| 引用本文： |
-
夏冰,楚世豪,董玉,唐崇俊,单征.一种基于API调用图和外部知识的恶意代码分类方法[J].信息安全学报,2026,11(3):164-173 [点击复制]
- XIA Bing,CHU Shihao,DONG Yu,TANG Chongjun,SHAN Zheng.A Malicious Code Classification Method Based on API Call Graphs and External Knowledge[J].Journal of Cyber Security,2026,11(3):164-173 [点击复制]
|
|
| |
|
|
| 本文已被：浏览 200次 下载 146次 |
码上扫一扫！ |
| 一种基于API调用图和外部知识的恶意代码分类方法 |
|
夏冰1,2, 楚世豪1,2, 董玉1,2, 唐崇俊1,2, 单征3
|
|
|
| (1.中原工学院 网络空间安全学院, 郑州 中国 450007;2.河南省网络舆情监测与智能分析重点实验室, 郑州 中国 450001;3.信息工程大学 嵩山实验室, 郑州 中国 450007) |
|
| 摘要: |
| 正确识别恶意代码的类别已成为现代数字防御机制的关键组成部分。针对现有基于应用程序编程接口(Application Programming Interface,API)的分类方法存在调用结构关系缺乏、行为语义表达不足等问题,提出了一种新颖的基于API调用图和外部知识的恶意代码分类方法。方法首先基于二进制恶意代码函数的控制流图(Control Flow Graph,CFG)构造函数内部的API调用子图,并作为节点嵌入函数调用图(Function Call Graph,FCG)中生成恶意代码API调用图(API Call Graph,ACG),以捕捉函数内部API的调用路径和依赖关系,接着通过爬虫技术获取API的功能描述、参数及返回值等外部知识以增强API节点的语义表达能力,最后借助双向编码器表示(Bidirectional Encoder Representations from Transformers,BERT)和图卷积网络(Graph Convolutional Networks,GCN),充分挖掘API序列词汇语义和API调用图节点间的结构依赖语义,实现了对恶意代码行为的深度表征。实验结果表明,所提出的方法在多样化的恶意代码样本集上显著优于现有基线模型,F1分值达到97.8%,同时可解释性实验也验证了该方法清晰地识别出恶意行为的关键特征和路径。 |
| 关键词: 恶意代码 BERT预训练模型 自然语言处理 图卷积神经网络 API调用图 |
| DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.12 |
| 投稿时间：2024-08-13修订日期：2024-11-28 |
| 基金项目:本课题得到河南省科技攻关项目(No.252102210217)和国家自然科学基金项目(No.62302540)资助。 |
|
| A Malicious Code Classification Method Based on API Call Graphs and External Knowledge |
|
XIA Bing1,2, CHU Shihao1,2, DONG Yu1,2, TANG Chongjun1,2, SHAN Zheng3
|
| (1.School of Cyberspace Security, Zhongyuan University of Technology, Zhengzhou 450007, China;2.Henan Key Laboratory on Public Opinion Intelligent Analysis, Zhengzhou 450001, China;3.Songshan Laboratory, Information Engineering University, Zhengzhou 450007, China) |
| Abstract: |
| Accurate identification of malware categories has become a critical component of modern digital defense. Existing Ap-plication Programming Interface (API)-based classification methods often fail to capture call-structure relationships ad-equately and provide insufficient behavioral semantic representation. To address these issues, this paper proposes a malware classification method based on API call graphs and external knowledge. First, the Control Flow Graph (CFG) of each binary function is used to construct an intra-function API call subgraph, which is then embedded into the Function Call Graph (FCG) to generate an API Call Graph (ACG) for the malware sample, thereby capturing intra-function API call paths and inter-function dependencies. Second, external knowledge, including API descriptions, parameters, and re-turn values, is collected through web crawling from official documentation to enrich the semantic representation of API nodes. Finally, Bidirectional Encoder Representations from Transformers (BERT) and Graph Convolutional Networks (GCN) are combined to jointly learn the lexical semantics of API descriptions and the structural dependency semantics of API call graphs, enabling deep representation of malware behavior. Experimental results on diverse malware datasets show that the proposed method significantly outperforms existing baselines and achieves an F1-score of 97.8%. Inter-pretability experiments further demonstrate that the method can clearly identify key features and critical paths associat-ed with malicious behavior. |
| Key words: malware BERT pre-trained model natural language processing graph convolutional networks API call graph |
|
|
|
|
|
