Vulnerability detection method, device and readable storage medium

Abstract

This application discloses a vulnerability detection method, device, and readable storage medium to address the problem of inaccurate detection caused by overfitting of feature parameters when using a deep learning model for vulnerability detection. The method includes: obtaining first physical data when the system is running a normal sample file, and second physical data when the system is running a vulnerability sample file; inputting the first and second physical data into a deep learning model for training to obtain a target deep learning model; obtaining third physical data when the system is running, inputting the third physical data into the target deep learning model, and determining whether the file corresponding to the third physical data is a vulnerability test file.

Description

Technical Field

[0001] The present application relates to the field of computer security technology, and in particular to a vulnerability detection method, device, and readable storage medium. Background Art

[0002] With the rapid development of computer and network technologies, information systems have become widely used in people's work and daily lives. Due to various reasons, vulnerabilities inevitably exist in information systems. Attackers can exploit these vulnerabilities to gain unauthorized access or damage the system, causing significant economic losses. Deep learning models are commonly used to identify vulnerabilities.

[0003] Deep learning models have long been trained using code or logs from vulnerability detection. The composition of logs and code is highly variable, and the data volume is large. This leads to overfitting when constructing vectors from logs or code due to information compression. In practice, this overfitting can lead to missed or false positives for valid information in the logs or code, further impacting vulnerability detection results.

[0004] Therefore, when the existing technology uses deep learning models for vulnerability detection, there is a problem of overfitting of feature parameters leading to inaccurate detection. Summary of the Invention

[0005] The present application provides a vulnerability detection method, device and readable storage medium to solve the problem in the prior art of inaccurate detection results caused by overfitting of feature parameters when using deep learning models for vulnerability detection.

[0006] In a first aspect, the present application provides a vulnerability detection method, the method comprising:

[0007] Obtaining first physical data when the system runs a normal sample file, and second physical data when the system runs a vulnerability sample file; wherein the first physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the normal sample file, and the second physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the vulnerability sample file;

[0008] Inputting the first physical data and the second physical data into a deep learning model for training to obtain a target deep learning model; wherein the target deep learning model indicates, at each moment, a correspondence between the first physical data and normal files, and a correspondence between the second physical data and vulnerable files, wherein the vulnerable files include the vulnerability sample file and the vulnerability test file;

[0009] Acquire third physical data during system operation, input the third physical data into the target deep learning model, and determine whether the file corresponding to the third physical data is a vulnerability test file.

[0010] The method provided in the embodiment of the present application determines the parameters of the input deep learning model as the changes in physical parameters when the system runs normal files and vulnerable files. By reducing the number of feature parameters, the problem of inaccurate detection results caused by overfitting of feature parameters is avoided.

[0011] In one possible implementation, before obtaining the first physical data when the system runs a normal sample file and the second physical data when the system runs a vulnerable sample file, the method includes:

[0012] Adjust the system state to be consistent with the standard state; wherein the standard state includes the standard state of the hard disk, the standard state of the central processing unit, and the standard state of the memory.

[0013] In a possible implementation manner, the changes in the physical parameters of the CPU, memory, and solid-state drive include: thermal infrared images, power, and output voltage change information of the CPU, memory, and solid-state drive at each moment.

[0014] In one possible implementation, inputting the first physical data and the second physical data into a deep learning model for training to obtain a target deep learning model includes:

[0015] In the deep learning model, according to preset rules, the first physical data and the second physical data are respectively converted into a first feature vector and a second feature vector; wherein the first feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state drive status over time when running the normal sample file, and the second feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state drive status over time when running the vulnerability sample file;

[0016] Determine a first difference between the first feature vector and a first standard vector, and a second difference between the second feature vector and a second standard vector; wherein the first standard vector indicates standard characteristics of physical parameters of a central processing unit, a memory, and a solid-state drive during the system's operation of the normal sample file, and the second standard vector indicates standard characteristics of physical parameters of a central processing unit, a memory, and a solid-state drive during the system's operation of the vulnerability sample file; and the first and second differences indicate parameters to be adjusted in the deep learning model;

[0017] Based on the first difference and the second difference, the parameters to be adjusted in the deep learning model are adjusted to obtain the target deep learning model.

[0018] In a possible implementation, the preset rule indicates the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the first feature vector when running the normal sample file, and the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the second feature vector when running the vulnerability sample file.

[0019] In a possible implementation manner, the types of the normal sample files include normal web page sample files and normal office sample files, and the types of the vulnerability sample files include vulnerability web page sample files and vulnerability office sample files;

[0020] The step of obtaining third physical data during system operation, inputting the third physical data into the target deep learning model, and determining whether a file corresponding to the third physical data is a vulnerability test file includes:

[0021] In the target deep learning model, determining the type of the file corresponding to the third physical data, and converting the third physical data into a third feature vector according to the preset rule;

[0022] Based on the type, determining a third standard vector corresponding to the third characteristic vector; wherein the third standard vector includes a normal third standard vector and a vulnerability third standard vector, the normal third standard vector indicating the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive of the system during the process of running a normal file of the type, and the vulnerability third standard vector indicating the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive of the system during the process of running a vulnerable file of the type;

[0023] Based on the third standard vector, it is determined whether the file corresponding to the third physical data is a vulnerability testing file.

[0024] In a second aspect, the present application provides a vulnerability detection device, comprising:

[0025] An acquisition unit is configured to acquire first physical data when the system runs a normal sample file, and second physical data when the system runs a vulnerability sample file; wherein the first physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system runs the normal sample file, and the second physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system runs the vulnerability sample file;

[0026] A training unit is configured to input the first physical data and the second physical data into a deep learning model for training to obtain a target deep learning model; wherein the target deep learning model indicates, at each moment, a correspondence between the first physical data and a normal file, and a correspondence between the second physical data and a vulnerable file, wherein the vulnerable file includes the vulnerability sample file and the vulnerability test file;

[0027] A determination unit obtains third physical data when the system is running, inputs the third physical data into the target deep learning model, and determines whether a file corresponding to the third physical data is a vulnerability test file.

[0028] In a possible implementation manner, the device further includes an adjustment unit, specifically configured to adjust the system state to be consistent with a standard state; wherein the standard state includes a standard state of the hard disk, a standard state of the central processing unit, and a standard state of the memory.

[0029] In a possible implementation manner, the changes in the physical parameters of the CPU, memory, and solid-state drive include: thermal infrared images, power, and output voltage change information of the CPU, memory, and solid-state drive at each moment.

[0030] In a possible implementation manner, the training unit is specifically used to convert the first physical data and the second physical data into a first feature vector and a second feature vector, respectively, in the deep learning model according to preset rules; wherein the first feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state drive status over time when running the normal sample file, and the second feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state drive status over time when running the vulnerability sample file; determine a first difference between the first feature vector and a first standard vector, and a second difference between the second feature vector and a second standard vector; wherein the first standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive during the system running the normal sample file, and the second standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive during the system running the vulnerability sample file, and the first difference and the second difference indicate the parameters to be adjusted in the deep learning model; based on the first difference and the second difference, adjust the parameters to be adjusted in the deep learning model to obtain the target deep learning model.

[0031] In a possible implementation, the preset rule indicates the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the first feature vector when running the normal sample file, and the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the second feature vector when running the vulnerability sample file.

[0032] In a possible implementation manner, the types of the normal sample files include normal web page sample files and normal office sample files, and the types of the vulnerability sample files include vulnerability web page sample files and vulnerability office sample files;

[0033] The determination unit is specifically used to determine the type of the file corresponding to the third physical data in the target deep learning model, and convert the third physical data into a third feature vector according to the preset rules; based on the type, determine the third standard vector corresponding to the third feature vector; wherein, the third standard vector includes a normal third standard vector and a vulnerability third standard vector, the normal third standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk when the system runs a normal file of the type, and the vulnerability third standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk when the system runs a vulnerability file of the type; based on the third standard vector, determine whether the file corresponding to the third physical data is a vulnerability test file.

[0034] In a third aspect, the present application provides a readable storage medium, comprising:

[0035] Memory,

[0036] The memory is used to store instructions. When the instructions are executed by the processor, the device including the readable storage medium performs the method as described in the first aspect and any possible implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flowchart of a vulnerability detection method provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of vulnerability detection based on changes in hardware physical parameters provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of the structure of a vulnerability detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In view of the problem of inaccurate detection results when using deep learning models for vulnerability detection in the existing technology, an embodiment of the present application proposes a vulnerability detection method: using the changes in physical parameters of a file when it is running in the system as feature parameters, training and using the deep learning model, avoiding the problem of feature overfitting caused by too many feature parameters in vulnerability detection in the existing technology, thereby achieving the purpose of improving the accuracy of vulnerability detection.

[0041] In order to better understand the above technical solution, the technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0042] Please refer to Figure 1 The present invention provides a vulnerability detection method to solve the problem of low accuracy in vulnerability detection using deep learning models in the prior art. The method specifically includes the following implementation steps:

[0043] Step 101: Acquire first physical data when the system runs a normal sample file, and second physical data when the system runs a vulnerability sample file.

[0044] Among them, the first physical data indicates the changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the normal sample file, and the second physical data indicates the changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the vulnerability sample file.

[0045] Changes in the physical parameters of the CPU, memory, and SSD can include thermal infrared images, power, and output voltage information for the CPU, memory, and SSD at each moment. This information is recorded using a thermal imaging infrared camera, power meter, and voltmeter while the system is running both normal and vulnerability sample files.

[0046] Specifically, based on the principle of thermal radiation, a thermal imaging infrared camera is used to collect thermal infrared images of the CPU, memory, and solid-state drive when the system is running normal sample files and vulnerability sample files. The thermal infrared images of the CPU, memory, and solid-state drive are then used to determine the overall temperature of the CPU, memory, and solid-state drive when the system is running. At the same time, based on the principle of electrical signal energy conversion, a power meter is used to collect the power changes of the CPU, memory, and solid-state drive when the system is running normal sample files and vulnerability sample files. A voltmeter is used to collect the voltage changes of the CPU, memory, and solid-state drive when the system is running normal sample files and vulnerability sample files.

[0047] It is worth noting that before obtaining the first physical data when the system runs a normal sample file, and the second physical data when the system runs a vulnerability sample file, it is also necessary to adjust the system state to be consistent with the standard state, so that the processing process of all sample files is the same environment, so that the characteristic changes caused by the vulnerability between the first physical data and the second physical data obtained by running the sample file are more prominent. Among them, the standard state includes the standard state of the hard disk, the standard state of the central processing unit, and the standard state of the memory. The method of adjusting the system state to be consistent with the standard state in this step can be a snapshot, that is, using a snapshot to record the starting parameters of the system running any file in the standard state, and then before the system runs the sample file, the system parameters are adjusted to be consistent with the starting parameters.

[0048] Step 102: Input the first physical data and the second physical data into a deep learning model for training to obtain a target deep learning model.

[0049] Among them, the target deep learning model indicates the correspondence between the first physical data and normal files, and the correspondence between the second physical data and vulnerability files at each moment, and the vulnerability files include the vulnerability sample files and the vulnerability test files.

[0050] Specifically, first, in the deep learning model, according to the preset rules, the first physical data and the second physical data are converted into a first feature vector and a second feature vector, respectively. The first feature vector indicates the characteristics of the change of the physical parameters of the central processing unit, memory, and solid-state hard disk state over time when the normal sample file is run, and the second feature vector indicates the characteristics of the change of the physical parameters of the central processing unit, memory, and solid-state hard disk state over time when the vulnerability sample file is run. The preset rules include the arrangement order of the characteristic parameters of the central processing unit, memory, and solid-state hard disk in the feature vector, that is, the second relative position of the change characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk state over time when the normal sample file is run in the first feature vector, and the second relative position of the change characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk state over time when the vulnerability sample file is run in the second feature vector.

[0051] Then, a first difference between the first eigenvector and the first standard vector, and a second difference between the second eigenvector and the second standard vector are determined. The first standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive during the system's execution of the normal sample file, and the second standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive during the system's execution of the vulnerability sample file. The first and second differences indicate parameters to be adjusted in the deep learning model.

[0052] Finally, based on the first difference and the second difference, the parameters to be adjusted in the deep learning model are adjusted to obtain the target deep learning model.

[0053] Step 103: Obtain third physical data during system operation, input the third physical data into the target deep learning model, and determine whether the file corresponding to the third physical data is a vulnerability test file.

[0054] For different file types, the form in which vulnerabilities are hidden in the files may be different. That is, the types of sample files in step 101 include web page files and office sample files (for example, .doc, .xlxs, .PPT). Correspondingly, the types of normal sample files include normal web page sample files and normal office sample files, and the types of vulnerability sample files include vulnerable web page sample files and vulnerable office sample files.

[0055] Therefore, in step 102, it is necessary to train for different types of sample files during the model training process. That is, before converting the first physical data and the second physical data into the first feature vector and the second feature vector respectively according to the preset rules, the first physical data and the second physical data generated by different types of normal sample files and vulnerability sample files are converted into the first feature vector and the second feature vector respectively. In other words, for each type of sample file, a first feature vector and a second feature vector are generated during the model training process. In this way, the target deep learning model obtained through training can further extract features for vulnerability insertion methods of different types of file types, further improving the accuracy of vulnerability detection.

[0056] Correspondingly, the step of using the target deep learning model to determine the vulnerability test file in this step may be: first, in the target deep learning model, determine the type of the file corresponding to the third physical data, and according to the preset rule, convert the third physical data into a third feature vector. Then, based on the type, determine the third standard vector corresponding to the third feature vector. Among them, the third standard vector may include a normal third standard vector and a vulnerability third standard vector. Then, the normal third standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive of the system during the process of running the normal file of the type, and the vulnerability third standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive of the system during the process of running the vulnerability file of the type. Finally, based on the third standard vector, determine whether the file corresponding to the third physical data is a vulnerability test file.

[0057] In summary, when determining whether a file running on the system contains a vulnerability, hardware physical parameters can be extracted as feature parameters of the deep learning model for judgment. Figure 2 This is a schematic diagram of vulnerability detection based on changes in hardware physical parameters provided by this application. Figure 2 As shown, when extracting the running file, the thermal imaging infrared device, power meter, and voltmeter respectively collect the changes in the physical parameters of the hardware (CPU, memory, solid-state drive), and input these physical parameter changes into the deep learning model for feature conversion, and the analysis result of whether the file contains vulnerabilities can be obtained.

[0058] Based on the same inventive concept, a vulnerability detection device is provided in the embodiment of the present application. Figure 1 The vulnerability detection method shown corresponds to the specific implementation of the device, which can be found in the description of the above method embodiment part, and the repeated parts will not be repeated. Figure 3 , the device comprises:

[0059] The acquisition unit 301 is used to acquire first physical data when the system runs a normal sample file, and second physical data when the system runs a vulnerability sample file.

[0060] Among them, the first physical data indicates the changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the normal sample file, and the second physical data indicates the changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the vulnerability sample file.

[0061] Specifically, the changes in the physical parameters of the central processing unit, memory, and solid-state drive include: thermal infrared images, power, and output voltage change information of the central processing unit, memory, and solid-state drive at each moment.

[0062] Training unit 302: used to input the first physical data and the second physical data into a deep learning model for training to obtain a target deep learning model.

[0063] Among them, the target deep learning model indicates the correspondence between the first physical data and normal files, and the correspondence between the second physical data and vulnerability files at each moment, and the vulnerability files include the vulnerability sample files and the vulnerability test files.

[0064] Specifically, first, the first physical data and the second physical data are converted into a first feature vector and a second feature vector, respectively, in the deep learning model according to preset rules. The first feature vector indicates the characteristics of the change of the physical parameters of the central processing unit, memory, and solid-state drive status over time when the normal sample file is run, and the second feature vector indicates the characteristics of the change of the physical parameters of the central processing unit, memory, and solid-state drive status over time when the vulnerability sample file is run.

[0065] Then, a first difference between the first feature vector and the first standard vector, and a second difference between the second feature vector and the second standard vector are determined. The first standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive during the system's execution of the normal sample file, and the second standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive during the system's execution of the vulnerability sample file. The first and second differences indicate parameters to be adjusted in the deep learning model.

[0066] Finally, based on the first difference and the second difference, the parameters to be adjusted in the deep learning model are adjusted to obtain the target deep learning model.

[0067] The preset rule indicates the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the first feature vector when running the normal sample file, and the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the second feature vector when running the vulnerability sample file.

[0068] Determining unit 303: Obtain third physical data during system operation, input the third physical data into the target deep learning model, and determine whether the file corresponding to the third physical data is a vulnerability test file.

[0069] The types of normal sample files include normal web page sample files and normal office sample files, and the types of vulnerability sample files include vulnerability web page sample files and vulnerability office sample files; the determination unit 303 is specifically used to determine the type of file corresponding to the third physical data in the target deep learning model, and convert the third physical data into a third feature vector according to the preset rules; based on the type, determine the third standard vector corresponding to the third feature vector; wherein the third standard vector includes a normal third standard vector and a vulnerability third standard vector, the normal third standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk of the system during the process of running the normal file of the type, and the vulnerability third standard vector indicates the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk of the system during the process of running the vulnerability file of the type; based on the third standard vector, determine whether the file corresponding to the third physical data is a vulnerability test file.

[0070] The vulnerability detection device further includes an adjustment unit, specifically configured to adjust the system state to be consistent with a standard state; wherein the standard state includes a standard state of a hard disk, a standard state of a central processing unit, and a standard state of a memory.

[0071] Based on the same inventive concept, an embodiment of the present application further provides a readable storage medium, including:

[0072] Memory,

[0073] The memory is used to store instructions. When the instructions are executed by the processor, the device including the readable storage medium completes the vulnerability detection method as described above.

[0074] Those skilled in the art will clearly understand that for the sake of convenience and brevity, the division of the above-mentioned functional modules is only used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. The specific working processes of the above-mentioned systems, devices, and units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0075] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the modules or units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0076] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0077] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0078] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a universal serial bus flash disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0079] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A vulnerability detection method, characterized in that: The method comprises: Obtaining first physical data when the system runs a normal sample file, and second physical data when the system runs a vulnerability sample file; wherein the first physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the normal sample file, and the second physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system running the vulnerability sample file; In the deep learning model, according to preset rules, the first physical data and the second physical data are respectively converted into a first feature vector and a second feature vector; wherein the first feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state drive status over time when running the normal sample file, and the second feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state drive status over time when running the vulnerability sample file; Determine a first difference between the first feature vector and a first standard vector, and a second difference between the second feature vector and a second standard vector; wherein the first standard vector indicates standard characteristics of physical parameters of a central processing unit, a memory, and a solid-state drive during the system's operation of the normal sample file, and the second standard vector indicates standard characteristics of physical parameters of a central processing unit, a memory, and a solid-state drive during the system's operation of the vulnerability sample file; and the first and second differences indicate parameters to be adjusted in the deep learning model; Based on the first difference and the second difference, adjusting the parameters to be adjusted in the deep learning model to obtain a target deep learning model; wherein the target deep learning model indicates, at each moment, a correspondence between the first physical data and a normal file, and a correspondence between the second physical data and a vulnerable file, wherein the vulnerable file includes the vulnerable sample file and the vulnerability test file; Acquire third physical data when the system is running, input the third physical data into the target deep learning model, and determine whether the file corresponding to the third physical data is the vulnerability test file.

2. The method according to claim 1, wherein Before obtaining the first physical data when the system runs a normal sample file and the second physical data when the system runs a vulnerability sample file, the method includes: Adjust the system state to be consistent with the standard state; wherein the standard state includes the standard state of the hard disk, the standard state of the central processing unit, and the standard state of the memory.

3. The method according to claim 2, wherein The changes in the physical parameters of the central processing unit, memory, and solid-state hard disk include: thermal infrared images of the central processing unit, memory, and solid-state hard disk at each moment, and change information of power and output voltage.

4. The method according to claim 1, wherein The preset rule indicates the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the first feature vector when running the normal sample file, and the second relative position of the change characteristics of the central processing unit, memory, and solid-state hard disk status over time and physical parameters arranged in the second feature vector when running the vulnerability sample file.

5. The method according to claim 4, wherein The types of normal sample files include normal web page sample files and normal office sample files, and the types of vulnerability sample files include vulnerability web page sample files and vulnerability office sample files; The step of obtaining third physical data during system operation, inputting the third physical data into the target deep learning model, and determining whether a file corresponding to the third physical data is a vulnerability test file includes: In the target deep learning model, determining the type of the file corresponding to the third physical data, and converting the third physical data into a third feature vector according to the preset rule; Based on the type, determining a third standard vector corresponding to the third characteristic vector; wherein the third standard vector includes a normal third standard vector and a vulnerability third standard vector, the normal third standard vector indicating the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive of the system during the process of running a normal file of the type, and the vulnerability third standard vector indicating the standard characteristics of the physical parameters of the central processing unit, memory, and solid-state drive of the system during the process of running a vulnerable file of the type; Based on the third standard vector, it is determined whether the file corresponding to the third physical data is a vulnerability testing file.

6. A vulnerability detection device, characterized in that: The device comprises: An acquisition unit is configured to acquire first physical data when the system runs a normal sample file, and second physical data when the system runs a vulnerability sample file; wherein the first physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system runs the normal sample file, and the second physical data indicates changes in physical parameters of the central processing unit, memory, and solid-state drive during the system runs the vulnerability sample file; Training unit: used to convert the first physical data and the second physical data into a first feature vector and a second feature vector respectively according to preset rules in a deep learning model; wherein, the first feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk state accompanying time when running the normal sample file, and the second feature vector indicates the change characteristics of the physical parameters of the central processing unit, memory, and solid-state hard disk state accompanying time when running the vulnerability sample file; determine the first difference between the first feature vector and the first standard vector, and the second difference between the second feature vector and the second standard vector; wherein, the first standard vector indicates that the system runs the normal sample file During the process of the system running the vulnerability sample file, the standard characteristics of the physical parameters of the central processing unit, the memory, and the solid-state drive, the second standard vector indicates, during the system running the vulnerability sample file, the standard characteristics of the physical parameters of the central processing unit, the memory, and the solid-state drive, the first difference and the second difference indicate the parameters to be adjusted in the deep learning model; based on the first difference and the second difference, the parameters to be adjusted in the deep learning model are adjusted to obtain a target deep learning model; wherein the target deep learning model indicates, at each moment, the correspondence between the first physical data and the normal file, and the correspondence between the second physical data and the vulnerability file, and the vulnerability file includes the vulnerability sample file and the vulnerability test file; A determination unit is configured to obtain third physical data when the system is running, input the third physical data into the target deep learning model, and determine whether the file corresponding to the third physical data is the vulnerability test file.

7. The device according to claim 6, characterized in that The device further includes an adjustment unit, specifically configured to adjust the system state to be consistent with a standard state; wherein the standard state includes a standard state of a hard disk, a standard state of a central processing unit, and a standard state of a memory.

8. A readable storage medium, characterized in that: include, Memory, The memory is used to store instructions. When the instructions are executed by the processor, the device including the readable storage medium performs the method according to any one of claims 1 to 5.

Images