A program processing method, device and related equipment

Abstract

The embodiment of the present invention discloses a program processing method, device and related equipment, the method comprising: obtaining multiple sample programs, and obtaining behavior parameter values ​​corresponding to each sample program, and determining sample feature vectors corresponding to each sample program according to the behavior parameter values ​​corresponding to each sample program; dividing the sample feature vectors into multiple vector sets, and determining the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set; determining the security label corresponding to each sample program according to the sample behavior state; and generating a program recognition model according to the multiple sample programs and the security label corresponding to each sample program. By adopting the present invention, corresponding labels can be automatically set for sample programs to increase the number of sample programs with labels and improve the accuracy of the recognition model.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a program processing method, device and related equipment. Background Art

[0002] The development and popularization of the Internet has changed people's lifestyles and work styles. People's lives and work have become more convenient and efficient, and society has entered the information age. With the continuous improvement of the degree of social informatization, information in various industries such as industry, education, and finance is increasingly dependent on computers and the Internet. However, malicious programs directly threaten the interests of individuals and enterprises. Data shows that 84% of Internet users have suffered network attacks caused by malicious programs. Therefore, the identification of malicious programs has important social value.

[0003] The existing technology for identifying malicious programs is mainly based on supervised methods, that is, using a large number of labeled normal programs and labeled malicious programs to train a recognition model. The recognition model can fit the data distribution of malicious programs and normal programs, and then identify subsequent unknown programs. The number of sample programs participating in the model training will directly determine the accuracy of the recognition model.

[0004] However, each sample program participating in the training needs to be manually verified to be a normal program or a malicious program, and then a corresponding label is manually set for the program, resulting in low efficiency in setting labels for the program and a small number of labeled sample programs, which in turn leads to low recognition accuracy of the recognition model. Summary of the invention

[0005] The embodiments of the present invention provide a program processing method, apparatus and related equipment, which can automatically and accurately set corresponding labels for sample programs to increase the number of sample programs with labels and improve the accuracy of the recognition model.

[0006] An embodiment of the present invention provides a program processing method, including:

[0007] Acquire a plurality of sample programs, and acquire a behavior parameter value corresponding to each sample program, and determine a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program;

[0008] Dividing the sample feature vectors into a plurality of vector sets, and determining the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set;

[0009] Determine, according to the sample behavior state, a security label corresponding to each sample program; the security label includes a normal label and an abnormal label;

[0010] A program identification model is generated according to the multiple sample programs and the security labels respectively corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0011] Among them, it also includes:

[0012] When a program identification request is received, the target program is obtained according to the program identification request, and a behavior parameter value corresponding to the target program is obtained, and a target feature vector is determined according to the behavior parameter value corresponding to the target program;

[0013] Based on the program recognition model, the target feature vector is identified and processed to obtain a security label that matches the target feature vector, and the security type indicated by the security label identified by the program recognition model is determined as the security type corresponding to the target program.

[0014] The step of obtaining the behavior parameter values ​​corresponding to each sample program and determining the sample feature vectors corresponding to each sample program according to the behavior parameter values ​​corresponding to each sample program includes:

[0015] Acquire a plurality of original parameter values ​​corresponding to the sample program, and extract the original parameter value representing the program operation behavior from the plurality of original parameter values ​​as the conditional parameter value;

[0016] The conditional parameter value within the target numerical range is adjusted to a target numerical value matching the target numerical range, the target numerical value is determined as a behavior parameter value corresponding to the sample program, and the behavior parameter values ​​corresponding to the sample program are combined into the sample feature vector.

[0017] The step of dividing the sample feature vectors into a plurality of vector sets and determining the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set includes:

[0018] Acquire a target isolation forest associated with the plurality of sample feature vectors, and extract a node record corresponding to a first node in a target isolation tree in the target isolation forest as a first record;

[0019] Using the plurality of sample feature vectors as first auxiliary vectors, and dividing the first auxiliary vectors into the vector set according to the first record; the vector set includes the vector set to be divided;

[0020] Extracting a node record corresponding to the second node as a second record; the second node is a child node of the first node in the target isolated tree;

[0021] Taking the second node as the first node, taking the second record as the first record, and taking the sample feature vector contained in the set of vectors to be divided as the first auxiliary vector;

[0022] When there is no node record in the second node, counting the number of vector sets that are associated with the sample feature vector, and determining the height of the sample feature vector in the target isolated tree according to the number of vector sets counted;

[0023] According to the height of the sample feature vector in each target isolation tree, the sample behavior state corresponding to the sample feature vector is determined.

[0024] Among them, it also includes:

[0025] Acquire multiple training programs and obtain behavior parameter values ​​corresponding to each training program, and determine multiple training feature vectors according to the behavior parameter values ​​corresponding to each training program;

[0026] Extracting a set of training feature vectors from the plurality of training feature vectors as basis vectors, and constructing a target isolation tree according to the basis vectors and all behavior parameter attributes contained in the basis vectors;

[0027] Extracting a next set of training feature vectors from the plurality of training feature vectors as the basis vectors;

[0028] When the number of the target isolated trees respectively constructed based on the multiple groups of basis vectors is greater than a first number threshold, all the target isolated trees are determined as the target isolated forest.

[0029] The step of constructing a target isolation tree according to the basis vector and all behavior parameter attributes contained in the basis vector includes:

[0030] Creating a node tree, generating a third node according to the basis vector, and adding the third node to the node tree;

[0031] Determine the base vector as a second auxiliary vector, select a behavior parameter attribute from all behavior parameter attributes included in the second auxiliary vector as a node attribute, and determine a node attribute value according to the behavior parameter values ​​of the node attributes in all the second auxiliary vectors;

[0032] combining the node attribute and the node attribute value into a node record and adding the node record to the third node; dividing the second auxiliary vector into a first sub-vector and a second sub-vector according to the node attribute and the node attribute value; generating a fourth node according to the first sub-vector and the second sub-vector respectively; and adding the fourth node as a child node of the third node to the node tree;

[0033] Determine the fourth node as the third node, and determine both the first sub-vector and the second sub-vector as the second auxiliary vector;

[0034] When the node tree meets the convergence condition, the node tree is determined as the target isolated tree.

[0035] The step of dividing the sample feature vectors into a plurality of vector sets and determining the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set includes:

[0036] Selecting a group of sample feature vectors from the plurality of sample feature vectors as a center vector;

[0037] Dividing the plurality of sample feature vectors into a plurality of feature clusters according to the distances between the plurality of sample feature vectors and the central vector;

[0038] Among all the sample feature vectors contained in each feature cluster, select the sample feature vector located at the center as the center vector;

[0039] When the sample feature vectors contained in each feature cluster remain unchanged, determining the multiple feature clusters as the multiple vector sets;

[0040] Taking the center vector of a vector set that has an association relationship with the sample feature vector as the target center vector, and calculating the center distance between the sample feature vector and the target center vector;

[0041] According to the center distance corresponding to the sample feature vector, the sample behavior state corresponding to the sample feature vector is determined.

[0042] The step of determining the security label corresponding to each sample program according to the sample behavior state includes:

[0043] Detecting the sample behavior state corresponding to the sample feature vector;

[0044] When the sample behavior state belongs to an abnormal state, determining that the security label of the sample program corresponding to the sample feature vector is an abnormal label;

[0045] When the sample behavior state belongs to a normal state, the security label of the sample program corresponding to the sample feature vector is determined to be a normal label.

[0046] The step of generating a program identification model according to the plurality of sample programs and the security tags respectively corresponding to each sample program includes:

[0047] Acquire the plurality of sample feature vectors, extract a group of sample feature vectors from the plurality of sample feature vectors as a decision vector, and select a plurality of behavior parameter attributes as decision attributes from all behavior parameter attributes included in the decision vector;

[0048] Constructing a target decision tree according to the decision attribute, the decision vector, and the security label corresponding to the decision vector;

[0049] Extracting a next set of sample feature vectors from the multiple sample feature vectors as the decision vector;

[0050] When the number of the target decision trees respectively constructed based on the multiple groups of decision vectors is greater than a second number threshold, all target decision trees are determined as the program recognition model.

[0051] The step of constructing a target decision tree according to the decision attribute, the decision vector, and the security label corresponding to the decision vector includes:

[0052] Creating a decision tree, calculating the information gain corresponding to each decision attribute according to the decision vector and the security label corresponding to the decision vector, and taking the decision attribute with the largest information gain as the first attribute;

[0053] generating a fifth node according to the first attribute, and adding the fifth node to the decision tree;

[0054] Determine the decision vector as a third auxiliary vector, and divide the third auxiliary vector into a plurality of vector sets to be processed according to a behavior parameter value corresponding to a first attribute in the third auxiliary vector;

[0055] Taking the decision vector included in the set of vectors to be processed as the target sub-vector;

[0056] According to the target sub-vector and the security label corresponding to the target sub-vector, calculating the information gain corresponding to each decision attribute, and taking the decision attribute with the largest information gain as the second attribute;

[0057] generating a sixth node according to the second attribute, adding the sixth node as a child node of the fifth node to the decision tree, and adding the behavior parameter value corresponding to the first attribute in the target sub-vector to the sixth node;

[0058] determining the second attribute as the first attribute, determining the sixth node as the fifth node, and determining the target sub-vector as the third auxiliary vector;

[0059] When the security labels of the sample feature vectors contained in the set of vectors to be processed are the same, the leaf nodes of the decision tree are generated according to the same security labels in the set of vectors to be processed, the behavioral parameter values ​​corresponding to the first attributes of the decision vectors in the set of vectors to be processed are added to the leaf nodes, and the decision tree is determined as the target decision tree.

[0060] The step of performing identification processing on the target feature vector based on the program identification model to obtain a security label matching the target feature vector includes:

[0061] Traversing the target feature vector through all target decision trees in the process identification model, and determining a security label of the target feature vector in each target decision tree;

[0062] According to the security labels determined by all target decision trees, the sum of the number of normal labels is counted as the normal number, and the sum of the number of abnormal labels is counted as the abnormal number;

[0063] If the normal number is greater than the abnormal number, determining that the security label matching the target feature vector is a normal label;

[0064] If the normal number is less than or equal to the abnormal number, it is determined that the security label matching the target feature vector is an abnormal label.

[0065] Before generating a program identification model according to the plurality of sample programs and the security tags respectively corresponding to each sample program, the method further includes:

[0066] Acquire multiple groups of initial model parameters, and select one group of initial model parameters from the multiple groups of initial model parameters as training parameters;

[0067] Divide the plurality of sample programs into a plurality of program sets, extract one program set from the plurality of program sets as a first set, and extract the remaining program sets as a second set;

[0068] training an anomaly detection model according to the training parameters, the sample programs in the second set, and the security labels respectively corresponding to the sample programs in the second set;

[0069] Based on the anomaly detection model, the sample programs in the first set are identified to obtain predicted safety labels, and a prediction error is calculated according to the safety labels of the sample programs in the first set and the predicted safety labels;

[0070] When each program set is determined to be the first set, taking a mean value of a plurality of prediction errors as an identification error of the training parameter;

[0071] Selecting a next set of initial model parameters from the multiple sets of initial model parameters as the training parameters;

[0072] When each set of initial model parameters is determined as the training parameters, the training parameters with the lowest recognition error are used as target model parameters; the target model parameters are used to generate the program recognition model.

[0073] An embodiment of the present invention provides a program processing device, including:

[0074] A first acquisition module, used for acquiring a plurality of sample programs;

[0075] A second acquisition module is used to acquire a behavior parameter value corresponding to each sample program, and determine a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program;

[0076] A score determination module, used to divide the sample feature vector into a plurality of vector sets, and determine the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set;

[0077] A label determination module, used to determine the security label corresponding to each sample program according to the sample behavior state; the security label includes a normal label and an abnormal label;

[0078] The model generation module is used to generate a program identification model according to the multiple sample programs and the security labels corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0079] Among them, it also includes:

[0080] a third acquisition module, configured to, when receiving a program identification request, acquire the target program according to the program identification request, acquire a behavior parameter value corresponding to the target program, and determine a target feature vector according to the behavior parameter value corresponding to the target program;

[0081] An identification module, used to perform identification processing on the target feature vector based on the program identification model to obtain a security label matching the target feature vector;

[0082] The third acquisition module is further used to determine the security type indicated by the security label identified by the program identification model as the security type corresponding to the target program.

[0083] Wherein, the second acquisition module includes:

[0084] A parameter acquisition unit, used to acquire a plurality of original parameter values ​​corresponding to the sample program, and extract the original parameter value representing the program operation behavior from the plurality of original parameter values ​​as the conditional parameter value;

[0085] A numerical adjustment unit is used to adjust the conditional parameter value within the target numerical range to a target numerical value matching the target numerical range, determine the target numerical value as a behavioral parameter value corresponding to the sample program, and combine the behavioral parameter values ​​corresponding to the sample program into the sample feature vector.

[0086] Wherein, the score determination module includes:

[0087] An extraction unit, configured to obtain a target isolation forest associated with the plurality of sample feature vectors, and extract a node record corresponding to a first node in a target isolation tree in the target isolation forest as a first record;

[0088] The extraction unit is further configured to use the plurality of sample feature vectors as first auxiliary vectors, and divide the first auxiliary vectors into the vector set according to the first record; the vector set includes the vector set to be divided;

[0089] The extraction unit is further used to extract a node record corresponding to the second node as a second record; the second node is a child node of the first node in the target isolated tree;

[0090] The extraction unit is further configured to use the second node as the first node, the second record as the first record, and the sample feature vector included in the set of vectors to be divided as the first auxiliary vector;

[0091] A vector statistics unit, used for counting the number of vector sets associated with the sample feature vector when there is no node record in the second node, and determining the height of the sample feature vector in the target isolated tree according to the number of vector sets counted;

[0092] The vector statistics unit is further used to determine the sample behavior state corresponding to the sample feature vector according to the height of the sample feature vector in each target isolation tree.

[0093] Among them, it also includes:

[0094] A vector determination module, used to obtain a plurality of training programs and obtain a behavior parameter value corresponding to each training program, and determine a plurality of training feature vectors according to the behavior parameter value corresponding to each training program;

[0095] The vector determination module is further used to extract a group of training feature vectors from the multiple training feature vectors as basis vectors;

[0096] A construction module, used for constructing a target isolation tree according to the basis vector and all behavior parameter attributes contained in the basis vector;

[0097] The vector determination module is further used to extract a next set of training feature vectors from the multiple training feature vectors as the basis vectors;

[0098] The vector determination module is further used to determine all target isolated trees as the target isolated forest when the number of the target isolated trees respectively constructed based on multiple groups of the basis vectors is greater than a first number threshold.

[0099] Wherein, the building blocks include:

[0100] A creating unit, used for creating a node tree, generating a third node according to the basis vector, and adding the third node to the node tree;

[0101] A selection unit, configured to determine the base vector as a second auxiliary vector, select a behavior parameter attribute from all behavior parameter attributes included in the second auxiliary vector as a node attribute, and determine a node attribute value according to the behavior parameter values ​​of the node attributes in all the second auxiliary vectors;

[0102] The selection unit is further configured to combine the node attribute and the node attribute value into a node record and add it to the third node, divide the second auxiliary vector into a first sub-vector and a second sub-vector according to the node attribute and the node attribute value, generate a fourth node according to the first sub-vector and the second sub-vector respectively, and add the fourth node as a child node of the third node to the node tree;

[0103] The selection unit is further configured to determine the fourth node as the third node, and determine both the first sub-vector and the second sub-vector as the second auxiliary vector;

[0104] The selection unit is further configured to determine the node tree as the target isolated tree when the node tree meets a convergence condition.

[0105] Wherein, the score determination module includes:

[0106] A vector determination unit, configured to select a group of sample feature vectors from the plurality of sample feature vectors as a center vector;

[0107] a division unit, configured to divide the plurality of sample feature vectors into a plurality of feature clusters according to distances between the plurality of sample feature vectors and the central vector;

[0108] The division unit is further used to select the sample feature vector located at the center from all the sample feature vectors contained in each feature cluster as the center vector;

[0109] The division unit is further configured to determine the plurality of feature clusters as the plurality of vector sets when the sample feature vectors contained in each feature cluster remain unchanged;

[0110] The division unit is further used to use the central vector of the vector set that has an association relationship with the sample feature vector as the target central vector, and calculate the central distance between the sample feature vector and the target central vector;

[0111] The division unit is further used to determine the sample behavior state corresponding to the sample feature vector according to the center distance corresponding to the sample feature vector.

[0112] Wherein, the label determination module includes:

[0113] A detection unit, used for detecting a sample behavior state corresponding to a sample feature vector;

[0114] a label determination unit, configured to determine, when the sample behavior state belongs to an abnormal state, that the security label of the sample program corresponding to the sample feature vector is an abnormal label;

[0115] The label determination unit is further configured to determine, when the sample behavior state belongs to a normal state, that the security label of the sample program corresponding to the sample feature vector is a normal label.

[0116] Wherein, the model generation module includes:

[0117] A vector acquisition unit, used to acquire the plurality of sample feature vectors, extract a group of sample feature vectors from the plurality of sample feature vectors as a decision vector, and select a plurality of behavior parameter attributes as decision attributes from all behavior parameter attributes included in the decision vector;

[0118] A construction unit, configured to construct a target decision tree according to the decision attribute, the decision vector, and a security label corresponding to the decision vector;

[0119] The vector acquisition unit is further used to extract a next group of sample feature vectors from the multiple sample feature vectors as the decision vector;

[0120] The vector acquisition unit is further used to determine all target decision trees as the program recognition model when the number of the target decision trees respectively constructed based on multiple groups of the decision vectors is greater than a second number threshold.

[0121] Wherein, the construction unit comprises:

[0122] A creation subunit is used to create a decision tree, calculate the information gain corresponding to each decision attribute according to the decision vector and the security label corresponding to the decision vector, and take the decision attribute with the largest information gain as the first attribute;

[0123] an adding subunit, configured to generate a fifth node according to the first attribute, and add the fifth node to the decision tree;

[0124] a dividing subunit, configured to determine the decision vector as a third auxiliary vector, and divide the third auxiliary vector into a plurality of vector sets to be processed according to a behavior parameter value corresponding to a first attribute in the third auxiliary vector;

[0125] The division subunit is further configured to use the decision vector included in the set of vectors to be processed as a target subvector;

[0126] The division subunit is further used to calculate the information gain corresponding to each decision attribute according to the target subvector and the security label corresponding to the target subvector, and take the decision attribute with the largest information gain as the second attribute;

[0127] The division subunit is further configured to generate a sixth node according to the second attribute, add the sixth node as a child node of the fifth node to the decision tree, and add the behavior parameter value corresponding to the first attribute in the target subvector to the sixth node;

[0128] The division subunit is further configured to determine the second attribute as the first attribute, determine the sixth node as the fifth node, and determine the target sub-vector as the third auxiliary vector;

[0129] The division subunit is also used to generate leaf nodes of the decision tree according to the same security labels in the set of vectors to be processed when the security labels of the sample feature vectors contained in the set of vectors to be processed are the same, add the behavior parameter values ​​corresponding to the first attributes of the decision vectors in the set of vectors to be processed to the leaf nodes, and determine the decision tree as the target decision tree.

[0130] Wherein, the identification module includes:

[0131] A traversal unit, used for traversing the target feature vector through all target decision trees in the process identification model to determine a security label of the target feature vector in each target decision tree;

[0132] A label counting unit is used to count the sum of the number of normal labels as the normal number, and count the sum of the number of abnormal labels as the abnormal number according to the security labels determined by all target decision trees;

[0133] The label counting unit is further configured to determine that the security label matching the target feature vector is a normal label if the normal number is greater than the abnormal number;

[0134] The label statistics unit is further configured to determine that the security label matching the target feature vector is an abnormal label if the normal number is less than or equal to the abnormal number.

[0135] Among them, it also includes:

[0136] A fourth acquisition module is used to acquire multiple groups of initial model parameters, and select one group of initial model parameters from the multiple groups of initial model parameters as training parameters;

[0137] An extraction module, used for dividing the plurality of sample programs into a plurality of program sets, extracting one program set from the plurality of program sets as a first set, and extracting the remaining program sets as a second set;

[0138] A training module, configured to train an anomaly detection model according to the training parameters, the sample programs in the second set, and the security labels respectively corresponding to the sample programs in the second set;

[0139] a calculation module, configured to perform identification processing on the sample programs in the first set based on the anomaly detection model to obtain predicted safety labels, and calculate prediction errors according to the safety labels of the sample programs in the first set and the predicted safety labels;

[0140] The calculation module is further configured to use a mean of a plurality of prediction errors as a recognition error of the training parameter when each program set is determined to be the first set;

[0141] The calculation module is further used to select a next set of initial model parameters from the multiple sets of initial model parameters as the training parameters;

[0142] The calculation module is also used to use the training parameters with the lowest recognition error as target model parameters when each group of initial model parameters is determined as the training parameters; the target model parameters are used to generate the program recognition model.

[0143] An embodiment of the present invention provides an electronic device, including: a processor and a memory;

[0144] The processor is connected to a memory, wherein the memory is used to store program codes, and the processor is used to call the program codes to execute the method in the embodiment of the present invention.

[0145] On one hand, an embodiment of the present invention provides a computer storage medium, wherein the computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the method according to the embodiment of the present invention is executed.

[0146] The embodiment of the present invention divides the feature vectors into multiple sets by taking the behavior parameter values ​​of the sample program as the feature vectors that characterize the characteristics of the sample program. According to the association relationship between each feature vector and the set, the behavior state of each sample feature vector can be determined. The label of the sample program corresponding to each feature vector can be determined from the behavior state, and then the recognition model can be trained based on a large number of labeled sample programs for subsequent recognition of unknown types of programs. Taking the behavior parameter values ​​of the sample program as the feature vector can accurately express the characteristics of the sample program, thereby increasing the accuracy of the labels obtained based on the feature vector; at the same time, according to the association relationship between each sample program and the corresponding vector set, the behavior state of each sample vector can be determined, and the corresponding label can be automatically set for the corresponding sample program. Compared with manually setting labels, the efficiency of setting labels can be improved and the number of labeled sample programs can be expanded; further, the recognition model obtained by using a large number of sample programs carrying labels has a higher recognition accuracy than the recognition model obtained by using a small number of sample programs carrying labels. BRIEF DESCRIPTION OF THE DRAWINGS

[0147] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0148] Figure 1 It is a system architecture diagram of a program processing provided by an embodiment of the present invention;

[0149] Figure 2a-2b It is a schematic diagram of a scenario of program processing provided by an embodiment of the present invention;

[0150] Figure 2c It is a schematic diagram of an interface of a program processing provided by an embodiment of the present invention;

[0151] Figure 3 It is a flowchart of a program processing method provided by an embodiment of the present invention;

[0152] Figure 4 It is a flowchart of another program processing method provided by an embodiment of the present invention;

[0153] Figure 5 It is a schematic diagram of a flow chart of generating a program recognition model provided by an embodiment of the present invention;

[0154] Figure 6 is a schematic diagram of constructing a target decision tree provided by an embodiment of the present invention;

[0155] Figure 7 It is a flowchart of another program processing method provided by an embodiment of the present invention;

[0156] Figure 8 is a schematic diagram of constructing a target isolation tree provided by an embodiment of the present invention;

[0157] Figure 9a-9b is a schematic diagram of determining a sample behavior state provided by an embodiment of the present invention;

[0158] Fig.10 It is a flowchart of another program processing method provided by an embodiment of the present invention;

[0159] Fig.11 is another schematic diagram of determining a sample behavior state provided by an embodiment of the present invention;

[0160] Fig.12 is a schematic diagram of the structure of a program processing device provided by an embodiment of the present invention;

[0161] Fig.13 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0162] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0163] See also Figure 1, is a system architecture diagram of program processing provided by an embodiment of the present invention. The server 10f establishes a connection with a user terminal cluster through a switch 10e and a communication bus 10d, and the user terminal cluster may include: user terminal 10a, user terminal 10b, ..., user terminal 10c. The database 10g stores a plurality of programs of unknown security types and executable files associated with each program, wherein the security types include normal types and malicious types. The server 10f extracts a plurality of programs of unknown security types from the database 10g as sample programs, and uses an unsupervised learning method to set corresponding labels for each sample program, and the labels may include normal labels and malicious labels. Based on a plurality of sample programs carrying labels, the server 10f uses a supervised learning method to train a recognition model and stores the recognition model. The server 10f can monitor whether there is a malicious program in each user terminal in the user terminal cluster based on the trained recognition model. When a malicious program is detected, the server 10f sends a warning signal to the corresponding user terminal; or when the server 10f receives an identification request from a user terminal in the terminal cluster, it identifies whether the program to be identified corresponding to the above identification request is a malicious program or a normal program based on the recognition model, and the server 10f sends the identification result to the corresponding user terminal. Of course, the server 10f can also send the trained recognition model to each user terminal in the user terminal cluster, and the user terminal monitors the security type of the local program.

[0164] Since setting labels for unlabeled programs and training recognition models involve a large amount of calculations, the server 10f can adopt a distributed architecture, divide the data / model, optimize the model training in a distributed manner through multiple working nodes, and finally aggregate the model. The above-mentioned program can be an application program or system program in a Linux system, a Window system, or a Unix system. The following takes the process in the Linux system as an example to train a process recognition model based on a large number of unlabeled sample processes. Among them, the user terminal can include a mobile phone, a tablet computer, a laptop computer, a PDA, an intelligent speaker, a mobile Internet device (MID), a POS (Point Of Sales), a wearable device (such as a smart watch, a smart bracelet, etc.), etc.

[0165] See also Figure 2a-2b, is a schematic diagram of a program processing scenario provided by an embodiment of the present invention. Obtain n unlabeled processes, and obtain the executable file corresponding to each process, wherein the executable file is the file obtained after the program is compiled, and the process is the instance in the memory after the program is run. From the executable file of each process, extract the behavior parameter value that characterizes the business behavior of the process, and combine the extracted multiple behavior parameter values ​​into a feature vector of the corresponding process, and each process has a corresponding feature vector. The behavior parameter value may include: the number of files opened by the process, the number of process parameters, whether the file MD5 value in the file MD5 (Message Digest Algorithm MD5, digest algorithm) value library is the same as the MD5 value of the process executable file (using the value 0 or 1 to indicate existence or non-existence, respectively), etc.

[0166] At this point, multiple processes and the feature vectors corresponding to each process are obtained. Next, the anomaly score calculation module calculates the anomaly score of each feature vector. The anomaly score calculation module can calculate the anomaly score based on clustering; it can also calculate the anomaly score based on the isolation forest method. The process of calculating the anomaly score based on the clustering method is: according to the similarity between all feature vectors, all feature vectors are clustered to obtain multiple feature clusters, one of which contains similar feature vectors; the anomaly score of each feature vector is determined based on the distance between each feature vector and the center vector of the feature cluster to which it belongs. The process of calculating the anomaly score based on the isolation forest method is: each feature vector traverses each isolated tree in the isolation forest in turn, and determines the height of each feature vector in each isolated tree; the anomaly score of each feature vector is determined based on the average value of the height in all isolated trees.

[0167] It should be noted that in addition to the above two methods for calculating the anomaly score, the anomaly score of each feature vector may also be calculated based on a distance method, a density method, or the like.

[0168] Set a score threshold, set the behavior state of the feature vector that is higher than the abnormal score threshold as an abnormal state; set the behavior state of the feature vector that is lower than or equal to the abnormal score threshold as a normal state. Set the process corresponding to the feature vector whose behavior state is an abnormal state as a malicious process, and set an abnormal label for the malicious process; set the process corresponding to the feature vector whose behavior state is a normal state as a normal process, and set a normal label for the normal process. There are corresponding labels for n processes. According to the n processes and the corresponding labels, the detection model 20a can be trained in a supervised learning manner. The detection model 20a can fit the data distribution of normal processes and malicious processes respectively, and establish a mapping relationship between the feature information of the process and the label. After the detection model 20a is trained, the unknown process can be directly detected later. Among them, the detection model 20a can be trained based on the supervised learning method using decision forests, k nearest neighbors, naive Bayes, etc.

[0169] like Figure 2b As shown, the server stores a pre-trained detection model 20a. The user terminal sends the process to be detected and the executable file related to the process to be detected to the server for detecting the security type of the process. The server obtains the feature information of the process to be detected, and identifies the label 20b matching the feature information of the process to be detected based on the detection model 20a as: abnormal. The server sends the detected label 20b to the user terminal and prompts the user terminal that the process is a malicious process.

[0170] See also Figure 2c , is a schematic diagram of an interface for program processing provided by an embodiment of the present invention. Taking the process in the program as an example, the monitoring platform trains a process detection model to monitor the security of multiple processes running in a server cluster (including server 1, server 2, ..., server n). As shown in interface 20c, the user clicks the "Performance Upgrade" button in the interface, and the monitoring platform copies some processes from the server cluster as sample processes, and copies the executable files corresponding to each sample process. Based on the above sample processes and corresponding executable files, the monitoring platform trains a process detection model (the specific process of training can be found in Figure 2a-2bDescription of the corresponding embodiment, and after the process detection model training is completed, the monitoring platform can delete all sample processes and all executable files). After the process detection model training is completed, as shown in interface 20d, the user clicks the "Start Scan" button in the interface, and the monitoring platform can continuously and uninterruptedly detect each process in the server cluster based on the process detection model, and display the detection results on the screen (as shown in interface 20e). The user can also set a scheduled scan, and the monitoring platform detects each process in the server cluster at intervals to reduce resource loss. The user can also set a scheduled upgrade, and the monitoring platform re-copies new data from the server cluster at intervals for training the detection model.

[0171] Among them, obtain the feature vector, for the program (as mentioned above Figure 2a-2b Process in the embodiment) sets labels, trains program recognition models (as described above Figure 2a-2b The specific process of the detection model 20a) in the embodiment can be seen below Figures 3 to 11 The corresponding embodiment.

[0172] For further information, see Figure 3 , is a flowchart of a program processing method provided by an embodiment of the present invention. Figure 3 As shown, the program processing method may include:

[0173] Step S101 : obtaining a plurality of sample programs, and obtaining a behavior parameter value corresponding to each sample program, and determining a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program.

[0174] Specifically, the terminal (as mentioned above Figure 1 The server 10f) in the embodiment obtains multiple programs of unknown security type as sample programs. The programs may include system programs, applications, processes or threads, etc. The following takes a sample program as an example to illustrate how the terminal determines a sample feature vector corresponding to a sample program. In the executable file of the sample program, the terminal extracts multiple original parameter values ​​of the sample program. The original parameter values ​​include static attribute values ​​and dynamic attribute values ​​of the program. For example, the identity of the program belongs to the static attribute value, and the last modification time of the program belongs to the dynamic attribute value. Among the multiple original parameter values, the terminal extracts the conditional parameter value. The conditional parameter value is the value of the conditional parameter that represents the program operation behavior. The conditional parameter can also be called a behavior parameter attribute. The behavior parameter attribute may include the various attributes shown in Table 1 below:

[0175] Table 1

[0176]

[0177] Among them, the file MD5 value library contains a large number of file MD5 values. The behavior parameter attributes numbered 4, 8, and 9 in Table 1 correspond to the scenario where the same program is deployed on multiple machines. Among the 16 behavior parameter attributes in Table 1 above, the behavior parameter attributes that have a greater impact on the final classification result can be found in the various behavior parameter attributes shown in Table 2 below. Table 2 below also includes the influence score of each behavior parameter attribute. The sum of the influence scores of the 16 behavior parameter attributes is equal to 1. The influence score is calculated by scoring each behavior parameter attribute through random forest.

[0178] Table 2

[0179]

[0180] From the behavior parameter attributes and impact scores in Table 2, it can be seen that whether there is a file MD5 value in the behavior parameter attribute library that is the same as the MD5 value of the executable file has the largest impact score, indicating that the behavior parameter attribute has better feature discrimination.

[0181] When the behavior parameter attribute represents a quantity, the corresponding conditional parameter value is an integer greater than or equal to 0; when the behavior parameter attribute represents a logical judgment result, the corresponding conditional parameter value is 0 or 1 (when the logical judgment result is yes, the corresponding conditional parameter value can be set to 1; when the logical judgment result is no, the corresponding conditional parameter value can be set to 0). Therefore, the difference between the values ​​of the behavior parameter attributes (conditional parameter values) is relatively large, which is not conducive to the subsequent expression of the characteristics of the sample program. In order to make the values ​​of the behavior parameter attributes within a smaller range, the terminal can convert the continuous conditional parameter values ​​into discrete values ​​based on the bucket method. The converted values ​​are called behavior parameter values. The bucket method used here only changes the values ​​of the behavior parameter attributes, and the behavior meaning corresponding to each behavior parameter attribute does not change.

[0182] The specific process of converting continuous conditional parameter values ​​into discrete behavior parameter values ​​based on the bucket method is as follows: the terminal detects all conditional parameter values, and adjusts the conditional parameter values ​​within the target value range to target values ​​that match the target value range, that is, the adjusted target value is the behavior parameter value. For example, the target value range is 2-100, and the target value that matches the above target value range is 3. If the behavior parameter attribute is: the number of files opened by the program; the corresponding value of the behavior parameter attribute (conditional parameter value) is 40. Since the conditional parameter value 40 is within the target value range, the conditional parameter value 40 is adjusted to 3, and the value 3 is the behavior parameter value. Then the adjusted behavior parameter attribute is still: the number of files opened by the program; the corresponding behavior parameter value is: 3.

[0183] Finally, according to the preset target order, the terminal combines multiple behavior parameter values ​​and vectors, called feature vectors, which are the feature representations of the program, and the feature vectors corresponding to the sample programs are called sample feature vectors. For multiple sample programs, the sample feature vectors corresponding to each sample program can be obtained in the above manner.

[0184] Step S102: divide the sample feature vectors into a plurality of vector sets, and determine the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set.

[0185] Specifically, the terminal divides multiple sample feature vectors into multiple sets, called vector sets, based on the similarity between the sample feature vectors. Generally speaking, the similarity between two sample feature vectors in the same vector set is greater than or equal to the similarity between two sample feature vectors in different vector sets. The similarity between two sample feature vectors can be measured by the distance between them. The closer the distance, the greater the similarity; the farther the distance, the smaller the similarity. The distance calculation formula can be the following formula (1):

[0186]

[0187] Among them, X and Y represent two sample feature vectors, X i and Y i Denotes the i-th dimension value of the two sample feature vectors (which can also be understood as the behavior parameter value of the i-th behavior parameter attribute). Formula (1) is the calculation formula of the Euclidean distance. The distance measurement methods such as Manhattan distance, Mahalanobis distance, Chebyshev distance, etc. can also be used as the distance between two sample feature vectors.

[0188] For a sample feature vector, in the above vector set, the terminal determines the vector set that has an associated relationship with the sample feature vector. The vector set that has an associated relationship with the sample feature vector refers to the vector set to which the sample feature vector belongs. If all sample feature vectors are divided into multiple vector sets by clustering, then one sample feature vector only corresponds to one vector set with an associated relationship; if all sample feature vectors are divided into multiple vector sets by tree, then one sample feature vector can correspond to multiple vector sets with an associated relationship. The terminal determines the behavior state corresponding to the sample feature vector based on the above determined set that has an associated relationship with the sample feature vector, which is called the sample behavior state. The sample behavior state includes a normal state and an abnormal state.

[0189] For multiple sample feature vectors, vector sets associated with each sample feature vector are determined respectively, and based on the vector sets associated with each sample feature vector, the sample behavior state of each sample feature vector is determined respectively.

[0190] Step S103, determining a security label corresponding to each sample program according to the sample behavior state; the security label includes a normal label and an abnormal label.

[0191] Specifically, each sample feature vector has a corresponding sample behavior state. For a sample feature vector, the terminal detects the corresponding sample behavior state. If the sample behavior state is an abnormal state, the terminal determines that the security label of the sample program corresponding to the sample feature vector is an abnormal label, and the security label corresponding to the sample feature vector is also an abnormal label. If the sample behavior state is a normal state, the terminal determines that the security label of the sample program corresponding to the sample feature vector is a normal label, and the security label corresponding to the sample feature vector is also a normal label. It can be known that the security label includes a normal label and an abnormal label. The security label is used to identify the security type of the corresponding sample program. The security type corresponding to the normal label is the normal type. The normal type of program is a program that does not pose any security threats; the security type corresponding to the abnormal label is the abnormal type. The abnormal type of program is a program that poses security threats and may harm the interests of users (for example, leaking information in the terminal).

[0192] Step S104: generating a program identification model according to the plurality of sample programs and the security labels corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0193] Specifically, after the terminal determines the security label corresponding to each sample program, it extracts the feature information of each sample program. Based on the feature information of each sample program and the security label of each sample program, a supervised learning method can be used to train a classification model, which is called a program recognition model (as described above). Figure 2a The detection model 20a in the corresponding embodiment). Supervised learning can be understood as finding the mapping relationship between the feature information of each sample program and the corresponding security label. This mapping relationship is the classification model. When the classification model is applied later, the same method is used to extract the program to be detected (such as the above Figure 2a The characteristic information of the process to be detected in the corresponding embodiment can be directly detected by directly using the above mapping relationship (classification model) to directly detect the security label that matches the characteristic information of the program to be detected. The detected security label is also the security label of the program to be detected, and then the security type of the program to be detected can be determined.

[0194] The supervised learning-based training program recognition model may include: K-nearest neighbor, decision forest, naive Bayes, logistic regression, deep learning encoding, etc. In order to improve the efficiency of the training program recognition model and better represent the features of each sample program, the terminal can still use the above sample feature vector as the feature information of the sample program to represent each sample program, and of course, other feature information of the sample program can also be extracted to represent the sample program.

[0195] Optionally, no matter which method is used to train the program recognition model, the terminal needs to set the hyperparameters of the program recognition model in advance. The hyperparameters are generally set manually based on past experience, which will result in large differences in the effects of program recognition models trained with different hyperparameters.

[0196] In order to improve the generalization ability of the model, K-fold verification can be used to determine the hyperparameters of the program recognition model in advance (hyperparameters are parameters set manually before model training). K-fold verification means that under a set of hyperparameters, the terminal divides the programs carrying security labels into K sets, K-1 sets are used as training sets to train the model under the above hyperparameters, and the remaining set is used as a test set to test the classification error of the above model. When each of the K sets is used as a test set, K errors can be obtained, and the terminal uses the average of the K errors as the error of the current set of hyperparameters. The above is to obtain the error of a set of hyperparameters. In the same way, the errors of multiple sets of different hyperparameters can be obtained. The set of hyperparameters with the smallest error is used as the hyperparameters of the program recognition model. In this way, better model hyperparameters can be selected before training the program recognition model.

[0197] The specific process of determining the model parameters of the program identification model by K-fold verification is as follows: the terminal obtains multiple sets of model parameters as initial model parameters. For example, when the program identification model is trained based on the decision forest, the initial model parameters may include the number of decision trees contained in the decision forest, the number of corresponding sample behavior attributes in each decision tree, etc. The terminal selects a set of initial model parameters from the multiple sets of initial model parameters as training parameters. All sample programs are divided into multiple sets, called program sets, and the number of sample programs contained in each program set is the same or similar. A program set is selected from multiple program sets as the first set, and the remaining program sets are selected as the second set. Under the above-selected training parameters, the terminal trains a classification model based on the sample programs in the second set and the security labels corresponding to the sample programs, which is called anomaly detection model. Based on the trained anomaly detection model, the sample programs in the first set are identified to obtain the predicted security labels output by the anomaly detection model. According to the security labels of the sample programs in the first set (the security labels carried by themselves) and the predicted security labels output by the anomaly detection model, the prediction error is calculated. Among the multiple program sets, a program set is re-selected as the first set, and the anomaly detection model is re-trained under the same set of training parameters to calculate the prediction error again. When each program set is regarded as the first set, the mean of multiple prediction errors is used as the recognition error of the selected training parameters. In this way, the recognition error of a set of initial model parameters is determined based on K-fold verification, and then a set of initial model parameters is reselected as training parameters, and the recognition error of the reselected training parameters is determined by K-fold verification. When all initial model parameters are determined as training parameters, the terminal uses the training parameters (initial model parameters) with the lowest recognition error as the target model parameters, and then the program recognition model can be trained based on the target model parameters, that is, the program recognition model is trained based on the target model parameters on all sample programs. In this way, the rationality of the model hyperparameter values ​​can be guaranteed when the program recognition model is trained subsequently.

[0198] See also Figure 4 , is a flow chart of another program processing method provided by an embodiment of the present invention. The program processing method includes: a data preprocessing module, a clustering labeling module and a classification and prediction module. Obtain the initial program data, and obtain the characteristics of the initial program (original parameter values), and use the values ​​of the 16 behavior parameter attributes (behavior parameter values) in the above Table 1 as program characteristics. According to the bucket method, the numerical values ​​of the program characteristics are converted to obtain a 16-dimensional bucket feature vector (feature vector). Use the isolation forest anomaly detection algorithm or the clustering algorithm to set corresponding labels for the corresponding programs according to the 16-dimensional bucket feature vectors (the specific process of using the isolation forest anomaly detection algorithm to set corresponding labels for the corresponding programs can be found in the following Figure 7The description of the corresponding embodiment; the specific process of using the clustering algorithm to set the corresponding label for the corresponding program can be seen below Fig.10 The classification model is trained by using the random forest algorithm based on the labeled program, and the trained classification model can be used to subsequently identify programs of unknown security types (the specific process of using the random forest algorithm to train the classification model can be found in the following Figure 5 Description of the corresponding embodiment).

[0199] For further information, see Figure 5 , is a flow chart of a process for generating a program recognition model provided by an embodiment of the present invention. Figure 5 As shown, the specific process of generating the program recognition model includes the following steps S201-step S204, and steps S201-step S204 are Figure 3 A specific embodiment of step S104 in the corresponding embodiment:

[0200] The following steps S201-S204 train the program recognition model in the manner of decision forest in supervised learning, and in order to improve the efficiency of training the program recognition model and better represent the characteristics of each sample program, the above-mentioned sample feature vector is used as the feature information of the sample program to represent each sample program.

[0201] Step S201, obtaining the plurality of sample feature vectors, extracting a group of sample feature vectors from the plurality of sample feature vectors as decision vectors, and selecting a plurality of behavior parameter attributes as decision attributes from all behavior parameter attributes included in the decision vectors;

[0202] Specifically, the terminal obtains multiple sample feature vectors, and extracts one sample feature vector each time from all sample feature vectors according to a sampling method with replacement, and extracts multiple times to obtain a group of sample feature vectors, called decision vectors, where the number of extractions is equal to the number of all sample feature vectors. It can be seen that according to the sampling method with replacement, there may be repeated sample feature vectors in a group of decision vectors obtained. The terminal randomly selects multiple behavior parameter attributes as decision attributes from all behavior parameter attributes contained in the decision vector. The behavior parameter value in the decision vector is the value of the behavior parameter attribute. The number of behavior parameter attributes is equal to the number of behavior parameters contained in each decision vector, and the number of randomly selected decision attributes (behavior parameter attributes) is less than the number of all behavior parameter attributes contained in the decision vector.

[0203] Step S202: construct a target decision tree according to the decision attribute, the decision vector, and the security label corresponding to the decision vector.

[0204] Specifically, the terminal creates a virtual tree, called a decision tree, which does not contain any nodes at this time. The terminal calculates the information gain corresponding to each decision attribute. The calculation formula of the information gain can be the following formula (2). The information gain refers to the data complexity of the sample feature vector D contained in the parent node before the split minus the sample feature vector D contained in the child node after the split. j The sum of the data complexity is:

[0205] Gain(A)=Info(D)-Info A (D) (2)

[0206] Where Gain(A) represents the information gain of decision attribute A, Info(D) represents the data complexity of the sample feature vector contained in the parent node before splitting, and Info A (D) represents the sum of the data complexity of the sample feature vectors corresponding to the child nodes after splitting according to the decision attribute A. The calculation method of Info(D) can be referred to formula (3):

[0207]

[0208] Info A The calculation method of (D) can be found in formula (4):

[0209]

[0210] Where m represents the number of types of security labels of the sample feature vector D in the parent node before splitting, and p i represents the probability of the i-th security label appearing in the sample feature vector D of the parent node before the split; n represents the sample feature vector D corresponding to the n child nodes of the sample feature vector D in the parent node before the split j ;

[0211] The terminal uses the decision attribute with the largest information gain as the first attribute. Here, information gain is used as the condition for selecting the first attribute. Information gain rate, Gini coefficient, etc. can also be used as the condition for selecting the first attribute. A node is generated according to the first attribute, called the fifth node, and the fifth node is added to the decision tree. At this time, the decision tree includes the fifth node, and the fifth node at this time is also the root node of the decision tree, which records the first attribute with the largest information gain.

[0212] The terminal uses all decision vectors as the third auxiliary vector, and divides the third auxiliary vector into multiple sets according to the value of the first attribute in the third auxiliary vector (behavior parameter value), which are called the to-be-processed vector sets, where the number of to-be-processed vector sets is equal to the number of types of values ​​of the first attribute in the third auxiliary vector, that is, the values ​​of the first attribute of the sample feature vectors in each to-be-processed vector set are the same. The terminal uses the decision vectors contained in each to-be-processed vector set as the target sub-vector. For a to-be-processed vector set, the terminal calculates the information gain corresponding to each decision attribute based on the target sub-vector in the to-be-processed vector set and the security label corresponding to the target sub-vector, again based on formula (2), formula (3) and formula (4), and also uses the decision attribute with the largest information gain as the second attribute. A node is generated according to the second attribute, called the sixth node, and the sixth node is added to the decision tree as a child node of the fifth node. The behavior parameter value of the first attribute of the decision vector in the target sub-vector is added to the sixth node. At this time, the decision tree includes the fifth node and the sixth node, and the sixth node is a child node of the fifth node. The sixth node records the second attribute with the largest information gain and the value of the first attribute (that is, the splitting condition for the fifth node to split into the sixth node).

[0213] For the remaining vector sets to be processed, the corresponding sixth nodes are generated, and each sixth node is added to the decision tree as a child node of the fifth node. All sixth nodes are sibling nodes. The above describes the process of generating a pair of parent nodes and child nodes in the decision tree. If the decision tree has not reached the convergence condition, the child nodes can be used as new parent nodes in the above manner to continuously split new child nodes.

[0214] The terminal then uses the second attribute as the first attribute, the sixth node as the fifth node, and determines the target sub-vector as the third auxiliary vector. The third auxiliary vector is again divided into multiple sets according to the value of the new first attribute (the second attribute mentioned above) in the new third auxiliary vector, which are also called the set of vectors to be processed. The decision vectors contained in each set of vectors to be processed are used as the target sub-vectors, and the information gain corresponding to each decision attribute is calculated again. The decision attribute with the largest information gain is also used as the second attribute. The terminal generates a node based on the second attribute, called the sixth node, and adds the sixth node to the decision tree as a child node of the new fifth node, and adds the behavior parameter value of the new first attribute in the new target sub-vector to the sixth node, and continuously recursively builds nodes from top to bottom on the decision tree. When the security labels of the sample feature vectors contained in the set of vectors to be processed are the same, that is, when the decision attributes with the largest information gain selected in two adjacent times are the same, it means that no new nodes can be split. The leaf nodes of the decision tree are generated based on the same security labels. The leaf nodes record the same security labels. The terminal then adds the behavior parameter value of the first attribute of the last split of the decision vector contained in the set of vectors to be processed to the leaf nodes. At this point, a decision tree (a classifier) ​​is constructed, and the constructed decision tree is used as the target decision tree. As can be seen from the above, the root node in the decision tree only records the behavior parameter attributes, the non-root nodes and non-leaf nodes record the behavior parameter attributes and the values ​​of the behavior parameter attributes (splitting conditions), and the leaf nodes record the security labels (including normal labels and abnormal labels) and the values ​​of the behavior parameter attributes.

[0215] Step S203: extracting a next group of sample feature vectors from the multiple sample feature vectors as the decision vector.

[0216] Specifically, step S202 is to construct a target decision tree, and the decision forest includes multiple target decision trees. Therefore, the terminal continues to sample with replacement from all sample feature vectors, extracting one sample feature vector each time, extracting multiple times, and obtaining a group of sample feature vectors again, which are called decision vectors. The terminal continues to randomly select multiple behavior parameter attributes as decision attributes from all behavior parameter attributes contained in the decision vector. Based on the selected decision vector and the security label corresponding to each decision vector, the terminal trains a target decision tree again. The cycle is continuous, and a target decision tree is generated in each cycle. Since the decision vectors selected each time are randomly extracted and are not all sample feature vectors, this ensures that each target decision tree is different and does not overfit.

[0217] Step S204: when the number of the target decision trees respectively constructed based on the multiple groups of decision vectors is greater than a second number threshold, all target decision trees are determined as the program recognition model.

[0218] Specifically, when the number of constructed target decision trees is greater than a preset second number threshold, all target decision trees are determined as program recognition models.

[0219] Optionally, the above steps are the process of building a program recognition model. Next, it is described how to identify the program to be detected based on the program recognition model of multiple target decision trees. When the terminal receives a program recognition request, it determines the program to be identified according to the program recognition request, which is called the target program (such as the above Figure 2b The process to be detected in the corresponding embodiment). Similarly, the terminal obtains the behavior parameter value characterizing the operation behavior of the target program, and also combines all the behavior parameter values ​​into a feature vector according to the preset target order. The feature vector corresponding to the target program is called the target feature vector (the behavior parameter attributes corresponding to the target feature vector are the same as the behavior parameter attributes corresponding to the sample feature vector in terms of quantity and type).

[0220] The terminal traverses the target feature vector through each target decision tree in the process identification model, that is, the terminal takes the root node of the target decision tree as the parent node. Since the behavior parameter attributes are recorded in the parent node, the behavior parameter values ​​are determined in all the child nodes of the parent node. According to the behavior parameter attributes and behavior parameter values ​​determined above, as well as the value of the behavior parameter attribute in the target feature vector, the next child node to be visited is determined, wherein the behavior parameter value recorded in the next child node to be visited is the same as the value of the behavior parameter attribute in the target feature vector. Then the child node is taken as the parent node, and recursion is continuously performed to continuously determine the next node to be visited, that is, traversing the target decision tree. The security label recorded by the last leaf node visited is the security label (identification result) output by the target decision tree.

[0221] According to the above method, the terminal traverses the target feature vector through each target decision tree, and each target decision tree will output a security label. After all target decision trees in the program recognition model have output security labels, the terminal counts the sum of the number of normal labels in all output results as the normal number; and counts the sum of the number of abnormal labels as the abnormal number. If the normal number is greater than the abnormal number, it means that the security label that matches the target feature vector (as mentioned above) Figure 2bThe security label 20b) in the corresponding embodiment is a normal label; if the normal number is less than or equal to the abnormal number, then the security label that matches the target feature vector is an abnormal label. The security label of the target feature vector is the security label of the target program. If the security label of the target feature vector is a normal label, it means that the security type of the target program is a normal type, that is, the target program is a normal program; if the security label of the target feature vector is an abnormal label, it means that the security type of the target program is an abnormal type, that is, the target program is a malicious program (abnormal program). It can also be understood that each target decision tree is a weak classifier. When multiple target decision trees (multiple weak classifiers) are combined together, they become a strong classifier. The classification effect of the strong classifier is much stronger than that of the weak classifier. This idea also belongs to ensemble learning.

[0222] See also Figure 6 , is a schematic diagram of constructing a target decision tree provided by an embodiment of the present invention. Figure 6 As shown, there are sample feature vectors corresponding to the existing 6 sample programs (respectively vector 1, vector 2, ..., vector 6), each sample feature vector includes 5 behavior parameter attributes (respectively attribute A, attribute B, ..., attribute E), and each sample feature vector also corresponds to a security label. The terminal extracts a sample feature vector each time according to the random sampling method with replacement, and extracts a total of 6 times, so that 6 decision vectors and the security label corresponding to each decision vector can be obtained. It can be seen that due to the random sampling with replacement, the decision vector may contain multiple identical sample feature vectors, for example, vector 1 and vector 4 are sampled twice, and the sample feature vectors of vector 3 and vector 6 are only sampled once. Among the 5 behavior parameter attributes in the 6 decision vectors extracted above, 4 behavior parameter attributes (select attribute A, attribute C, attribute D and attribute E) are randomly selected as decision attributes. That is, the decision vector is determined by row sampling first, and then the decision attribute is determined by column sampling.

[0223] Among the four decision attributes, the information gain of each decision attribute is calculated using formula (2), formula (3), and formula (4). First, the information gain of decision attribute A is calculated:

[0224]

[0225] Therefore, the information gain of decision attribute A is: 0.91-0.67=0.24; using a similar calculation method, the information gain of decision attribute C can be calculated in turn: 0.91-0=0.91; the information gain of decision attribute D is: 0.91-0.45=0.46; the information gain of decision attribute E is: 0.91-0.80=0.11. Therefore, the decision attribute C (attribute C is also the first attribute) has the largest information gain, and a root node can be created, in which attribute C is recorded. According to the value of decision attribute C (behavior parameter value), decision vectors with the same value are divided into a set of vectors to be processed, that is, decision vector 3 and decision vector 6 (corresponding to attribute C=1) are divided into a set of vectors to be processed; decision vector 1 (corresponding to attribute C=2) is divided into a set of vectors to be processed; decision vector 4 (corresponding to attribute C=3) is divided into a set of vectors to be processed.

[0226] For the set of vectors to be processed that includes decision vector 3 and decision vector 6, since the decision vectors included correspond to only one security label, there is no need to split them again. A leaf node can be generated directly. The leaf node records the security labels of decision vector 3 and decision vector 6: normal. The value of the first attribute in the set, namely "attribute C=1" (that is, the splitting condition), is recorded in the leaf node. The leaf node "normal, attribute C=1" is also a child node of the root node.

[0227] For the set of vectors to be processed that includes decision vector 1, since the decision vectors included therein have only one security label, a leaf node is directly generated. The leaf node records the security label of decision vector 1: abnormal. The value of the first attribute in the set, namely "attribute C=2" (that is, the splitting condition), is recorded in the leaf node, and the leaf node "abnormal, attribute C=2" is used as a child node of the root node. The leaf node is also a brother node of the aforementioned leaf node "normal, attribute C=1".

[0228] For the set of vectors to be processed that includes decision vector 4, since the decision vectors included therein have only one security label, a leaf node is also directly generated. The leaf node records the security label of decision vector 4: normal. The value of the first attribute in the set, namely "attribute C=3" (that is, the splitting condition), is then recorded in the leaf node. The leaf node "normal, attribute C=3" is used as a child node of the root node, and the leaf node is also a brother node of the aforementioned two leaf nodes.

[0229] In this way, a target decision tree 30d is completely constructed, and row sampling and column sampling can be performed again to reconstruct the target decision tree. Multiple target decision trees are decision forests, and decision forests are a program recognition model. In the recognition stage, the recognition process of the terminal based on the target decision tree 30d is: the target vector 1 corresponds to the values ​​of 6 behavior parameter attributes (attribute A, attribute B, ..., attribute E) are (1, 1, 1, 2, 3), respectively, and the attribute recorded in the root node in the target decision tree is determined to be: attribute C, and the value of attribute C in the target vector 1 is determined to be: 1. Among all the child nodes of the root node, it is determined that attribute C = 1 corresponds to the node "normal, attribute C = 1", and the node is already a leaf node, and the security label recorded in the leaf node is output, that is, after the target vector 1 traverses the target decision tree 30d, the target decision tree outputs the result security label as: normal label.

[0230] If in the above example of building the target decision tree, the attribute E (first attribute) with the largest information gain is calculated for the first time, that is, the root node records the attribute E, then according to the value of the attribute E, the decision vector 1, decision vector 3, and decision vector 4 can be divided into a set of vectors to be processed, and the remaining decision vector 6 can be used as a set of vectors to be processed. For the set of vectors to be processed that includes the decision vector 6, a leaf node 1 "normal, attribute E = 1" can be generated, and the leaf node 1 is the child node of the root node. For the set of vectors to be processed that includes the decision vector 1, decision vector 3, and decision vector 4, the attribute with the largest information gain is determined again. If the determined attribute is the attribute C (second attribute), a node 1 is generated, and the attribute C and the attribute E = 2 (the value of the first attribute in the set of vectors to be processed) are recorded in the node 1, and the node 1 is used as the child node of the root node. According to the value of the attribute C, the decision vector 1, decision vector 3, and decision vector 4 are divided into three sets to be processed, and one decision vector corresponds to one set to be processed. For the set to be processed that includes decision vector 1, leaf node 2 "abnormal, attribute C = 2" can be generated, and leaf node 2 is the child node of node 1. For the set to be processed that includes decision vector 3, leaf node 3 "normal, attribute C = 1" can be generated, and leaf node 3 is the child node of node 1. For the set to be processed that includes decision vector 4, leaf node 3 "normal, attribute C = 3" can be generated, and leaf node 4 is also the child node of node 1, and leaf nodes 2, 3 and 4 are sibling nodes.

[0231] Using the behavioral parameter values ​​of the sample program as feature vectors can accurately express the characteristics of the sample program, thereby increasing the accuracy of the subsequent labels obtained based on the feature vectors; at the same time, based on the association between each sample program and the corresponding vector set, the behavioral state of each sample vector can be determined, and the corresponding label can be automatically set for the corresponding sample program. Compared with manual label setting, the efficiency of label setting can be improved and the number of labeled sample programs can be expanded; further, the recognition model obtained using a large number of sample programs carrying labels has a higher recognition accuracy rate.

[0232] For further information, see Figure 7 , is a flowchart of another program processing method provided by an embodiment of the present invention. Figure 7 As shown, the program processing method may include:

[0233] Step S301 : obtaining a plurality of sample programs and obtaining a behavior parameter value respectively corresponding to each sample program, and determining a sample feature vector respectively corresponding to each sample program according to the behavior parameter value respectively corresponding to each sample program.

[0234] The specific implementation of step S301 can be found in the above Figure 3 The step S101 in the corresponding embodiment will not be described in detail here.

[0235] Step S302: obtaining a target isolation forest associated with the plurality of sample feature vectors, and extracting a node record corresponding to a first node in a target isolation tree in the target isolation forest as a first record.

[0236] Specifically, the terminal obtains a trained target isolation forest associated with the sample feature vector. The association here means that when training the target isolation forest, the behavior parameter attributes in the training feature vector used are the same as the behavior parameter attributes in the sample feature vector. The target isolation forest includes multiple target isolation trees. The following steps are described using a target isolation tree as an example. The terminal extracts the node record corresponding to the node (called the first node) in the target isolation tree as the first record. It can be known that the first extraction is the node record corresponding to the root node.

[0237] Step S303: taking the plurality of sample feature vectors as first auxiliary vectors, and dividing the first auxiliary vectors into the vector set according to the first record; the vector set includes the vector set to be divided.

[0238] Specifically, the terminal uses all sample feature vectors as the first auxiliary vectors, and according to the behavior parameter attributes (called node attributes) and behavior parameter values ​​(called node attribute values) recorded in the first record, combines the first auxiliary vectors whose behavior parameter values ​​of the node attributes are greater than the node attribute values ​​into a set, called a vector set; and combines the first auxiliary vectors whose behavior parameter values ​​of the node attributes are less than the node attribute values ​​into a vector set, and the above vector set includes the set to be divided. The first auxiliary vector whose behavior parameter value of the node attribute is equal to the node attribute value does not generate any set, and the first auxiliary vector can stop executing subsequent steps.

[0239] Step S304: extract the node record corresponding to the second node as the second record; the second node is a child node of the first node in the target isolated tree.

[0240] Specifically, the terminal extracts a node record corresponding to a child node of the first node (referred to as a second node) in the target isolated tree, which is referred to as a second record.

[0241] Step S305: Use the second node as the first node, use the second record as the first record, and use the sample feature vector included in the set of vectors to be divided as the first auxiliary vector.

[0242] Specifically, recursively according to the aforementioned method, that is, the terminal uses the second record as the new first record, the second node as the new first node, and the sample feature vector contained in the vector set to be divided as the first auxiliary vector. For a vector set to be divided, the terminal again combines the new first auxiliary vectors whose behavior parameter values ​​of the node attributes are greater than the node attribute values ​​according to the behavior parameter attributes (called node attributes) and behavior parameter values ​​(called node attribute values) recorded in the new first record (the second record in the aforementioned) into a vector set; and combines the new first auxiliary vectors whose behavior parameter values ​​of the node attributes are less than the node attribute values ​​into a vector set, and the above vector set includes the set to be divided. Recursively dividing multiple sample feature vectors into multiple vector sets, it can be known that yes, the same sample feature vector may belong to multiple different vector sets. It should be noted that even if the vector set includes only one sample feature vector, as long as there is a node record in the second node, the vector set containing one sample feature vector will continue to generate a new vector set, and the sample feature vectors contained in multiple vector sets may be the same. When there is no node record in the extracted second node, or the behavior parameter value corresponding to the node attribute of the sample feature vector is the same as the node attribute value, the generation of a new vector set can be stopped.

[0243] Step S306: when there is no node record in the second node, count the number of vector sets associated with the sample feature vector, and determine the height of the sample feature vector in the target isolated tree according to the counted number of vector sets.

[0244] Specifically, when the second node does not contain a node record, it means that the vector set has been generated. For a sample feature vector, the terminal uses the vector set containing the sample feature vector as a vector set associated with the sample feature vector. The terminal counts the number of vector sets containing the sample feature vector, that is, counts the number of vector sets associated with the sample feature vector, and uses the counted number as the height of the sample feature vector in a target isolation tree. The above process can also be understood as: the sample feature vector traverses the target isolation tree, and the terminal determines the height of the sample feature vector in the target isolation tree.

[0245] Step S307: determining the sample behavior state corresponding to the sample feature vector according to the height of the sample feature vector in each target isolation tree.

[0246] Specifically, the above steps are to determine the heights of multiple sample feature vectors in a target isolation tree. Since the target isolation forest includes multiple target isolation trees, the heights of multiple sample feature vectors in each target isolation tree can be determined. For each sample feature vector, the terminal can use formula (5) to calculate the sample anomaly score of each sample feature vector based on the multiple heights:

[0247]

[0248] Among them, x represents the sample feature vector, represents the number of training samples when constructing the target isolated tree; E(h(x)) represents the average height of the sample feature vector x in all target isolated trees in the target isolated forest; The number of training samples is The average value of the path length when . H(i) is the harmonic number, which can be estimated as In(i)+0.577.

[0249] It can be seen from formula (5) that when E(h(x))→0, S→1, that is, the sample anomaly score of the sample feature vector x is close to 1. When S→0, the sample anomaly score of the sample feature vector x is close to 0. When , S→0.5, that is, the sample anomaly score of x is close to 0.5.

[0250] Get the anomaly score threshold. If the sample anomaly score is greater than the anomaly score threshold, the sample behavior state of the corresponding sample feature vector is an abnormal state; if the sample anomaly score is less than or equal to the anomaly score threshold, the sample behavior state of the corresponding sample feature vector is a normal state. The sample anomaly score can also be interpreted as: the probability that the sample program corresponding to the sample feature vector is an abnormal program. The higher the sample anomaly score, the higher the probability that the corresponding sample program is an abnormal program; the lower the sample anomaly score, the lower the probability that the corresponding sample program is an abnormal program.

[0251] For example, sample program A corresponds to sample feature vector A. If it is determined that the sample anomaly score of sample feature vector A is 0.8, and the preset anomaly score threshold is 0.5, since the sample anomaly score of sample feature vector A is greater than the anomaly score threshold (0.8>0.5), it can be determined that the sample behavior state of sample feature vector A is an abnormal state.

[0252] Optionally, since the anomaly score threshold directly determines whether the behavior state of a sample feature vector is normal or abnormal, the specific value of the anomaly score threshold is very important. In order to improve the accuracy of setting security labels for sample programs, the terminal needs to reasonably set the anomaly score threshold. Add a program with a known security label to the sample program. The known security label refers to the security label of the program that is known in advance, and the known security label is the true label of the program. According to the above steps, the sample anomaly score of the program with the known security label can be determined. The terminal can determine the anomaly score threshold based on the sample anomaly score. In order to further accurately determine the sample anomaly score threshold, the terminal can extract the sample anomaly score of the abnormal program in the program with a known security label, and set the anomaly score threshold based on the extracted sample anomaly score.

[0253] Optionally, before calculating the sample anomaly score of each sample feature vector based on the target isolation forest, the terminal needs to build the target isolation forest. The specific process of building the target isolation forest is described below: the terminal obtains multiple training programs, and the security label (security type) of the training program can be known or unknown. Similarly, the terminal extracts parameter values ​​that characterize the operating behavior of the training program as behavioral parameter values, which can also be understood as the value of the behavioral parameter attribute. Combine multiple behavioral parameter values ​​into a vector according to a preset target order, which is called a training feature vector (the behavioral parameter attributes corresponding to the training feature vector and the behavioral parameter attributes corresponding to the sample feature vector are the same in both quantity and type). Each training program has a corresponding training feature vector. The terminal randomly selects a group of training feature vectors from multiple training feature vectors as basis vectors. Of course, the number of basis vectors is less than the number of training feature vectors, and the number of basis vectors is equal to the number of training samples when constructing the target isolation tree in formula (5). Based on the basis vectors and the behavior parameter attributes corresponding to the basis vectors, the terminal constructs an isolated tree, which is called a target isolated tree. In this way, a target isolated tree is constructed. Subsequently, a group of training feature vectors can be randomly selected from all training feature vectors as basis vectors to continue to construct the target isolated tree. When the number of constructed target isolated trees is greater than a preset first number threshold, all constructed target isolated trees are determined as a target isolated forest.

[0254] The specific process of constructing an isolated tree based on the basis vectors and the behavior parameter attributes corresponding to the basis vectors is as follows: the terminal creates a virtual tree, called a node tree. The terminal generates a node based on all the basis vectors, called a third node. The third node is added to the node tree. At this time, the node tree contains the third node. The terminal determines all the basis vectors as the second auxiliary vectors, and randomly selects a behavior parameter attribute from all the behavior parameter attributes contained in the second auxiliary vector as the node attribute. Between the maximum behavior parameter value corresponding to the node attributes of all the second auxiliary vectors and the minimum behavior parameter value corresponding to the node attributes of all the second auxiliary vectors, the terminal randomly selects a value as the node attribute value. The above node attributes and node attribute values ​​are combined into a node record and added to the third node. The second auxiliary vector whose behavior parameter value corresponding to the node attribute is less than the node attribute value is used as the first sub-vector; the second auxiliary vector whose behavior parameter value corresponding to the node attribute is greater than the node attribute value is used as the second sub-vector. The fourth node is generated according to the first sub-vector, and the fourth node is generated according to the second sub-vector. The above two fourth nodes are added to the node tree as child nodes of the third node, and the above two fourth nodes are brother nodes. Preferably, the terminal uses the fourth node corresponding to the first subvector as the left child node of the third node, and uses the fourth node corresponding to the second subvector as the right child node of the third node. In this way, a binary branch of the node tree is constructed, and the basis vectors smaller than the node attribute value are divided into the left subtree, and the basis vectors larger than the node attribute value are divided into the right subtree. Continue recursively, continuously construct binary branches, and generate a binary tree, that is, the fourth node is used as the new third node, and the first subvector and the second subvector are both used as the new second auxiliary vector.

[0255] For the new second auxiliary vector corresponding to the first sub-vector, the terminal randomly selects a behavior parameter attribute from all the behavior parameter attributes contained in the new second auxiliary vector (that is, the first sub-vector mentioned above) as a new node attribute. Between the maximum behavior parameter value corresponding to the new node attributes of all new second auxiliary vectors and the minimum behavior parameter value corresponding to the new node attributes of all new second auxiliary vectors, the terminal randomly selects a value as a new node attribute value. Then combine the above node attributes and node attribute values ​​into a node record and add it to the new third node (that is, the fourth node corresponding to the first sub-vector mentioned above). The terminal uses the new second auxiliary vector whose behavior parameter value corresponding to the node attribute is less than the node attribute value as the new first sub-vector; and uses the new second auxiliary vector whose behavior parameter value corresponding to the node attribute is greater than the node attribute value as the new second sub-vector. Generate a new fourth node and add the newly generated fourth node to the node tree as a child node of the third node. Preferably, the terminal uses the new fourth node corresponding to the new first sub-vector as the left child node of the third node and the new fourth node corresponding to the new second sub-vector as the right child node of the third node. Continuously recursively, when the height of the node tree reaches the height threshold, or when the first sub-vector and the second sub-vector contain only one training feature vector (that is, they are indivisible), it means that the node tree meets the convergence condition. After meeting the convergence condition, the terminal node tree is determined as the target isolated tree. As can be seen from the above, all nodes except leaf nodes in the target isolated tree include node records.

[0256] Before training the target isolation forest, the model hyperparameters can also be determined in advance based on K-fold validation, and then the target isolation forest is trained based on the model hyperparameters. Since the performance of the model needs to be verified, the security labels corresponding to all training feature vectors need to be known in advance. The model hyperparameters of the target isolation forest may include: the height of each target isolation tree, the number of training feature vectors when constructing the target isolation tree, The value of and the number of target isolated trees contained in the target isolation forest. Similar to the K-fold verification to determine the model parameters of the program recognition model, the terminal first divides all the training feature vectors into K groups, and presets multiple groups of model parameters in advance, randomly selects a group of model parameters A, and the terminal trains the auxiliary isolation forest based on the selected model parameters A and K-1 groups of training feature vectors. The terminal verifies the recognition error of the auxiliary isolation forest in the model parameter A based on the remaining 1 group of training feature vectors. In this way, each group of training feature vectors is used as a test set, and the mean of K recognition errors under model parameter A can be obtained. The terminal then randomly selects a model parameter B, and similarly uses K-fold verification to determine the mean of K recognition errors under model parameter B. Continuously cycle, and finally use the model parameter with the smallest mean of recognition error as the model hyperparameter for training the target isolation forest. The terminal can subsequently train the target isolation forest based on the determined model hyperparameters, that is, train the target isolation forest on all training feature vectors based on the determined model hyperparameters.

[0257] See also Figure 8 , is a schematic diagram of constructing a target isolation tree provided by an embodiment of the present invention. As shown in the figure, there are training feature vectors corresponding to 6 existing training programs (respectively vector 1, vector 2, ..., vector 6), and each training feature vector contains 5 behavior parameter attributes (attribute A, attribute B, ..., attribute E). Five training feature vectors (select vector 1, vector 3, vector 4, vector 5, vector 6) are randomly selected from the 6 training feature vectors as basis vectors. The above 5 training feature vectors are all used as second auxiliary vectors, and node 40c (third node) is generated according to the second auxiliary vector, and node 40c is added to the node tree 40z. From the above 5 behavior parameter attributes, the behavior parameter attribute A is randomly selected as the node attribute. The value range of attribute A in the second auxiliary vector is: 0-1. Within the above range, a value 0.2 is randomly selected as the node attribute value. "(attribute A, 0.2)" is combined into a node record and added to node 40c. The second auxiliary vector whose attribute A value is less than 0.2 is used as the first sub-vector, that is, vector 1 and vector 4 are the first sub-vectors. The second auxiliary vector whose attribute A has a value greater than 0.2 is taken as the second sub-vector, that is, vector 3, vector 5 and vector 6 are the second sub-vectors.

[0258] According to the first sub-vector (vector 1 and vector 4), node 40d (the fourth node) is generated, and node 40d is added to the node tree 40z as the left child node of node 40c; according to the second sub-vector (vector 3, vector 5, and vector 6), node 40e (the fourth node) is generated, and node 40e is added to the node tree 40z as the right child node of node 40c. Of course, node 40d can also be used as the right child node of node 40c; node 40e can be used as the left child node of node 40c.

[0259] The left subtree of the node tree 40z is processed, and the above-mentioned first sub-vector is determined as the second auxiliary vector again, that is, vector 1 and vector 4 are used as the second auxiliary vector, and node 40d is used as the new third node. From the above-mentioned 5 behavior parameter attributes, the behavior parameter attribute C is randomly selected as the node attribute. The value range of attribute C in the new second auxiliary vector (vector 1 and vector 4) is: 2-3. Within the above range, a value 2.5 is randomly selected as the node attribute value. "(attribute C, 2.5)" is combined into a node record and added to node 40d (the third node). The second auxiliary vector whose attribute C value is less than 2.5 is used as the first sub-vector again, that is, vector 1 is the first sub-vector. The second auxiliary vector whose attribute C value is greater than 2.5 is used as the second sub-vector, that is, vector 4 is the second sub-vector. Node 40f (the fourth node) is generated according to the first sub-vector (that is, vector 1), and node 40g (the fourth node) is generated according to the second sub-vector (that is, vector 4). Node 40f and node 40g are respectively used as the left and right child nodes of node 40d. Since the first sub-vector and the second sub-vector mentioned above only contain one training feature vector and cannot be divided any further, the left sub-tree of node tree 40z is constructed.

[0260] The right subtree of the node tree 40z is processed, and vector 3, vector 5 and vector 6 are used as the second auxiliary vector, and node 40e is used as the new third node. From the above five behavior parameter attributes, the behavior parameter attribute E is randomly selected as the node attribute. The value range of attribute E in the second auxiliary vector (vector 3, vector 5 and vector 6) is: 1-2. Within the above range, the value 1.3 is randomly selected as the node attribute value. "(attribute E, 1.3)" is combined into a node record and added to node 40e (the third node). The second auxiliary vector whose attribute E value is less than 1.3 is used as the first subvector, that is, vector 6 is the first subvector. The second auxiliary vector whose attribute E value is greater than 1.3 is used as the second subvector, that is, vector 3 and vector 5 are the second subvectors. According to the first subvector, that is, vector 6, node 40h (the fourth node) is generated, and according to the second subvector, that is, vector 3 and vector 5, node 40k (the fourth node) is generated, and node 40h and node 40k are respectively used as the left and right child nodes of node 40e. Since the first sub-vector (vector 6) mentioned above only contains one training feature vector and cannot be divided any further, the division of vector 6 is completed.

[0261] The training vector 3 and the training vector 5 are used as the second auxiliary vector, and the node 40k is used as the new third node. From the above five behavior parameter attributes, the behavior parameter attribute D is randomly selected as the node attribute. The value range of the attribute D in the second auxiliary vector (vector 3, vector 5) is: 2-3. Within the above range, the value 1.3 is randomly selected as the node attribute value. "(attribute D, 2.3)" is combined into a node record and added to node 40k (the third node). The second auxiliary vector whose attribute D value is less than 2.3 is used as the first sub-vector, that is, vector 5 is the first sub-vector. The training feature vector whose attribute D value is greater than 2.3 is used as the second sub-vector, that is, vector 3 is the second sub-vector. According to the first sub-vector, that is, vector 5, the node 40x (the fourth node) is generated, and according to the second sub-vector, that is, vector 3, the node 40y (the fourth node) is generated. Node 40x and node 40y are respectively used as the left and right child nodes of node 40k. Since the first sub-vector and the second sub-vector each contain only one training feature vector and cannot be divided any further, the right sub-tree of the node tree is constructed. At this point, the node tree is constructed and the node tree 40z is used as the target isolated tree 40z.

[0262] See also Figure 9a-9b, is a schematic diagram of determining a sample behavior state provided by an embodiment of the present invention. Based on the trained target isolation tree 40z, the height of the sample feature vector in the above target isolation tree is determined, and then the sample behavior state of the above sample feature vector is determined. As shown in 8a, there are 3 sample feature vectors (vector 7, vector 8 and vector 9). Extract the node record in the root node (first node) of the target isolation tree 40z: (attribute A, 0.2), which is also the first record. According to the first record, the sample feature vectors whose behavior parameter attribute A is greater than 0.2 are divided into a vector set, such as Figure 9b As shown, a vector set 50a composed of vector 7, vector 8, and vector 9 can be obtained. Since there is no sample feature vector with behavior parameter attribute A less than 0.2, there is only one vector set 50a at this time. For vector set 50a, continue to extract node record from the right child node 40e (second node) of the root node: (attribute E, 1.3) (when constructing the target isolated tree, the training feature vector greater than the node attribute value is divided into the right subtree, and the training feature vector less than the node attribute value is divided into the left subtree, so here the node in the right subtree is extracted), and this node record is also the second record. The second node is used as the new first node, and the second record is used as the new first record. According to the new first record, the sample feature vectors in set 50a with behavior parameter attribute E less than 1.3 are divided into vector set 50c (vector 9 is included in vector set 50c). The sample feature vectors in set 50a with behavior parameter attribute E greater than 1.3 are divided into vector set 50b (vector set 50b includes sample vector 7 and vector 8).

[0263] For vector set 50c, since the left child node 40h of node 40e (the new first node) does not contain a node record, there is no need to generate a new vector set for set 50c. Of course, if the left child node 40h of node 40e also includes a node record, even if there is only one sample feature vector in set 50c, a new vector set will continue to be generated.

[0264] For vector set 50b, extract the node record in the right child node 40k (second node) of node 40e (first node): (attribute D, 2.3), which is also the second record. Take the above second node as the new first node, and take the second record as the new first record. According to the new first record, the sample feature vectors in set 50b whose behavior parameter attribute D is less than 2.3 are divided into vector set 50d (vector 7 in vector set 50d), and the sample feature vectors in set 50b whose behavior parameter attribute D is greater than 2.3 are divided into vector set 50e (vector 8 is included in vector set 50e). For vector set 50d, since the left child node 40x of node 40k does not contain node records, there is no need to generate a new vector set for set 50d. Similarly, for vector set 50e, since the right child node 40y of node 40k does not contain node records, there is no need to generate a new vector set for set 50e. Therefore, vector set 50a, vector set 50b and vector set 50d are associated with vector 7; vector set 50a, vector set 50b and vector set 50e are associated with vector 8; vector set 50a and vector set 50c are associated with vector 9. Therefore, the height of sample feature vector 7 in target isolated tree 40z is 3, the height of sample feature vector 8 in target isolated tree 40z is 3, and the height of sample feature vector 9 in target isolated tree 40z is 2.

[0265] The above process can also be understood as: the sample feature vector 7 traverses the target isolated tree 40z, visits the node 40c, visits the node 40e, visits the node 40k and visits the node 40x in sequence, so the height of the sample feature vector 7 in the target isolated tree 40z is 3;

[0266] Sample feature vector 8 traverses the target isolated tree 40z, visits node 40c, visits node 40e, visits node 40k and visits node 40y in sequence, so the height of sample feature vector 8 in the target isolated tree 40z is 3; sample feature vector 9 traverses the target isolated tree 40z, visits node 40c, visits node 40e, visits node 40h in sequence, so the height of sample feature vector 9 in the target isolated tree 40z is 2.

[0267] According to the height corresponding to each sample feature vector, the sample anomaly score of each sample feature vector can be determined based on formula (5), and then the sample behavior state can be determined.

[0268] Step S308: Determine a security label corresponding to each sample program according to the sample behavior state; the security label includes a normal label and an abnormal label.

[0269] Step S309: Generate a program identification model according to the multiple sample programs and the security labels corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0270] The specific implementation of steps S308 to S309 can be found in the above Figure 3 Steps S101 to S104 in the corresponding embodiment will not be described in detail here.

[0271] Using the behavioral parameter values ​​of the sample program as feature vectors can accurately express the characteristics of the sample program, thereby increasing the accuracy of the subsequent labels obtained based on the feature vectors; at the same time, based on the association between each sample program and the corresponding vector set, the behavioral state of each sample vector can be determined, and the corresponding label can be automatically set for the corresponding sample program. Compared with manual label setting, the efficiency of label setting can be improved and the number of labeled sample programs can be expanded; further, the recognition model obtained using a large number of sample programs carrying labels has a higher recognition accuracy rate.

[0272] For further information, see Fig.10 , is a flowchart of another program processing method provided by an embodiment of the present invention. Fig.10 As shown, the program processing method may include:

[0273] Step S401 : obtaining a plurality of sample programs and obtaining a behavior parameter value respectively corresponding to each sample program, and determining a sample feature vector respectively corresponding to each sample program according to the behavior parameter value respectively corresponding to each sample program.

[0274] The specific implementation of step S401 can be found in the above Figure 3 The step S101 in the corresponding embodiment will not be described in detail here.

[0275] Step S402: Select a group of sample feature vectors from the multiple sample feature vectors as a center vector.

[0276] Specifically, the terminal randomly selects a plurality of sample feature vectors from all sample feature vectors as the central vector.

[0277] Step S403: Divide the multiple sample feature vectors into multiple feature clusters according to the distances between the multiple sample feature vectors and the central vector.

[0278] Specifically, the terminal calculates the distance between each sample feature vector and each center vector, and can use the Euclidean distance in the above formula (1) as the distance between two sample feature vectors. The terminal divides each sample feature vector into a feature cluster corresponding to the nearest center vector, so that each sample feature vector can correspond to a feature cluster. It can be seen that the number of feature clusters is equal to the number of center vectors.

[0279] Step S404: Select the sample feature vector located at the center from among all the sample feature vectors included in each feature cluster as the center vector.

[0280] Specifically, for a feature cluster, among all the sample feature vectors contained in the feature cluster, the terminal selects the sample feature vector located at the center as the center vector again. The sample feature vector located at the center of the feature cluster means that the sample feature vector is closest to the other sample feature vectors in the feature cluster. For multiple feature clusters, each feature cluster has a corresponding new center vector. The terminal continues to calculate the distance between all sample feature vectors and the new center vector, continues to determine new feature clusters, and determines a new center vector. The cycle continues, and similar sample feature vectors are continuously clustered into one category.

[0281] Step S405 : when the sample feature vectors contained in each feature cluster remain unchanged, determining the multiple feature clusters as the multiple vector sets.

[0282] Specifically, when the sample feature vectors contained in each feature cluster remain unchanged, or the number of cycles reaches a threshold, the terminal stops clustering and determines each feature cluster as a vector set.

[0283] Step S406, taking the center vector of the vector set that has an association relationship with the sample feature vector as the target center vector, and calculating the center distance between the sample feature vector and the target center vector;

[0284] Specifically, for a sample feature vector, the terminal extracts the center vector of the vector set to which the sample feature vector belongs as the target center vector. The distance between the sample feature vector and the target center vector is calculated as the center distance. The Euclidean distance in the above formula (1) can also be used as the distance between the two sample feature vectors. For multiple sample feature vectors, the terminal can calculate the center distance between the sample feature vector and the center vector of the vector set to which it belongs.

[0285] Step S407: determining the sample behavior state corresponding to the sample feature vector according to the center distance corresponding to the sample feature vector.

[0286] Specifically, the terminal can use the following formula (6) to determine the sample anomaly score corresponding to each sample feature vector according to the center distance corresponding to each sample feature vector.

[0287]

[0288] Among them, d(x) represents the center distance of the sample feature vector x, d max It represents the distance between the sample feature vector farthest from the center vector and the center vector in the feature cluster to which the feature vector x belongs.

[0289] If the center distance of the sample feature vector is large, the sample anomaly score of the sample feature vector is high; if the center distance of the sample feature vector is small, the sample anomaly score of the sample feature vector is low.

[0290] Similarly, the sample anomaly score of each sample feature vector is detected. If the sample anomaly score is greater than the anomaly score threshold, the sample behavior state of the corresponding sample feature vector is an abnormal state; if the sample anomaly score is less than or equal to the anomaly score threshold, the sample behavior state of the corresponding sample feature vector is a normal state.

[0291] Step S408: Determine a security label corresponding to each sample program according to the sample behavior state; the security label includes a normal label and an abnormal label.

[0292] Step S409: Generate a program identification model according to the multiple sample programs and the security labels corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0293] The specific implementation of steps S408 to S409 can be found in the above Figure 3 The steps S103 and S104 in the corresponding embodiment will not be described in detail here.

[0294] See also Fig.11, is another schematic diagram of determining the behavior state of a sample provided by an embodiment of the present invention. There are 6 sample feature vectors (vector 1, vector 2, ..., vector 6), and vector 1 and vector 4 are randomly selected from the above 6 vectors as the center vectors. The remaining 4 vectors are respectively calculated with respect to the distance between vector 1 and vector 4, and the 4 vectors are divided into the feature cluster to which the nearest center vector belongs. It can be obtained that vector 1, vector 2 and vector 3 belong to the same feature cluster; vector 4, vector 5 and vector 6 belong to the same feature cluster. Select vector 2 located at the center from vector 1, vector 2 and vector 3, and use it as the center vector. Select vector 6 located at the center from vector 4, vector 5 and vector 6, and use it as the center vector. Calculate the distance between the remaining 4 vectors and vector 2 and vector 6 respectively, and it can be obtained that vector 1, vector 2 and vector 4 belong to the same feature cluster; vector 3, vector 5 and vector 6 belong to the same feature cluster. If the number of iterations reaches the threshold at this time, clustering is stopped. For the feature clusters corresponding to vector 1, vector 2, and vector 4, the center vector (target center vector) is vector 2. Vector 1 and vector 4 respectively calculate the distance from vector 2, and the anomaly score of each vector is determined according to formula (5). For the feature clusters corresponding to vector 3, vector 5, and vector 6, the center vector (target center vector) is vector 6. Vector 3 and vector 5 respectively calculate the distance from vector 6, and the anomaly score of each vector is determined according to formula (5). Based on the anomaly score of each vector and the anomaly score threshold, the behavior state of each vector is determined.

[0295] Using the behavioral parameter values ​​of the sample program as feature vectors can accurately express the characteristics of the sample program, thereby increasing the accuracy of the subsequent labels obtained based on the feature vectors; at the same time, based on the association between each sample program and the corresponding vector set, the behavioral state of each sample vector can be determined, and the corresponding label can be automatically set for the corresponding sample program. Compared with manual label setting, the efficiency of label setting can be improved and the number of labeled sample programs can be expanded; further, the recognition model obtained using a large number of sample programs carrying labels has a higher recognition accuracy rate.

[0296] For further information, see Fig.12 , is a schematic diagram of the structure of a program processing device provided by an embodiment of the present invention. Fig.12 As shown, the program processing device can be applied to the above Figure 3-Figure 11 Corresponding to the terminal in the embodiment, the program processing device 1 may include: a first acquisition module 11 , a second acquisition module 12 , a score determination module 13 , a label determination module 14 and a model generation module 15 .

[0297] A first acquisition module 11, used to acquire a plurality of sample programs;

[0298] A second acquisition module 12 is used to acquire a behavior parameter value corresponding to each sample program, and determine a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program;

[0299] A score determination module 13, used to divide the sample feature vector into a plurality of vector sets, and determine the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set;

[0300] The label determination module 14 is used to determine the security label corresponding to each sample program according to the sample behavior state; the security label includes a normal label and an abnormal label;

[0301] The model generation module 15 is used to generate a program identification model according to the multiple sample programs and the security labels corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0302] The specific functional implementation of the first acquisition module 11, the second acquisition module 12, the score determination module 13, the label determination module 14 and the model generation module 15 can be found in the above Figure 3 Steps S101 to S104 in the corresponding embodiment will not be described in detail here.

[0303] See also Fig.12 The program processing device 1 may include: a first acquisition module 11, a second acquisition module 12, a score determination module 13, a label determination module 14, and a model generation module 15, and may also include: a third acquisition module 16 and an identification module 17.

[0304] The third acquisition module 16 is used for, when receiving a program identification request, acquiring the target program according to the program identification request, acquiring a behavior parameter value corresponding to the target program, and determining a target feature vector according to the behavior parameter value corresponding to the target program;

[0305] An identification module 17, configured to perform identification processing on the target feature vector based on the program identification model to obtain a security label matching the target feature vector;

[0306] The third acquisition module 16 is further configured to determine the security type indicated by the security tag identified by the program identification model as the security type corresponding to the target program.

[0307] The specific functional implementation of the third acquisition module 16 and the identification module 17 can be found in the above Figure 5 The step S204 in the corresponding embodiment will not be described in detail here.

[0308] See also Fig.12 The second acquisition module 12 may include: a parameter acquisition unit 121 and a value adjustment unit 122.

[0309] The parameter acquisition unit 121 is used to acquire a plurality of original parameter values ​​corresponding to the sample program, and extract the original parameter value representing the program operation behavior from the plurality of original parameter values ​​as the conditional parameter value;

[0310] The numerical adjustment unit 122 is used to adjust the conditional parameter value within the target numerical range to a target numerical value matching the target numerical range, determine the target numerical value as a behavioral parameter value corresponding to the sample program, and combine the behavioral parameter values ​​corresponding to the sample program into the sample feature vector.

[0311] The specific functional implementation of the parameter acquisition unit 121 and the value adjustment unit 122 can be found in the above Figure 3 The step S101 in the corresponding embodiment will not be described in detail here.

[0312] See also Fig.12 The score determination module 13 may include: an extraction unit 131 and a vector statistics unit 132 .

[0313] An extraction unit 131 is used to obtain a target isolation forest associated with the multiple sample feature vectors, and extract a node record corresponding to a first node in a target isolated tree in the target isolation forest as a first record;

[0314] The extraction unit 131 is further configured to use the plurality of sample feature vectors as first auxiliary vectors, and divide the first auxiliary vectors into the vector set according to the first record; the vector set includes the vector set to be divided;

[0315] The extracting unit 131 is further used to extract a node record corresponding to the second node as a second record; the second node is a child node of the first node in the target isolated tree;

[0316] The extraction unit is further configured to use the second node as the first node, the second record as the first record, and the sample feature vector included in the set of vectors to be divided as the first auxiliary vector;

[0317] A vector statistics unit 132, configured to count the number of vector sets associated with the sample feature vector when no node record exists in the second node, and determine the height of the sample feature vector in the target isolated tree according to the counted number of vector sets;

[0318] The vector statistics unit 132 is further configured to determine a sample behavior state corresponding to the sample feature vector according to the height of the sample feature vector in each target isolation tree.

[0319] The specific functional implementation of the extraction unit 131 and the vector statistics unit 132 can be found in the above Figure 7 Steps S302 to S307 in the corresponding embodiment are not described in detail here.

[0320] See also Fig.12 The program processing device 1 may include: a first acquisition module 11, a second acquisition module 12, a score determination module 13, a label determination module 14, a model generation module 15, a third acquisition module 16, and an identification module 17, and may also include: a vector determination module 18 and a construction module 19.

[0321] The vector determination module 18 is used to obtain a plurality of training programs and obtain a behavior parameter value corresponding to each training program, and determine a plurality of training feature vectors according to the behavior parameter value corresponding to each training program;

[0322] The vector determination module 18 is further used to extract a set of training feature vectors from the plurality of training feature vectors as basis vectors;

[0323] A construction module 19, configured to construct a target isolation tree according to the basis vector and all behavior parameter attributes contained in the basis vector;

[0324] The vector determination module 18 is further used to extract a next set of training feature vectors from the multiple training feature vectors as the basis vectors;

[0325] The vector determination module 18 is further configured to determine all target isolated trees as the target isolated forest when the number of target isolated trees respectively constructed based on multiple groups of basis vectors is greater than a first number threshold.

[0326] The specific functional implementation of the vector determination module 18 and the construction module 19 can be found in the above Figure 7 The step S307 in the corresponding embodiment will not be described in detail here.

[0327] See also Fig.12 The construction module 19 may include: a creation unit 191 and a selection unit 192.

[0328] A creating unit 191, configured to create a node tree, generate a third node according to the basis vector, and add the third node to the node tree;

[0329] A selection unit 192 is used to determine the base vector as a second auxiliary vector, select a behavior parameter attribute from all behavior parameter attributes included in the second auxiliary vector as a node attribute, and determine a node attribute value according to the behavior parameter values ​​of the node attributes in all the second auxiliary vectors;

[0330] The selection unit 192 is further configured to combine the node attribute and the node attribute value into a node record and add it to the third node, divide the second auxiliary vector into a first sub-vector and a second sub-vector according to the node attribute and the node attribute value, generate a fourth node according to the first sub-vector and the second sub-vector, and add the fourth node as a child node of the third node to the node tree;

[0331] The selection unit 192 is further configured to determine the fourth node as the third node, and determine both the first sub-vector and the second sub-vector as the second auxiliary vector;

[0332] The selection unit 192 is further configured to determine the node tree as the target isolated tree when the node tree meets a convergence condition.

[0333] The specific functional implementation of the creation unit 191 and the selection unit 192 can be found in the above Figure 7 The step S307 in the corresponding embodiment will not be described in detail here.

[0334] See also Fig.12 The score determination module 13 may include: a vector determination unit 133 and a division unit 134.

[0335] A vector determination unit 133, configured to select a group of sample feature vectors from the plurality of sample feature vectors as a center vector;

[0336] A division unit 134, configured to divide the plurality of sample feature vectors into a plurality of feature clusters according to the distances between the plurality of sample feature vectors and the central vector;

[0337] The division unit 134 is further configured to select a sample feature vector located at the center from among all sample feature vectors included in each feature cluster as the center vector;

[0338] The division unit 134 is further configured to determine the plurality of feature clusters as the plurality of vector sets when the sample feature vectors contained in each feature cluster remain unchanged;

[0339] The division unit 134 is further configured to use the center vector of a vector set that has an association relationship with the sample feature vector as the target center vector, and calculate the center distance between the sample feature vector and the target center vector;

[0340] The division unit 134 is further configured to determine a sample behavior state corresponding to the sample feature vector according to a center distance corresponding to the sample feature vector.

[0341] The specific functional implementation of the vector determination unit 133 and the division unit 134 can be found in the above Fig.10 Steps S402 to S407 in the corresponding embodiment are not described in detail here.

[0342] It should be understood that when the terminal determines the sample behavior state through the extraction unit 131 and the vector statistics unit 132, it will not determine the sample behavior state through the vector determination unit 133 and the division unit 134; conversely, when the terminal determines the sample behavior state through the vector determination unit 133 and the division unit 134, it will not determine the sample behavior state through the extraction unit 131 and the vector statistics unit 132.

[0343] See also Fig.12 The label determination module 14 may include: a detection unit 141 and a label determination unit 142 .

[0344] A detection unit 141, used to detect a sample behavior state corresponding to a sample feature vector;

[0345] A label determination unit 142, configured to determine, when the sample behavior state belongs to an abnormal state, that the security label of the sample program corresponding to the sample feature vector is an abnormal label;

[0346] The label determination unit 142 is further configured to determine that the security label of the sample program corresponding to the sample feature vector is a normal label when the sample behavior state belongs to a normal state.

[0347] The specific functional implementation of the detection unit 141 and the label determination unit 142 can be found in the above Figure 5 The step S204 in the corresponding embodiment will not be described in detail here.

[0348] See also Fig.12 The model generation module 15 may include: a vector acquisition unit 151 and a construction unit 152.

[0349] The vector acquisition unit 151 is used to acquire the multiple sample feature vectors, extract a group of sample feature vectors from the multiple sample feature vectors as a decision vector, and select multiple behavior parameter attributes as decision attributes from all behavior parameter attributes included in the decision vector;

[0350] A construction unit 152, configured to construct a target decision tree according to the decision attribute, the decision vector, and a security label corresponding to the decision vector;

[0351] The vector acquisition unit 151 is further used to extract a next group of sample feature vectors from the multiple sample feature vectors as the decision vector;

[0352] The vector acquisition unit 151 is further configured to determine all target decision trees as the program recognition model when the number of the target decision trees respectively constructed based on the multiple groups of decision vectors is greater than a second number threshold.

[0353] The specific functional implementation of the vector acquisition unit 151 and the construction unit 152 can be found in the above Figure 5 Steps S201 to S204 in the corresponding embodiment are not described in detail here.

[0354] See also Fig.12 The construction unit 152 may include: creating a subunit 1521, adding a subunit 1522, and dividing a subunit 1523.

[0355] A creation subunit 1521 is used to create a decision tree, calculate the information gain corresponding to each decision attribute according to the decision vector and the security label corresponding to the decision vector, and take the decision attribute with the largest information gain as the first attribute;

[0356] An adding subunit 1522, configured to generate a fifth node according to the first attribute, and add the fifth node to the decision tree;

[0357] A division subunit 1523 is used to determine the decision vector as a third auxiliary vector, and divide the third auxiliary vector into a plurality of vector sets to be processed according to a behavior parameter value corresponding to a first attribute in the third auxiliary vector;

[0358] The division subunit 1523 is further configured to use the decision vector included in the set of vectors to be processed as a target subvector;

[0359] The division subunit 1523 is further configured to calculate the information gain corresponding to each decision attribute according to the target subvector and the security label corresponding to the target subvector, and take the decision attribute with the largest information gain as the second attribute;

[0360] The division subunit 1523 is further configured to generate a sixth node according to the second attribute, add the sixth node as a child node of the fifth node to the decision tree, and add the behavior parameter value corresponding to the first attribute in the target subvector to the sixth node;

[0361] The division subunit 1523 is further configured to determine the second attribute as the first attribute, determine the sixth node as the fifth node, and determine the target sub-vector as the third auxiliary vector;

[0362] The division subunit 1523 is also used to generate leaf nodes of the decision tree according to the same security labels in the vector set to be processed when the security labels of the sample feature vectors contained in the vector set to be processed are the same, add the behavior parameter value corresponding to the first attribute of the decision vector in the vector set to be processed to the leaf node, and determine the decision tree as the target decision tree.

[0363] The specific functional implementation methods of creating subunit 1521, adding subunit 1522, and dividing subunit 1523 can be referred to above. Figure 5 The step S202 in the corresponding embodiment will not be described in detail here.

[0364] See also Fig.12 The identification module 17 may include: a traversal unit 171 and a tag counting unit 172 .

[0365] A traversal unit 171, configured to traverse the target feature vector through all target decision trees in the process identification model to determine a security label of the target feature vector in each target decision tree;

[0366] The label counting unit 172 is used to count the sum of the number of normal labels as the normal number, and count the sum of the number of abnormal labels as the abnormal number according to the security labels determined by all target decision trees;

[0367] The label counting unit 172 is further configured to determine that the security label matching the target feature vector is a normal label if the normal number is greater than the abnormal number;

[0368] The label counting unit 172 is further configured to determine that the security label matching the target feature vector is an abnormal label if the normal number is less than or equal to the abnormal number.

[0369] The specific functional implementation of the traversal unit 171 and the tag counting unit 172 can be found in the above Figure 5 The step S204 in the corresponding embodiment will not be described in detail here.

[0370] See also Fig.12 The program processing device 1 may include: a first acquisition module 11, a second acquisition module 12, a score determination module 13, a label determination module 14, a model generation module 15, a third acquisition module 16, a recognition module 17, a vector determination module 18, and a construction module 19, and may also include: a fourth acquisition module 20, an extraction module 21, a training module 22, and a calculation module 23.

[0371] A fourth acquisition module 20, configured to acquire multiple groups of initial model parameters, and select one group of initial model parameters from the multiple groups of initial model parameters as training parameters;

[0372] An extraction module 21, configured to divide the plurality of sample programs into a plurality of program sets, extract a program set from the plurality of program sets as a first set, and extract the remaining program sets as a second set;

[0373] A training module 22, configured to train an anomaly detection model according to the training parameters, the sample programs in the second set, and the security labels respectively corresponding to the sample programs in the second set;

[0374] A calculation module 23, configured to perform identification processing on the sample programs in the first set based on the anomaly detection model to obtain a predicted safety label, and calculate a prediction error according to the safety label of the sample programs in the first set and the predicted safety label;

[0375] The calculation module 23 is further configured to use a mean of a plurality of prediction errors as a recognition error of the training parameter when each program set is determined to be the first set;

[0376] The calculation module 23 is further used to select a next set of initial model parameters from the multiple sets of initial model parameters as the training parameters;

[0377] The calculation module 23 is further used to use the training parameters with the lowest recognition error as target model parameters when each group of initial model parameters is determined as the training parameters; the target model parameters are used to generate the program recognition model.

[0378] The specific functional implementation of the fourth acquisition module 20, the extraction module 21, the training module 22, and the calculation module 23 can be found in the above Figure 3 The step S104 in the corresponding embodiment will not be described in detail here.

[0379] For further information, see Fig.13 , is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 3-Figure 11 The terminal in the corresponding embodiment may be an electronic device 1000, such as Fig.13 As shown, the electronic device 1000 may include: a user interface 1002, a processor 1004, an encoder 1006 and a memory 1008. The signal receiver 1016 is used to receive or send data via a cellular interface 1010, a WIFI interface 1012, ..., or an NFC interface 1014. The encoder 1006 encodes the received data into a data format for computer processing. A computer program is stored in the memory 1008, and the processor 1004 is configured to perform the steps in any of the above method embodiments through the computer program. The memory 1008 may include a volatile memory (e.g., a dynamic random access memory DRAM), and may also include a non-volatile memory (e.g., a one-time programmable read-only memory OTPROM). In some instances, the memory 1008 may further include a memory remotely arranged relative to the processor 1004, and these remote memories may be connected to the electronic device 1000 via a network. The user interface 1002 may include: a receiver 1018 and a display 1020.

[0380] exist Fig.13 In the electronic device 1000 shown, the processor 1004 may be used to call a computer program stored in the memory 1008 to implement:

[0381] Acquire a plurality of sample programs, and acquire a behavior parameter value corresponding to each sample program, and determine a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program;

[0382] Dividing the sample feature vectors into a plurality of vector sets, and determining the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set;

[0383] Determine, according to the sample behavior state, a security label corresponding to each sample program; the security label includes a normal label and an abnormal label;

[0384] A program identification model is generated according to the multiple sample programs and the security labels respectively corresponding to each sample program; the program identification model is used to identify the security type of the target program.

[0385] It should be understood that the electronic device 1000 described in the embodiment of the present invention can execute the above Figures 3 to 11 The description of the program processing method in the corresponding embodiment can also be performed as described above. Fig.12 The description of the program processing device 1 in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of adopting the same method will not be repeated here either.

[0386] In addition, it should be pointed out here that: the embodiment of the present invention further provides a computer storage medium, and the computer storage medium stores a computer program executed by the program processing device 1 mentioned above, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the above-mentioned Figures 3 to 11 The description of the program processing method in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer storage medium embodiment involved in the present invention, please refer to the description of the method embodiment of the present invention.

[0387] A person skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0388] The above disclosure is only the preferred embodiment of the present invention, which certainly cannot be used to limit the scope of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope of the present invention.

Claims

1. A program processing method, characterized in that: include: Acquire a plurality of sample programs, and acquire a behavior parameter value corresponding to each sample program, and determine a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program; Acquire a target isolation forest associated with a plurality of sample feature vectors, and extract a node record corresponding to a first node in a target isolation tree in the target isolation forest as a first record; Using the plurality of sample feature vectors as first auxiliary vectors, and dividing the first auxiliary vectors into a vector set according to the first record; the vector set includes a vector set to be divided; Extracting the node record corresponding to the second node as the second record; The second node is a child node of the first node in the target isolated tree; Taking the second node as the first node, taking the second record as the first record, and taking the sample feature vector contained in the set of vectors to be divided as the first auxiliary vector; When there is no node record in the second node, counting the number of vector sets that are associated with the sample feature vector, and determining the height of the sample feature vector in the target isolated tree according to the number of vector sets counted; Determining a sample behavior state corresponding to the sample feature vector according to the height of the sample feature vector in each target isolation tree; Determine, according to the sample behavior state, a security label corresponding to each sample program; the security label includes a normal label and an abnormal label; A program identification model is generated according to the multiple sample programs and the security labels respectively corresponding to each sample program; the program identification model is used to identify the security type of the target program.

2. The method according to claim 1, characterized in that Also includes: When a program identification request is received, the target program is obtained according to the program identification request, and a behavior parameter value corresponding to the target program is obtained, and a target feature vector is determined according to the behavior parameter value corresponding to the target program; Based on the program recognition model, the target feature vector is identified and processed to obtain a security label that matches the target feature vector, and the security type indicated by the security label identified by the program recognition model is determined as the security type corresponding to the target program.

3. The method according to claim 1, characterized in that The obtaining of the behavior parameter values ​​respectively corresponding to each sample program and determining the sample feature vectors respectively corresponding to each sample program according to the behavior parameter values ​​respectively corresponding to each sample program include: Acquire a plurality of original parameter values ​​corresponding to the sample program, and extract the original parameter value representing the program operation behavior from the plurality of original parameter values ​​as the conditional parameter value; The conditional parameter value within the target numerical range is adjusted to a target numerical value matching the target numerical range, the target numerical value is determined as a behavior parameter value corresponding to the sample program, and the behavior parameter values ​​corresponding to the sample program are combined into the sample feature vector.

4. The method according to claim 1, characterized in that Also includes: Acquire multiple training programs and obtain behavior parameter values ​​corresponding to each training program, and determine multiple training feature vectors according to the behavior parameter values ​​corresponding to each training program; Extracting a set of training feature vectors from the plurality of training feature vectors as basis vectors, and constructing a target isolation tree according to the basis vectors and all behavior parameter attributes contained in the basis vectors; Extracting a next set of training feature vectors from the plurality of training feature vectors as the basis vectors; When the number of the target isolated trees respectively constructed based on the multiple groups of basis vectors is greater than a first number threshold, all the target isolated trees are determined as the target isolated forest.

5. The method according to claim 4, characterized in that The step of constructing a target isolation tree according to the basis vector and all behavior parameter attributes contained in the basis vector comprises: Creating a node tree, generating a third node according to the basis vector, and adding the third node to the node tree; Determine the base vector as a second auxiliary vector, select a behavior parameter attribute from all behavior parameter attributes included in the second auxiliary vector as a node attribute, and determine a node attribute value according to the behavior parameter values ​​of the node attributes in all the second auxiliary vectors; combining the node attribute and the node attribute value into a node record and adding the node record to the third node; dividing the second auxiliary vector into a first sub-vector and a second sub-vector according to the node attribute and the node attribute value; generating a fourth node according to the first sub-vector and the second sub-vector respectively; and adding the fourth node as a child node of the third node to the node tree; Determine the fourth node as the third node, and determine both the first sub-vector and the second sub-vector as the second auxiliary vector; When the node tree meets the convergence condition, the node tree is determined as the target isolated tree.

6. The method according to claim 1, characterized in that The step of determining the security label corresponding to each of the sample programs according to the sample behavior state includes: Detecting the sample behavior state corresponding to the sample feature vector; When the sample behavior state belongs to an abnormal state, determining that the security label of the sample program corresponding to the sample feature vector is an abnormal label; When the sample behavior state belongs to a normal state, the security label of the sample program corresponding to the sample feature vector is determined to be a normal label.

7. The method according to claim 2, characterized in that: The step of generating a program identification model according to the plurality of sample programs and the security tags respectively corresponding to each sample program includes: Acquire the plurality of sample feature vectors, extract a group of sample feature vectors from the plurality of sample feature vectors as a decision vector, and select a plurality of behavior parameter attributes as decision attributes from all behavior parameter attributes included in the decision vector; Constructing a target decision tree according to the decision attribute, the decision vector, and the security label corresponding to the decision vector; Extracting a next set of sample feature vectors from the multiple sample feature vectors as the decision vector; When the number of the target decision trees respectively constructed based on the multiple groups of decision vectors is greater than a second number threshold, all target decision trees are determined as the program recognition model.

8. The method according to claim 7, characterized in that The step of constructing a target decision tree according to the decision attribute, the decision vector, and the security label corresponding to the decision vector includes: Creating a decision tree, calculating the information gain corresponding to each decision attribute according to the decision vector and the security label corresponding to the decision vector, and taking the decision attribute with the largest information gain as the first attribute; generating a fifth node according to the first attribute, and adding the fifth node to the decision tree; Determine the decision vector as a third auxiliary vector, and divide the third auxiliary vector into a plurality of vector sets to be processed according to a behavior parameter value corresponding to a first attribute in the third auxiliary vector; Taking the decision vector included in the set of vectors to be processed as the target sub-vector; According to the target sub-vector and the security label corresponding to the target sub-vector, calculating the information gain corresponding to each decision attribute, and taking the decision attribute with the largest information gain as the second attribute; generating a sixth node according to the second attribute, adding the sixth node as a child node of the fifth node to the decision tree, and adding the behavior parameter value corresponding to the first attribute in the target sub-vector to the sixth node; determining the second attribute as the first attribute, determining the sixth node as the fifth node, and determining the target sub-vector as the third auxiliary vector; When the security labels of the sample feature vectors contained in the set of vectors to be processed are the same, the leaf nodes of the decision tree are generated according to the same security labels in the set of vectors to be processed, the behavioral parameter values ​​corresponding to the first attributes of the decision vectors in the set of vectors to be processed are added to the leaf nodes, and the decision tree is determined as the target decision tree.

9. The method according to claim 7, characterized in that: The step of performing recognition processing on the target feature vector based on the program recognition model to obtain a security label matching the target feature vector includes: Traversing the target feature vector through all target decision trees in the program recognition model to determine a safety label of the target feature vector in each target decision tree; According to the security labels determined by all target decision trees, the sum of the number of normal labels is counted as the normal number, and the sum of the number of abnormal labels is counted as the abnormal number; If the normal number is greater than the abnormal number, determining that the security label matching the target feature vector is a normal label; If the normal number is less than or equal to the abnormal number, it is determined that the security label matching the target feature vector is an abnormal label.

10. The method according to claim 1, characterized in that Before generating a program identification model according to the plurality of sample programs and the security tags respectively corresponding to each sample program, the method further includes: Acquire multiple groups of initial model parameters, and select one group of initial model parameters from the multiple groups of initial model parameters as training parameters; Divide the plurality of sample programs into a plurality of program sets, extract one program set from the plurality of program sets as a first set, and extract the remaining program sets as a second set; training an anomaly detection model according to the training parameters, the sample programs in the second set, and the security labels respectively corresponding to the sample programs in the second set; Based on the anomaly detection model, the sample programs in the first set are identified to obtain predicted safety labels, and a prediction error is calculated according to the safety labels of the sample programs in the first set and the predicted safety labels; When each program set is determined to be the first set, taking a mean value of a plurality of prediction errors as an identification error of the training parameter; Selecting a next set of initial model parameters from the multiple sets of initial model parameters as the training parameters; When each set of initial model parameters is determined as the training parameters, the training parameters with the lowest recognition error are used as target model parameters; the target model parameters are used to generate the program recognition model.

11. A program processing device, characterized in that: include: A first acquisition module, used for acquiring a plurality of sample programs; A second acquisition module is used to acquire a behavior parameter value corresponding to each sample program, and determine a sample feature vector corresponding to each sample program according to the behavior parameter value corresponding to each sample program; A score determination module, used to divide the sample feature vector into a plurality of vector sets, and determine the sample behavior state corresponding to each sample feature vector according to the association relationship between each sample feature vector and the vector set; A label determination module, used to determine the security label corresponding to each sample program according to the sample behavior state; the security label includes a normal label and an abnormal label; A model generation module, used to generate a program identification model according to the plurality of sample programs and the security label corresponding to each sample program; The program identification model is used to identify the security type of the target program; Wherein, the score determination module includes: An extraction unit, configured to obtain a target isolation forest associated with a plurality of sample feature vectors, and extract a node record corresponding to a first node in a target isolation tree in the target isolation forest as a first record; The extraction unit is further configured to use the plurality of sample feature vectors as first auxiliary vectors, and divide the first auxiliary vectors into the vector set according to the first record; the vector set includes the vector set to be divided; The extraction unit is further used to extract a node record corresponding to a second node as a second record; the second node is a child node of the first node in the target isolated tree; The extraction unit is further configured to use the second node as the first node, the second record as the first record, and the sample feature vector included in the set of vectors to be divided as the first auxiliary vector; A vector statistics unit, used for counting the number of vector sets associated with the sample feature vector when there is no node record in the second node, and determining the height of the sample feature vector in the target isolated tree according to the number of vector sets counted; The vector statistics unit is further used to determine the sample behavior state corresponding to the sample feature vector according to the height of the sample feature vector in each target isolation tree.

12. An electronic device, characterized in that: include: Processor and memory; The processor is connected to a memory, wherein the memory is used to store program codes, and the processor is used to call the program codes to execute the method according to any one of claims 1 to 10.

13. A computer storage medium, characterized in that: The computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 10 is executed.

Images