一种基于指向API调用关系的恶意软件分类方法
Cuihua Ma1,2,3, Zhenwan Li1, Haixia Long1,2,3
1College of Information Science Technology, Hainan Normal University, Haikou, Hainan, China.
PloS one
|March 17, 2025
概括
本研究引入了一种新的恶意软件检测方法,使用API序列的定向图. 该方法有效地捕获结构和顺序信息,在现实世界数据集上表现优于现有技术.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 网络安全 网络安全
背景情况:
- 越来越复杂的网络威胁需要先进的恶意软件检测.
- 使用应用程序编程接口 (API) 序列的现有方法经常忽略结构信息.
- 当前基于图形的方法可能会忽视API交互的顺序性质.
研究的目的:
- 提出一种新的恶意软件分类方法,解决现有技术的局限性.
- 为了利用API序列中的定向关系来增强恶意软件检测.
- 提高恶意软件分类模型的准确性和稳定性.
主要方法:
- 将API序列建模为有节点属性和定向关系的定向图.
- 使用一级和二级图形卷积网络 (FSGCN) 来近似定向图形卷积网络 (DGCN).
- 用卷积神经网络 (CNN) 将图形嵌入转化为灰度图像进行分类,并在不平衡的数据集中使用合成少数人过量采样技术 (SMOTE).
主要成果:
- 拟议的基于FSGCN的方法有效地从API序列中捕获结构和序列信息.
- 在真实世界恶意软件数据集上的实验结果表明,与传统和现有的基于图形的方法相比,性能优越.
- 该方法在更准确地分类恶意软件方面表现出显著的有效性.
结论:
- 这种基于导向图的新型方法在恶意软件分类方面取得了重大进展.
- 通过FSGCN集成结构和顺序信息,提高了检测能力.
- 这种方法为打击复杂的网络威胁提供了更强大,更有效的解决方案.
更多相关视频
相关概念视频
01:25Drug Classes and Categories
1.9K
Drugs can be classified according to their chemical composition or their intended therapeutic application. For instance, anti-infective agents that possess the ability to eliminate pathogens or suppress their growth and reproduction can be grouped based on the organisms they target or their chemical structure. Furthermore, drugs can be divided into prescription, nonprescription, or controlled substances. Prescription medications, such as antibiotics, require oversight from a licensed healthcare...
1.9K
02:54Evolutionary Relationships through Genome Comparisons
5.6K
Genome comparison is one of the excellent ways to interpret the evolutionary relationships between organisms. The basic principle of genome comparison is that if two species share a common feature, it is likely encoded by the DNA sequence conserved between both species. The advent of genome sequencing technologies in the late 20th century enabled scientists to understand the concept of conservation of domains between species and helped them to deduce evolutionary relationships across diverse...
5.6K