A virus-invaded system recovery method and system

Abstract

The present invention discloses a virus-invaded system recovery method and system. A tree is constructed according to the path of a damaged file to reflect the path and category of the damaged file. The number of files contained in the damaged file is determined according to a registry. The file category of the most files contained in the damaged file is determined through a network through the operation statement of a log file. Thus, the corresponding file category is found more accurately. A new tree structure is constructed according to the number of files and the file category. By traversing the tree structure, files of the corresponding number of damaged files and the corresponding file category can be generated. When a file is irreversibly damaged, the type can be restored to know which data is lost, and the same category can be automatically generated, and then the data can be manually added or automatically updated again. The technical effect of being able to restore system files of corresponding file types without backup data is achieved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a virus-invaded system recovery method and system. Background Art

[0002] Currently, virus intrusion refers to the behavior of malicious software invading computer systems through various means to damage, tamper with or steal user information. Some viruses will delete, encrypt or tamper with important user data, making the data inaccessible or unusable. System recovery refers to the process of taking a series of measures to restore the system to normal after the system is invaded by a virus. For damaged or tampered system files, they can be restored through system backup, repair tools or reinstalling the operating system. However, backing up all data will consume a lot of computer resources. When a folder on the computer has been damaged and the file is irreversibly damaged, it is impossible to know the file content contained in the folder, making it difficult to restore to the situation before the virus invasion. Summary of the invention

[0003] The purpose of the present invention is to provide a virus-invaded system recovery method and system to solve the above-mentioned problems existing in the prior art.

[0004] In a first aspect, an embodiment of the present invention provides a method for recovering a system invaded by a virus, comprising:

[0005] Obtaining a log file, a damaged file and an undamaged file after virus invasion; the log file includes a plurality of damaged files and a plurality of operation statements of undamaged files; the undamaged file is a file that is not damaged after virus invasion; the damaged file is a file that is damaged after virus invasion;

[0006] According to the damaged file, a damaged file tree is obtained; the damaged file tree indicates the damaged file path and the category of the file;

[0007] Obtain the number of files contained in the damaged file in the registry to obtain the number of damaged files;

[0008] According to the log file, the damaged file and the undamaged file, a damaged file type is obtained through a file identification network; the damaged file type indicates the file type of a file whose damaged file contains the number of damaged files;

[0009] According to the damaged file quantity, damaged file type and damaged file tree, a generated file tree is obtained; the generated file tree includes a generated location and a type corresponding to the location;

[0010] Generate files according to the generated file tree;

[0011] The file generated by the generated file tree is a file of a corresponding damaged file type generated at the damaged file location, and the data is automatically updated in the generated file;

[0012] Delete some damaged files and modify the information pointing to some damaged files in the registry to the generated files.

[0013] Optionally, obtaining the damaged file type through a file identification network according to the log file, the damaged file and the undamaged file includes:

[0014] Finding the operation statement corresponding to the undamaged file in the log file to obtain an undamaged operation set; finding the operation statement corresponding to the damaged file in the log file to obtain a damaged operation set;

[0015] Obtaining an undamaged file type; the undamaged file type indicates a file type of an undamaged file;

[0016] Training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network;

[0017] The damaged operation set is input into a trained file discrimination network to obtain a damaged file type.

[0018] Optionally, the file discrimination network includes a semantic convolutional network and an attention network; the attention network includes a first convolutional network, a second convolutional network, a third convolutional network and a first neural network.

[0019] Optionally, the training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network includes:

[0020] The undamaged operation set is used to construct a two-dimensional matrix to obtain an undamaged operation matrix; multiple undamaged operation matrices are obtained corresponding to multiple undamaged operation sets;

[0021] Obtaining an undamaged two-dimensional convolution kernel; the size of the undamaged two-dimensional convolution kernel is 1xn; n represents the number of rows of the damaged operation matrix;

[0022] Convolving the undamaged operation matrix with an undamaged two-dimensional convolution kernel with a step size of 1 to obtain a first undamaged operation feature vector; obtaining multiple undamaged operation feature vectors corresponding to multiple undamaged operation matrices;

[0023] Based on the undamaged operation matrix and the undamaged file type, obtaining a second undamaged operation feature vector through an attention network;

[0024] After fusing the first undamaged operation feature vector and the second undamaged operation feature vector, the resultant vectors are input into a classification network to obtain a predicted file type;

[0025] The loss is calculated between the predicted file type and the corresponding undamaged file type, and the discriminant network is trained by backpropagation to obtain a trained discriminant network.

[0026] Optionally, the obtaining of a second undamaged operation feature vector based on the undamaged operation matrix and the undamaged file type by focusing on a network comprises:

[0027] Adding the undamaged operation matrices of the same undamaged file type in the multiple undamaged operation matrices into a set as an undamaged set of the same category; obtaining multiple undamaged sets of the same category corresponding to the multiple undamaged file types;

[0028] Extract all the operation statements that appear in the undamaged operation matrix in the undamaged set of the same category to obtain the same operation matrix;

[0029] Extracting non-overlapping operation statements between the plurality of undamaged sets of the same category to obtain a non-overlapping operation matrix;

[0030] Inputting the same operation matrix into a first convolutional network, extracting features for distinguishing the same undamaged file types, and obtaining the same operation features;

[0031] The operation statements in the intact operation matrix that overlap with the non-overlapping operation matrix are used as the non-overlapping damaged operation matrix;

[0032] Inputting the non-overlapping damaged operation matrix into a second convolutional network, extracting features for distinguishing different types of undamaged files, and obtaining non-overlapping operation features;

[0033] Inputting the undamaged operation matrix into a third convolutional network, extracting features of the undamaged operation matrix, and obtaining undamaged operation features;

[0034] The same operation features, non-overlapping operation features and undamaged operation features are input into the first neural network to obtain a second undamaged operation feature vector.

[0035] Optionally, obtaining a damaged file tree according to the damaged file includes:

[0036] The file path of the damaged file is used as the damaged file path;

[0037] Construct a damaged file tree according to multiple damaged file paths.

[0038] Optionally, constructing a damaged file tree according to multiple damaged file paths includes:

[0039] Take the root directory as the root node;

[0040] Use the files and folders in the root directory of the damaged file path as the second file;

[0041] If the second file does not exist in the damaged file tree, a child node of the root node is newly created, and the value in the child node represents the category of the second file.

[0042] Optionally, generating a file tree according to the number of damaged files, the types of damaged files and the damaged file tree includes:

[0043] At the leaf node in the damaged file tree, generate child nodes of the number of damaged files to obtain a first generated file tree;

[0044] The value corresponding to the child node generated in the first generated file tree is set as the damaged file type to obtain a generated file tree.

[0045] The damaged file tree represents the path of the damaged file. After detection, the number of files contained in the damaged file and the corresponding file categories are obtained. The nodes corresponding to these files are added to the leaf nodes of the damaged file tree to construct a new generated file tree.

[0046] Optionally, obtaining a generated file according to the generated file tree includes:

[0047] The generated file tree is traversed in order to obtain a damaged file position, and a file of a corresponding damaged file type is generated at the damaged file position.

[0048] The damaged position indicates the final position reached through the path of the damaged file, and is also the leaf node position of the generated file tree.

[0049] Among them, in this embodiment, in-order traversal is adopted because the construction method of generating the file tree is more consistent with the path corresponding to the file.

[0050] In a second aspect, an embodiment of the present invention provides a system recovery system for virus invasion, including:

[0051] Acquisition module: obtains log files, damaged files and undamaged files after virus invasion; the log files include multiple operation statements of multiple damaged files and undamaged files; the undamaged files are files that are not damaged after virus invasion; the damaged files are files that are damaged after virus invasion;

[0052] A damaged tree construction module: a damaged file tree is obtained according to the damaged file; the damaged file tree indicates the damaged file path and the file category;

[0053] Damaged file number acquisition module: obtains the number of files contained in the damaged file in the registry to obtain the number of damaged files;

[0054] File type identification module: according to the log file, damaged files and undamaged files, obtain the damaged file type through the file identification network; the damaged file type indicates the file type of the damaged file containing the number of damaged files;

[0055] Obtaining a generated file tree module: obtaining a generated file tree according to the number of damaged files, the type of damaged files and the damaged file tree; the generated file tree includes a generated location and a type corresponding to the location;

[0056] Generating file module: obtaining generating file according to the generating file tree;

[0057] Registry modification module: Delete some damaged files and modify the information pointing to some damaged files in the registry to the generated files.

[0058] Compared with the prior art, the embodiments of the present invention achieve the following beneficial effects:

[0059] The embodiment of the present invention also provides a method and system for recovering a system invaded by a virus, the method comprising: obtaining a log file, a damaged file and an undamaged file after the virus invasion. The log file comprises a plurality of operation statements for a plurality of damaged files and an undamaged file. The undamaged file is a file that is not damaged after the virus invasion. The damaged file is a file that is damaged after the virus invasion. According to the damaged file, a damaged file tree is obtained. The damaged file tree indicates the file path and the category of the file after the damage. The number of files contained in the damaged file is obtained in the registry to obtain the number of damaged files. According to the log file, the damaged file and the undamaged file, the damaged file type is obtained through a file discrimination network. The damaged file type indicates the file type of the file containing the number of damaged files in the damaged file. According to the number of damaged files, the damaged file type and the damaged file tree, a generated file tree is obtained. The generated file tree includes the generated location and the type corresponding to the location. According to the generated file tree, a file is generated. Some damaged files are deleted, and the information pointing to some damaged files in the registry is modified to the generated file.

[0060] A tree is constructed based on the path of the damaged file to reflect the path and category of the damaged file. The number of files contained in the damaged file is determined based on the registry. Through the operation statements of the log file, the file category of the damaged file with the most files is determined through the network. In this way, the corresponding file category can be found more accurately. A new tree structure is constructed based on the number of files and file categories. By traversing the tree structure, files with the corresponding number of damaged files and corresponding file categories can be generated. When the file is irreversibly damaged, the type can be restored to know which data has been lost, and the same category can be automatically generated. After that, the data can be manually added or automatically updated again. The technical effect of being able to restore system files of corresponding file types without backup data is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 The present invention provides a flowchart of a virus-invaded system recovery method. DETAILED DESCRIPTION

[0062] The present invention will be described in detail below in conjunction with the accompanying drawings.

[0063] Example 1

[0064] like Figure 1 As shown, an embodiment of the present invention provides a system recovery method for virus invasion, the method comprising:

[0065] S101: Obtaining a log file, a damaged file, and an undamaged file after virus invasion. The log file includes multiple damaged files and multiple operation statements of undamaged files. The undamaged file is a file that is not damaged after virus invasion. The damaged file is a file that is damaged after virus invasion.

[0066] The log file contains operations on the file at multiple time points in the time period from the backup file to the damaged file.

[0067] S102: Obtain a damaged file tree according to the damaged file; the damaged file tree indicates the damaged file path and file category.

[0068] S103: Obtain the number of files included in the damaged file in the registry to obtain the number of damaged files.

[0069] S104: Obtain the damaged file type through a file identification network according to the log file, damaged files and undamaged files. The damaged file type indicates the file type of the file whose damaged file contains the number of damaged files.

[0070] If the damaged file is a document file, then the damaged file type indicates the corresponding document file. If the damaged file is a file containing an image file and a document file, then the damaged file contains the image file and the document file.

[0071] S105: Obtain a generated file tree according to the damaged file quantity, damaged file type and damaged file tree; the generated file tree includes a generated location and a damaged file type corresponding to the location.

[0072] S106: Generate a file according to the generated file tree.

[0073] S107: deleting some damaged files, and modifying the information pointing to some damaged files in the registry to the generated files.

[0074] The name in the registry is modified to the name of the currently generated file. The file inclusion relationship in the registry is modified to the folder where the currently generated file is located.

[0075] Optionally, obtaining the damaged file type through a file identification network according to the log file, the damaged file and the undamaged file includes:

[0076] Find the operation statement corresponding to the undamaged file in the log file to obtain the undamaged operation set. Find the operation statement corresponding to the damaged file in the log file to obtain the damaged operation set.

[0077] The undamaged operation set includes operation statements for operating an undamaged file at multiple time points before the virus invasion in the log file. The damaged operation set includes operation statements for operating a damaged file at multiple time points before the virus invasion in the log file. The operation statements in this embodiment are SQL statements. For example, the keyword of the query operation statement is SELECT, the keyword of the insert operation statement is INSERT, the keyword of the update operation statement is UPDATE, and the keyword of the delete operation statement is DELETE.

[0078] An undamaged file type is obtained, wherein the undamaged file type indicates a file type of an undamaged file.

[0079] In this embodiment, txt represents a text type, jpg represents an image type, doc represents a doc document, and other file types.

[0080] A file discrimination network is trained according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network.

[0081] The damaged operation set is input into a trained file discrimination network to obtain a damaged file type.

[0082] Optionally, the training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network includes:

[0083] The document discrimination network includes a semantic convolutional network and an attention network.

[0084] The undamaged operation set is used to construct a two-dimensional matrix to obtain an undamaged operation matrix. Multiple undamaged operation sets correspond to multiple undamaged operation matrices.

[0085] The number of rows of the undamaged operation matrix is ​​the length of the longest statement corresponding to the operation that can be recorded in the log in the database. For example, in this embodiment, there is only an operation statement such as query with the keyword SELECT, an operation statement with the keyword INSERT, an operation statement with the keyword UPDATE, and an operation statement with the keyword DELETE. Then the number of rows of the undamaged operation matrix is ​​6. If a statement with 7 rows appears based on this embodiment, the number of rows of the undamaged operation matrix is ​​7.

[0086] The number of rows of the plurality of undamaged operation matrices is fixed based on a database.

[0087] An undamaged two-dimensional convolution kernel is obtained. The size of the undamaged two-dimensional convolution kernel is 1xn. n represents the number of rows of the damaged operation matrix.

[0088] Wherein, n is a natural number greater than 0.

[0089] The undamaged operation matrix is ​​convolved with the convolution kernel with a step size of 1 to obtain a first undamaged operation feature vector. Multiple undamaged operation matrices correspond to multiple undamaged operation feature vectors.

[0090] In this embodiment, convolution is performed using Convolutional Neural Networks (CNN).

[0091] Based on the unimpaired operation matrix, a second unimpaired operation feature vector is obtained by focusing on the network.

[0092] The first undamaged operation feature vector and the second undamaged operation feature vector are fused and input into a classification network to obtain a predicted file type.

[0093] The loss is calculated between the predicted file type and the corresponding undamaged file type, and the discriminant network is trained by backpropagation to obtain a trained discriminant network.

[0094] The loss is calculated using a loss function. In this embodiment, the loss function is a cross entropy loss function.

[0095] Optionally, obtaining a second unimpaired operation feature vector based on the unimpaired operation matrix by focusing on a network comprises:

[0096] The undamaged operation matrices of the same undamaged file type in the multiple undamaged operation matrices are added into a set as an undamaged set of the same category. Corresponding to the multiple undamaged file types, multiple undamaged sets of the same category are obtained.

[0097] All the operation statements that appear in the undamaged operation matrix in the undamaged set of the same category are extracted to obtain the same operation matrix.

[0098] The non-overlapping operation statements between the multiple undamaged sets of the same category are extracted to obtain a non-overlapping operation matrix.

[0099] The same operation matrix is ​​input into the first convolutional network, features for distinguishing the same undamaged file types are extracted, and the same operation features are obtained.

[0100] Among them, in this embodiment, the first convolutional network is a recurrent neural network (RNN).

[0101] The operation statements in the intact operation matrix that overlap with the non-overlapping operation matrix are used as the non-overlapping damaged operation matrix.

[0102] The non-overlapping damaged operation matrix is ​​input into a second convolutional network to extract features for distinguishing different types of undamaged files, thereby obtaining non-overlapping operation features.

[0103] The second convolutional network is a recurrent neural network (RNN) different from the first convolutional network.

[0104] The undamaged operation matrix is ​​input into a third convolutional network, and features of the undamaged operation matrix are extracted to obtain undamaged operation features.

[0105] Among them, the third convolutional network is a recurrent neural network (RNN) that is different from the first convolutional network and the second convolutional network.

[0106] The same operation features, non-overlapping operation features and undamaged operation features are input into the first neural network to obtain a second undamaged operation feature vector.

[0107] Wherein, the first neural network is a fully connected neural network (Fully Connected Neural Network, FCN).

[0108] Through the above method, all operations that have appeared are found according to multiple log files corresponding to undamaged files of the same damaged file category. All operations that have not appeared in multiple log files corresponding to undamaged files of different damaged file categories are found. Then, the characteristics of these operations are emphasized in the network, so as to find the corresponding file category more accurately.

[0109] Optionally, obtaining a damaged file tree according to the damaged files and the undamaged files includes:

[0110] Use the file path of the damaged file as the damaged file path.

[0111] The file path of the damaged file can be obtained through a registry.

[0112] Construct a damaged file tree according to multiple damaged file paths.

[0113] Optionally, the method for constructing the damaged file tree includes:

[0114] The root directory is used as the root node.

[0115] Use the files and folders in the root directory of the damaged file path as the second file.

[0116] If the second file does not exist in the damaged file tree, a child node of the root node is newly created, and the value in the child node represents the category of the second file.

[0117] Optionally, generating a file tree according to the number of damaged files, the types of damaged files and the damaged file tree includes:

[0118] At the leaf node in the damaged file tree, child nodes of the number of damaged files are generated to obtain a first generated file tree.

[0119] The value corresponding to the child node generated in the first generated file tree is set as the damaged file type to obtain a generated file tree.

[0120] Through the above method, the corresponding file type is found for the leaf node in the damaged file tree, and the node is added to obtain the generated file tree.

[0121] Optionally, generating a file according to the generated file tree includes:

[0122] The generated file tree is traversed in order to find the damaged file location, and a file of a corresponding damaged file type is generated at the damaged file location.

[0123] The structure of the generated file tree simulates the storage location of the file. For example, the root directory is in the root node, and the files and folders under the root directory are in the child nodes of the root node. The values ​​in the nodes of the generated file tree represent the categories of the files, such as folders, text documents, and pictures.

[0124] Example 2

[0125] Based on the above-mentioned virus-invaded system recovery method, an embodiment of the present invention also provides a virus-invaded system recovery system, the system comprising an acquisition module, a damaged tree construction module, a damaged file quantity acquisition module, a file type identification module, a file tree acquisition generation module, a file generation module and a registry modification module.

[0126] The acquisition module is used to obtain log files, damaged files and undamaged files after virus invasion. The log files include multiple damaged files and multiple operation statements of undamaged files. The undamaged files are files that are not damaged after virus invasion. The damaged files are files that are damaged after virus invasion.

[0127] The damaged tree construction module is used to obtain a damaged file tree according to the damaged file. The damaged file tree indicates the damaged file path and the category of the file.

[0128] The damaged file quantity acquisition module is used to obtain the number of files contained in the damaged file in the registry to obtain the number of damaged files.

[0129] The file type identification module is used to obtain the damaged file type through the file identification network according to the log file, damaged files and undamaged files. The damaged file type indicates the file type of the file whose damaged file contains the number of damaged files.

[0130] The module for obtaining the generated file tree is used to obtain the generated file tree according to the number of damaged files, the type of damaged files and the damaged file tree. The generated file tree includes the generated location and the type corresponding to the location.

[0131] The generated file module is used to obtain the generated file according to the generated file tree.

[0132] The registry modification module is used to delete some damaged files and modify the information pointing to some damaged files in the registry to the generated files.

[0133] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0134] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0135] Similarly, it should be understood that in order to streamline the present disclosure and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0136] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0137] In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and form different embodiments. For example, in the claims below, any one of the claimed embodiments may be used in any combination.

[0138] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the apparatus according to an embodiment of the present invention. The present invention may also be implemented as a device or device program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may have the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0139] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

Claims

1. A virus-invaded system recovery method, characterized in that: include: Obtain log files, damaged files, and undamaged files after virus intrusion; The log file includes multiple operation statements of multiple damaged files and undamaged files; the undamaged files are files that have not been damaged after the virus invasion; the damaged files are files that have been damaged after the virus invasion; According to the damaged file, a damaged file tree is obtained; The damaged file tree indicates the damaged file path and file category; Obtain the number of files contained in the damaged file in the registry to obtain the number of damaged files; According to the log file, the damaged file and the undamaged file, a damaged file type is obtained through a file identification network; the damaged file type indicates the file type of a file whose damaged file contains the number of damaged files; Obtaining a generated file tree according to the damaged file quantity, damaged file type and damaged file tree; The generated file tree includes the generated location and the type corresponding to the location; Generate files according to the generated file tree; The file generated by the generated file tree is a file of a corresponding damaged file type generated at the damaged file location, and the data is automatically updated in the generated file; Delete some damaged files and modify the information pointing to some damaged files in the registry to the generated files; The method of obtaining the damaged file type through a file identification network according to the log file, the damaged file and the undamaged file includes: Finding the operation statement corresponding to the undamaged file in the log file to obtain an undamaged operation set; finding the operation statement corresponding to the damaged file in the log file to obtain a damaged operation set; Obtaining an undamaged file type; the undamaged file type indicates a file type of an undamaged file; Training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network; Inputting the damaged operation set into a trained file discrimination network to obtain a damaged file type; The document discrimination network includes a semantic convolutional network and an attention network; the attention network includes a first convolutional network, a second convolutional network, a third convolutional network and a first neural network; The step of training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network includes: The undamaged operation set is used to construct a two-dimensional matrix to obtain an undamaged operation matrix; multiple undamaged operation matrices are obtained corresponding to multiple undamaged operation sets; Obtain an undamaged two-dimensional convolution kernel; the size of the undamaged two-dimensional convolution kernel is 1xn; n represents the number of rows of the undamaged operation matrix; the number of rows of the undamaged operation matrix is ​​the length of the statement corresponding to the longest operation that can be recorded in the log in the database; Convolving the undamaged operation matrix with an undamaged two-dimensional convolution kernel with a step size of 1 to obtain a first undamaged operation feature vector; obtaining a plurality of undamaged operation feature vectors corresponding to a plurality of undamaged operation matrices; Based on the undamaged operation matrix and the undamaged file type, obtaining a second undamaged operation feature vector through an attention network; After fusing the first undamaged operation feature vector and the second undamaged operation feature vector, the resultant vectors are input into a classification network to obtain a predicted file type; The loss is calculated between the predicted file type and the corresponding undamaged file type, and the discriminant network is trained by backpropagation to obtain a trained discriminant network.

2. The virus-invaded system recovery method according to claim 1, characterized in that: The method of obtaining a second undamaged operation feature vector based on the undamaged operation matrix and the undamaged file type through a focus network includes: Adding the undamaged operation matrices of the same undamaged file type in the multiple undamaged operation matrices into a set as an undamaged set of the same category; obtaining multiple undamaged sets of the same category corresponding to the multiple undamaged file types; Extract all the operation statements that appear in the undamaged operation matrix in the undamaged set of the same category to obtain the same operation matrix; Extracting non-overlapping operation statements between the plurality of undamaged sets of the same category to obtain a non-overlapping operation matrix; Inputting the same operation matrix into a first convolutional network, extracting features for distinguishing the same undamaged file types, and obtaining the same operation features; The operation statements in the undamaged operation matrix that overlap with the non-overlapping operation matrix are used as the non-overlapping damaged operation matrix; Inputting the non-overlapping damaged operation matrix into a second convolutional network, extracting features for distinguishing different types of undamaged files, and obtaining non-overlapping operation features; Inputting the undamaged operation matrix into a third convolutional network, extracting features of the undamaged operation matrix, and obtaining undamaged operation features; The same operation features, non-overlapping operation features and undamaged operation features are input into the first neural network to obtain a second undamaged operation feature vector.

3. A virus-invaded system recovery method according to claim 1, characterized in that: The method of obtaining a damaged file tree according to the damaged file includes: The file path of the damaged file is used as the damaged file path; Construct a damaged file tree according to multiple damaged file paths.

4. The virus-invaded system recovery method according to claim 3, characterized in that: The step of constructing a damaged file tree according to the multiple damaged file paths includes: Take the root directory as the root node; Use the files and folders in the root directory of the damaged file path as the second file; If the second file does not exist in the damaged file tree, a child node of the root node is newly created, and the value in the child node represents the category of the second file.

5. The method for recovering a virus-invaded system according to claim 1, characterized in that: The generating a file tree according to the damaged file quantity, damaged file type and damaged file tree comprises: At the leaf node in the damaged file tree, generate child nodes of the number of damaged files to obtain a first generated file tree; The value corresponding to the child node generated in the first generated file tree is set as the damaged file type to obtain a generated file tree.

6. The virus-invaded system recovery method according to claim 1, characterized in that: Generating a file according to the generated file tree includes: The generated file tree is traversed in order to obtain a damaged file position, and a file of a corresponding damaged file type is generated at the damaged file position.

7. A virus-invaded system recovery system, characterized in that: include: The acquisition module is used to obtain the log files, damaged files and undamaged files after the virus invasion; The log file includes multiple operation statements of multiple damaged files and undamaged files; the undamaged files are files that have not been damaged after the virus invasion; the damaged files are files that have been damaged after the virus invasion; A damaged tree construction module is used to obtain a damaged file tree according to the damaged file; the damaged file tree indicates the damaged file path and file category; A damaged file number acquisition module is used to obtain the number of files contained in the damaged file in the registry to obtain the number of damaged files; A file type identification module, used to obtain the damaged file type through a file identification network according to the log file, damaged files and undamaged files; the damaged file type indicates the file type of the file whose damaged file contains the number of damaged files; A module for obtaining a generated file tree is used to obtain a generated file tree according to the number of damaged files, the type of damaged files and the damaged file tree; The generated file tree includes the generated location and the type corresponding to the location; A file generation module is used to obtain a generated file according to the generated file tree; wherein the file generated by the generated file tree is a file of a corresponding damaged file type generated at the damaged file location, and data is automatically updated in the generated file; A registry modification module is used to delete some damaged files and modify the information in the registry pointing to some damaged files to the generated files; The method of obtaining the damaged file type through a file identification network according to the log file, the damaged file and the undamaged file includes: Finding the operation statement corresponding to the undamaged file in the log file to obtain an undamaged operation set; finding the operation statement corresponding to the damaged file in the log file to obtain a damaged operation set; Obtaining an undamaged file type; the undamaged file type indicates a file type of an undamaged file; Training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network; Inputting the damaged operation set into a trained file discrimination network to obtain a damaged file type; The document discrimination network includes a semantic convolutional network and an attention network; the attention network includes a first convolutional network, a second convolutional network, a third convolutional network and a first neural network; The step of training a file discrimination network according to the undamaged operation set and the undamaged file type to obtain a trained file discrimination network includes: The undamaged operation set is used to construct a two-dimensional matrix to obtain an undamaged operation matrix; multiple undamaged operation matrices are obtained corresponding to multiple undamaged operation sets; Obtain an undamaged two-dimensional convolution kernel; the size of the undamaged two-dimensional convolution kernel is 1xn; n represents the number of rows of the undamaged operation matrix; the number of rows of the undamaged operation matrix is ​​the length of the statement corresponding to the longest operation that can be recorded in the log in the database; Convolving the undamaged operation matrix with an undamaged two-dimensional convolution kernel with a step size of 1 to obtain a first undamaged operation feature vector; obtaining a plurality of undamaged operation feature vectors corresponding to a plurality of undamaged operation matrices; Based on the undamaged operation matrix and the undamaged file type, obtaining a second undamaged operation feature vector through an attention network; After fusing the first undamaged operation feature vector and the second undamaged operation feature vector, the resultant vectors are input into a classification network to obtain a predicted file type; The loss is calculated between the predicted file type and the corresponding undamaged file type, and the discriminant network is trained by backpropagation to obtain a trained discriminant network.

Images