1829-1836,共8页Application Research of Computers

基　　金：国家自然科学基金资助项目(61602279);山东省泰山学者工程专项基金资助项目(ts20190936);山东省高等学校青创科技支持计划资助项目(2019KJN024);山东省自然科学基金智慧计算联合基金资助项目(ZR2021LZH004);青岛市西海岸新区2022年“揭榜挂帅”技术攻关项目。

摘　　要：基于数据流图的恶意软件检测方法通常仅关注API(application programming interface)调用过程中的数据流信息,而忽略API调用顺序信息。为解决此问题,所提方法在传统数据流图的基础上融入API调用的时序信息,提出恶意软件时序对偶数据流图的概念,并给出模型挖掘方法,最后提出一种基于优化的图卷积网络对时序对偶数据流图进行分类、进而用于恶意软件检测与分类的方法。实验结果表明,所提方法的恶意软件识别准确率较传统基于数据流图的恶意软件识别方法有更好的检测效果。The malware detection methods based on data flow graph only focused on the data flow information caused by API calls,which ignored the sequence information among API calls.To address this issue,this paper integrated the sequence information of API calls into data flow graph,put forward the concept of dual data flow graph combined with sequence information,gave the method of constructing event logs from the API call sequence,and proposed the mining method of dual data flow graph combined with sequence information.Finally,this paper proposed an improved graph convolution network to classify dual data flow graph combined with sequential information.The classification result could be used to detect and classify malwares.The experimental results show that the proposed method has better detection accuracy than traditional methods based on data flow graphs.

关 键 词：恶意软件检测 过程挖掘 时序对偶数据流图 图卷积网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]