Primary extracted opcodes.

In recent years, with the development of the Internet, the attribution classification of APT malware remains an important issue in society. Existing methods have yet to consider the DLL link library and hidden file address during the execution process, and there are shortcomings in capturing the local and global correlation of event behaviors. Compared to the structural features of binary code, opcode features reflect the runtime instructions and do not consider the issue of multiple reuse of local operation behaviors within the same APT organization. Obfuscation techniques more easily influence attribution classification based on single features. To address the above issues, (1) an event behavior graph based on API instructions and related operations is constructed to capture the execution traces on the host using the GNNs model. (2) ImageCNTM captures the local spatial correlation and continuous long-term dependency of opcode images. (3) The word frequency and behavior features are concatenated and fused, proposing a multi-feature, multi-input deep learning model. We collected a publicly available dataset of APT malware to evaluate our method. The attribution classification results of the model based on a single feature reached 89.24% and 91.91%. Finally, compared to single-feature classifiers, the multi-feature fusion model achieves better classification performance.近年来，随着互联网技术的发展，高级持续威胁（APT，Advanced Persistent Threat）恶意软件的归属分类仍是当前社会亟待解决的重要议题。现有研究方法尚未考虑恶意软件执行过程中的动态链接库（DLL，Dynamic Link Library）调用与隐藏文件地址信息，且在捕获事件行为的局部与全局关联层面存在固有缺陷。相较于二进制代码的结构特征，操作码（Opcode）特征仅能反映程序运行时的指令序列，未考虑同一APT组织内本地操作行为的多重复用问题；同时，基于单一特征的归属分类模型更易受到代码混淆技术的干扰。为解决上述问题，本研究开展如下三项工作：(1) 构建基于应用程序编程接口（API，Application Programming Interface）指令与关联操作的事件行为图，并借助图神经网络（GNNs，Graph Neural Networks）模型捕获主机端的程序执行轨迹；(2) 提出ImageCNTM模型以捕捉操作码图像的局部空间关联与持续长期依赖关系；(3) 将词频特征与行为特征进行拼接融合，构建多特征、多输入的深度学习分类模型。本研究收集了公开可用的APT恶意软件数据集以评估所提方法的性能。实验结果显示，基于单一特征的模型归属分类准确率分别达到89.24%与91.91%；最终，相较于单一特征分类器，多特征融合模型实现了更优异的分类性能。