Malicious software API call sequence detection method based on graph convolution

Abstract

The invention provides a malicious software API (Application Program Interface) call sequence detection method based on graph convolution. The method comprises the following steps: acquiring and recording API call sequence information of processes and sub-processes when a large number of software samples run; performing vectorization processing on the API calling sequence information; extracting aparameter relationship, a dependency relationship and a sequence relationship of the API function; establishing an API call graph; inputting the API call graph into a graph convolutional neural network for training to obtain a malicious software detection network model; collecting API calling sequence information of processes and sub-processes when the executable file to be detected runs; constructing an API call graph of the executable file to be detected, then inputting the API call graph of the executable file to be detected into the malicious software detection network model, If the output result of the malicious software detection network model is 1, indicating that the judgment result is malicious software; If the output result of the malicious software detection network model is 0,indicating that the judgment result is normal software.

Description

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine

Login to View More

AI Technical Summary

Benefits of technology

This technology helps detect malicious software programs through analyzed APIs called file or directory entry accesses that are associated with specific parameters like time stamps (time-stamp) values). By learning from these data it create models that identify patterns related to certain types of attacks on computer systems. These models help predict future threats based upon their previous behavior over time. Overall this approach improves efficiency and reliability in identifying cyberattacks against computers.

Problems solved by technology

This patented technical problem addressed by this patents relates specifically to detecting malwares that may be hidden inside executable programs or executed on hardware devices (such as smartphones). Current techniques require manual inspections with virus scanning tools like antivirus agents) while doing away from traditional ways of prevention against them.

Images