Computer virus detection method and computer equipment

Abstract

The present application belongs to the field of computer information security technology, and discloses a computer virus detection method and computer equipment. In addition to matching the target process to be detected with the virus signature code, the scheme also matches the target process to be detected with the virus behavior characteristics, thereby realizing risk assessment of the dynamic real-time behavior of the target process, and making the computer virus detection result more reliable. In addition, a feature frequent item set of the process behavior characteristics is constructed, and feature association rules are generated for the feature frequent item set. Feature association rules with a confidence level above a preset threshold are determined as strong association rules. When the process behavior executed in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is further predicted, thereby realizing early warning of possible risks before dangerous behavior occurs, facilitating further disposal in advance, and improving the security of the computer system.

Description

Technical Field

[0001] The present application relates to the field of computer information security technology, and in particular to a computer virus detection method and computer equipment. Background Art

[0002] In the existing technical solution, computer virus intrusion detection is performed at the network entrance. When it is found that the detection object meets the preset virus signature code, the detection object is considered to be a computer virus and is intercepted.

[0003] Due to the variability of computer virus implementation rules, especially ransomware, existing technical solutions determine whether a detection object is a computer virus based on whether the detection object meets the preset virus signature code. The detection rules are prone to failure, resulting in missed detections. Moreover, the detection results are simply divided into computer viruses or not. For suspicious detection objects that do not fully meet the preset virus signature code, no further judgment can be made, and no warning can be issued for potential subsequent risk behaviors. Summary of the Invention

[0004] In order to solve the above technical problems, the present application provides a computer virus detection method and computer equipment.

[0005] According to one aspect of an embodiment of the present application, a computer virus detection method is disclosed, the computer virus detection method comprising:

[0006] Matching a target process to be detected with a virus signature and virus behavior signature to determine a security level of the target process and / or the process behavior of the target process, wherein the target process includes one or more of the process behaviors;

[0007] Constructing a feature frequent item set of process behavior features based on virus behavior features matched by the process behavior contained in the target process;

[0008] Generating feature association rules for the feature frequent item sets, and determining feature association rules whose confidence reaches a preset threshold value as strong association rules;

[0009] When the executed process behavior in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is predicted, wherein the strong association rule includes the process behavior feature corresponding to the subsequent behavior.

[0010] In some embodiments, matching the target process to be detected with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process includes:

[0011] Match the target process to be detected with the virus signature;

[0012] If the target process successfully matches the virus signature, the target process is determined to be a dangerous process;

[0013] If the target process fails to match the virus signature, the probability values ​​of the process behaviors included in the target process corresponding to various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior.

[0014] In some embodiments, after matching the target process to be detected with the virus signature, the method further includes:

[0015] When the target process is determined to be a dangerous process, all process behaviors included in the target process are blocked and an alarm signal is issued;

[0016] If the target process fails to match the virus signature, the target process is determined to be a process of concern; if the security level corresponding to any process behavior contained in the target process is determined to be a dangerous behavior, the target process is changed from a process of concern to a dangerous process; if the security level corresponding to all process behaviors contained in the target process is determined to be a safe behavior, the target process is changed from a process of concern to a safe process, and all process behaviors contained in the target process are allowed; if the security level corresponding to some process behaviors contained in the target process is determined to be a behavior of concern, the target process is maintained as a process of concern, and process behaviors with a security level of safe behavior in the target process are allowed.

[0017] In some embodiments, the determining that the target process is a dangerous process includes: marking the target process as a black process; the determining that the target process is a process of concern includes: marking the target process as a gray process; the changing the target process from a process of concern to a safe process includes: changing the target process from a gray process to a white process; the dangerous behavior is a black behavior, the concerned behavior is a gray behavior, and the safe behavior is a white behavior.

[0018] In some embodiments, the constructing of a feature frequent item set of process behavior features based on virus behavior features matched by the process behavior contained in the target process includes:

[0019] Traversing a process behavior list of a target process in a process list whose process behavior matches a virus behavior feature, obtaining a first candidate item set, wherein the first candidate item set includes the process behavior and the support degree corresponding to the process behavior, wherein the process list includes a plurality of the target processes;

[0020] Eliminate the items whose support is below the support threshold in the first candidate item set to obtain a second candidate item set;

[0021] Traversing the second candidate item set, combining the process behaviors included in the second candidate item set in pairs, and obtaining combination supports corresponding to the pairwise combined process behavior combinations based on a process behavior list of target processes in the process list that matches virus behavior characteristics, thereby obtaining a third candidate item set including the pairwise combined process behavior combinations and the combination supports;

[0022] Iterative execution is performed to obtain a candidate item set Lk containing k-1 process behavior combinations and combination support according to the process behaviors contained in the candidate item set Lk-1 and the process behavior list of the target process in the process list that matches the virus behavior characteristics, until the candidate item set Lk is an empty set, where k represents the sequence number of the candidate item set and k is an integer greater than or equal to 4.

[0023] In some embodiments, the process behavior list including k-1 process behavior combinations and the combination support obtained based on the process behaviors included in the candidate item set Lk-1 and the process behaviors included in the target process in the process list that match the virus behavior characteristics includes:

[0024] Traversing the candidate item set Lk-1, for each process behavior included in the candidate item set Lk-1, storing a pointer to the next process behavior, wherein the next process behavior is k-2 process behaviors in the combination of process behaviors included in the candidate item set Lk-1;

[0025] Combine every k-1 process behaviors contained in the candidate item set Lk-1, and obtain the combined support corresponding to the process behavior combination after the k-1 process behaviors are combined based on the process behavior list of the target process in the process list that matches the virus behavior characteristics, and obtain the candidate item set Lk containing the process behavior combination and the combined support after the k-1 process behavior combinations.

[0026] In some embodiments, generating feature association rules for the feature frequent item sets and determining feature association rules with a confidence level above a preset threshold as strong association rules includes:

[0027] Using an association rule mining algorithm to perform association rule mining on the process behavior features in the feature frequent item set to obtain multiple feature association rules;

[0028] Calculate the confidence of each feature association rule based on the relationship: Confidence(A->B)=support(A&B) / support(A), where A and B represent the process behavior feature or a combination of at least two process behavior features occurring simultaneously.

[0029] The confidence level of each feature association rule is compared with a preset threshold, and when the confidence level of the feature association rule reaches or exceeds the preset threshold, the feature association rule is determined to be a strong association rule.

[0030] In some embodiments, predicting the security level of subsequent behavior of the target process includes:

[0031] Calculating the probability values ​​of subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors respectively;

[0032] The security level with the largest probability value is used as the security level of the subsequent behavior of the target process, where the security level is one of the dangerous behavior, the concerned behavior, and the safe behavior;

[0033] When the subsequent behavior of the target process is predicted to be a dangerous behavior, an alarm signal is issued.

[0034] In some embodiments, calculating the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors, respectively, includes:

[0035] Based on the relation Calculating the probability values ​​of subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors respectively;

[0036] Among them, P(Y=security level|X={behavior}) represents the probability value of the subsequent behavior of the target process being at a certain security level, P(security level) represents the prior probability of the process behavior being at a certain security level, P(behavior|security level) represents the probability of a certain process behavior occurring under the condition that the process behavior is at a certain security level, P9behavior) represents the prior probability of a certain process behavior, α represents the smoothing coefficient, and z represents the number of features.

[0037] According to one aspect of an embodiment of the present application, a computer device is disclosed, which includes one or more processors and a memory, wherein the memory is used to store one or more computer programs. When the one or more computer programs are executed by the one or more processors, the processors implement the computer virus detection method as described above.

[0038] The technical solutions provided by the embodiments of the present application include at least the following beneficial effects:

[0039] The solution disclosed in the present application not only matches the target process to be detected with the virus signature code, but also matches the target process to be detected with the virus behavior characteristics, thereby realizing risk assessment of the dynamic real-time behavior of the target process, and making the computer virus detection results more reliable; moreover, a feature frequent item set of the process behavior characteristics is constructed, and feature association rules are generated for the feature frequent item set, and feature association rules with a confidence level above a preset threshold are determined as strong association rules. When the process behavior executed in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is further predicted, thereby realizing early warning of possible risks before dangerous behavior occurs, facilitating further disposal in advance, and improving the security of the computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings are incorporated into and constitute a part of the specification, illustrating embodiments consistent with the present application and, together with the specification, explaining the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can derive other drawings based on these drawings without inventive effort. In the drawings:

[0041] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solutions of the embodiments of the present application can be applied;

[0042] Figure 2 A flowchart of a computer virus detection method according to an embodiment of the present application is shown;

[0043] Figure 3 Shown Figure 2 Detailed flow chart of an embodiment of step S202;

[0044] Figure 4 Shown Figure 2 Detailed flow chart of another embodiment of step S202;

[0045] Figure 5 Shown Figure 2 Detailed flow chart of another embodiment of step S202;

[0046] Figure 6 Shown Figure 2 Detailed flow chart of an embodiment of step S203;

[0047] Figure 7 Shown Figure 2 Detailed flow chart of an embodiment of step S204;

[0048] Figure 8 Shown Figure 2Detailed flow chart of an embodiment of step S206;

[0049] Figure 9 A block diagram showing the composition of a computer device according to an embodiment of the present application is shown;

[0050] Figure 10 A block diagram of a computer system structure for implementing some embodiments of the present application is shown.

[0051] The following are the descriptions of the reference numerals:

[0052] 101. Monitoring module; 102. Backup data acquisition module; 103. Tamper-proof storage system; 900. Computer equipment; 901. Processor; 902. Memory; 1000. Computer system; 1001. CPU; 1002. ROM; 1003. RAM; 1004. Bus; 1005. I / O interface; 1006. Input part; 1007. Output part; 1008. Storage part; 1009. Communication part; 1010. Drive; 1011. Removable media. DETAILED DESCRIPTION

[0053] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of this application will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art.

[0054] The terms "first," "second," "third," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, a feature specified as "first," "second," "third," etc. may explicitly or implicitly include one or more features.

[0055] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner.In the following description, many specific details are provided so as to provide a full understanding of the embodiments of the present application. However, it will be appreciated by those skilled in the art that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps etc. can be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0056] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, while others may be combined or partially combined. Therefore, the actual execution order may vary depending on the actual situation.

[0057] In this application, some professional terms are explained as follows:

[0058] Distributed system: A loosely coupled system consisting of multiple processors interconnected by communication lines. It has the following four characteristics: distribution, autonomy, parallelism, and globality.

[0059] Distributed system node: Each sub-node that makes up a distributed system contains its own processor and memory, and each has the ability to independently process data.

[0060] Ransomware: A computer virus that primarily spreads via email, Trojan programs, and webpages. This virus is highly harmful and can cause immeasurable losses to users once infected. These viruses encrypt files using various encryption algorithms, making them generally impossible to decrypt unless the victim obtains the private key.

[0061] Apriori algorithm: an association rule mining algorithm used to mine the correlation between process behavior features.

[0062] Support: The ratio of the number of transactions that contain both X and Y to the total number of transactions in the transaction set, reflecting the frequency with which X and Y appear simultaneously in the transaction set.

[0063] Confidence: The ratio of the number of transactions containing both X and Y to the number of transactions containing X, reflecting the probability of Y appearing in transactions containing X.

[0064] Frequent item set: refers to a set of feature items whose probability of appearing together is greater than the specified minimum support.

[0065] Virus signature: It is a characteristic binary content that can be used to identify viruses. Generally, the detected target is compared with the signature to determine whether the detected target is a virus.

[0066] Three-color marking: For processes running on system nodes, a sample data set is formed based on virus signature matching and behavioral feature matching. The sample data set is then classified using knowledge of probability statistics. The risk level of the process is then graded and classified into three colors, with corresponding corresponding handling methods.

[0067] Snapshot mechanism: A technology that records the data status at a certain point in time. Its characteristic is that it does not change with subsequent data changes, but maintains the data status at the time of creation and can be used to restore data.

[0068] Existing computer virus detection solutions have the problems of easily missing detections and failing to provide early warnings for potential subsequent risky behaviors. The reasons are that the implementation rules of computer viruses are changeable, especially for ransomware, and the detection rules are easily invalidated; in addition, virus detection is only based on the behavior of the process that has already occurred, without considering the subsequent behavior of the process.

[0069] To this end, the present application provides a new computer virus detection method, computer device and computer-readable storage medium to achieve risk assessment of the dynamic real-time behavior of the target process to be detected, thereby improving the reliability of computer virus detection results; at the same time, it can provide early warning of possible risks before dangerous behavior occurs, facilitate further disposal in advance, and improve the security of the computer system.

[0070] Figure 1 Schematic diagram showing an exemplary system architecture to which the technical solution of the embodiment of the present application can be applied. Figure 1 As shown, the system architecture may include a monitoring module 101, a backup data collection module 102, and a tamper-proof storage system 103. The monitoring module 101 resides on a distributed system node and is configured to execute all or part of the steps of the computer detection method described herein. The backup data collection module 102 connects to the distributed nodes of the distributed system and is used to obtain the protected data on the distributed nodes in real time. The backup data collection module 102 includes a change recognition thread and a data pull thread. The change recognition thread is used to identify changes in protected data in real time and send change notifications to the data pull thread. Upon receiving the change notifications, the data pull thread is used to pull the changed data from the distributed system nodes and write it to the tamper-proof storage system 103. The backup data collection module 102 may send data to the tamper-proof storage system 103 via a scheduled transmission method, for example, sending data to the tamper-proof storage system 103 every minute, or may send data to the tamper-proof storage system 103 via a fixed transmission method, for example, sending data to the tamper-proof storage system 103 when the content changes reach 100MB. The tamper-proof storage system 103 is a distributed storage system that supports tamper-proof functions. It is deployed in an independent network area and only opens the corresponding port of the data receiving interface to the backup data acquisition module 102 for data synchronization. When the data receiving interface receives data, it is forwarded to the data landing interface, and the data landing interface lands the data to the disk through the snapshot mechanism.

[0071] The following is a detailed description of the implementation details of the technical solution of the embodiment of the present application:

[0072] Figure 2 A flowchart of a computer virus detection method according to an embodiment of the present application is shown. Figure 2 As shown, the computer virus detection method can be executed by a monitoring module, which can be Figure 1 The monitoring module 101 shown in FIG. The computer virus detection method includes at least a virus feature acquisition step, a feature matching step, a frequent item set construction step, a strong association rule determination step, and a subsequent behavior risk prediction step, which correspond to the following steps S201 to S204 and steps S205 to S206, respectively, and are described in detail as follows:

[0073] In step S201, a virus signature database is obtained, wherein the virus signature database includes virus signature codes and virus behavior characteristics.

[0074] In some embodiments, virus behavior characteristics include privilege escalation (DD1), modification of domain settings (DD2), vulnerability scanning (DD3), port scanning (DD4), network sniffing (DD5), system information collection (SD1), large-scale reading of data and external transmission (SD2), deletion of protected data (ND1), modification of protected data (ND2), and addition of protected data (ND3).

[0075] Among them, privilege escalation (DD1) refers to increasing the permissions of a process through commands, such as chmod; modifying domain settings (DD2) refers to modifying the domain to which a process belongs through commands; vulnerability scanning (DD3) refers to scanning for system vulnerabilities through tools and commands; port scanning (DD4) refers to scanning open system ports through commands; network sniffing (DD5) refers to sniffing other open machine IPs in the network through commands; system information collection (SD1) refers to collecting system information such as CPU model, memory information, operating system information, other software information, etc.; reading large amounts of data and transmitting it externally (SD2) includes reading the collected information and transmitting it to the outside through the network; deleting protected data (ND1) refers to attempting to delete protected data, including but not limited to databases, files, etc.; modifying protected data (ND2) refers to attempting to modify protected data, including but not limited to databases, files, etc.; adding protected data (ND3) refers to attempting to add new protected data content, including but not limited to databases, files, etc.

[0076] It is understandable that the virus behavior characteristics including the ten behavior characteristics listed above is only an exemplary embodiment of the present application. In other embodiments, the virus behavior characteristics may further include other behavior characteristics, or only include some of the ten behavior characteristics listed above.

[0077] In step S202, the target process to be detected is matched with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process.

[0078] The target process includes one or more process behaviors.

[0079] Figure 3 Shown Figure 2 The detailed flow chart of step S202 in the embodiment is as follows: Figure 3 As shown, in an exemplary embodiment, step S202 includes the following steps S301 to S304, which are described in detail as follows:

[0080] In step S301, the target process to be detected is matched with the virus signature. If the target process matches the virus signature successfully, the process proceeds to step S302; if the target process does not match the virus signature successfully, the process proceeds to step S303.

[0081] Specifically, in step S301 , a disassembly operation is performed on the binary file of the newly started process, ie, the target process, to identify the code structure and library functions of the target process and match them with the virus signature.

[0082] In step S302, it is determined that the target process is a dangerous process.

[0083] In step S303, the probability values ​​of the process behaviors included in the target process corresponding to the various security levels are calculated. Then, the process proceeds to step S304.

[0084] In step S304, the security level with the largest probability value is determined as the security level corresponding to the process behavior.

[0085] exist Figure 3 In the illustrated embodiment, if the target process fails to match the virus signature, the probability values ​​of the process behaviors contained in the target process corresponding to various security levels are further calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior. The security level judgment result of the process behavior is highly reliable.

[0086] Figure 4 Shown Figure 2 Detailed flow chart of another embodiment of step S202, as shown in FIG. Figure 4 As shown, in an exemplary embodiment, step S202 includes the following steps S401 to S409, which are described in detail as follows:

[0087] In step S401, the target process to be detected is matched with the virus signature. If the target process matches the virus signature successfully, the process proceeds to step S402; if the target process does not match the virus signature successfully, the process proceeds to step S403.

[0088] In step S402, the target process is determined to be a dangerous process, all process behaviors of the target process are blocked and an alarm signal is issued.

[0089] In step S403, it is determined that the target process is a process of interest, and then the process proceeds to step S404.

[0090] In step S404, the probability values ​​of the process behaviors included in the target process corresponding to the various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior. Then, the process proceeds to step S405.

[0091] In step S405, it is determined whether the target process contains a process behavior with a security level of dangerous behavior. If so, the process proceeds to step S406; otherwise, the process proceeds to step S407.

[0092] In step S406, the target process is changed from a concern process to a dangerous process.

[0093] In step S407, it is determined whether the security levels of all process behaviors included in the target process are safe behaviors. If so, the process proceeds to step S408; otherwise, the process proceeds to step S409.

[0094] In step S408, the target process is changed from a concern process to a safe process, and all process behaviors included in the target process are allowed.

[0095] In step S409, the target process is kept as a focused process, and process behaviors with a security level of safe behaviors in the target process are allowed.

[0096] exist Figure 4 In the illustrated embodiment, if the target process fails to match the virus signature, the security level of the target process is further determined based on the security level of the process behavior. The process security level judgment result is highly reliable; moreover, it can accurately determine whether the process behavior of the target process is allowed, which provides better security.

[0097] In some embodiments, a three-color marking method is used to mark the security level of the target process. Figure 4 In the steps shown, determining the target process as a dangerous process is specifically: marking the target process as a black process; determining the target process as a concern process is specifically: marking the target process as a gray process; changing the target process from a concern process to a safe process is specifically: changing the target process from a gray process to a white process.

[0098] Specifically, if the target process successfully matches the virus signature, the target process is marked as a black process. If the target process does not successfully match the virus signature, the target process's security level may be gray or white. In the initialization phase, the target process is first marked as a gray process. Then, based on the security level of the target process's process behavior, the target process's security level is determined. The target process's mark is then changed to a white process, or the target process remains gray.

[0099] In detail, for the target process marked as a gray process in the initialization phase, if it is determined that the security levels corresponding to all process behaviors contained in the target process are safe behaviors, the target process mark is changed to a white process; if it is determined that the security levels corresponding to some process behaviors contained in the target process are concern behaviors, the target process remains a gray process.

[0100] In some embodiments, a three-color marking method is used to mark the security level of the process behavior of the target process, wherein dangerous behaviors are marked as black behaviors, concerning behaviors are marked as gray behaviors, and safe behaviors are marked as white behaviors.

[0101] In an exemplary embodiment, Figure 5 As shown, step S202 includes the following steps S501 to S509, which are described in detail as follows:

[0102] In step S501, the target process to be detected is matched with the virus signature. If the target process matches the virus signature successfully, the process proceeds to step S502; if the target process does not match the virus signature successfully, the process proceeds to step S503.

[0103] In step S502, the target process is marked as a black process, all process behaviors of the target process are blocked and an alarm signal is issued.

[0104] In step S503, the target process is marked as a gray process. Then, the process proceeds to step S504.

[0105] In step S504, the probability values ​​of the process behaviors included in the target process corresponding to the various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior. Then, the process proceeds to step S505.

[0106] In step S505, it is determined whether the target process contains black behavior. If so, the process proceeds to step S506; otherwise, the process proceeds to step S507.

[0107] In step S506 , the target process is changed from a gray process to a black process.

[0108] In step S507 , it is determined whether all process behaviors included in the target process are white behaviors. If so, the process proceeds to step S508 ; otherwise, the process proceeds to step S509 .

[0109] In step S508 , the target process is changed from a gray process to a white process, and all process behaviors included in the target process are allowed.

[0110] In step S509 , the target process is kept as a gray process, and white behaviors in the target process are allowed.

[0111] For example, the initialization mapping relationship table between the process security level mark and the virus signature matching result and the virus behavior feature matching result is shown in Table 1 below:

[0112] Table 1

[0113]

[0114] In Table 1, 1 indicates a successful match, and 0 indicates an unsuccessful match.

[0115] The following describes the process of determining the security level of a process behavior of the present application by taking a specific embodiment as an example.

[0116] Process B initiates a behavior request. It is determined that process B fails to match the virus signature, and matches suspected behaviors: "collecting system information SD1" and "modifying domain settings DD2". Then, a calculation is performed to determine the security level of the suspected behavior.

[0117] The relevant process behavior matching is shown in Table 2 below:

[0118] Table 2

[0119]

[0120] In Table 2, 1 indicates a successful match, and 0 indicates an unsuccessful match.

[0121] First, based on Table 2 above, calculate the probability values ​​of the security levels of the process behavior being black, gray, and white respectively when the process behavior matches SD1 and DD2.

[0122] Specifically, the probability value of the security level of the process behavior being black is calculated based on the relational expression 1:

[0123]

[0124] Where P(Y=black|X={SD1,DD2}) represents the probability of the security level being black, P(black) represents the prior probability of the process behavior being black, P(SD1|black) represents the probability of SD1 occurring under the condition that the process behavior is black, P(DD2|black) represents the probability of DD2 occurring under the condition that the process behavior is black, P(SD1) represents the prior probability of SD1, P(DD2) represents the prior probability of DD2, α represents the smoothing coefficient, and z represents the number of features. In this embodiment, α is 1 and z is 5.

[0125] Substituting P(black), P(SD1|black), P(DD2|black), P(SD1), P(DD2), α, and z into equation 1, we can get

[0126] The probability value of the process behavior security level being gray is calculated based on equation 2:

[0127]

[0128] Where P(Y=gray|X={SD1, DD2}) represents the probability of the security level being gray, P(gray) represents the prior probability of the process behavior being gray, P(SD1|gray) represents the probability of SD1 occurring under the condition that the process behavior is gray, P(DD2|gray) represents the probability of DD2 occurring under the condition that the process behavior is gray, P(SD1) represents the prior probability of SD1, P(DD2) represents the prior probability of DD2, α represents the smoothing coefficient, and z represents the number of features. In this embodiment, α is 1 and z is 5.

[0129] Substituting P(gray), P(SD1|gray), P(DD2|gray), P(SD1), P(DD2), α, and z into equation 2, we can get

[0130] The probability value of the security level of the process behavior being white is calculated based on equation 3:

[0131]

[0132] Where P(Y=white|X={SD1,DD2}) represents the probability of the security level being white, P(white) represents the prior probability of the process behavior being white, P(SD1|white) represents the probability of SD1 occurring under the condition that the process behavior is white, P(DD2|white) represents the probability of DD2 occurring under the condition that the process behavior is white, P(SD1) represents the prior probability of SD1, P(DD2) represents the prior probability of DD2, α represents the smoothing coefficient, and z represents the number of features. In this embodiment, α is 1 and z is 5.

[0133] Substituting P(white), P(SD1|white), P(DD2|white), P(SD1), P(DD2), α, and z into equation 3, we can obtain

[0134] According to the above calculation results, P(Y=gray|X={SD1, DD2}) is the largest, and the security level of the process behavior is determined to be gray behavior.

[0135] In the process of calculating the probability value of the security level of the process behavior, a calculated probability value may be 0, which is obviously illogical. Therefore, in the above embodiment, a smoothing coefficient is set to avoid this situation.

[0136] In step S203, a feature frequent item set of the process behavior feature is constructed based on the virus behavior feature matched by the process behavior contained in the target process.

[0137] Figure 6 Shown Figure 2 The detailed flow chart of step S203 in the embodiment is as follows: Figure 6 As shown, in an exemplary embodiment, step S203 includes the following steps S601 to S604, which are described in detail as follows:

[0138] In step S601, a process behavior list of a target process in a process list that matches a virus behavior feature is traversed to obtain a first candidate item set.

[0139] The first candidate item set includes process behaviors and their corresponding support levels. The process list includes multiple target processes.

[0140] In step S602, items whose support is below the support threshold are removed from the first candidate item set to obtain a second candidate item set. Then, the process proceeds to step S603.

[0141] In step S603, the second candidate item set is traversed, and the process behaviors included in the second candidate item set are combined in pairs. Based on the process behavior list of the target process in the process list that matches the virus behavior characteristics, the combined support corresponding to the process behavior combinations after the two combinations are obtained. This obtains a third candidate item set containing the process behavior combinations after the two combinations and the combined support. Then, the process proceeds to step S604.

[0142] In step S604, iterative execution is performed to obtain a candidate item set Lk containing k-1 process behavior combinations and combination support based on the process behaviors contained in the candidate item set Lk-1 and the process behavior list of the target process in the process list that matches the virus behavior characteristics, until the candidate item set Lk is an empty set.

[0143] Wherein, k represents the sequence number of the candidate item set, and k is an integer greater than or equal to 4.

[0144] Among them, the process behavior included in the candidate set can be represented by the behavioral characteristics that match the process behavior and the virus behavior characteristics, and the support corresponding to the process behavior can be represented by the support corresponding to the behavioral characteristics of the process behavior, as shown in Tables 3 to 7 below.

[0145] In this way, all feature frequent item sets are obtained, so that subsequent steps can be further performed to predict the security level of the subsequent behavior of the target process.

[0146] In some embodiments, step S604 includes: traversing the candidate item set Lk-1, storing a pointer to the next process behavior for each process behavior contained in the candidate item set Lk-1; combining every k-1 process behaviors contained in the process behaviors contained in the candidate item set Lk-1, and obtaining the combined support corresponding to the process behavior combination after the k-1 process behaviors are combined based on the process behavior list that matches the virus behavior characteristics contained in the target process in the process list, and obtaining the candidate item set Lk containing the process behavior combination and the combined support after the k-1 process behaviors are combined.

[0147] Here, the next process behavior is the k-2 process behaviors in the process behavior combination included in the candidate item set Lk-1. Exemplarily, the candidate item set Lk-1 is the third candidate item set, and the k-2 process behaviors are two process behaviors. In other words, the next process behavior is the other two process behaviors in the process behavior combination included in the third candidate item set, excluding the current process behavior. Exemplarily, the candidate item set Lk-1 is the fourth candidate item set, and the k-2 process behaviors are three process behaviors. In other words, the next process behavior is the other three process behaviors in the process behavior combination included in the fourth candidate item set, excluding the current process behavior.

[0148] For each process behavior included in the candidate item set Lk-1, a pointer to the next process behavior is stored. The required candidate item set Lk can be obtained by simply traversing each process behavior included in the candidate item set Lk-1 by k elements, with low computational complexity.

[0149] In step S204, feature association rules are generated for the feature frequent item sets, and feature association rules with confidence levels exceeding a preset threshold are determined as strong association rules.

[0150] Figure 7 Shown Figure 2 The detailed flow chart of step S204 in the embodiment is as follows: Figure 7 As shown, in an exemplary embodiment, step S204 includes the following steps S701 to S704, which are described in detail as follows:

[0151] In step S701, an association rule mining algorithm is used to mine the process behavior features in the feature frequent item set to obtain multiple feature association rules. Then, the process proceeds to step S702.

[0152] In step S702, the confidence of each feature association rule is calculated based on the relationship Confidence(A->B)=support(A&B) / support(A). Then, the process proceeds to step S703.

[0153] Wherein, A and B represent process behavior characteristics or a combination of at least two process behavior characteristics occurring simultaneously.

[0154] In step S703, it is determined whether the confidence of each feature association rule reaches or exceeds a preset threshold. If the confidence of a feature association rule reaches or exceeds the preset threshold, the process proceeds to step S704.

[0155] In step S704, the feature association rule is determined to be a strong association rule.

[0156] exist Figure 7 In the illustrated embodiment, feature association rules with confidence levels exceeding a preset threshold are determined as strong association rules, which can improve the accuracy of predictions of subsequent behaviors of a process, thereby further predicting the security level of subsequent behaviors of the target process.

[0157] In step S205 , it is determined whether the process behavior executed in the target process matches the prerequisite in the strong association rule. If so, the process proceeds to step S206 .

[0158] In step S206 , the security level of the subsequent behavior of the target process is predicted.

[0159] The strong association rule includes the process behavior characteristics corresponding to the subsequent behavior. That is, the process behavior characteristics corresponding to the subsequent behavior are the association results in the strong association rule.

[0160] Figure 8 Shown Figure 2 The detailed flow chart of step S206 in the embodiment is as follows: Figure 8 As shown, in an exemplary embodiment, step S206 includes the following steps S801 to S802, which are described in detail as follows:

[0161] In step S801, the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors are calculated. Then, the process proceeds to step S802.

[0162] In some embodiments, in step S801, based on the relation Calculate the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, attention behaviors, and safe behaviors respectively.

[0163] Where P(Y = security level | X = {behavior}) represents the probability that the target process's subsequent behavior will be at a certain security level, P(security level) represents the prior probability that the process's behavior will be at a certain security level, P(behavior | security level) represents the probability that a certain process behavior will occur given that the process's behavior is at a certain security level, P(behavior) represents the prior probability of a certain process behavior, α represents the smoothing coefficient, and z represents the number of features. For example, α is set to 1.

[0164] In step S802, the security level with the maximum probability value is used as the security level of subsequent behavior of the target process.

[0165] The safety level is one of dangerous behavior, concerning behavior, and safe behavior. As described in the above embodiment, dangerous behavior can be marked as black behavior, concerning behavior can be marked as gray behavior, and safe behavior can be marked as white behavior.

[0166] Figure 8 In the embodiment shown, the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors are first calculated, and the security level with the largest probability value is used as the security level of the subsequent behaviors of the target process. The security level judgment result of the subsequent behaviors is highly reliable.

[0167] Furthermore, in some embodiments, when the subsequent behavior of the target process is predicted to be dangerous behavior, an alarm signal is issued to facilitate further processing in advance, thereby improving the security of the computer system.

[0168] Below, taking a specific embodiment as an example, the frequent item set construction step, the strong association rule determination step, and the subsequent behavior risk prediction step are described.

[0169] For example, the target process in the process list includes a process behavior list that matches the virus behavior characteristics, as shown in Table 3 below:

[0170] Table 3

[0171]

[0172]

[0173] In the frequent item set construction step, first, the process behavior list of the target process in the process list that matches the virus behavior characteristics is traversed to obtain the first candidate item set L1, as shown in Table 4 below:

[0174] Table 4

[0175] Behavior Name Support DD1 1 DD2 5 SD1 6 SD2 3 ND1 7 ND2 2

[0176] Among them, the support in Table 4 represents the number of times the process behavior appears in the process list.

[0177] Then, the support threshold is set to 4. Based on the support threshold, the second candidate item set L2 is generated from the first candidate item set L1. Among them, the process behaviors with support less than 4 in the first candidate item set L1 will be pruned. The obtained second candidate item set L2 is shown in Table 5 below:

[0178] Table 5

[0179] Behavior Name Support DD2 5 SD1 6 ND1 7

[0180] Next, based on the second candidate item set L2, a third candidate item set L3 is generated. Specifically, the second candidate item set L2 is traversed, storing the corresponding process behaviors and the associated process behaviors they point to. Since all ongoing behaviors are unrelated, the second candidate item set L2 is composed of the set of pairwise combinations of items and the corresponding combined support. The resulting third candidate item set L3 is shown in Table 6 below:

[0181] Table 6

[0182]

[0183]

[0184] Next, based on the third candidate item set L3, a fourth candidate item set L4 is generated. Specifically, the third candidate item set L3 is traversed, and the corresponding process behaviors and the related process behaviors they point to are stored as follows: (DD2, pointer SD1, pointer ND1), (SD1, pointer DD2, pointer ND1), (ND1, pointer DD2, pointer SD1); a circular linked list is formed. Once constructed, a three-element traversal of each element is performed to obtain the required L4. The resulting fourth candidate item set L4 is shown in Table 7 below:

[0185] Table 7

[0186] Behavior Name Support DD2,SD1,ND1 4

[0187] Repeat the above steps and iterate to generate the candidate item set Lk based on the candidate item set Lk-1; traverse the candidate item set LK-1, and for each element p in it, store the pointer to the next hop to form a circular linked list; you only need to traverse each element k elements to get the required Lk.

[0188] This process is deduced in this way until the candidate item set Lk = empty set. At this point, all candidate item sets are obtained, that is, all feature frequent item sets are obtained.

[0189] In the strong association rule determination step, the association rule mining algorithm (Apriori algorithm) is first used to perform association evaluation on the process behavior features in each feature frequent item set, generate feature association rules, and calculate the confidence of each feature association rule.

[0190] Among them, the confidence calculation formula of the feature association rule is:

[0191] Confidence(A->B)=P(A|B)=support(A&B) / support(A).

[0192] Wherein, A and B represent process behavior characteristics or a combination of at least two process behavior characteristics occurring simultaneously.

[0193] For example, for the feature frequent item set {DD2, SD1, ND1}, the generated feature association rules and the corresponding confidences of the feature association rules are as follows:

[0194] (DD2&SD1)->ND1 confidence=4 / 4=100%;

[0195] (DD2&ND1)->SD1 confidence=4 / 5=80%;

[0196] (SD1&ND1)->DD2 confidence=4 / 6=66.67%;

[0197] DD2->(SD1&ND1)confidence=4 / 5=80%;

[0198] SD1->(DD2&ND1)confidence=4 / 6=66.67%;

[0199] ND1->(DD2&SD1)confidence=4 / 7=57.14%.

[0200] Then, the confidence threshold (min_confidence) is set to 70%, and the confidence greater than 70% is a strong association rule; all association rules with confidence greater than the confidence threshold are recorded in the database, and the strong association rules are obtained as follows:

[0201] (DD2&SD1)->ND1 confidence=4 / 4=100%>min_confidence;

[0202] (DD2&ND1)->SD1 confidence=4 / 5=80%>min_confidence;

[0203] DD2->(SD1&ND1)confidence=4 / 5=80%>min_confidence.

[0204] In the subsequent behavior risk prediction step, according to the strong association rules listed in the strong association rule determination step, it can be seen that the probability of ND1 occurring is 100%.

[0205] According to the strong association rule (DD2 & SD1) -> ND1, given the occurrence of DD2 and SD1, the confidence probability of ND1 is 100% (greater than the confidence threshold of 70%). Therefore, the safety level of ND1 is calculated based on the following relationship and in combination with Table 2.

[0206]

[0207] According to the above calculation results, P(Y=black|X={ND1}) is the largest, and it is predicted that the occurrence of ND1 behavior will cause the process behavior to turn black and issue an alarm signal.

[0208] It should be noted that, in the above exemplary embodiments, only the feature frequent item set {DD2, SD1, ND1} and the strong association rule: (DD2&SD1)->ND1 are used as examples for illustration. It can be understood that when implementing the method of the present application, for other feature frequent item sets containing process behavior feature combinations (for example, the third candidate item set L3), it is also necessary to perform association evaluation and further obtain strong association rules, which are not listed one by one here.

[0209] In summary, in addition to matching the target process to be detected with the virus signature code, the present application also matches the target process to be detected with the virus behavior characteristics, thereby realizing risk assessment of the dynamic real-time behavior of the target process, and making the computer virus detection results more reliable; moreover, a feature frequent item set of the process behavior characteristics is constructed, and feature association rules are generated for the feature frequent item set, and the feature association rules with a confidence level above a preset threshold are determined as strong association rules. When the executed process behavior in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is further predicted, thereby realizing early warning of possible risks before dangerous behavior occurs, facilitating further disposal in advance, and improving the security of the computer system.

[0210] In addition, the protected data is backed up in real time, and an incremental snapshot mechanism is used to enforce tamper prevention. Even if the computer system is invaded by a ransomware virus, the system data recovery requirements can be met.

[0211] See next Figure 9This embodiment provides a computer device 900, which includes one or more processors 901 and a memory 902. The memory 902 is used to store one or more programs. When the one or more programs are executed by the one or more processors 901, the computer device 900 implements the computer virus detection method of the present application.

[0212] Figure 10 A block diagram of a computer system structure for implementing some embodiments of the present application is shown. It should be noted that: Figure 10 The computer system shown is only an example and should not limit the functions and scope of use of the embodiments of the present application.

[0213] like Figure 10 As shown, the computer system 1000 includes a CPU (Central Processing Unit) 1001, which can perform various appropriate actions and processes according to the program stored in the ROM (Read-Only Memory) 1002 or the program loaded from the storage part 1008 into the RAM (Random Access Memory) 1003, such as executing the computer virus detection method in the above embodiment. Various programs and data required for system operation are also stored in the RAM 1003. The CPU 1001, ROM 1002 and RAM 1003 are connected to each other via a bus 1004. An I / O (Input / Output) interface 1005 is also connected to the bus 1004.

[0214] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, and the like; an output section 1007 including devices such as a CRT (Cathode Ray Tube), an LCD (Liquid Crystal Display), and a speaker; a storage section 1008 including a hard disk; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card or a modem. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. Removable media 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, or a semiconductor memory, is installed in the drive 1010 as needed, so that computer programs read from the removable media can be installed in the storage section 1008 as needed.

[0215] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing all or part of the steps shown in the flowchart in the computer virus detection method. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the central processing unit (CPU) 1001, the various functions defined in the system of the present application are executed.

[0216] It should be noted that the computer-readable medium shown in the embodiments of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable computer program. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. A computer program embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0217] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. Among them, each box in the flowchart or block diagram can represent a module, program segment, or part of the code, and the above-mentioned module, program segment, or part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0218] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. In some cases, the names of these units do not constitute limitations on the units themselves.

[0219] As another aspect, the present application further provides a computer-readable medium, which may be included in the computer device described in the above embodiments, or may exist independently and not be incorporated into the computer device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the computer device, the computer device implements the method described in the above embodiments.

[0220] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiment of the application, the features and functions of two or more modules or units described above can be concretized in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0221] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the embodiments of the present application.

[0222] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered merely as exemplary, and the true scope and spirit of the present application are indicated by the appended claims.

Claims

1. A computer virus detection method, characterized in that: include: Matching a target process to be detected with a virus signature and virus behavior signature to determine a security level of the target process and / or the process behavior of the target process, wherein the target process includes one or more of the process behaviors; Constructing a feature frequent item set of process behavior features based on the virus behavior features matched by the process behaviors contained in the target process, including: traversing the process behavior list of the target process in the process list that matches the virus behavior features, obtaining a first candidate item set, wherein the first candidate item set contains the process behaviors and the support corresponding to the process behaviors, and the process list contains multiple target processes; eliminating the items in the first candidate item set whose support is below the support threshold, obtaining a second candidate item set; traversing the second candidate item set, combining the process behaviors contained in the second candidate item set in pairs, and based on the process list The process behavior list of the target process in the process list that matches the virus behavior characteristics obtains the combination support corresponding to the process behavior combination after pairwise combination, and obtains a third candidate item set containing the process behavior combination after pairwise combination and the combination support; iterative execution, according to the process behavior contained in the candidate item set Lk-1 and the process behavior list of the target process in the process list that matches the virus behavior characteristics, obtains the candidate item set Lk containing the process behavior combination after k-1 process behavior combinations and the combination support, until the candidate item set Lk is an empty set, wherein k represents the sequence number of the candidate item set, and k is an integer greater than or equal to 4; Generating feature association rules for the feature frequent item sets, and determining the feature association rules whose confidence reaches a preset threshold or above as strong association rules, including: using an association rule mining algorithm to perform association rule mining on process behavior features in the feature frequent item sets to obtain multiple feature association rules, and determining the feature association rules whose confidence reaches a preset threshold or above as strong association rules; When the process behavior executed in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is predicted, wherein the strong association rule includes the process behavior characteristics corresponding to the subsequent behavior, and the security level of the subsequent behavior of the target process is predicted, including: based on the relationship Calculate the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors, respectively, where P(Y=security level|X={behavior}) represents the probability value of the subsequent behavior of the target process being a certain security level, P(security level) represents the prior probability of the process behavior being a certain security level, P(behavior|security level) represents the probability of a certain process behavior occurring under the condition that the process behavior is a certain security level, P(behavior) represents the prior probability of a certain process behavior, α represents the smoothing coefficient, and z represents the number of features; the security level with the largest probability value is taken as the security level of the subsequent behavior of the target process.

2. The method according to claim 1, characterized in that The step of matching the target process to be detected with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process includes: Match the target process to be detected with the virus signature; If the target process successfully matches the virus signature, the target process is determined to be a dangerous process; If the target process fails to match the virus signature, the probability values ​​of the process behaviors included in the target process corresponding to various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior.

3. The method according to claim 2, characterized in that After matching the target process to be detected with the virus signature, the method further includes: When the target process is determined to be a dangerous process, all process behaviors included in the target process are blocked and an alarm signal is issued; If the target process fails to match the virus signature, the target process is determined to be a process of concern; if the security level corresponding to any process behavior contained in the target process is determined to be a dangerous behavior, the target process is changed from a process of concern to a dangerous process; if the security level corresponding to all process behaviors contained in the target process is determined to be a safe behavior, the target process is changed from a process of concern to a safe process, and all process behaviors contained in the target process are allowed; if the security level corresponding to some process behaviors contained in the target process is determined to be a behavior of concern, the target process is maintained as a process of concern, and process behaviors with a security level of safe behavior in the target process are allowed.

4. The method according to claim 3, characterized in that Determining that the target process is a dangerous process includes: marking the target process as a black process; The determining that the target process is a process of interest includes: marking the target process as a gray process; Changing the target process from a concerned process to a safe process includes: changing the target process from a gray process to a white process; The dangerous behavior is black behavior, the concerning behavior is gray behavior, and the safe behavior is white behavior.

5. The method according to claim 1, wherein The process behavior list including k-1 process behavior combinations and combination support is obtained based on the process behaviors included in the candidate item set Lk-1 and the process behaviors included in the target process in the process list, which match the virus behavior characteristics, including: Traversing the candidate item set Lk-1, for each process behavior included in the candidate item set Lk-1, storing a pointer to the next process behavior, wherein the next process behavior is k-2 process behaviors in the combination of process behaviors included in the candidate item set Lk-1; Combine every k-1 process behaviors contained in the candidate item set Lk-1, and obtain the combined support corresponding to the process behavior combination after the k-1 process behaviors are combined based on the process behavior list of the target process in the process list that matches the virus behavior characteristics, and obtain the candidate item set Lk containing the process behavior combination and the combined support after the k-1 process behavior combinations.

6. The method according to any one of claims 1 to 4, characterized in that The generating of feature association rules for the feature frequent item sets and determining the feature association rules whose confidence exceeds a preset threshold as strong association rules further includes: Calculate the confidence of each feature association rule based on the relationship: Confidence(A->B)=support(A&B) / support(A), where A and B represent the process behavior feature or a combination of at least two process behavior features occurring simultaneously. The confidence level of each feature association rule is compared with a preset threshold, and when the confidence level of the feature association rule reaches or exceeds the preset threshold, the feature association rule is determined to be a strong association rule.

7. The method according to any one of claims 1 to 4, characterized in that The safety level is one of the dangerous behavior, the concerning behavior, and the safe behavior. The safety level of the subsequent behavior of the target process is predicted, and further includes: When the subsequent behavior of the target process is predicted to be a dangerous behavior, an alarm signal is issued.

8. A computer device, characterized in that: include: one or more processors; A memory for storing one or more computer programs, which, when executed by the one or more processors, enables the processors to implement the method according to any one of claims 1 to 7.

Images