A security analysis method and system for distributed sandbox based on large model

Abstract

The present invention provides a security analysis method and system for a distributed sandbox based on a large model, and relates to the field of security analysis of large models. The technical solution is as follows: the original data of a distributed data sandbox is obtained, and preliminary screening is performed based on a large model adversarial review method to obtain a preliminary screening sample; the preliminary screening samples are respectively calculated based on a plurality of similarity algorithms to obtain a mixed similarity; an abstract syntax tree is compiled based on a threat program of the preliminary screening sample to obtain a dependency graph, and the nodes in the dependency graph are traversed to perform nested directed acyclic graph modeling to obtain a nested relationship graph; labels are added to the nested relationship graph based on the mixed similarity and sliced ​​to obtain a subgraph, and the similar subgraphs are traversed and matched based on an existing threat program library to obtain a subgraph similarity, and a weighted calculation is performed to obtain a static threat score. The present invention proposes a hybrid calculation method and a nested relationship representation method, which improves the problem that traditional static analysis is difficult to effectively analyze threat programs and has a high misjudgment rate.

Description

Technical Field

[0001] The present invention relates to the technical field of large model security analysis, and in particular to a large model-based distributed sandbox security analysis method and system. Background Art

[0002] Distributed sandbox refers to a technology that isolates different applications or components in a distributed system and runs them in an independent virtual environment through a sandbox mechanism to achieve resource isolation, security isolation, and fault isolation. It combines distributed technology and sandbox mechanisms to improve the security, stability, and resource utilization of applications through distributed deployment and sandbox isolation. Distributed data sandboxes are used to process large amounts of heterogeneous data sets in parallel, and executing programs in a closed sandbox environment will not damage the external environment.

[0003] As an important branch of artificial intelligence, large models refer to neural network models that contain ultra-large-scale parameters (usually more than one billion). These models are characterized by their huge scale, multi-task learning capabilities, the need for powerful computing resources, and the large amount of data required for training. They are widely used in natural language processing and computer vision.

[0004] The problems of the prior art mainly involve two points:

[0005] First, traditional static analysis examines bugs and semantic errors in the code, but this is not effective for threat programs. However, machine learning can improve static analysis capabilities and feature extraction capabilities, but as a passive defense mechanism, it is not an effective method for lightweight deployment. The data set required for machine learning is a headache in today's era of numerous threat programs.

[0006] Secondly, the traditional identification method is the commonly used text matching and token method, which often ignores semantic issues. Multiple documents have shown that the misjudgment rate of using this method alone is very high. Later, some scholars proposed starting from the syntax tree, which is a data structure that abstracts the semantic relationship of the code. It retains the logical relationship between the codes very well, but there is still a problem of high misjudgment rate.

[0007] Therefore, it is urgent to develop a solution to improve the above problems. Summary of the invention

[0008] The purpose of the present invention is to provide a security analysis method and system for a distributed sandbox based on a large model, which improves the problem that traditional static analysis is difficult to effectively analyze threat programs and has a high misjudgment rate.

[0009] The present invention provides a distributed sandbox security analysis method and system based on a large model, which adopts the following technical solutions:

[0010] In the first aspect, a security analysis method of a distributed sandbox based on a large model specifically includes:

[0011] Obtain the original data of the distributed data sandbox, write rules based on the big model to resist censorship and obtain Yara rules, and preliminarily screen the original data based on Yara rules to obtain preliminary screening samples;

[0012] Based on two or more similarity algorithms, weighted similarity calculations are performed on the primary screening samples respectively, and weighted calculations are performed based on the calculation results to obtain mixed similarity;

[0013] An abstract syntax tree is compiled based on the threat program of the initial screening sample to obtain a dependency graph, and nodes in the dependency graph are traversed to perform nested directed acyclic graph modeling to obtain a nested relationship graph;

[0014] Labels are added to the nested relationship graph based on the mixed similarity. Based on the visual ability of the large model, the nested relationship graph is sliced ​​according to the labels to obtain similar subgraphs. Based on the existing threat program library, the similar subgraphs are traversed and matched to obtain subgraph similarity. Based on the subgraph similarity and the proportion of the subgraph in the whole graph, a weighted calculation is performed to obtain the static threat score result, and a security analysis report is output.

[0015] The beneficial effect of a security analysis method based on distributed data sandbox and big model provided by the present invention is that it adopts a lightweight deployment strategy, does not require a data set to train the machine learning algorithm, but uses the ability of the big model to dynamically guide the writing of Yara rules, adopts an innovative hybrid analysis method for the similarity between threat programs, merges text and semantic matching, and finally uses the visual ability of the big model to perform structural matching judgment on the constructed DAG directed acyclic graph, thereby improving the problem that traditional static analysis is difficult to effectively analyze threat programs and has a high misjudgment rate.

[0016] Optionally, Yara rules can be written based on the big model to resist censorship, including:

[0017] The big model is set up with the identities of rule makers and rule reviewers respectively, and the corresponding formulation model and review model are obtained;

[0018] Polling based on the formulation model and review model to get the Yara rules;

[0019] The formulation model has all the knowledge and writing capabilities of Yara rules and is responsible for writing Yara rules. The review model has a threat sample library of Yara rules.

[0020] Optionally, poll Yara rules based on the development model and review model, including:

[0021] The model is formulated to write rules, retrieve the existing sample library to obtain the general rule template, and the model is formulated to write rules after accepting the review suggestions of the review model, and return the results to the review model;

[0022] The review model searches the existing sample library to find similar rules and makes review suggestions to the formulated model. When the review model search result is empty, the polling ends and the Yara rules are obtained.

[0023] Optionally, weighted similarity calculations are performed on the primary screening samples based on two or more similarity algorithms, and the weighted similarity calculation steps include:

[0024] Perform text similarity calculation on the initial screening samples to obtain text similarity;

[0025] The code structure similarity of the initial screening samples was calculated to obtain the structural similarity;

[0026] The weighted similarity is obtained based on the weighted calculation of text similarity and structural similarity.

[0027] Optionally, a weighted similarity is obtained based on a weighted calculation of text similarity and structural similarity. The weighted similarity calculation formula is as follows:

[0028] ;

[0029] In the formula, is the text similarity, is the structural similarity, is the weighted similarity, is the weight function;

[0030] in, The weight function calculation formula is as follows:

[0031] ;

[0032] In the formula, is the baseline weight to ensure the calculation results No less than , is the text similarity.

[0033] Optionally, a weighted calculation is performed based on the weighted similarity to obtain a mixed similarity, including:

[0034] Using two or more similarity algorithms to perform weighted similarity calculations on the initial screening samples respectively, and then performing normalization processing after obtaining the corresponding weighted similarities;

[0035] The normalized results were weighted based on the mean and standard deviation of the initial screening samples to obtain the mixed similarity.

[0036] Optionally, the normalized results are weighted based on the mean and standard deviation of the initial screening samples, and the calculation formula is as follows:

[0037] ;

[0038] In the formula, is the weight of the corresponding method, is the mean of the initial screening samples, is the standard deviation of the initial screening sample; is the similarity calculated by the corresponding method, represents the cosine similarity method, represents the Jaro similarity method, represents the edit distance similarity method, is the mixed similarity.

[0039] Optionally, the similar subgraphs are traversed and matched based on an existing threat program library to obtain subgraph similarity, and the matching process includes:

[0040] Extract the subgraphs of the directed acyclic graph to be matched, and calculate the similarity between the subgraphs to obtain the subgraph pairs with the highest similarity and their similarity;

[0041] The similarity between the internal nested graphs of the subgraph pair is calculated to obtain a weighting factor, and a weighted calculation is performed based on the similarity of the subgraph pair and the weighting factor to obtain the subgraph similarity.

[0042] Optionally, a weighted calculation is performed based on the similarity of the subgraph pair and a weighting factor to obtain the subgraph similarity, and the subgraph similarity calculation formula is as follows:

[0043] ;

[0044] In the formula, is the subgraph similarity, is the similarity of the subgraph pair, is the weighting factor, is the similarity between the internal nested graphs of a subgraph pair, is a subgraph pair, and is the figure number;

[0045] The static threat score result is obtained by weighted calculation based on the sub-graph similarity and the proportion of the sub-graph in the whole graph. The weighted calculation formula is as follows:

[0046] ;

[0047] In the formula, For static threat scoring results, For subgraph The proportion of the whole picture, For subgraph The proportion of the whole picture, is the subgraph similarity, and It is the figure number.

[0048] In the second aspect, a security analysis system based on a large model and distributed sandbox specifically includes:

[0049] The preliminary screening module is used to obtain the original data of the distributed data sandbox, write rules based on the big model to resist censorship and obtain Yara rules, and preliminarily screen the original data based on the Yara rules to obtain the preliminary screening samples;

[0050] A similarity calculation module performs mixed similarity calculations on the primary screening samples based on two or more similarity algorithms, and performs weighted calculations based on the calculation results to obtain mixed similarity;

[0051] A nested relationship graph module compiles an abstract syntax tree based on the threat program of the initial screening sample to obtain a dependency graph, traverses and accesses the nodes in the dependency graph to perform nested directed acyclic graph modeling, and obtains a nested relationship graph;

[0052] The static threat analysis module adds labels to the nested relationship graph based on the mixed similarity, slices the nested relationship graph according to the labels based on the visual ability of the large model to obtain similar subgraphs, traverses and matches the similar subgraphs based on the existing threat program library to obtain subgraph similarity, performs weighted calculation based on the subgraph similarity and the proportion of the subgraph in the entire graph to obtain the static threat score result, and outputs a security analysis report.

[0053] The beneficial effects of the second aspect can refer to the description of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 A flowchart of the overall steps of a distributed sandbox security analysis method based on a large model provided by the present invention;

[0055] Figure 2 A schematic diagram of the nested relationship of a large-model-based distributed sandbox security analysis method provided by the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0057] See also Figure 1 The embodiment of the present invention provides a security analysis method based on a distributed data sandbox and a large model, comprising the following steps:

[0058] S1. Obtain the original data of the distributed data sandbox, write rules based on the big model to resist censorship and obtain Yara rules, and preliminarily screen the original data based on the Yara rules to obtain the initial screening samples;

[0059] S2, performing mixed similarity calculations on the primary screening samples based on two or more similarity algorithms, and performing weighted calculations based on the calculation results to obtain mixed similarity;

[0060] S3, compiling the threat program based on the initial screening sample into an abstract syntax tree to obtain a dependency graph, traversing and accessing the nodes in the dependency graph to perform nested directed acyclic graph modeling, and obtaining a nested relationship graph;

[0061] S4. Label the nested relationship graph based on the mixed similarity, slice the nested relationship graph according to the labels based on the visual ability of the large model to obtain similar subgraphs, traverse and match the similar subgraphs based on the existing threat program library to obtain subgraph similarity, perform weighted calculation based on the subgraph similarity and the proportion of the subgraph in the entire graph to obtain a static threat score result, and output a security analysis report.

[0062] In some embodiments, executing step S1 specifically includes:

[0063] S1-1. Obtain the original data of the distributed data sandbox;

[0064] S1-2, based on the big model to resist censorship, we write rules to get Yara rules;

[0065] S1-3. Preliminary screening of raw data based on Yara rules to obtain preliminary screening samples.

[0066] Specifically, when executing step S1-1, a heterogeneous data set in a distributed data sandbox is obtained as original data. The heterogeneous data set refers to a data set containing different structures, formats or sources. The data set includes structured data (such as tables in relational databases), semi-structured data (such as XML, JSON documents) and unstructured data (such as text, images, audio, etc.).

[0067] Specifically, when executing step S1-2, the Yara rules are written based on the big model anti-censorship method, including:

[0068] S1-2-1. Set up a large model with the identities of rule makers and rule reviewers, and obtain a formulation model and a review model respectively;

[0069] S1-2-2. Polling is performed based on the formulation model and the review model to obtain the Yara rules.

[0070] Furthermore, the formulation model has all the knowledge and writing capabilities of Yara rules and is responsible for writing Yara rules; the review model has a threat sample library of Yara rules and can guide the writing strategy of a designated person through historical samples.

[0071] In fact, when executing step S1-2-2, the Yara rules are obtained by polling based on the formulation model and the review model, including:

[0072] The model is formulated to write rules, retrieve the existing sample library to obtain the general rule template, and the model is formulated to write rules after accepting the review suggestions of the review model, and return the results to the review model;

[0073] The review model searches the existing sample library to find similar rules and makes review suggestions to the formulated model. When the review model search result is empty, the polling ends and the Yara rules are obtained.

[0074] Furthermore, before polling, the review model first searches the sample library to try to find files with the same hash value. If found, the sample hash value and the corresponding threat category are returned.

[0075] Specifically, when executing step S1-3, the Yara rules obtained by polling and writing are applied to matching, and the original data is matched with the threat program to complete the preliminary screening to obtain the preliminary screening sample.

[0076] Furthermore, Yara rules are a rule language specifically used to detect and classify malware and threat files. Its rules include several parts: metadata, strings, conditions, etc.

[0077] Furthermore, when the big model writes Yara rules, it will write multiple modes of Yara rules based on the tools mounted by itself and the Yara rule knowledge base. The tools mounted by the big model can be crawlers or browsers, etc., which are used to provide the latest knowledge when writing Yara rules.

[0078] Applied to practical scenarios, a powerful Agent model with large language models (LLMs) and multi-role state applications is built based on the language chain (Langchain) and language graph (Langgraph).

[0079] Furthermore, an agent is a software entity or system that can perceive the environment, make decisions and take actions to complete specific tasks; Langchain is an implementation framework based on artificial intelligence workflow; Langgraph is an implementation framework for artificial intelligence multi-agent collaboration.

[0080] In some embodiments, when executing step S2, weighted similarity calculations are performed on the primary screening samples based on two or more similarity algorithms, and the weighted similarity calculations include:

[0081] S2-1, perform text similarity calculation on the initial screening samples to obtain text similarity, and perform code structure similarity calculation on the initial screening samples to obtain structure similarity;

[0082] S2-2. A weighted similarity is obtained based on a weighted calculation of text similarity and structural similarity.

[0083] Furthermore, in the static analysis of threat programs, combining text matching methods and code matching methods is a comprehensive and effective solution. The difference between the two is that text matching focuses on detecting the number of repetitions of text within a text range, but in the code support library, functions with duplicate names account for a large proportion. Using text similarity alone for similarity matching should not be used as the detection result of similarity matching.

[0084] Specifically, when executing step S2-2, a weighted similarity is obtained based on a weighted calculation of text similarity and structure similarity. The weighted similarity calculation formula is as follows:

[0085] ;

[0086] In the formula, is the text similarity, is the structural similarity, is the weighted similarity, is the weight function;

[0087] in, The weight function calculation formula is as follows:

[0088] ;

[0089] In the formula, is the baseline weight to ensure the calculation results No less than , is the text similarity.

[0090] Specifically, when executing step S2 and performing weighted calculation based on the weighted similarity to obtain the mixed similarity, the method includes:

[0091] Using two or more similarity algorithms to perform weighted similarity calculations on the initial screening samples respectively, and then performing normalization processing after obtaining the corresponding weighted similarities;

[0092] The normalized results were weighted based on the mean and standard deviation of the initial screening samples to obtain the mixed similarity.

[0093] Furthermore, in order to eliminate the linear relationship and constraints brought by mixing multiple similarity calculation results, the multiple calculation results are normalized so that multiple parameters have a unified standard.

[0094] In fact, the normalized results are weighted based on the mean and standard deviation of the initial screening samples. The calculation formula is as follows:

[0095] ;

[0096] In the formula, is the weight of the corresponding method, is the mean of the initial screening samples, is the standard deviation of the initial screening sample; is the similarity calculated by the corresponding method, represents the cosine similarity method, represents the Jaro similarity method, represents the edit distance similarity method, is the mixed similarity.

[0097] Furthermore, by matching texts of different lengths and content differences, the feasibility of the hybrid calculation method was verified, and finally good experimental results were obtained through different average value calculation methods. In the experiment, two pieces of crawler code from github open source were selected to compare the similarity between the two. Table 1 shows the experimental results of text matching using the three methods.

[0098] Table 1 Text matching results

[0099] ,

[0100] From the results in Table 1, we can see that the time and similarity of the Jaro similarity calculation method are much higher than the other two methods. When calculating English text, Jaro similarity can often find more matching characters, so the similarity value is higher. Jaro is very effective when processing short texts, so reducing its weight can eliminate the impact of its excessively high similarity in long texts.

[0101] In some embodiments, when executing step S3, it specifically includes:

[0102] An abstract syntax tree is compiled based on the threat program of the initial screening sample to obtain a dependency graph, and nodes in the dependency graph are traversed to perform nested directed acyclic graph modeling to obtain a nested relationship graph;

[0103] Specifically, we first compile the AST (Abstract Syntax Tree) to find out the dependencies, and then model the DAG (Directed Acyclic Graph). Then, we visit each node, model the DAG between functions in the file, obtain multi-layer DAG dependencies, and finally get a nested relationship graph. Figure 2 , which is a schematic diagram of a nested relationship diagram.

[0104] In some embodiments, when executing step S4, it specifically includes:

[0105] S4-1, adding labels to the nested relationship graph based on the mixed similarity, and slicing the nested relationship graph according to the labels to obtain similar subgraphs based on the visual ability of the large model;

[0106] S4-2, traversing and matching the similar subgraphs based on the existing threat program library to obtain subgraph similarity;

[0107] S4-3. Perform weighted calculation based on sub-graph similarity and the proportion of sub-graphs to the entire graph to obtain static threat score results, and output a security analysis report.

[0108] Specifically, when executing step S4-1, the mixed similarity is added as a label to the nested relationship graph, and the labeled nested relationship graph is translated based on the visual ability of the large model, thereby avoiding misjudgment and wrong judgment caused by the large model directly comparing two DAGs.

[0109] Specifically, when executing step S4-2, the similar subgraphs are traversed and matched based on the existing threat program library to obtain subgraph similarity, and the matching process includes:

[0110] Extract the subgraphs of the directed acyclic graph to be matched, and calculate the similarity between the subgraphs to obtain the subgraph pairs with the highest similarity and their similarity;

[0111] The similarity between the internal nested graphs of the subgraph pair is calculated to obtain a weighting factor, and a weighted calculation is performed based on the similarity of the subgraph pair and the weighting factor to obtain the subgraph similarity.

[0112] Furthermore, a weighted calculation is performed based on the similarity of the subgraph pair and a weighting factor to obtain the subgraph similarity. The subgraph similarity calculation formula is as follows:

[0113] ;

[0114] In the formula, is the subgraph similarity, is the similarity of the subgraph pair, is the weighting factor, is the similarity between the internal nested graphs of a subgraph pair, is a subgraph pair, and It is the figure number.

[0115] Furthermore, a weighted calculation is performed based on the subgraph similarity and the proportion of the subgraph to the entire graph to obtain the static threat score result. The weighted calculation formula is as follows:

[0116] ;

[0117] In the formula, For static threat scoring results, For subgraph The proportion of the whole picture, For subgraph The proportion of the whole picture, is the subgraph similarity, and It is the figure number.

[0118] Further, As the static threat scoring result, the static threat scoring result is analyzed to obtain and output a security analysis report.

[0119] The embodiment of the present invention further provides a security analysis system of a distributed sandbox based on a large model, which specifically includes:

[0120] The preliminary screening module is used to obtain the original data of the distributed data sandbox, write rules based on the big model to resist censorship and obtain Yara rules, and preliminarily screen the original data based on the Yara rules to obtain the preliminary screening samples;

[0121] A similarity calculation module performs mixed similarity calculations on the primary screening samples based on two or more similarity algorithms, and performs weighted calculations based on the calculation results to obtain mixed similarity;

[0122] A nested relationship graph module compiles an abstract syntax tree based on the threat program of the initial screening sample to obtain a dependency graph, traverses and accesses the nodes in the dependency graph to perform nested directed acyclic graph modeling, and obtains a nested relationship graph;

[0123] The static threat analysis module adds labels to the nested relationship graph based on the mixed similarity, slices the nested relationship graph according to the labels based on the visual ability of the large model to obtain similar subgraphs, traverses and matches the similar subgraphs based on the existing threat program library to obtain subgraph similarity, performs weighted calculation based on the subgraph similarity and the proportion of the subgraph in the entire graph to obtain the static threat score result, and outputs a security analysis report.

[0124] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A security analysis method based on a large model distributed sandbox, characterized in that: include: Obtain the original data of the distributed data sandbox, write rules based on the big model to resist censorship and obtain Yara rules, and preliminarily screen the original data based on Yara rules to obtain preliminary screening samples; The text similarity of the initial screening samples is calculated to obtain the text similarity, the code structure similarity of the initial screening samples is calculated to obtain the structural similarity, and the weighted similarity is obtained by weighted calculation based on the text similarity and the structural similarity; The weighted similarity of the initial screening samples is calculated by using two or more similarity algorithms respectively, and the corresponding weighted similarities are normalized after being obtained. The normalized results are weighted based on the mean and standard deviation of the initial screening samples to obtain a mixed similarity. After finding the dependency relationship based on the abstract syntax tree compilation, a directed acyclic graph modeling is performed, each node of the directed acyclic graph is accessed, an acyclic graph modeling is performed between functions in the file, and a multi-layer directed acyclic graph dependency relationship is obtained to obtain a nested relationship graph; Labels are added to the nested relationship graph based on the mixed similarity. Based on the visual ability of the large model, the nested relationship graph is sliced ​​according to the labels to obtain similar subgraphs. Based on the existing threat program library, the similar subgraphs are traversed and matched to obtain subgraph similarity. Based on the subgraph similarity and the proportion of the subgraph in the whole graph, a weighted calculation is performed to obtain the static threat score result, and a security analysis report is output.

2. The security analysis method of distributed sandbox based on large model according to claim 1 is characterized in that: Yara rules are written based on the big model to resist censorship, including: The big model is set up with the identities of rule makers and rule reviewers respectively, and the corresponding formulation model and review model are obtained; Polling based on the formulation model and review model to get the Yara rules; The formulation model has all the knowledge and writing capabilities of Yara rules and is responsible for writing Yara rules. The review model has a threat sample library of Yara rules.

3. The security analysis method of the distributed sandbox based on a large model according to claim 2 is characterized in that: Polling based on the development model and review model to obtain Yara rules, including: The model is formulated to write rules, retrieve the existing sample library to obtain the general rule template, and the model is formulated to write rules after accepting the review suggestions of the review model, and return the results to the review model; The review model searches the existing sample library to find similar rules and makes review suggestions to the formulated model. When the review model search result is empty, the polling ends and the Yara rules are obtained.

4. The security analysis method of distributed sandbox based on large model according to claim 1 is characterized in that: The weighted similarity is obtained by weighted calculation based on text similarity and structural similarity. The weighted similarity calculation formula is as follows: ； In the formula, is the text similarity, is the structural similarity, is the weighted similarity, is the weight function; in, The weight function calculation formula is as follows: ； In the formula, is the baseline weight to ensure the calculation results No less than , is the text similarity.

5. The security analysis method of distributed sandbox based on large model according to claim 1 is characterized in that: The normalized results are weighted based on the mean and standard deviation of the initial screening samples. The calculation formula is as follows: ； In the formula, is the weight of the corresponding method, is the mean of the initial screening samples, is the standard deviation of the initial screening sample; is the similarity calculated by the corresponding method, represents the cosine similarity method, represent Jaro Similarity method, represents the edit distance similarity method, is the mixed similarity.

6. The security analysis method of distributed sandbox based on large model according to claim 1 is characterized in that: Based on the existing threat program library, the similar subgraphs are traversed and matched to obtain subgraph similarity, and the matching process includes: Extract the subgraphs of the directed acyclic graph to be matched, and calculate the similarity between the subgraphs to obtain the subgraph pairs with the highest similarity and their similarity; The similarity between the internal nested graphs of the subgraph pair is calculated to obtain a weighting factor, and a weighted calculation is performed based on the similarity of the subgraph pair and the weighting factor to obtain the subgraph similarity.

7. The security analysis method of distributed sandbox based on large model according to claim 6 is characterized in that: The subgraph similarity is obtained by weighted calculation based on the similarity of the subgraph pair and the weighting factor. The subgraph similarity calculation formula is as follows: ； In the formula, is the subgraph similarity, is the similarity of the subgraph pair, is the weighting factor, is the similarity between the internal nested graphs of a subgraph pair, is a subgraph pair, and is the figure number; The static threat score result is obtained by weighted calculation based on the sub-graph similarity and the proportion of the sub-graph in the whole graph. The weighted calculation formula is as follows: ； In the formula, For static threat scoring results, For subgraph The proportion of the whole picture, For subgraph The proportion of the whole picture, is the subgraph similarity, and It is the figure number.

8. A security analysis system based on a large model and distributed sandbox, characterized in that: include: The preliminary screening module is used to obtain the original data of the distributed data sandbox, write rules based on the big model to resist censorship and obtain Yara rules, and preliminarily screen the original data based on the Yara rules to obtain the preliminary screening samples; The similarity calculation module performs text similarity calculation on the preliminary screening samples to obtain text similarity, performs code structure similarity calculation on the preliminary screening samples to obtain structure similarity, performs weighted calculation based on text similarity and structure similarity to obtain weighted similarity, performs weighted similarity calculation on the preliminary screening samples using two or more similarity algorithms respectively, performs normalization processing after obtaining corresponding weighted similarities, and performs weighted calculation on the normalized results based on the mean and standard deviation of the preliminary screening samples to obtain mixed similarity; The nested relationship graph module finds out the dependency relationship based on the abstract syntax tree compilation and then performs directed acyclic graph modeling, visits each node of the directed acyclic graph, performs acyclic graph modeling between functions in the file, obtains multi-layer directed acyclic graph dependency relationships, and obtains a nested relationship graph; The static threat analysis module adds labels to the nested relationship graph based on the mixed similarity, slices the nested relationship graph according to the labels based on the visual ability of the large model to obtain similar subgraphs, traverses and matches the similar subgraphs based on the existing threat program library to obtain subgraph similarity, performs weighted calculation based on the subgraph similarity and the proportion of the subgraph in the entire graph to obtain the static threat score result, and outputs a security analysis report.

Images