Abstract: Disclosed in the present invention are a method and system for recognizing mining malicious software, and a storage medium. The method comprises the following steps: pre-processing data of different dimensions; extracting and vectorizing a text feature; on the basis of Stacking, constructing a mining malicious software recognition model integrated with multiple models; and obtaining a prediction result. The present invention relates to a method for detecting mining malicious software for a binary file, which method is rare at present. The targeting performance is great, the implementation process is simple, and the efficiency is high. In addition, in the present invention, multi-dimensional feature extraction is performed on mining software features by a plurality of angles, a method of multi-model integration is designed for features of different dimensions, and a combined mining malicious software recognition model is constructed, and the model has high recognition accuracy and a low false alarm rate.

Abstract: The invention discloses a weighted heterogeneous graph-oriented malicious behavior identification method, system and storage medium. The method comprises the following steps: constructing an inductive graph neural network model. The inductive graph neural network model comprises a subgraph extraction module, a plurality of feature vector generation and fusion modules and a classification learning module; performing training and learning for the inductive graph neural network model, extracting subgraphs, learning the latent vector representation of nodes in the subgraphs, obtaining a plurality of subgraph feature vectors corresponding to the subgraphs, and fusing a plurality of subgraph feature vectors. The node feature vector obtained by fusion is used for classification learning in the classification learning module; using the trained inductive graph neural network model for malicious behavior identification.

Abstract: An APT organization identification method, system and storage medium based on a stacking ensemble are provided, the method comprising: using a TF-IDF algorithm combined with an n-gram to extract and vectorize behavior features from malware samples to form a malicious behavior vector feature set; based on the malicious behavior vector feature set, calculating correlations between features and chi-square values between the features and categories, performing screening twice on the malicious behavior vector feature set to obtain an improved low-dimensional feature subset data; constructing a multi-model fusion stacking ensemble, learning an APT organization identification model, using the APT organization identification model to perform an identification on new ATP attacks.