Computer virus intelligent defense method and system based on data mining

Abstract

The invention discloses a computer virus intelligent defense method and system based on data mining, and belongs to the technical field of network security, and the defense method comprises the following specific steps: I, collecting various behavior data in a computer system, extracting corresponding behavior characteristics, carrying out entropy modeling according to each behavior characteristic, and analyzing entropy fluctuation in real time; iI, constructing a heterogeneous threat relation graph according to an analysis result, and reasoning a threat propagation path based on the heterogeneous threat relation graph; according to the method, the whole-process defense capability can be improved, normal behaviors and potential threats can be effectively distinguished, false alarm and missing alarm are reduced, the capability of coping with unknown viruses, variant viruses and zero-day attacks is greatly improved, the viruses are prevented from reversely bypassing defense, a complex threat propagation chain can be accurately recognized, the active trapping and behavior reduction capability is improved, and the method is suitable for popularization and application. The attack chain tracking and threat tracing capability is improved, and the system robustness is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a computer virus intelligent defense method and system based on data mining. BACKGROUND

[0002] In the digital era, information security threats continue to intensify, and malicious programs such as computer viruses, worms, ransomware, and spyware are showing a high degree of concealment, intelligence, and chain development trend. In particular, traditional defense systems face serious challenges in the face of new attack methods such as zero-day vulnerability attacks, advanced persistent threats (APT), and supply chain attacks. Traditional virus defense methods rely on static feature matching, rule library comparison, and known threat intelligence. Although these methods are efficient in known virus detection, they have obvious lag and high false positive rate problems in the face of unknown viruses, obfuscated variants, and AI-based adversarial attacks. In addition, with the development of virus technology, attack methods gradually shift to complex attack chains that span multiple stages, systems, and protocols, and virus propagation behavior tends to be small, hidden, and low-frequency dynamic changes, making it difficult for traditional single-point detection mechanisms to accurately identify and defend. In this context, the combination of data mining and artificial intelligence technology has become a key breakthrough in improving virus defense capabilities. Therefore, it is particularly important to invent a computer virus intelligent defense method and system based on data mining.

[0003] The existing computer virus intelligent defense method and system have low full-process defense capability, cannot distinguish between normal behavior and potential threats, increase false positives and false negatives, have poor ability to deal with unknown viruses, variant viruses, and zero-day attacks, and are prone to virus reverse bypass defense risks, reducing system robustness. Therefore, we propose a computer virus intelligent defense method and system based on data mining. SUMMARY

[0004] The purpose of the present application is to solve the defects in the prior art and to propose a computer virus intelligent defense method and system based on data mining.

[0005] To achieve the above purpose, the present application adopts the following technical solutions: A computer virus intelligent defense method based on data mining, the specific steps of which are as follows: I. Collect various behavior data in the computer system, extract corresponding behavior features, and at the same time, model the entropy value according to each behavior feature and analyze the entropy value fluctuation in real time; II. According to the analysis results, construct a heterogeneous threat relationship graph, and based on the heterogeneous threat relationship graph, infer the threat propagation path; III. For the identified threats, real-time defense interference is performed, and threat interference strategies are updated in a distributed manner; IV. During the interference process, the gene editing mechanism is simulated to dynamically tamper with viral instructions, forge environmental feedback, and induce the virus to expose its true intentions and complete attack chain; V. Based on the complete attack chain and defense results obtained, conduct learning analysis and optimize the defense interference and defense strategies through attention mechanisms; VI. All data obtained in this round of defense will be sent back to the global defense engine database, and the dynamic virus defense system will be updated accordingly.

[0006] As a further aspect of the present invention, the specific steps for collecting various behavioral data from the computer and extracting corresponding behavioral features in step I are as follows: P1.1: Real-time collection of multi-source data related to virus behavior at various levels of the computer operating system, and extraction of preliminary feature data of various types of data through deduplication, missing value imputation and time synchronization. Then, using the Min-Max normalization method, the feature values ​​of each extracted preliminary feature data are unified to the range of [0, 1]. P1.2: Perform sliding window mean aggregation on the normalized feature data to smooth out noise and highlight trends in each feature data, and then divide the smoothed feature data into sliding time window segments according to the time series. P1.3: Within each sliding time window, the frequency of occurrence of various behaviors is counted to obtain the corresponding behavior frequency. Then, the change in the usage rate of each type of computer resource is calculated. Afterward, PCA principal component analysis is used to perform feature dimensionality reduction on the behavior frequency vector and the resource change rate. Finally, the dimensionality-reduced behavior frequency vector and the resource change rate of each sliding time window are concatenated to form the corresponding dynamic behavior features.

[0007] As a further aspect of the present invention, the multi-source data related to virus behavior mentioned in P1.1 specifically includes: system call sequence data, process resource consumption, file operation logs, network traffic indicators, registry entry change logs, and user behavior records; The specific formula for calculating the frequency of behavior mentioned in P1.3 is as follows: In the formula, Representing the A sliding time window The Middle The standardization frequency of class behaviors; This represents the total number of rows in the window; Representative moment The normalized eigenvectors; Representing the Class predefined behavior types; Represents an indicator function, when the behavior is consistent with... The value is 1 if the values ​​are the same, otherwise it is 0. The use rate change specific calculation formula of P1.3 is as follows: ; In the formula, represent resource The change rate of the first sliding time window; represent the average use value of resource in the first sliding time window; represent the average use value of resource in the first sliding time window; represent the time interval between the current selected sliding time window.

[0008] As a further scheme of the present application, the specific steps of modeling entropy value according to each behavior feature in step I are as follows: S1.1: Calculate the behavior probability distribution of each feature dimension of each extracted dynamic behavior feature in the current time period, and calculate the instantaneous entropy value in the current sliding time window according to the behavior probability distribution of each feature dimension, and calculate the entropy change rate per unit time, and establish a behavior entropy change model according to the behavior probability distribution, the instantaneous entropy value and the entropy change rate; S1.2: For each active process in the computer, calculate the behavior entropy value of each active process in each sliding time window through the behavior entropy change model, and calculate the environmental stress factor of the current computer in real time to obtain the complexity and interference intensity of the current computer environment; S1.3: Dynamically modulate the behavior entropy value of each active process according to the environmental stress factor of the current computer, simulate the entropy increase process in the actual running environment, and obtain the modulated behavior entropy value of each active process; S1.4: Real-time track the entropy increase rate of each process after modulation, if the entropy increase rate exceeds the preset critical transition threshold, it is determined that the current behavior enters the critical entropy transition state, that is, there is abnormal entropy fluctuation, and the risk response is triggered.

[0009] As a further scheme of the present application, the specific form of the behavior entropy change model in S1.1 is as follows: ; In the formula, represent the behavior probability of the first feature dimension in the first sliding time window; represent the absolute value of the feature value of the first j feature dimension in the first sliding time window; represent the total number of feature dimensions; represent the sum of all feature values in the current sliding time window;instantaneous entropy value of the th sliding time window; represents natural logarithm, used to measure the amount of information of the probability; instantaneous entropy value of the th sliding time window; represents the entropy rate of the th sliding time window; instantaneous entropy value of the th sliding time window; S1.2 The specific calculation formula of the behavior entropy value is as follows: ; In the formula, represents the behavior entropy value of the th process in the th sliding time window; represents the behavior probability of the th feature dimension of the th process in the th sliding time window; represents natural logarithm, used to measure the amount of information of the behavior probability; represents the number of feature dimensions currently used for calculation, which can be different from the number of dimensions in the last round of behavior entropy value calculation according to the process feature selection; S1.2 The specific calculation formula of the environmental stress factor is as follows: ; In the formula, represents the environmental stress factor of the th sliding time window; represents the total number of environmental state indicators; represents the weight coefficient of the th environmental indicator; represents the measured value of the th environmental indicator in the th sliding time window; represents the standardization factor of the th environmental indicator; S1.3 The specific calculation formula of the dynamic modulation is as follows: ; In the formula, represents the modulated behavior entropy value of the th process in the th sliding time window; represents the original behavior entropy value of the th process in the th sliding time window; representing a modulation sensitivity coefficient; representing the environmental pressure factor of the th sliding time window; The specific calculation formula of the entropy value change trend in S1.4 is as follows: ; In the formula, representing the entropy increase rate of the th process in the th sliding time window; representing the modulated behavior entropy value of the th process in the th sliding time window; representing the modulated behavior entropy value of the th process in the th sliding time window; representing a time normalization factor.

[0010] As a further scheme of the present application, the specific steps of constructing the heterogeneous threat relationship graph in step II are as follows: S2.1: filter out each active process that is judged as an abnormal entropy fluctuation in the behavior entropy change model, and simultaneously follow and filter out system entities that interact with each active process filtered out more than a preset threshold according to system logs, process relationship chains and kernel events, and take each system entity as a node, wherein the system entity includes a file, a network port, a registry item, a user account and a user session; S2.2: extract file size, port type and registry path level structural features from the inherent attributes of each system entity, and take each extracted structural feature as a static description of the corresponding entity node, and then extract file modification frequency, port access mode, registry item change trend and user behavior periodicity dynamic features from the behavior trajectory of each system entity; S2.3: respectively fuse each structural feature and behavior feature to form a unified comprehensive feature vector, and take the established comprehensive feature vector as the corresponding node attribute, analyze the association relationship between different entities, and calculate the association tightness between each node according to the direct interaction intensity and implicit semantic similarity between each entity; S2.4: traverse all nodes, judge whether the association tightness between each node is 0, if it is 0, it indicates that there is no association between the corresponding two groups of nodes, otherwise, it indicates that there is an association between the corresponding two groups of nodes, and a connection edge is established between the corresponding two groups of nodes, and the association tightness is taken as the edge weight, so as to establish the corresponding heterogeneous threat relationship graph, and then perform structure normalization processing on the nodes and edges in the heterogeneous threat relationship graph.

[0011] As a further scheme of the present application, the specific steps of real-time defense interference in step III are as follows: S3.1: After locking the threat propagation path, the active processes corresponding to each threat propagation path and each type of behavior data are determined in the computer data processing layer, and an initial quantum seed value is randomly generated by a quantum random number generator; S3.2: The generated quantum seed value is combined with the dynamic behavior feature identification code of each type of behavior data, and a dynamic noise vector is generated through an irreversible hash diffusion mechanism, and then the dynamic behavior features corresponding to each type of behavior data are normalized; S3.3: Based on the current risk score and operation sensitivity of the target active process and each type of behavior data, a noise adjustment factor is calculated, and the noise adjustment factor is normalized according to the maximum disturbance capacity of the current computer system, and a disturbance weight matrix is constructed according to the normalized noise adjustment factor; S3.4: After the dynamic noise vector and the disturbance weight matrix are fused according to the element correspondence, the fusion result is superimposed into the normalized dynamic behavior features to form new disturbed dynamic behavior features, and then the new dynamic behavior features are restored to the same numerical scale as the original dynamic behavior features through inverse normalization.

[0012] A computer virus intelligent defense system based on data mining includes a collection modeling module, an identification evaluation module, a threat reasoning module, a disturbance intervention module, a defense synchronization module, a trapping restoration module, an analysis labeling module, a learning evolution module, and an update pushing module; The collection modeling module is used to collect various types of behavior data in real time from each layer of the computer system, and to establish a behavior entropy change model based on the various types of behavior data; The identification evaluation module is used to simulate environmental stress factors and monitor entropy value fluctuations in real time based on the behavior entropy change model to identify abnormal entropy value fluctuations; The threat reasoning module constructs a heterogeneous threat relationship graph based on abnormal entropy value fluctuations, and reasons and identifies threat propagation paths; The disturbance intervention module is used to perform dynamic feature disturbance on the data preprocessing layer after the threat propagation path identification is completed; The defense synchronization module is used to synchronize the noise injection model between different terminals; The trapping restoration module is used to actively trap virus samples in a sandbox environment and dynamically tamper with virus instructions and fake virtual environment feedback to guide the virus to expose the complete attack chain; The analysis labeling module identifies the attack intention, attack method, and attack stage of the virus based on the complete attack chain, and labels the virus attack chain in detail; The learning evolution module is used for deep learning of the attack chain and the defense process, and dynamically adjusts the defense strategy weight; The update pushing module is used for returning the newly extracted data to the global defense engine database, generating the latest defense strategy, and pushing to each defense terminal.

[0013] As a further scheme of the present application, the threat reasoning module reasons and identifies the specific steps of the threat propagation path as follows: S4.1: According to the node type and edge type of the heterogeneous threat relationship graph, a set of all meta-paths meeting the preset rules is established, wherein the meta-path represents the sequence of semantic connection between entities, and then each specific instantiated path meeting the meta-path mode is searched in the heterogeneous threat relationship graph, and each item of information on the path is encoded as path features; S4.2: According to the path features of each specific instantiated path, the risk score of the path as a potential threat propagation path is calculated, the loss value between the current risk score and the target labeled threat propagation path is calculated, and the gradient value of each specific instantiated path is obtained according to the loss value, and then the adjustment direction and amplitude of each specific instantiated path in the current iteration are confirmed according to the obtained gradient information; S4.3: According to each gradient information, the learning rate controlled gradient descent strategy is used to update the corresponding specific instantiated path, and the weight is normalized after each iteration, and the iteration is repeated until the loss value of each specific instantiated path converges to within the preset threshold; S4.4: Based on the risk score and path weight of each specific instantiated path, the risk value of each specific instantiated path is calculated, and the corresponding specific instantiated path with a risk value lower than a preset minimum risk threshold is excluded, and then all high-risk paths are combined to generate the corresponding threat propagation path.

[0014] As a further scheme of the present application, the trap reduction module guides the specific steps of the virus to expose the complete attack chain as follows: S5.1: Disassemble and reverse engineer the virus sample, extract its function call graph and control flow graph static structure features, and preliminarily screen out code segments with potential malicious behavior, and then calculate the static weight of each code segment in the static structure according to the instruction density and feature instruction proportion indicators; S5.2: Run the virus sample in a sandbox environment, and track its behavior trajectory in real time, record the API call, memory change and file operation dynamic behavior features of the virus sample, and take the dynamic behavior features with a frequency higher than a preset threshold as high-frequency behavior hotspots, and calculate the dynamic weight of each high-frequency behavior hotspot segment in the behavior trajectory; S5.3: According to the obtained static weight and dynamic weight, weighted fusion is performed to obtain the total importance of each code segment, and each code segment with a total importance higher than a preset core segment selection threshold is screened out as a core code segment; S5.4: According to the extracted core code segments of the virus sample, a corresponding editing template is generated, a modifiable position is marked, and then in a sandbox environment, based on the editing template, real-time instruction tampering is performed on the core code segments of the virus sample, and control code is injected; S5.5: After the instruction tampering is completed, a simulated computer system response information is simulated, and the tampered virus code segment is guided to enter a specific execution path, and then the tampered instruction and the simulated environment are repeatedly performed until a preset simulation round is reached, and in the iteration process, the exposure behavior of the virus is collected in real time to obtain the complete attack chain and the real intention of each virus sample.

[0015] Compared with the prior art, the beneficial effects of the present application are: The computer virus intelligent defense method based on data mining extracts the dynamic behavior characteristics of the process in the sliding time window, calculates the behavior probability distribution, instantaneous entropy value and entropy change rate, establishes a behavior entropy change model, dynamically modulates the process entropy value combined with the environmental stress factor, simulates the entropy increase process, monitors the abnormal entropy transition in real time, determines the potential risk, then analyzes the system entity with high-frequency interaction based on the abnormal process, extracts the static structure characteristics and dynamic behavior characteristics, fuses them into a unified comprehensive feature vector, calculates the correlation tightness between entities, establishes a heterogeneous threat relationship graph, traces the threat propagation path, generates dynamic noise through a quantum random number generator according to the locked threat propagation path, constructs a disturbance matrix combined with the risk score and the operation sensitivity, applies noise disturbance to the behavior characteristics, resists the virus's adaptive learning, then disassembles the virus sample, fuses the static and dynamic characteristics to extract the core code segment, generates an editing template, dynamically tampers the instruction and simulates the system environment in a sandbox, and induces the virus to expose the complete attack chain and the real intention, which can improve the whole-process defense capability, effectively distinguish normal behavior and potential threats, reduce false positives and false negatives, greatly improve the ability to cope with unknown viruses, variant viruses and zero-day attacks, prevent viruses from bypassing the defense, accurately identify complex threat propagation chains, improve the active trapping and behavior restoration capability, improve the attack chain tracking and threat tracing capability, and improve the system robustness. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation on the present application.

[0017] Figure 1A flow chart of a computer virus intelligent defense method based on data mining is provided in the present application. Figure 2 A system block diagram of a computer virus intelligent defense system based on data mining is provided in the present application. DETAILED DESCRIPTION

[0018] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments.

[0019] Embodiment 1, refer to Figure 1 The present embodiment discloses a computer virus intelligent defense method based on data mining, and the specific steps of the defense method are as follows: Collect various behavior data in the computer system, extract corresponding behavior features, and at the same time, model the entropy value according to each behavior feature and analyze the entropy value fluctuation in real time.

[0020] Specifically, the behavior probability distribution of each dynamic behavior feature in each feature dimension in the current time period is calculated, and the instantaneous entropy value in the current sliding time window is calculated according to the behavior probability distribution of each feature dimension, and the entropy change rate in unit time is calculated, and the behavior entropy change model is established according to the behavior probability distribution, the instantaneous entropy value and the entropy change rate. For each active process in the computer, the behavior entropy value of each active process in each sliding time window is calculated through the behavior entropy change model, and the environmental stress factor of the current computer is calculated in real time to obtain the complexity and interference intensity of the current computer environment. The behavior entropy value of each active process is dynamically modulated according to the environmental stress factor of the current computer, the entropy increase process in the actual running environment is simulated, and the modulated behavior entropy value of each active process is obtained. The entropy increase rate of each process after modulation is tracked in real time. If the entropy increase rate exceeds the preset critical transition threshold, it is determined that the current behavior enters the critical entropy transition state, that is, there is abnormal entropy fluctuation, and the risk response is triggered.

[0021] In addition, it needs to be further explained that the specific form of the behavior entropy change model is as follows: ; in the formula, represents the behavior probability of the jth feature dimension in the kth sliding time window; represents the absolute value of the feature value of the jth feature dimension in the kth sliding time window; represents the total number of feature dimensions; represents the sum of all feature values in the current sliding time window; represents the jth feature dimension;​​​ The instantaneous entropy value of a sliding time window; Represents the natural logarithm, used to measure the amount of probabilistic information; Representing the The rate of entropy change of a sliding time window; Representing the The instantaneous entropy value of a sliding time window; Represents the time span between sliding time windows; The specific formula for calculating behavioral entropy is as follows: ; In the formula, Representing the The process in the 1st The entropy value of behavior within a sliding time window; Representing the The process in the 1st Within the first sliding time window The probability of behavior in each feature dimension; Represents the natural logarithm, used to measure the amount of probabilistic information about behavior; This represents the number of feature dimensions currently used for computation. The number of feature dimensions is selected based on the process characteristics and may differ from the number of dimensions used in the previous round of behavior entropy value calculation. The specific formula for calculating the environmental stress factor is as follows: ; In the formula, Representing the Environmental stress factor within a sliding time window; Represents the total number of environmental status indicators; Representing the Weighting coefficients for each environmental indicator; Representing the Within the first sliding time window Measured values ​​of each environmental indicator; Representing the Standardization factors for each environmental indicator; The specific calculation formula for dynamic modulation is as follows: ; In the formula, Representing the The process in the 1st The modulated behavioral entropy value of a sliding time window; Representing the The process in the 1st The original behavior entropy value within a sliding time window; Represents the modulation sensitivity coefficient; Representing the Environmental stress factor within a sliding time window; The specific formula for calculating the entropy change trend is as follows: ; In the formula, Representing the The process in the 1st The rate of increase of entropy within a sliding time window; Representing the The process in the 1st The modulated behavioral entropy value of a sliding time window; Representing the The process in the 1st The modulated behavioral entropy value of a sliding time window; Represents the time standardization factor.

[0022] In this embodiment, it should be noted that multi-source data related to virus behavior at various levels of the computer operating system are collected in real time. After deduplication, missing value imputation, and time synchronization, preliminary feature data of various types of data are extracted. Then, the Min-Max normalization method is used to unify the feature values ​​of each extracted preliminary feature data to the interval [0, 1]. The normalized feature data is then subjected to sliding window mean aggregation to smooth out noise and prominent trends in each feature data. The smoothed feature data is then segmented into sliding time windows according to the time series. Within each sliding time window, the occurrence frequency of various behaviors is counted to obtain the corresponding behavior frequency. Then, the usage rate change of each type of computer resource is calculated. Then, PCA principal component analysis is used to perform feature dimensionality reduction processing on the behavior frequency vector and the resource change rate respectively. Finally, the dimensionality-reduced behavior frequency vector and the resource change rate of each sliding time window are concatenated to form the corresponding dynamic behavior features.

[0023] In addition, it should be noted that the multi-source data related to virus behavior specifically includes: system call sequence data, process resource consumption, file operation logs, network traffic indicators, registry key change logs, and user behavior records. The specific formula for calculating behavior frequency is as follows: In the formula, Representing the A sliding time window The Middle The standardization frequency of class behaviors; This represents the total number of rows in the window; Representative moment The normalized eigenvectors; Representing the Class predefined behavior types; Represents an indicator function, when the behavior is consistent with... 1 if the same, otherwise 0; The use rate change formula used in P1.3 is as follows: In the formula, represent the resource The change rate of the first sliding time window; represent the average use value of the resource in the first sliding time window; represent the average use value of the resource in the first sliding time window; represent the time interval between the currently selected sliding time windows.

[0024] According to the analysis result, a heterogeneous threat relationship graph is constructed, and based on the heterogeneous threat relationship graph, a threat propagation path is inferred.

[0025] Specifically, each active process determined as an abnormal entropy fluctuation in the behavior entropy change model is screened out, and simultaneously according to system logs, process relationship chains and kernel events, system entities interacting with the screened active processes more than a preset threshold are followed and screened out, and each system entity is taken as a node, wherein the system entity includes a file, a network port, a registry item, a user account and a user session, structural features of file size, port type and registry path level are extracted from inherent properties of each system entity, and each structural feature is taken as a static description of the corresponding entity node, then dynamic features of file modification frequency, port access mode, registry item change trend and user behavior periodicity are extracted from behavior trajectories of each system entity, each structural feature and behavior feature is fused to form a unified comprehensive feature vector, and the established comprehensive feature vector is taken as a corresponding node attribute, an association relationship between different entities is analyzed, an association closeness between nodes is calculated according to direct interaction intensity and implicit semantic similarity between entities, all nodes are traversed, whether the association closeness between nodes is 0 is judged, if 0, it indicates that there is no association between the corresponding two groups of nodes, otherwise, it indicates that there is an association between the corresponding two groups of nodes, a connection edge is established between the corresponding two groups of nodes, and the association closeness is taken as an edge weight, to establish a corresponding heterogeneous threat relationship graph, and then the nodes and edges in the heterogeneous threat relationship graph are subjected to structure normalization processing.

[0026] For the identified threat, real-time defense interference is carried out, and a distributed threat interference strategy is updated.

[0027] ​Specifically, after locking the threat propagation path, the active processes corresponding to each threat propagation path and each type of behavior data are determined in the computer data processing layer. Then, an initial quantum seed value is randomly generated by a quantum random number generator. The generated quantum seed value is combined with the dynamic behavior feature identification code of each type of behavior data, and a dynamic noise vector is generated through an irreversible hash diffusion mechanism. After that, the dynamic behavior features corresponding to each type of behavior data are normalized. Based on the current risk score and operation sensitivity of the target active process and each type of behavior data, a noise adjustment factor is calculated. Meanwhile, according to the maximum disturbance capacity that the current computer system can withstand, the noise adjustment factor is normalized. Based on the normalized noise adjustment factor, a disturbance weight matrix is constructed. After the dynamic noise vector and the disturbance weight matrix are fused according to the element correspondence relationship, the fusion result is superimposed into the normalized dynamic behavior features to form new disturbed dynamic behavior features. Then, the new dynamic behavior features are restored to the same numerical scale as the original dynamic behavior features through inverse normalization.

[0028] During the interference process, the gene editing mechanism is simulated, the virus instructions are dynamically tampered with, the environmental feedback is forged, and the virus is induced to expose the real intention and complete attack chain.

[0029] According to the acquired complete attack chain and defense results, learning analysis is performed, and the defense interference defense strategy is optimized through the attention mechanism.

[0030] The data obtained in this round of defense is returned to the global defense engine database, and the dynamic virus defense system is updated according to the data.

[0031] Embodiment 2, refer to Figure 2 The embodiment discloses a computer virus intelligent defense system based on data mining, which includes a collection modeling module, an identification evaluation module, a threat reasoning module, a disturbance intervention module, a defense synchronization module, a trapping restoration module, an analysis marking module, a learning evolution module, and an update pushing module.

[0032] The collection modeling module is used to collect various behavior data in real time from each layer of the computer system, and to establish a behavior entropy change model according to the various behavior data. The identification evaluation module is used to simulate environmental stress factors and monitor entropy fluctuations in real time based on the behavior entropy change model to identify abnormal entropy fluctuations. The threat reasoning module constructs a heterogeneous threat relationship graph based on abnormal entropy fluctuations, and reasons and identifies threat propagation paths.

[0033] Specifically, according to the node type and edge type of the heterogeneous threat relationship graph, a meta-path set meeting preset rules is established, wherein the meta-path represents a sequence of semantic connection modes between entities, then each specific instantiated path meeting the meta-path mode is searched in the heterogeneous threat relationship graph, and each item of information on the path is encoded as a path feature, the risk score of each specific instantiated path as a potential threat propagation path is calculated according to the path feature of each specific instantiated path, the loss value between the current risk score and the target labeled threat propagation path is calculated, the gradient value of each specific instantiated path is obtained according to the loss value, the adjustment direction and amplitude of each specific instantiated path in the current iteration are confirmed according to the obtained gradient information, each specific instantiated path is updated by using a learning rate controlled gradient descent strategy according to the gradient information, and the weights are normalized after each iteration, and the iteration is repeated until the loss value of each specific instantiated path converges to within a preset threshold, the risk value of each specific instantiated path is calculated based on the risk score and the path weight of each specific instantiated path, and the corresponding specific instantiated path with a risk value lower than a preset minimum risk threshold is screened out, then all high-risk paths are combined to generate the corresponding threat propagation path.

[0034] The perturbation intervention module is used for dynamically perturbing the data preprocessing layer after the threat propagation path is identified; the defense synchronization module is used for synchronously updating the noise injection model between different terminals; and the decoy restoration module is used for actively trapping a virus sample in a sandbox environment, and dynamically tampering with virus instructions and forging virtual environment feedback to guide the virus to expose a complete attack chain.

[0035] Specifically, the virus sample is disassembled and reverse engineered, the function call graph and the static structure features of the control flow graph are extracted, and the code fragments with potential malicious behavior are preliminarily screened out, and then the static weight of each code fragment in the static structure is calculated according to the instruction density and the feature instruction proportion indicators, the virus sample is run in a sandbox environment, and its behavior track is tracked in real time, the dynamic behavior features of the virus sample such as API call, memory change and file operation are recorded, and the dynamic behavior features with a frequency higher than a preset threshold are taken as high-frequency behavior hotspots, and the dynamic weight of each high-frequency behavior hotspot fragment in the behavior track is calculated, the static weight and the dynamic weight are weighted and fused to obtain the total importance of each code fragment, and the code fragments with a total importance higher than a preset core fragment selection threshold are selected as core code fragments, and the corresponding editing template is generated according to the extracted core code fragments of the virus sample, and the editable positions are marked, and then in the sandbox environment, the core code fragments of the virus sample are tampered with in real time based on the editing template, and control code is injected, after the instruction tampering is completed, the response information of the simulated computer system is simulated and forged, and the tampered virus code fragments are guided to enter a specific execution path, and then the tampered instructions and the forged environment are repeatedly performed until a preset simulation round is reached, and in the iteration process, the exposure behavior of the virus is collected in real time to obtain the complete attack chain and the real intention of each virus sample.

[0036] The analysis and labeling module identifies the attack intention, attack method and attack stage of the virus according to the complete attack chain, and labels the virus attack chain in detail; the learning and evolution module is used for deep learning of the attack chain and the defense process, and dynamically adjusts the defense strategy weight; the update and push module is used for returning the newly extracted data to the global defense engine database, generating the latest defense strategy, and pushing to each defense terminal.

Claims

1. A data mining-based intelligent defense method for computer viruses, characterized in that, The specific steps of this defense method are as follows: I. Collect various behavioral data from the computer, extract corresponding dynamic behavioral features, and model entropy values ​​based on each dynamic behavioral feature, and analyze entropy fluctuations in real time; II. Based on the analysis results, construct a heterogeneous threat relationship diagram, and based on the heterogeneous threat relationship diagram, infer the threat propagation path; III. For identified threats, implement real-time defense and interference, and simultaneously update threat interference strategies through distributed updates; IV. During the interference process, the gene editing mechanism is simulated to dynamically tamper with viral instructions, forge environmental feedback, and induce the virus to expose its true intentions and complete attack chain; V. Based on the complete attack chain and defense results obtained, conduct learning analysis and optimize the defense interference and defense strategies through attention mechanisms; VI. All data obtained in this round of defense will be sent back to the global defense engine database, and the dynamic virus defense system will be continuously updated.

2. The intelligent computer virus defense method based on data mining according to claim 1, characterized in that, The specific steps for entropy modeling based on each behavioral feature, as described in Step I, are as follows: S1.1: Calculate the probability distribution of each feature dimension of the extracted dynamic behavior features in the current time period, and calculate the instantaneous entropy value in the current sliding time window based on the probability distribution of each feature dimension. At the same time, calculate the rate of entropy change per unit time. Establish a behavior entropy change model based on the behavior probability distribution, instantaneous entropy value and entropy change rate. S1.2: For each active process in the computer, the behavioral entropy value of each active process in each sliding time window is calculated by using the behavioral entropy change model. At the same time, the environmental pressure factor of the current computer is calculated in real time to obtain the complexity and interference intensity of the current computer environment. S1.3: Dynamically modulate the behavioral entropy values ​​of each active process based on the current computer's environmental pressure factors, simulate the entropy increase process in the actual operating environment, and obtain the modulated behavioral entropy values ​​of each active process; S1.4: Real-time tracking of the entropy growth rate after modulation of each process. If the entropy growth rate exceeds the preset critical transition threshold, the current behavior is determined to have entered the critical entropy transition state, that is, there is abnormal entropy fluctuation, and a risk response is triggered.

3. The intelligent computer virus defense method based on data mining according to claim 2, characterized in that, The specific manifestation of the behavioral entropy change model described in S1.1 is as follows: In the formula, Representative at the In the sliding time window, the first The probability of behavior in each feature dimension; Representative at the The absolute value of the feature value of the j-th feature dimension within a sliding time window; Represents the total number of feature dimensions; This represents the sum of all feature values ​​within the current sliding time window; Representing the The instantaneous entropy value of a sliding time window; Represents the natural logarithm, used to measure the amount of probabilistic information; Representing the The rate of entropy change of a sliding time window; Representing the The instantaneous entropy value of a sliding time window; Represents the time span between sliding time windows; The specific formula for calculating the behavioral entropy value mentioned in S1.2 is as follows: ； In the formula, Representing the The process in the 1st The entropy value of behavior within a sliding time window; Representing the The process in the 1st Within the first sliding time window The probability of behavior in each feature dimension; Represents the natural logarithm, used to measure the amount of probabilistic information about behavior; This represents the number of feature dimensions currently used for computation. The number of feature dimensions is selected based on the process characteristics and may differ from the number of dimensions used in the previous round of behavior entropy value calculation. The specific calculation formula for the environmental pressure factor mentioned in S1.2 is as follows: ； In the formula, Representing the Environmental stress factor within a sliding time window; Represents the total number of environmental status indicators; Representing the Weighting coefficients for each environmental indicator; Representing the Within the first sliding time window Measured values ​​of each environmental indicator; Representing the Standardization factors for each environmental indicator; The specific calculation formula for the dynamic modulation described in S1.3 is as follows: ； In the formula, Representing the The process in the 1st The modulated behavioral entropy value of a sliding time window; Representing the The process in the 1st The original behavior entropy value within a sliding time window; Represents the modulation sensitivity coefficient; Representing the Environmental stress factor within a sliding time window; The specific calculation formula for the entropy change trend mentioned in S1.4 is as follows: ； In the formula, Representing the The process in the 1st The rate of increase of entropy within a sliding time window; Representing the The process in the 1st The modulated behavioral entropy value of a sliding time window; Representing the The process in the 1st The modulated behavioral entropy value of a sliding time window; Represents the time standardization factor.

4. The intelligent computer virus defense method based on data mining according to claim 2, characterized in that, The specific steps for constructing the heterogeneous threat relationship graph described in step II are as follows: S2.1: Filter out each active process that is judged to have abnormal entropy fluctuations in the behavioral entropy change model. At the same time, based on system logs, process relationship chains and kernel events, follow the system entities that interact with each of the selected active processes more than a preset threshold, and treat each system entity as a node. System entities include files, network ports, registry entries, user accounts and user sessions. S2.2: Extract structural features such as file size, port type and registry path hierarchy from the inherent attributes of each system entity, and use the extracted structural features as the static description of the corresponding entity node. Then, extract dynamic features such as file modification frequency, port access mode, registry item change trend and user behavior periodicity from the behavior trajectory of each system entity. S2.3: The structural features and behavioral features are fused to form a unified comprehensive feature vector. The established comprehensive feature vector is used as the attribute of the corresponding node to analyze the relationship between different entities. The correlation between nodes is calculated based on the direct interaction strength between entities and the implicit semantic similarity. S2.4: Traverse all nodes and determine whether the association density between each node is 0. If it is 0, it means that the two corresponding pairs of nodes are not related. Otherwise, it means that the two corresponding pairs of nodes are related. Establish connecting edges for the two corresponding pairs of nodes and use the association density as the edge weight to establish the corresponding heterogeneous threat relationship graph. Then, perform structural normalization on the nodes and edges in the heterogeneous threat relationship graph.

5. The intelligent computer virus defense method based on data mining according to claim 4, characterized in that, The specific steps for real-time interference defense described in step III are as follows: S3.1: After locking the threat propagation path, determine the active processes and various behavioral data corresponding to each threat propagation path in the computer data processing layer, and then randomly generate the initial quantum seed value through the quantum random number generator. S3.2: Combine the generated quantum seed value with the dynamic behavior feature identifier code of various types of behavior data, and generate a dynamic noise vector through an irreversible hash diffusion mechanism. Then, normalize the dynamic behavior features corresponding to various types of behavior data. S3.3: Based on the target's active process and the current risk score and operational sensitivity of various behavioral data, calculate the noise adjustment factor. At the same time, normalize the noise adjustment factor according to the maximum disturbance capacity that the current computer system can withstand, and construct the disturbance weight matrix based on the normalized noise adjustment factor. S3.4: After fusing the dynamic noise vector and the perturbation weight matrix according to the element-to-element correspondence, the fusion result is superimposed on each normalized dynamic behavior feature to form a new perturbed dynamic behavior feature. Then, the new dynamic behavior feature is restored to the same numerical scale as the original dynamic behavior feature through inverse normalization.

6. A data mining-based intelligent computer virus defense system, used to implement the data mining-based intelligent computer virus defense method according to any one of claims 1-5, characterized in that, It includes modules for data acquisition and modeling, identification and assessment, threat reasoning, disturbance intervention, defense synchronization, trapping and reconstruction, analysis and labeling, learning and evolution, and update push. The data acquisition and modeling module is used to collect various types of behavioral data from all levels of the computer system in real time, and to establish a behavioral entropy change model based on the various types of behavioral data. The identification and assessment module is used to simulate environmental stress factors and, based on the behavioral entropy change model, monitor entropy fluctuations in real time and identify abnormal entropy fluctuations. The threat inference module constructs a heterogeneous threat relationship graph based on abnormal entropy fluctuations, and infers and identifies threat propagation paths at the same time; The disturbance intervention module is used to dynamically perturb the data preprocessing layer after the threat propagation path is identified; The defense synchronization module is used to synchronously update the noise injection model across different terminals; The trapping and restoration module is used to actively trap virus samples in a sandbox environment and dynamically tamper with virus instructions and fake virtual environment feedback to guide the virus to expose the complete attack chain. The analysis and labeling module identifies the virus's attack intent, attack methods, and attack stages based on the complete attack chain, and assigns detailed labels to the virus attack chain. The learning evolution module is used to perform deep learning on the attack chain and defense process, and dynamically adjust the weights of the defense strategy. The update push module is used to send the newly extracted data back to the system's global defense engine database, generate the latest defense strategy, and push it to each defense terminal.

7. The intelligent computer virus defense system based on data mining according to claim 6, characterized in that, The specific steps by which the threat reasoning module infers and identifies threat propagation paths are as follows: S4.1: Based on the node type and edge type of the heterogeneous threat relationship graph, establish a set of all meta-paths that conform to the preset rules. The meta-path represents the sequence of semantic connection methods between entities. Then, search for each specific instantiated path that satisfies the meta-path pattern in the heterogeneous threat relationship graph and encode the information on the path as path features. S4.2: Based on the path characteristics of each specific instantiated path, calculate its risk score as a potential threat propagation path, then calculate the loss value between the current risk score and the target labeled threat propagation path, and obtain the gradient value of each specific instantiated path based on the loss value. Then, based on the obtained gradient information, confirm the adjustment direction and magnitude of each specific instantiated path in the current iteration. S4.3: Based on the gradient information, the corresponding specific instantiation path is updated using a gradient descent strategy with learning rate control, and the weights are normalized after each iteration. The iteration is repeated until the loss value of each specific instantiation path converges to within the preset threshold. S4.4: Based on the risk score and path weight of each specific instantiation path, calculate the risk value of each specific instantiation path, and filter out the corresponding specific instantiation paths with risk values ​​lower than the preset minimum risk threshold. Then, combine all high-risk paths to generate the corresponding threat propagation path.

8. A computer virus intelligent defense system based on data mining according to claim 6, characterized in that, The specific steps of the trapping and restoration module in guiding the virus to expose the complete attack chain are as follows: S5.1: Disassemble and reverse engineer the virus sample, extract its function call graph and control flow graph static structural features, and initially screen out code segments with potential malicious behavior. Then, calculate the static weight of each code segment in the static structure based on the instruction density and characteristic instruction ratio. S5.2: Run the virus sample in the sandbox environment and track its behavior trajectory in real time. Record the dynamic behavior characteristics of the virus sample's API calls, memory changes and file operations. Dynamic behavior characteristics with a frequency higher than a preset threshold are identified as high-frequency behavior hotspots. At the same time, the dynamic weight of each high-frequency behavior hotspot segment in the behavior trajectory is calculated. S5.3: Perform weighted fusion based on the obtained static weights and dynamic weights to obtain the total importance of each code segment, and select the code segments with a total importance higher than the preset core segment selection threshold, and use them as core code segments; S5.4: Based on the core code fragments of the extracted virus sample, generate corresponding editing templates, mark the modifiable locations, and then in the sandbox environment, modify the core code fragments of the virus sample in real time based on the editing templates, while injecting control code. S5.5: After the instruction is tampered with, simulate and forge computer system response information, and with the tampered virus code fragment, guide it into a specific execution path. Then, repeatedly tamper with instructions and forge the environment until the preset simulation round is reached. During the iteration process, collect the virus's exposure behavior in real time to obtain the complete attack chain and true intent of each virus sample.

Images