摘 要
随着网络技术的快速发展，恶意软件攻击事件日益频繁且复杂化，传统基于特征码或静态分析的检测方法逐渐难以应对新型变种恶意软件的威胁，因此亟需一种高效、精准的检测手段以适应当前安全需求本研究旨在探索基于图神经网络的恶意软件检测方法，通过将恶意软件的行为特征建模为图结构数据，并利用图神经网络强大的非欧几里得数据处理能力实现对恶意软件的智能分类与识别具体而言，研究首先提出了一种多维度特征提取机制，能够从系统调用序列、控制流图以及程序依赖关系中提取高分辨度的特征信息，随后设计了一种改进的图卷积网络模型，该模型引入注意力机制以增强关键节点特征的学习能力，并结合深度学习框架完成端到端训练实验结果表明，所提方法在公开数据集上的检测准确率达到了98.3%，相较于传统机器学习方法和常规深度学习模型分别提升了7.6%和4.2%，同时具备较强的泛化能力和鲁棒性。此外，研究还验证了模型在面对未知恶意软件样本时的有效性，进一步证明其在实际应用场景中的潜力。
关键词：图神经网络，恶意软件检测，多维度特征提取
ABSTRACT
With the rapid development of network technology, malware attack events become increasingly frequent and complex. Traditional detection methods based on feature code or static analysis are gradually unable to cope with the threat of new varieties of malware. Therefore, an efficient and accurate detection method is urgently needed to meet the current security requirements. By modeling the behavioral features of malware as graph-structured data, and using the powerful non-Euclidean data processing capability of graph-neural networks to achieve intelligent classification and recognition of malware, specifically, a multi-dimensional feature extraction mechanism is proposed first, which can extract high-resolution feature information from system call sequences, control flow graphs and program dependencies. Then, an improved graph convolutional network model was designed, which introduced attention mechanism to enhance the learning ability of key node features. The end-to-end training experiment combined with deep learning fr amework showed that the detection accuracy of the proposed method on the public data set reached 98.3%. Compared with the traditional machine learning method and the conventional deep learning model, it has improved by 7.6% and 4.2% respectively, and has strong generalization ability and robustness. In addition, the study verifies the effectiveness of the model in the face of unknown malware samples, further demonstrating its potential in practical application scenarios.
Keywords: Graph neural network, malware detection, multi-dimensional feature extraction
目 录
摘 要 I
ABSTRACT II
第一章 绪论 1
1.1 研究背景及意义 1
1.2 图神经网络在恶意软件检测中的应用现状 1
1.3 本文研究方法与技术路线 2
第二章 图神经网络基础与关键技术分析 3
2.1 图神经网络的基本原理与架构 3
2.2 图嵌入技术在恶意软件建模中的作用 3
2.3 节点特征提取与图结构表示方法 3
2.4 图神经网络的训练与优化策略 4
2.5 关键技术挑战与解决方案 4
第三章 基于图神经网络的恶意软件检测模型构建 5
3.1 恶意软件数据集的构建与预处理 5
3.2 图结构化数据的生成与特征提取 5
3.3 图神经网络模型的设计与实现 5
3.4 模型性能评估指标与实验设计 6
3.5 检测模型的鲁棒性与泛化能力分析 6
第四章 实验验证与结果分析 7
4.1 实验环境与数据集介绍 7
4.2 不同模型的对比实验与性能评估 7
4.3 参数调优与模型改进策略 8
4.4 实验结果分析与讨论 9
4.5 检测方法的实际应用场景探讨 9
结束语 11
谢 辞 12
参考文献 13
