A network threat detection system, method, device, and storage medium

Abstract

The application discloses a network threat detection system, method, device and storage medium, and the method comprises a data distribution module, a sandbox module and a policy decision module; the data distribution module is used for obtaining a to-be-detected sample and distributing the to-be-detected sample to the sandbox module; the sandbox module is used for constructing a virtual running environment, running the to-be-detected sample in the virtual running environment, and extracting feature information of the to-be-detected sample and sending the feature information to the policy decision module; and the policy decision module is used for extracting a time sequence feature vector of the feature information, inputting the time sequence feature vector as an input variable into a preset detection model, and taking an output variable of the preset detection model as a network threat detection result. The network threat detection system disclosed by the application constructs a virtual running environment of a to-be-detected sample based on a sandbox, sends extracted feature information to a policy decision module, uses a set detection model to mine possible network threats, and improves the accuracy of network threat detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network threat detection system, method, device and storage medium. Background Technology

[0002] In cloud-edge collaborative scenarios, the ubiquitous access of various intelligent terminals has led to the continuous expansion of industrial control systems. Unknown network threats, such as vulnerabilities and backdoors, pose significant security threats and challenges. Therefore, real-time awareness of the cybersecurity posture of industrial control systems and facilities helps to promptly identify security threats and provide a reliable basis for subsequent security protection measures. More and more vendors are considering detection methods using virtual execution or simulated environments. This involves using an operating system or browser instance to create a virtual execution container (or sandbox) where malware can execute, mimicking a real user environment, to detect malware behavior during the vulnerability exploitation phase.

[0003] Existing sandbox systems possess a certain capability to detect unknown threats; however, they still have the following issues:

[0004] 1. The main monitoring method relies on the built-in virtual environment to trigger the malicious behavior of the sample (the system version and software version of the virtual environment should be selected with more exploitable vulnerabilities in order to trigger the malicious behavior of the sample as much as possible). However, the serial processing method is prone to the escape of the attack, and the information that can be obtained is limited. The ability to detect and perceive unknown threats needs to be improved.

[0005] 2. In the face of increasingly prevalent distributed and collaborative attacks, the anomaly detection capabilities of a single security component are limited.

[0006] 3. The defense or detection capabilities of network security components depend on the professional knowledge of security personnel and the service support capabilities of the manufacturer. The conditions for their effective operation are quite stringent and there is a great deal of uncertainty, resulting in high maintenance costs in the later stages. Summary of the Invention

[0007] This invention provides a network threat detection system, method, device, and storage medium to improve the accuracy of network threat perception and detection.

[0008] According to one aspect of the present invention, a network threat detection system is provided, the network threat detection system comprising: a data distribution module, a sandbox module, and a policy adjudication module;

[0009] The data distribution module is used to acquire the sample to be tested and distribute the sample to be tested to the sandbox module;

[0010] The sandbox module is used to construct a virtual operating environment, run the sample to be detected in the virtual operating environment, and extract the feature information of the sample to be detected and send it to the policy adjudication module.

[0011] The strategy adjudication module is used to extract the temporal feature vector of the feature information, input the temporal feature vector as an input variable into a preset detection model, and use the output variable of the preset detection model as the network threat detection result.

[0012] Optionally, the sandbox module includes at least three sandbox units, and the network threat detection system further includes a feedback control module, which is used for:

[0013] The target sandbox unit among the at least three sandbox units is determined, and the data distribution module is controlled to distribute the sample to be detected to the target sandbox unit.

[0014] Optionally, the feedback control module is specifically used for:

[0015] Assign a unique number to each of the at least three sandbox units;

[0016] The target number is determined by generating a random number, and the sandbox unit corresponding to the target number is determined as the target sandbox unit.

[0017] Optionally, the strategy adjudication module is specifically used for:

[0018] The feature information is cleaned to obtain standardized data;

[0019] The standardized data is used to extract features to obtain the time-series feature vector.

[0020] Optionally, the preset detection model includes a first detection model, and the strategy adjudication module is specifically used for:

[0021] The fused feature vector is obtained by fusing the time-series feature vectors described above.

[0022] The fused feature vector is input into the first detection model, and the output variable of the first detection model is used as the network threat detection result.

[0023] Optionally, the preset detection model includes at least one second detection model, the second detection model corresponding one-to-one with the temporal feature vector, and the policy decision module is specifically used for:

[0024] Each of the aforementioned time-series feature vectors is input into the corresponding second detection model to obtain the respective detection results;

[0025] The fusion result is obtained based on the detection results, and the fusion result is used as the network threat detection result.

[0026] Optionally, the strategy adjudication module is specifically used for:

[0027] The detection results are subjected to a majority vote, and the fusion result is determined based on the voting results.

[0028] According to another aspect of the present invention, a network threat detection method is provided, the method being applied to a network threat detection system, the network threat detection system including a data distribution module, a sandbox module, and a policy adjudication module, the method comprising:

[0029] The data distribution module acquires the sample to be tested and distributes the sample to be tested to the sandbox module.

[0030] A virtual operating environment is constructed through the sandbox module, the sample to be detected is run in the virtual operating environment, and the feature information of the sample to be detected is extracted and sent to the policy adjudication module.

[0031] The temporal feature vector of the feature information is extracted by the policy adjudication module, and the temporal feature vector is used as an input variable to input the preset detection model. The output variable of the preset detection model is used as the network threat detection result.

[0032] Furthermore, the sandbox module includes at least three sandbox units, the network threat detection system further includes a feedback control module, and the method further includes:

[0033] The target sandbox unit among the at least three sandbox units is determined, and the data distribution module is controlled to distribute the sample to be detected to the target sandbox unit.

[0034] Further, identifying the target sandbox unit among the at least three sandbox units includes:

[0035] Assign a unique number to each of the at least three sandbox units;

[0036] The target number is determined by generating a random number, and the sandbox unit corresponding to the target number is determined as the target sandbox unit.

[0037] Further, the temporal feature vector of the feature information is extracted through the policy decision module, including:

[0038] The feature information is cleaned and processed by the strategy adjudication module to obtain standardized data.

[0039] The standardized data is used to extract features to obtain the time-series feature vector.

[0040] Furthermore, the preset detection model includes a first detection model, which takes the time-series feature vector as an input variable and uses the output variable of the preset detection model as the network threat detection result, including:

[0041] The fused feature vector is obtained by fusing the time-series feature vectors described above.

[0042] The fused feature vector is input into the first detection model, and the output variable of the first detection model is used as the network threat detection result.

[0043] Furthermore, the preset detection model includes at least one second detection model, which corresponds one-to-one with the time-series feature vector. The time-series feature vector is input as an input variable to the preset detection model, and the output variable of the preset detection model is used as the network threat detection result, including:

[0044] Each of the aforementioned time-series feature vectors is input into the corresponding second detection model to obtain the respective detection results;

[0045] The fusion result is obtained based on the detection results, and the fusion result is used as the network threat detection result.

[0046] Furthermore, the fusion result is obtained based on the aforementioned detection results, including:

[0047] The detection results are subjected to a majority vote, and the fusion result is determined based on the voting results.

[0048] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0049] At least one processor; and

[0050] A memory communicatively connected to the at least one processor; wherein,

[0051] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the network threat detection method according to any embodiment of the present invention.

[0052] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the network threat detection method according to any embodiment of the present invention.

[0053] This invention discloses a network threat detection system, comprising: a data distribution module, a sandbox module, and a policy adjudication module. The data distribution module acquires samples to be detected and distributes them to the sandbox module. The sandbox module constructs a virtual operating environment, runs the samples to be detected within this environment, and extracts feature information from the samples, sending it to the policy adjudication module. The policy adjudication module extracts temporal feature vectors from the feature information, uses these vectors as input variables to a preset detection model, and uses the output variables of the preset detection model as the network threat detection result. This network threat detection system, by constructing a virtual operating environment for the samples to be detected using a sandbox, sending the extracted feature information to the policy adjudication module, and utilizing a pre-defined detection model to uncover potential network threats, can improve the accuracy of network threat detection.

[0054] The network threat detection method, device, and storage medium disclosed in this invention also possess the aforementioned technical effects.

[0055] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a schematic diagram of the structure of a network threat detection system according to Embodiment 1 of the present invention;

[0058] Figure 2 This is a schematic diagram of another network threat detection system provided in Embodiment 1 of the present invention;

[0059] Figure 3 This is a schematic diagram of a network threat fusion detection method provided in Embodiment 1 of the present invention;

[0060] Figure 4 This is a schematic diagram of another network threat fusion detection method provided in Embodiment 1 of the present invention;

[0061] Figure 5 This is a flowchart of a network threat detection method provided in Embodiment 2 of the present invention;

[0062] Figure 6This is a schematic diagram of the structure of an electronic device that implements the network threat detection method of Embodiment 3 of the present invention. Detailed Implementation

[0063] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0064] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0065] Example 1

[0066] Figure 1 This is a schematic diagram of a network threat detection system provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where threats that may exist in network information need to be detected. The network threat detection system can be implemented in hardware and / or software. Figure 1 As shown, the system includes: a data distribution module 110, a sandbox module 120, and a strategy adjudication module 130.

[0067] The data distribution module 110 is used to acquire the sample to be tested and distribute the sample to the sandbox module 120.

[0068] The samples to be detected are data and information that may contain malicious programs or Trojan viruses and other network threats that need to be detected by this network threat detection system.

[0069] In this embodiment, the data distribution module 110 can acquire the sample to be detected and distribute it to the sandbox module 120 for detection. Optionally, the sample to be detected can be information such as program behavior and execution environment changes generated during the user's operation of the business system. In order to detect whether the data therein is infected by a virus or Trojan malicious program, it can be distributed to the sandbox module 120 for detection by the data distribution module 110.

[0070] Specifically, for a certain business system, the system cloud carries a massive amount of user identity information. Before a user interacts with the system, the user's identity needs to be verified, which requires downloading data from the cloud. In the cloud environment or when a user downloads data from the cloud, the data is in an uncontrollable state. The data is stored and transmitted between different layers of the network and may be infected by viruses or Trojan malware, inevitably posing a security risk to the host. To detect potential risks in the data, the user can initiate a sample detection request, instructing the data distribution module 110 to transmit the data to be detected, i.e., the sample to be detected, to the sandbox module 120.

[0071] The sample to be tested is actually executed in the controllable analysis environment of the sandbox module 120, and information such as program behavior and changes in the execution environment during the execution process, such as traffic, API call sequence, and changes in the execution environment (e.g., changes in memory attributes), is monitored and collected to enable the sample to complete multi-dimensional detection and in-depth analysis.

[0072] The sandbox module 120 is used to build a virtual operating environment, run the sample to be tested in the virtual operating environment, and extract the feature information of the sample to be tested and send it to the policy adjudication module 130.

[0073] In this embodiment, the sandbox module 120 is a security software that allows a program to run within it. All files and registry entries created, modified, or deleted by the program are virtualized and redirected. This means all operations are virtual, and the real files and registry entries remain untouched. This ensures that viruses cannot modify or damage critical system components. By utilizing the virtual runtime environment constructed by the sandbox module 120, the sample to be tested is executed within this virtual environment, allowing the extraction of feature information that describes the sample's attributes and behavioral characteristics.

[0074] Optionally, the feature information of the sample to be detected includes, but is not limited to, network traffic, opcode sequences, API call sequences, etc.

[0075] Specifically, the sandbox module 120, acting as a virtual execution container, allows the sample to be tested to execute within it, just like in a real user environment. If the sample contains malware, this allows observation of its entire attack lifecycle, from the initial exploitation, subsequent communication with the command and control server, downloading further malicious executables, and subsequent network callbacks, all providing information reflecting its attributes and characteristics. The sandbox module 120 can independently perform tasks such as malware analysis and abnormal traffic detection. By using the sandbox module 120, malware behavior during the exploitation phase can be detected, thus avoiding the false negatives common with other methods that only detect later stages of activity. Furthermore, because the monitoring is based on real malware activity that closely approximates a real user environment, the false positive rate is extremely low.

[0076] The strategy adjudication module 130 is used to extract the temporal feature vector of the feature information, input the temporal feature vector as the input variable into the preset detection model, and use the output variable of the preset detection model as the network threat detection result.

[0077] The temporal feature vector can be a structured feature vector extracted based on feature information, and the preset detection model can be a trained algorithm model. The input of the model is the temporal feature vector, and the output is the network threat detection result, i.e., "network threat exists" or "network threat does not exist".

[0078] In this embodiment, the strategy adjudication module 130 is a key component for mimicry defense, enabling the network threat detection system to perceive generalized uncertain disturbances. After the sandbox module 120 sends the obtained network traffic, opcode sequences, API call sequences, and other feature information to the strategy adjudication module 130, the strategy adjudication module 130 can preprocess this feature information, extract temporal feature vectors, use them as input vectors for a preset detection model, and finally obtain the network threat detection results output by the preset detection model, thereby comprehensively perceiving unknown network threats.

[0079] Optionally, the sandbox module 120 includes at least three sandbox units 121, and the network threat detection system also includes a feedback control module 140, which is used for:

[0080] The target sandbox unit is identified from at least three sandbox units 121, and the control data distribution module distributes the sample to be tested to the target sandbox unit.

[0081] In this embodiment, the sandbox module 120 may include multiple sandbox units 121, each with the same function, capable of independently performing tasks such as malware analysis and abnormal traffic detection. Preferably, each time a sample to be detected is tested, three or more sandbox units 121 can be selected from the sandbox module 120 to construct virtual operating environments, run the sample to be detected in the virtual operating environments, and extract the feature information of the sample to be detected and send it to the policy adjudication module 130. In this way, the accuracy of network threat detection can be improved.

[0082] Figure 2 This is a schematic diagram of another network threat detection system provided in this embodiment. As shown in the figure, the data distribution module 110 distributes the acquired samples to be detected to each sandbox unit 121. Each sandbox unit 121 executes the samples to be detected and monitors and collects feature information during the execution process, which is then sent to the policy decision module 130. The feedback control module 140 can control the multiple sandbox units 121 included in the sandbox module 120, determine the online sandbox unit 121 as the target sandbox unit, and the data distribution module 110 distributes the samples to be detected to the determined online sandbox unit 121.

[0083] Optionally, the feedback control module 140 is specifically used for:

[0084] Assign unique numbers to at least three sandbox units 121; determine the target number by generating a random number, and identify the sandbox unit corresponding to the target number as the target sandbox unit.

[0085] In this embodiment, the feedback control module 140 can control the online and offline status of each sandbox unit 121 in the sandbox module 120. In order to disrupt the collaborative action mechanism that may be established between the various sandbox units 121 by unknown threats, a random scheduling strategy can be adopted to reduce the probability of attackers mastering the system's operating rules and reduce the probability of sandbox escape.

[0086] Specifically, the feedback control module 140 can use a pseudo-random number generation algorithm to ensure the randomness of the online sandbox unit 121, that is, each time one or more sandbox units 121 are randomly selected from the sandbox module 120 for the detection of the sample to be detected.

[0087] Under the condition that the performance of the pseudo-random number algorithm is reliable, it is difficult or almost impossible to find the pattern of the completely random scheduling algorithm and at the same time find the common mode vulnerability between each sandbox unit 121 to achieve sandbox escape.

[0088] Optionally, the strategy adjudication module 130 is specifically used for:

[0089] The feature information is cleaned to obtain standardized data; the language model is used to extract features from the standardized data to obtain time-series feature vectors.

[0090] Data cleaning is a method to improve data quality. It involves reviewing and verifying data to remove duplicate information, correct errors, and ensure data consistency.

[0091] In this embodiment, after obtaining the feature information of the sample to be detected, the strategy decision module 130 can first perform data cleaning to improve the data quality, and then perform feature extraction on the obtained standardized data.

[0092] Specifically, the feature information of the sample to be tested obtained from the strategy adjudication module 130 may contain duplicate, invalid, unnecessary, or secondary data. This data increases processing time and resource consumption, and also impairs the accuracy of identification and evaluation. Data cleaning can remove this data. Furthermore, if the sample to be tested is an executable file, it is necessary to check whether it has been packed by a packer. If it has been packed, it needs to be processed using an unpacker. After unpacking, the unpacked sample to be tested can be disassembled to extract feature information such as opcode sequences and API call sequences.

[0093] Furthermore, language models can be used to extract features from standardized data.

[0094] Preferably, the N-gram algorithm can be used. N-gram is a commonly used language model in large-vocabulary continuous speech recognition. This algorithm can extract corresponding statistical features from feature information such as network traffic, opcode sequences, and API call sequences, mapping multi-source data to a high-dimensional feature vector space. The N-gram algorithm is based on the Markov assumption, which states that the occurrence of a word is only related to the preceding words and not to any other words; the probability of the entire sentence is the product of the probabilities of each word.

[0095] In the N-gram algorithm, for a word sequence (w1 w2…w) consisting of m elements... m The sentence S, composed of ) is represented by the probability model of sentence S as follows:

[0096] P(s) = P(w1) × P(w2) × ... × P(w m )

[0097] =P(w1)×P(w2|w1)×P(w3|w1w2)×...×P(w m |w1w2w3...w m-1 )

[0098] Based on the Markov assumption, assuming a word sequence (w1 w2 … w m one element w in ) i If (1 < i < m) is only related to the first n-1 elements, then we have

[0099]

[0100] Among them, C(w) 1-n+1 …w i ) and C(w 1-n+1 …w i-1 ) are respectively the word sequence (w 1-n+1 …w i ) and (w 1-n+1 …w i-1 The frequency of ) in the corpus. Let C(w) i ) represents element w i In (w1 w2…w m The frequency in (w1 w2 … w) is represented by M. m The total number of words in w) i The probability is expressed as:

[0101]

[0102] For strategy decision module 130, P(w) i That is, the extracted time-series feature vector.

[0103] Optionally, the preset detection model includes a first detection model, and the strategy adjudication module 130 is specifically used for:

[0104] The fused feature vector is obtained by fusing the feature vectors of each time series; the fused feature vector is input into the first detection model, and the output variable of the first detection model is used as the network threat detection result.

[0105] Preferably, the first detection model can be a machine learning model.

[0106] In this embodiment, the strategy adjudication module 130 can utilize the first detection model to uncover behavioral patterns hidden in malware, thereby promptly detecting and discovering potential malware, programs, and other security threats and behaviors. Since different data and their features can only cover a portion of the characteristics of malware and samples, resulting in the loss of other useful information, feature fusion of various temporal feature vectors can be performed to improve the completeness of the dynamic behavior description of samples, thus enhancing the accuracy of anomaly detection and adjudication.

[0107] Specifically, after extracting time-series feature vectors from network traffic, opcode sequences, API call sequences, and other characteristic information, these vectors can be fused in a concatenated manner and input into the first detection model to achieve multi-feature-based adjudication and accurate perception of unknown threats. Let H... p H(x) represents the time-series feature vector extracted from the p-th data source (for example, the time-series feature vectors extracted from network traffic, opcode sequences, API call sequences, etc., can be represented as H1(x), H2(x), and H3(x) respectively). Then, the fused feature vector H(x) can be expressed as:

[0108] H(x) = {H1(x), H2(x), ..., H p (x)}.

[0109] Furthermore, the fused features are input into the trained first detection model for fused feature interpretation, and the output variables can be used as the network threat detection result to determine whether the sample to be detected is abnormal. Preferably, the first detection model can be a machine learning model. For example, considering that SVM is not sensitive to the dimensionality of the input features and can better avoid the curse of dimensionality, Support Vector Machine (SVM) can be selected.

[0110] Figure 3 This is a schematic diagram of a network threat fusion detection method provided by an embodiment of the present invention. The diagram shows a detection method that fuses feature vectors. As shown, the feature information of the sample to be detected obtained by the sandbox module 120 is processed by the N-gram algorithm to obtain the corresponding temporal feature vector. The temporal feature vectors are fused to obtain a fused feature vector. The fused feature vector is input into the first detection model, and the output of the first detection model is used as the network threat detection result.

[0111] Optionally, the preset detection model includes at least one second detection model, which corresponds one-to-one with the temporal feature vector. The policy decision module 130 is specifically used for:

[0112] Each time-series feature vector is input into the corresponding second detection model to obtain its own detection result; the fusion result is obtained based on each detection result, and the fusion result is used as the network threat detection result.

[0113] In this embodiment, in addition to feature vector-level fusion, the policy decision module 130 can also obtain the corresponding model output results based on each time-series feature vector, and then perform decision-level fusion on the model output results.

[0114] For example, if the time-series feature vectors extracted from the three feature information of network traffic, opcode sequence, and API call sequence are time-series feature 1, time-series feature 2, and time-series feature 3 respectively, these three feature vectors are used as input vectors of three second detection models to obtain three output results. After fusing these three output results, the fused result is used as the network threat detection result.

[0115] Figure 4 This is a schematic diagram of another network threat fusion detection method provided by an embodiment of the present invention. This figure shows a detection method that fuses model outputs. As shown in the figure, the feature information of the sample to be detected obtained by the sandbox module 120 is processed by the N-gram algorithm to obtain the corresponding time-series feature vectors. Each time-series feature vector is input into the corresponding second detection model. After fusing the detection results of each second detection model, the fusion result is used as the network threat detection result.

[0116] Optionally, the strategy adjudication module 130 is specifically used for:

[0117] A majority vote was conducted on each test result, and the fusion result was determined based on the voting results.

[0118] In this embodiment, the fusion result can be obtained by performing a mode vote on each detection result. Specifically, the mode vote method can be expressed by the following formula:

[0119] D(x) = argmax k＝{1，...K} V x (k)

[0120] Where D(x) represents the network threat detection result after fusing the sample x to be detected, K is the total number of detection results, and V x (k) represents the voting result for detection result k, k∈{1,…K}, and

[0121]

[0122] Where I represents the recognition function, and D f (x) is the functional expression of the second detection model, and F is the total number of the second detection models.

[0123] This invention discloses a network threat detection system, comprising: a data distribution module, a sandbox module, and a policy adjudication module. The data distribution module acquires samples to be detected and distributes them to the sandbox module. The sandbox module constructs a virtual operating environment, runs the samples to be detected within this environment, and extracts feature information from the samples, sending it to the policy adjudication module. The policy adjudication module extracts temporal feature vectors from the feature information, uses these vectors as input variables to a preset detection model, and uses the output variables of the preset detection model as the network threat detection result. This network threat detection system, by constructing a virtual operating environment for the samples to be detected using a sandbox, sending the extracted feature information to the policy adjudication module, and utilizing a pre-defined detection model to uncover potential network threats, can improve the accuracy of network threat detection.

[0124] Example 2

[0125] Figure 5 This is a flowchart of a network threat detection method provided in Embodiment 2 of the present invention. The method is applied to a network threat detection system, which includes a data distribution module, a sandbox module, and a policy adjudication module. Figure 5 As shown, the method includes:

[0126] S210. Obtain the sample to be tested through the data distribution module and distribute the sample to be tested to the sandbox module.

[0127] In this embodiment, the data distribution module can acquire the sample to be detected and distribute it to the sandbox module for detection. Optionally, the sample to be detected can be information such as program behavior and changes in the execution environment generated during user operation of the business system. To detect whether the data in it is infected by viruses or Trojan malware, it can be distributed to the sandbox module for detection by the data distribution module.

[0128] S220. A virtual operating environment is built through the sandbox module. The sample to be tested is run in the virtual operating environment, and the feature information of the sample to be tested is extracted and sent to the policy adjudication module.

[0129] In this embodiment, the sandbox module 120 is a security software that allows a program to run within it. All files and registry entries created, modified, or deleted by the program are virtualized and redirected. This means all operations are virtual, and the real files and registry entries remain untouched, ensuring that viruses cannot modify or damage critical system components. The virtual runtime environment constructed using the sandbox module 120 allows the sample to be tested to be executed, enabling the extraction of feature information describing the sample's attributes and behavioral characteristics. The sample is actually executed within the sandbox module's controllable analysis environment, and information such as program behavior and execution environment changes during execution, including traffic, API call sequences, and changes in the execution environment (e.g., memory attribute changes), is monitored and collected. This information is then sent to the policy adjudication module to complete multi-dimensional detection and in-depth analysis of the sample.

[0130] Optionally, the sandbox module includes at least three sandbox units, and the network threat detection system also includes a feedback control module. The method also includes:

[0131] The feedback control module determines the target sandbox unit among at least three sandbox units, and the control data distribution module distributes the sample to be tested to the target sandbox unit.

[0132] In this embodiment, the sandbox module may include multiple sandbox units, each with the same function, capable of independently performing tasks such as malware analysis and abnormal traffic detection. Preferably, each time a sample to be detected is tested, the feedback control module can select three or more sandbox units from the sandbox module, allowing them to construct virtual operating environments, run the sample to be detected in these virtual environments, and extract the feature information of the sample to be detected and send it to the policy adjudication module. This approach can improve the accuracy of network threat detection.

[0133] Optionally, the method for determining the target sandbox cell among at least three sandbox cells can be:

[0134] Assign unique numbers to at least three sandbox units; determine the target number by generating a random number, and identify the sandbox unit corresponding to the target number as the target sandbox unit.

[0135] In this embodiment, the feedback control module can control the online and offline status of each sandbox unit 121 in the sandbox module. In order to disrupt the collaborative action mechanism that may be established between the various sandbox units by unknown threats, a random scheduling strategy can be adopted. A pseudo-random number generation algorithm is used to generate random numbers within the range of sandbox unit numbers. Then, the generated random numbers are used as target numbers, and the sandbox unit corresponding to the target number is determined as the target sandbox unit. This reduces the probability of attackers mastering the system's operating rules and lowers the probability of sandbox escape.

[0136] S230. Extract the temporal feature vector of the feature information through the strategy adjudication module, input the temporal feature vector as the input variable into the preset detection model, and use the output variable of the preset detection model as the network threat detection result.

[0137] In this embodiment, the strategy adjudication module is a key component for mimicry defense, enabling the network threat detection system to perceive generalized uncertain disturbances. After the sandbox module sends the obtained network traffic, opcode sequences, API call sequences, and other feature information to the strategy adjudication module, this information is preprocessed to extract temporal feature vectors, which are then used as input vectors for a preset detection model. Finally, the network threat detection results output by the preset detection model are obtained, thus comprehensively perceiving unknown network threats.

[0138] Optionally, the temporal feature vector extracted through the policy decision module can be:

[0139] The feature information is cleaned and processed by the strategy adjudication module to obtain standardized data; the language model is used to extract features from the standardized data to obtain time-series feature vectors.

[0140] In this embodiment, the feature information of the sample to be detected obtained by the strategy adjudication module 130 may contain duplicate, invalid, unnecessary, or secondary data. This data increases processing time and resource consumption, and also impairs the accuracy of identification and evaluation. Data cleaning can remove this data. Furthermore, if the sample to be detected is an executable file, it is also necessary to check whether it has been packed by a packer. If it has been packed, a depacker needs to be used for processing. After depackaging, the depackaged sample to be detected can be disassembled to extract feature information such as opcode sequences and API call sequences. After obtaining standardized data, feature extraction is performed on the standardized data to obtain a temporal feature vector.

[0141] Optionally, the preset detection model includes a first detection model. The method of inputting the time-series feature vector as an input variable into the preset detection model and using the output variable of the preset detection model as the network threat detection result can be as follows:

[0142] The fused feature vector is obtained by fusing the feature vectors of each time series; the fused feature vector is input into the first detection model, and the output variable of the first detection model is used as the network threat detection result.

[0143] In this embodiment, the adjudication module can utilize the first detection model to uncover behavioral patterns hidden in malware, enabling timely detection and discovery of potential malware, programs, and other security threats and behaviors. Since different data and their features can only cover a portion of the characteristics of malware and samples, resulting in the loss of other useful information, feature fusion of various temporal feature vectors can be performed to improve the completeness of the dynamic behavior description of samples, thereby enhancing the accuracy of anomaly detection and adjudication.

[0144] Optionally, the preset detection model includes at least one second detection model, which corresponds one-to-one with the time-series feature vector. The time-series feature vector is input as an input variable to the preset detection model, and the output variable of the preset detection model is used as the network threat detection result. This can be achieved by:

[0145] Each time-series feature vector is input into the corresponding second detection model to obtain its own detection result; the fusion result is obtained based on each detection result, and the fusion result is used as the network threat detection result.

[0146] In this embodiment, in addition to feature vector-level fusion, the policy decision module can also obtain the corresponding model output results based on each time series feature vector, and then perform decision-level fusion on the model output results.

[0147] Furthermore, the method for obtaining the fusion result based on each detection result can be:

[0148] A majority vote was conducted on each test result, and the fusion result was determined based on the voting results.

[0149] The network threat detection method provided in this embodiment of the invention can be executed by the network threat detection system provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the network threat detection system.

[0150] Example 3

[0151] Figure 6 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0152] like Figure 6As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0153] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0154] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as network threat detection methods.

[0155] In some embodiments, the network threat detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the network threat detection described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the network threat detection method by any other suitable means (e.g., by means of firmware).

[0156] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0157] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0158] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0159] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0160] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0161] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0162] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0163] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network threat detection system, characterized in that, include: Data distribution module, sandbox module, and policy adjudication module; The data distribution module is used to acquire the sample to be detected and distribute the sample to the sandbox module; wherein, the sandbox module includes at least three sandbox units, and the sandbox module is used to independently complete malicious program analysis and abnormal traffic detection; The sandbox module is used to construct a virtual operating environment, run the sample to be detected in the virtual operating environment, and extract the feature information of the sample to be detected and send it to the policy adjudication module; wherein, the feature information of the sample to be detected includes network traffic and opcode sequence; The strategy adjudication module is used to extract the temporal feature vector of the feature information, input the temporal feature vector as an input variable into the preset detection model, and use the output variable of the preset detection model as the network threat detection result. Specifically, the strategy adjudication module is used for: The feature information is cleaned to obtain standardized data; The standardized data is used to extract features using a language model to obtain the time-series feature vector; The preset detection model includes a first detection model, and the strategy adjudication module is specifically used for: The fused feature vector is obtained by fusing the time-series feature vectors described above. The fused feature vector is input into the first detection model, and the output variable of the first detection model is used as the network threat detection result.

2. The system according to claim 1, characterized in that, The network threat detection system further includes a feedback control module, which is used for: The target sandbox unit among the at least three sandbox units is determined, and the data distribution module is controlled to distribute the sample to be detected to the target sandbox unit.

3. The system according to claim 2, characterized in that, The feedback control module is specifically used for: Assign a unique number to each of the at least three sandbox units; The target number is determined by generating a random number, and the sandbox unit corresponding to the target number is determined as the target sandbox unit.

4. The system according to claim 1, characterized in that, The preset detection model includes at least one second detection model, and the second detection model corresponds one-to-one with the temporal feature vector. The policy adjudication module is specifically used for: Each of the aforementioned time-series feature vectors is input into the corresponding second detection model to obtain the respective detection results; The fusion result is obtained based on the detection results, and the fusion result is used as the network threat detection result.

5. The system according to claim 4, characterized in that, The strategy adjudication module is specifically used for: The detection results are subjected to a majority vote, and the fusion result is determined based on the voting results.

6. A method for detecting network threats, characterized in that, The method is applied to a network threat detection system, which includes a data distribution module, a sandbox module, and a policy adjudication module. The method includes: The data distribution module acquires the sample to be detected and distributes the sample to the sandbox module; wherein, the sandbox module includes at least three sandbox units, and the sandbox module is used to independently complete malicious program analysis and abnormal traffic detection; A virtual operating environment is constructed through the sandbox module, the sample to be tested is run in the virtual operating environment, and the feature information of the sample to be tested is extracted and sent to the policy adjudication module; wherein, the feature information of the sample to be tested includes network traffic and opcode sequence; The temporal feature vector of the feature information is extracted by the policy adjudication module, and the temporal feature vector is used as an input variable to input the preset detection model. The output variable of the preset detection model is used as the network threat detection result. The step of extracting the temporal feature vector of feature information through the strategy adjudication module includes: cleaning the feature information through the strategy adjudication module to obtain standardized data; and extracting features from the standardized data using a language model to obtain the temporal feature vector. The preset detection model includes a first detection model. The method of inputting the time-series feature vector as an input variable into the preset detection model and using the output variable of the preset detection model as the network threat detection result is as follows: The fused feature vector is obtained by fusing the time-series feature vectors described above. The fused feature vector is input into the first detection model, and the output variable of the first detection model is used as the network threat detection result.

7. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the network threat detection method of claim 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the network threat detection method of claim 6.

Images