Abstract: The invention discloses a weighted heterogeneous graph-oriented malicious behavior identification method, system and storage medium. The method comprises the following steps: constructing an inductive graph neural network model. The inductive graph neural network model comprises a subgraph extraction module, a plurality of feature vector generation and fusion modules and a classification learning module; performing training and learning for the inductive graph neural network model, extracting subgraphs, learning the latent vector representation of nodes in the subgraphs, obtaining a plurality of subgraph feature vectors corresponding to the subgraphs, and fusing a plurality of subgraph feature vectors. The node feature vector obtained by fusion is used for classification learning in the classification learning module; using the trained inductive graph neural network model for malicious behavior identification.

Abstract: An APT organization identification method, system and storage medium based on a stacking ensemble are provided, the method comprising: using a TF-IDF algorithm combined with an n-gram to extract and vectorize behavior features from malware samples to form a malicious behavior vector feature set; based on the malicious behavior vector feature set, calculating correlations between features and chi-square values between the features and categories, performing screening twice on the malicious behavior vector feature set to obtain an improved low-dimensional feature subset data; constructing a multi-model fusion stacking ensemble, learning an APT organization identification model, using the APT organization identification model to perform an identification on new ATP attacks.