有向复杂网络软件异常交互执行行为挖掘算法

Algorithm for Mining Abnormal Interactive Execution Behavior of Directed Complex Network Software

挖掘软件异常交互行为直接影响软件的安全性,研究有向复杂网络软件异常交互执行行为挖掘算法,精准挖掘存在异常交互执行行为的关键节点。以社交网络形式描绘有向复杂网络,分割社交网络图获取数个社区,利用局部哈希法提取社区特征值即社区内节点与边的质量分数,通过局部散列结合质量分数得到社区相似度,对比分析相似度与异常交互执行行为阈值,确定存在异常交互执行行为的社区即异常区域;利用局部中心性算法挖掘确定区域内异常交互执行行为的关键函数节点,其中按照函数节点积累缺陷能力挖掘关键调动函数节点,按照传播缺陷能力挖掘关键被调函数节点。仿真结果表明,上述算法可有效确定网络软件存在异常交互执行行为的区域;有向边权重为0.4时,上述算法的挖掘效果最佳;在不同软件调用次数时,上述算法可精准挖掘异常交互执行行为的关键函数节点。

Mining abnormal interactive behavior of software directly affects the security of software. Therefore, the mining algorithm of abnormal interactive execution behavior of software in directed complex network was studied to precisely mine the key nodes with abnormal interactive execution behavior. Describe directed complex networks in the form of social networks, and divide the social network graph to obtain several communities. The local hash method was used to extract the community eigenvalues, that is, the quality scores of nodes and edges in the community, and the community similarity was obtained by combining the local hash with the quality scores. Compare and analyze the similarity and the threshold of abnormal interactive execution, and determine the community with abnormal interactive execution, that is, the abnormal area. The local centrality algorithm was used to mine the key function nodes of abnormal interactive execution behavior in the region, in which the key transfer function nodes were mined according to the defect accumulation ability of function nodes, and the key modulated function nodes were mined according to the defect propagation ability. Simulation results show that the algorithm can effectively identify the regions where abnormal interactive execution behaviors exist in network software. When the weight of directed edge is 0.4,the mining effect of this algorithm is the best. The algorithm can precisely mine the key function nodes of abnormal interactive execution behavior for different times of software calls.