Viruses are one of the main threats to the security of today’s cyberspace. With the continuous development of virus and artificial intelligence technologies in recent years, the intelligentization of virus technology has become a trend. It is of urgent significance to study and combat intelligent viruses. In this paper, we design a new type of confirmatory virus from the attacker’s perspective that can intelligently infect software frameworks. We aim for structural software as the target and use BCSD (binary code similarity detection) to identify the framework. By incorporating a software framework functional structure recognition model in the virus, the virus is enabled to intelligently recognize software framework functions in executable files. This paper evaluates the BCSD model that is suitable for a virus to carry and constructs a lightweight BCSD model with a knowledge distillation technique. This research proposes a software framework functional structure recognition algorithm, which effectively reduces the recognition precision’s dependence on the BCSD model. Finally, this study discusses the next researching direction of intelligent viruses. This paper aims to provide a reference for the research of detection technology for possible intelligent viruses. Consequently, focused and effective defense strategies could be proposed and the technical system of malware detection could be reinforced.

As an infrastructure platform for launching large-scale cyber attacks, botnets are one of the biggest threats to cyberspace security today. With the development of network technology and changes in the network environment, network attack intelligence has become a trend, and botnet designers are also committed to developing more destructive intelligent botnets. The feasibility of implementing distributed intelligent computing based on botnet node resources is analyzed with regard to the aspects of program size, communication traffic and resource occupancy. AIBot, a botnet model that can perform intelligent computation in a distributed manner, is proposed from the attacker’s perspective, which hierarchically deploys distributed neural network models in the botnet, thereby organizing nodes to collaboratively perform intelligent computation tasks. AIBot enables the distributed execution of intelligent computing tasks on a cluster of bot nodes by decomposing the computational load of a deep neural network model. A general algorithm for the distributed deployment of neural networks in AIBot is proposed, and the overall operational framework for AIBot is given. Two classical neural network models, CNN and RNN, are used as examples to illustrate specific schemes for deploying and running distributed intelligent computing in AIBot. Experimental scenarios were constructed to experimentally validate and briefly evaluate the performance of the two AIBot attack modes, and the overall efficiency of AIBot was evaluated in terms of execution time. This paper studies new forms of botnet attack techniques from a predictive perspective, aiming to increase defenders’ understanding of potential botnet threats, in order to propose effective defense strategies and improve the botnet defense system.