CN113626817A - Malicious code family classification method - Google Patents
Malicious code family classification methodDownload PDFInfo
- Publication number
- CN113626817A CN113626817ACN202110979019.5ACN202110979019ACN113626817ACN 113626817 ACN113626817 ACN 113626817ACN 202110979019 ACN202110979019 ACN 202110979019ACN 113626817 ACN113626817 ACN 113626817A
- Authority
- CN
- China
- Prior art keywords
- graph
- malicious code
- dynamic
- malicious
- classification method
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/563—Static detection by source code analysis
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- General Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Evolutionary Computation (AREA)
- Computer Security & Cryptography (AREA)
- General Health & Medical Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Mathematical Physics (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Evolutionary Biology (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Biomedical Technology (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Hardware Design (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Virology (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
Technical Field
The invention relates to the technical field of network and information security, in particular to a malicious code family classification method.
Background
Malicious Code (also known as Malware or Malware) refers to a program, Code or instruction specifically designed for Malicious purposes, and refers to any Malicious program that is intended to destroy the reliability, availability, security, or consume system resources of a computer, mobile terminal, or network system. The main existing forms of malicious code include: malicious data documents, malicious web pages, memory code, executables, dynamic link libraries, and the like.
Through research on the prior literatures, each literature has one or more defects as follows:
(1) directly obtaining a malicious code sample from a malicious code sample library, classifying the obtained malicious code sample, and subsequently, automatically enriching and updating the malicious code library and updating a malicious code family classification feature library in real time;
(2) deep learning is not carried out by utilizing a convolutional neural network or is carried out by utilizing the convolutional neural network, but the number of layers and the size of the learned layers are not suitable for malicious code classification, so that the malicious code classification method is low in efficiency and accuracy.
Disclosure of Invention
The invention aims to provide a malicious code family classification method which can quickly and accurately judge the family information of malicious codes.
Embodiments of the invention may be implemented as follows:
in a first aspect, the present invention provides a method for classifying malicious code families, where the method includes:
labeling family information on malicious codes;
extracting static characteristics and dynamic characteristics from the marked malicious codes;
generating a dynamic relation graph of the malicious code according to the dynamic characteristics;
inputting the static characteristics and the dynamic relational graph into a graph neural network model to train the graph neural network model;
and acquiring static characteristics and a dynamic relation graph of the malicious codes to be classified, and inputting the trained graph neural network model to judge the family information of the malicious codes.
In an alternative embodiment, the static features include key API occurrences, key special character numbers, instruction code frequency numbers, instruction code n-grams, and byte sequence n-grams, and the dynamic features include API call dependency graphs, system call dependency graphs, and control flow graphs.
In an alternative embodiment, the dynamic feature includes a system call dependency graph, and the step of generating a dynamic relationship graph of malicious code according to the dynamic feature includes:
converting the system call dependency graph into a fixed-size directed weighted graph;
calculating distance values between directed weighted graphs;
and judging the two directed weighted graphs with the distance value smaller than the threshold value to be similar, and connecting the two directed weighted graphs to generate a dynamic relational graph of the malicious code.
In an alternative embodiment, the step of converting the system call dependency graph into a fixed-size directed weighted graph comprises:
grouping the system call dependencies by utilizing an open source tool, and constructing a system call dependency graph by utilizing the call relation among the system call dependencies;
the system call dependencies belonging to the same group are aggregated into a node, a new edge is redefined between two nodes, the weight of the new edge is the number of original edges between the two types of nodes, the system call dependency graph is converted into a group call graph with fixed size, and the group call graph is a directed weighted graph.
In an alternative embodiment, the step of calculating distance values between the directed weighted graphs comprises:
calculating Jaccard distance D for a set of nodes in two directed weighted graphsj；
Calculating out-degree cosine distance D between two same node pairs of directed weighted graphinAnd the inco-cosine distance Dout；
According to Jaccard distance DjDistance D of cosine of origininAnd the inco-cosine distance DoutThe distance value D between the two directed weighted graphs is calculated.
In an alternative embodiment, the distance value D is calculated by the formula:
where th is set empirically.
In an optional implementation manner, the step of obtaining the static features and the dynamic relationship graph of the malicious code to be classified, and inputting the trained graph neural network model to judge the family information of the malicious code includes:
inputting the static characteristics and the dynamic relational graph into a graph neural network model to obtain an embedded vector of the malicious code;
the embedded vector is input into a classifier to determine family information of the malicious code.
In an alternative embodiment, the classifier includes MLP, SVM and na iotave bayes.
In an alternative embodiment, the graph neural network model includes GraphSAGE, GCN, and GAT.
In an alternative embodiment, the step of extracting the static features and the dynamic features from the labeled malicious code comprises:
and extracting the static features by adopting an open source tool, wherein the open source tool comprises a PEFrame and an IDA.
The malicious code family classification method provided by the embodiment of the invention has the beneficial effects that:
1. the classification method comprises the steps of firstly labeling family information on malicious codes, acquiring static characteristics and dynamic characteristics from the malicious codes, inputting the acquired characteristics into a graph neural network model to train the graph neural network model, enabling the graph neural network model to acquire a standard for classifying the malicious codes, and finally inputting the static characteristics and the dynamic relation graph of the malicious codes to be classified into the trained graph neural network model, so that the family information of the malicious codes can be rapidly and accurately judged;
2. the classification method takes static characteristics and dynamic characteristics into consideration, utilizes the dynamic characteristics to generate a dynamic relation graph, then utilizes the dynamic relation graph and the static characteristics to fuse the two types of characteristics from the association angle, and is simple and high in accuracy.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained according to the drawings without inventive efforts.
Fig. 1 is a flowchart of a malicious code family classification method according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, but not all, embodiments of the present invention. The components of embodiments of the present invention generally described and illustrated in the figures herein may be arranged and designed in a wide variety of different configurations.
Thus, the following detailed description of the embodiments of the present invention, presented in the figures, is not intended to limit the scope of the invention, as claimed, but is merely representative of selected embodiments of the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.
It should be noted that the features of the embodiments of the present invention may be combined with each other without conflict.
It is understood that malicious code, also known as malware, is code that is capable of unauthorized operation in a computer system. Malicious code is written mostly for the purpose of commerce or to detect other people's material, such as promoting a certain product, providing a network charging service, or directly making intentional damage to others' computers, etc., and generally it has the purpose of malicious damage, itself being a program, and 3 features that act by execution. At present, many new malicious codes are variants of existing malicious codes, source malicious codes belong to the same family, and how to quickly identify the family to which the malicious codes belong is very important for guaranteeing network information security.
Referring to fig. 1, the present embodiment provides a classification method for malicious code families (hereinafter, referred to as "classification method"), which includes the following steps:
s1: and labeling the malicious code with family information.
Specifically, a sufficient amount of malicious code is collected first, and then family information of the malicious code is labeled, and the malicious code serves as original data of a training model.
S2: and extracting static characteristics and dynamic characteristics from the marked malicious code.
And extracting the static features by adopting an open source tool, wherein the open source tool comprises a PEFrame and an IDA.
The static characteristics comprise key API occurrence times, key special character number, instruction code frequency, instruction code n-gram and byte sequence n-gram. The dynamic features may be functional relationship call graphs of malicious code, including API (Application Programming Interface), system call dependency graphs, and control flow graphs.
Specifically, the process of extracting the static feature and the dynamic feature may be: and running the malicious codes in a virtual operating system layer of the dynamic sandbox, simulating the operation of calling all APIs of the operating system in the running process, and triggering and extracting dynamic features generated by the malicious codes. Wherein, dynamic sandbox includes: the system comprises a virtual machine layer and a virtual operating system layer, wherein the virtual machine layer is used for realizing the virtualization of the physical hardware of the computer, and the virtual operating system layer is used for running and analyzing samples.
The extracted features may also be dynamic behavior record files, features may be trained by using a model of text machine learning to generate a malicious code family classification model, the extracted features may also be pictures converted from the dynamic behavior record files, and features may be trained by using a model of picture machine learning to generate a malicious code family classification model.
S3: and generating a dynamic relation graph of the malicious code according to the dynamic characteristics.
The dynamic relationship graph is generated by mainly utilizing a system call dependency graph in the dynamic characteristics.
Firstly, a system call dependency graph in dynamic characteristics is obtained through dynamic analysis, and the system call dependency graph is converted into a directed weighted graph with a fixed size. Specifically, the open source tool is used for grouping the system call dependencies, and a system call dependency graph is formed by using the call relation among the system call dependencies, wherein the open source tool can be NtTrace and the like; and aggregating the system call dependencies belonging to the same group into a node, redefining a new edge between the two nodes, wherein the weight of the new edge is the number of the original edges between the two types of nodes, so that the system call dependency graph is converted into a group call graph with fixed size, and the group call graph is a directed weighted graph.
Then, the distance values between the directed weighted graphs are calculated, and in the embodiment, the mixed calculation is performed on both the node set and the structure of the directed weighted graph. Specifically, for the node sets in the two directed weighted graphs, the Jaccard distance D of the node sets in the two directed weighted graphs is calculated firstj(ii) a For a structure in two directed weighted graphs, calculating out-degree cosine distance D between the same node pair of the two directed weighted graphsinAnd the inco-cosine distance Dout(ii) a According to Jaccard distance DjDistance D of cosine of origininAnd the inco-cosine distance DoutThe distance value D between the two directed weighted graphs is calculated.
The calculation formula of the distance value D is as follows:
where th is set empirically.
And finally, setting a threshold lambda, judging the two directed weighted graphs with the distance value D smaller than the threshold lambda to be similar, and connecting the two directed weighted graphs to generate a dynamic relational graph of the malicious code.
The variable parameters alpha, beta, gamma and lambda can be manually preset and can also be obtained through small-batch sample training, and the training process is as follows: firstly, selecting a small number of samples of each family, extracting a system call dependency graph of each sample, converting the system call dependency graph into a group call graph with a fixed size, and calculating a distance value D between the group call graphs; training parameters alpha, beta and gamma to enable the distance value D between the group call graphs belonging to the same family to be smaller than the distance value D between the group call graphs belonging to different families; choosing an appropriate threshold λ makes the division between families obvious.
S4: and inputting the static characteristics and the dynamic relational graph into the graph neural network model so as to train the graph neural network model.
Wherein, the graph neural network model comprises GraphSAGE, GCN and GAT. In the embodiment, the graph neural network model adopts GraphSAGE, and the GraphSAGE has good flexibility and expansibility.
Firstly, inputting the static characteristics and the dynamic relational graph into a graph neural network model to obtain an embedded vector of the malicious code.
The embedded vector is then input into a classifier to determine the family information of the malicious code. Wherein, the classifier comprises MLP, SVM and naive Bayes.
The classifier can be trained in advance, embedded vectors of some marked malicious codes are obtained first, the obtained embedded vectors are input into the classifier, and the classifier is trained to enable the family classification to be accurate.
The trained graph neural network model and classifier are more suitable for classifying malicious codes, and the efficiency and the accuracy of the malicious code classification method are improved.
S5: and acquiring static characteristics and a dynamic relation graph of the malicious codes to be classified, and inputting the trained graph neural network model to judge the family information of the malicious codes.
Firstly, extracting static characteristics and dynamic characteristics of malicious codes to be classified, and then generating a dynamic relation graph of the malicious codes according to the dynamic characteristics; and finally, inputting the static characteristics and the dynamic relational graph into a graph neural network model, so that the family information of the malicious codes can be judged, and the classification of the malicious codes is completed.
The core of the malicious code family classification method provided by the embodiment is as follows: when the family information of a malicious code needs to be judged, firstly, a system call dependency graph in the static characteristic and the dynamic characteristic of the malicious code is extracted, then the system call dependency graph is converted into a group call graph with a fixed size, the distance between the group call graph and the existing group call graph is calculated, the group call graph is connected with the group call graph meeting the condition, then the characteristics of the neighbors of the group call graph are aggregated to obtain an embedded vector of the malicious code, and the embedded vector is input into a classifier to obtain judgment classification.
The malicious code family classification method provided by the embodiment has the beneficial effects that:
1. the classification method comprises the steps of firstly labeling family information on malicious codes, acquiring static characteristics and dynamic characteristics from the malicious codes, inputting the acquired characteristics into a graph neural network model to train the graph neural network model, enabling the graph neural network model to acquire a standard for classifying the malicious codes, and finally inputting the static characteristics and the dynamic relation graph of the malicious codes to be classified into the trained graph neural network model, so that the family information of the malicious codes can be rapidly and accurately judged;
2. the classification method takes static characteristics and dynamic characteristics into consideration, utilizes the dynamic characteristics to generate a dynamic relation graph, then utilizes the dynamic relation graph and the static characteristics to fuse the two types of characteristics from the association angle, and is simple and high in accuracy.
The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope of the present invention are included in the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.
Claims (10)
1. A malicious code family classification method, characterized in that the classification method comprises:
labeling family information on malicious codes;
extracting static characteristics and dynamic characteristics from the marked malicious code;
generating a dynamic relation graph of the malicious code according to the dynamic characteristics;
inputting the static features and the dynamic relational graph into a graph neural network model to train the graph neural network model;
and acquiring static characteristics and a dynamic relation graph of the malicious codes to be classified, and inputting the trained graph neural network model to judge the family information of the malicious codes.
2. The malicious code family classification method according to claim 1, wherein the static features include key API occurrence number, key special character number, instruction code frequency number, instruction code n-gram, and byte sequence n-gram, and the dynamic features include an API call dependency graph, a system call dependency graph, and a control flow graph.
3. The method of claim 1, wherein the dynamic features comprise a system call dependency graph, and wherein generating the dynamic relationship graph of the malicious code according to the dynamic features comprises:
converting the system call dependency graph into a fixed-size directed weighted graph;
calculating distance values between the directed weighted graphs;
and judging the two directed weighted graphs with the distance value smaller than the threshold value to be similar, and connecting the two directed weighted graphs to generate a dynamic relation graph of the malicious code.
4. The malicious code family classification method according to claim 3, wherein the step of converting the system call dependency graph into a fixed-size directed weighted graph comprises:
grouping system call dependencies by using an open source tool, and forming a system call dependency graph by using a call relation among the system call dependencies;
aggregating the system call dependencies belonging to the same group into a node, redefining a new edge between the two nodes, wherein the weight of the new edge is the number of original edges between the two types of nodes, so that the system call dependency graph is converted into a group call graph with a fixed size, and the group call graph is the directed weighted graph.
5. The malicious code family classification method according to claim 3, wherein the step of calculating distance values between the directed weighted graphs comprises:
calculating Jaccard distance D of node sets in two directed weighted graphsj；
Calculating the out-degree cosine distance D between the same node pair of the two directed weighted graphsinAnd the inco-cosine distance Dout；
According to the Jaccard distance DjThe output cosine distance DinAnd the incoupling cosine distance DoutAnd calculating a distance value D between the two directed weighted graphs.
6. The malicious code family classification method according to claim 5, wherein the distance value D is calculated by the formula:
where th is set empirically.
7. The method according to claim 1, wherein the step of obtaining the static features and the dynamic relationship graph of the malicious code to be classified and inputting the trained graph neural network model to judge the family information of the malicious code comprises:
inputting the static features and the dynamic relational graph into a graph neural network model to obtain an embedded vector of the malicious code;
inputting the embedded vector into a classifier to determine family information of the malicious code.
8. The malicious code family classification method according to claim 7, wherein the classifier comprises MLP, SVM and naive bayes.
9. The malicious code family classification method according to claim 1, wherein the graph neural network model comprises GraphSAGE, GCN, and GAT.
10. The method of claim 1, wherein the step of extracting static and dynamic features from the labeled malicious code comprises:
and extracting the static features by adopting an open source tool, wherein the open source tool comprises a PEFrame and an IDA.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110979019.5ACN113626817B (en) | 2021-08-25 | 2021-08-25 | Malicious code family classification method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110979019.5ACN113626817B (en) | 2021-08-25 | 2021-08-25 | Malicious code family classification method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113626817Atrue CN113626817A (en) | 2021-11-09 |
| CN113626817B CN113626817B (en) | 2024-06-25 |
Family
ID=78387740
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110979019.5AActiveCN113626817B (en) | 2021-08-25 | 2021-08-25 | Malicious code family classification method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113626817B (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114782965A (en)* | 2022-03-07 | 2022-07-22 | 华南理工大学 | Method, system and medium for visual rich document information extraction based on layout correlation |
| CN117972699A (en)* | 2024-03-01 | 2024-05-03 | 国网江苏省电力有限公司电力科学研究院 | A third-party open source component risk analysis method and system based on software genes |
Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105160208A (en)* | 2015-05-29 | 2015-12-16 | 杭州奥视图像技术有限公司 | Clustering method based on network for disease subtype problem |
| US20170053208A1 (en)* | 2015-08-17 | 2017-02-23 | Adobe Systems Incorporated | Behavioral Prediction for Targeted End Users |
| CN106663003A (en)* | 2014-06-13 | 2017-05-10 | 查尔斯斯塔克德拉珀实验室公司 | Systems and methods for software analysis |
| CN107392019A (en)* | 2017-07-05 | 2017-11-24 | 北京金睛云华科技有限公司 | A kind of training of malicious code family and detection method and device |
| CN108959924A (en)* | 2018-06-12 | 2018-12-07 | 浙江工业大学 | A kind of Android malicious code detecting method of word-based vector sum deep neural network |
| CN109615116A (en)* | 2018-11-20 | 2019-04-12 | 中国科学院计算技术研究所 | A kind of telecommunication fraud incident detection method and detection system |
| CN111611586A (en)* | 2019-02-25 | 2020-09-01 | 上海信息安全工程技术研究中心 | Software vulnerability detection method and device based on graph convolution network |
| CN112182568A (en)* | 2019-07-02 | 2021-01-05 | 四川大学 | Malicious code classification based on graph convolution network and topic model |
- 2021
- 2021-08-25CNCN202110979019.5Apatent/CN113626817B/enactiveActive
Patent Citations (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106663003A (en)* | 2014-06-13 | 2017-05-10 | 查尔斯斯塔克德拉珀实验室公司 | Systems and methods for software analysis |
| CN105160208A (en)* | 2015-05-29 | 2015-12-16 | 杭州奥视图像技术有限公司 | Clustering method based on network for disease subtype problem |
| US20170053208A1 (en)* | 2015-08-17 | 2017-02-23 | Adobe Systems Incorporated | Behavioral Prediction for Targeted End Users |
| CN107392019A (en)* | 2017-07-05 | 2017-11-24 | 北京金睛云华科技有限公司 | A kind of training of malicious code family and detection method and device |
| CN108959924A (en)* | 2018-06-12 | 2018-12-07 | 浙江工业大学 | A kind of Android malicious code detecting method of word-based vector sum deep neural network |
| CN109615116A (en)* | 2018-11-20 | 2019-04-12 | 中国科学院计算技术研究所 | A kind of telecommunication fraud incident detection method and detection system |
| CN111611586A (en)* | 2019-02-25 | 2020-09-01 | 上海信息安全工程技术研究中心 | Software vulnerability detection method and device based on graph convolution network |
| CN112182568A (en)* | 2019-07-02 | 2021-01-05 | 四川大学 | Malicious code classification based on graph convolution network and topic model |
Non-Patent Citations (2)
| Title |
|---|
| SHIFU HOU: "Deep4MalDroid: A Deep Learning Framework for Android Malware Detection Based on Linux Kernel System Call Graphs", 《2016 IEEE/WIC/ACM INTERNATIONAL CONFERENCE ON WEB INTELLIGENCE WORKSHOPS》, 31 December 2016 (2016-12-31), pages 104 - 111* |
| 李佳琳: "面向安卓恶意软件检测的对抗攻击技术综述", 《信息安全学报》, 31 July 2021 (2021-07-31), pages 28 - 43* |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114782965A (en)* | 2022-03-07 | 2022-07-22 | 华南理工大学 | Method, system and medium for visual rich document information extraction based on layout correlation |
| CN117972699A (en)* | 2024-03-01 | 2024-05-03 | 国网江苏省电力有限公司电力科学研究院 | A third-party open source component risk analysis method and system based on software genes |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113626817B (en) | 2024-06-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN106503558B (en) | An Android malicious code detection method based on community structure analysis | |
| CN103106365B (en) | The detection method of the malicious application software on a kind of mobile terminal | |
| CN103473346B (en) | A kind of Android based on application programming interface beats again bag applying detection method | |
| EP3619649A1 (en) | Analyzing sequence data using neural networks | |
| CN110795732A (en) | SVM-based dynamic and static combination detection method for malicious codes of Android mobile network terminal | |
| Song et al. | Permission Sensitivity‐Based Malicious Application Detection for Android | |
| CN109614795B (en) | Event-aware android malicious software detection method | |
| Wang et al. | LSCDroid: Malware detection based on local sensitive API invocation sequences | |
| CN111460446A (en) | Malicious file detection method and device based on model | |
| CN111931179A (en) | Cloud malware detection system and method based on deep learning | |
| WO2023129339A1 (en) | Extracting and classifying entities from digital content items | |
| CN113869789A (en) | Risk monitoring method and device, computer equipment and storage medium | |
| CN114244611B (en) | Abnormal attack detection method, device, equipment and storage medium | |
| CN106874760A (en) | A kind of Android malicious code sorting techniques based on hierarchy type SimHash | |
| CN113626817A (en) | Malicious code family classification method | |
| CN113901465A (en) | Heterogeneous network-based Android malicious software detection method | |
| CN110019820A (en) | Main suit and present illness history symptom Timing Coincidence Detection method in a kind of case history | |
| CN112989182B (en) | Information processing method, information processing device, information processing apparatus, and storage medium | |
| CN111988327B (en) | Threat behavior detection and model establishment method and device, electronic equipment and storage medium | |
| CN117874760A (en) | Android malicious software detection method and system based on interpretable graph learning | |
| CN114817925B (en) | Android malicious software detection method and system based on multi-modal graph features | |
| Yang et al. | MDADroid: A novel malware detection method by constructing functionality-API mapping | |
| CN115292674A (en) | Fraud application detection method and system based on user comment data | |
| CN115146160A (en) | Machine behavior detection method, device, equipment and medium | |
| CN114282216A (en) | Malicious software detection method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |