基于图结构的恶意代码同源性分析

Homology analysis of malware based on graph

恶意代码检测和同源性分析一直是恶意代码分析领域的研究热点。从恶意代码提取的API调用图,能够有效表示恶意代码的行为信息,但由于求解子图同构问题的算法复杂度较高,使基于图结构特征的恶意代码分析效率较低。为此,提出了利用卷积神经网络对恶意代码API调用图进行处理的方法。通过选择关键节点,以关键节点邻域构建感知野,使图结构数据转换为卷积神经网络能够处理的结构。通过对8个家族的恶意样本进行学习和测试,实验结果表明,恶意代码同源性分析的准确率达到93%,并且针对恶意代码检测的准确率达到96%。

Malware detection and homology analysis has been the hotspot of malware analysis.API call graph of malware can represent the behavior of it.Because of the subgraph isomorphism algorithm has high complexity,the analysis of malware based on the graph structure with low efficiency.Therefore,this studies a homology analysis method of API graph of malware that use convolutional neural network.By selecting the key nodes,and construct neighborhood receptive field,the convolution neural network can handle graph structure data.Experimental results on 8 real-world malware family,shows that the accuracy rate of homology malware analysis achieves 93%,and the accuracy rate of the detection of malicious code to 96%.