Attack defense method, system and defense device for abnormal system call

Abstract

The invention relates to an attack defense method, an attack defense system and an attack defense device for abnormal system call, and the method comprises the steps: obtaining a system call sequencefrom an operating system when detecting that a program is executed, and returning the system call sequence to a server; performing feature encoding on the system call sequence through a second encoderto obtain a corresponding second feature vector set, the second encoder being constructed according to encoding parameters of a first encoder in a self-encoding and decoding module transmitted by theserver; and comparing the second feature vector in the feature space through a regression equation, and determining whether the system call sequence is a normal system call according to a comparisonresult, the regression equation being obtained and transmitted by performing regression equation operation on the first feature vector set by the server. By implementing the technical scheme of the invention, the detection effectiveness of unseen malicious software can be effectively improved, the operation resources can be effectively distributed, and the hardware cost is reduced.

Description

technical field [0001] The invention relates to the field of computer security, in particular to an attack defense method, system and defense device for abnormal system calls. Background technique [0002] In recent years, with the advent of the era of big data and artificial intelligence, many researches and products of various companies are based on neural networks (NN) and combined with high-power GPU equipment to classify various texts, pictures and videos. application. However, compared with the above applications, there are few related researches on the intrusion prevention of abnormal system calls caused by malware, and most of the researches cannot be effectively commercialized. There are two main reasons: [0003] 1. At present, all artificial intelligence self-learning algorithms must rely on a large amount of labeled training data. However, malware must have never appeared before large-scale proliferation, so most network security companies can obtain training da...

AI Technical Summary

Problems solved by technology

Generally, in home computers, mobile phones, or even embedded systems or chips, due to the limitation of installation area and manufacturing cost, it is impossible to install such GPU hardware devices, but this will likely lead to a significant reduction in the calculation speed and classification accuracy of deep learning algorithms.

Images