A USB disk virus isolation data transmission method, system and USB disk

Abstract

The invention discloses a U disk virus isolation data transmission method, system and U disk, and relates to the field of U disk virus isolation data transmission. The technical scheme includes: establishing an isolation zone, connecting the U disk with a target device through the isolation zone, and using the isolation zone to pre-process the data in the U disk; setting the pre-processed data in the U disk as metadata, building a multi-layer virtual world, and transmitting the metadata from the isolation zone to the multi-layer virtual world; in the multi-layer virtual world, using an inspired sandbox algorithm to perform virus detection on the metadata to obtain shadow data; using an SCP or SFTP transmission tool to unidirectionally transmit the shadow data from the multi-layer virtual world to the target device, and extracting and warning deleted and missing blocks, so as to realize the detection and analysis of abnormal data carrying viruses in the process of U disk virus isolation data transmission, and improve the security of data transmission.

Description

Technical Field

[0001] The present invention relates to the field of U disk virus isolation data transmission, and more specifically, it relates to a U disk virus isolation data transmission method, system and U disk. Background Art

[0002] When using USB flash drives for data transfer, especially when considering virus isolation, you may encounter USB flash drive malware infection. Some viruses hide or disguise as normal data, which may be mistaken for legitimate data during transmission and spread to other computers. Some complex malware may not exhibit malicious behavior immediately, but may be triggered under specific conditions. This makes even USB flash drives that appear to be harmless on the surface potentially a threat in the future.

[0003] During the data transmission process of USB disk isolation virus, if the virus directly contacts the target device, it will easily cause large-scale spread and infection. Moreover, as the virus is updated and deformed all the time, the types of viruses are also increasing rapidly. Known virus detection cannot fully meet the effective identification of new and abnormal viruses. Therefore, how to design USB disk isolation virus data transmission is now urgently needed to be solved. Summary of the invention

[0004] In view of the problems existing in the prior art, the purpose of the present invention is to provide a USB disk virus isolation data transmission method, system and USB disk, so as to realize the detection and analysis and processing of abnormal data carrying viruses during the USB disk virus isolation data transmission process, and improve the security of data transmission.

[0005] To achieve the above object, the present invention provides the following technical solution: The USB disk virus isolation data transmission method comprises:

[0006] Step S1: Establish an isolation zone, connect the USB flash drive to the target device through the isolation zone, and use the isolation zone to pre-process the data in the USB flash drive;

[0007] Step S2: setting the pre-processed data in the USB flash drive as metadata, constructing a multi-layer virtual world, and transferring the metadata from the isolation zone to the multi-layer virtual world;

[0008] Step S3: In the multi-layer virtual world, use the heuristic sandbox algorithm to perform virus detection on the metadata and obtain the shadow data;

[0009] Step S4: Use SCP or SFTP transmission tools to unidirectionally transfer the shadow data from the multi-layer virtual world to the target device, and extract and warn of the deleted missing blocks.

[0010] Preferably, the isolation belt includes isolation equipment, and the method for using the isolation belt includes:

[0011] Select an isolation device and set it between the USB drive and the target device;

[0012] Configure the direction and rules of data transmission. Set the direction of data transmission to one-way transmission from the USB flash drive to the target device, and the rules of data transmission to monitoring and logging.

[0013] Start the isolation device, and the data in the USB flash drive is first transferred to the isolation zone, where the data in the USB flash drive is pre-processed to preliminarily determine whether the data is safe. If the data is safe, the data continues to be transferred; otherwise, the transfer is interrupted and the connection between the isolation device and the USB flash drive is automatically disconnected;

[0014] Clean up all the data in the isolation zone after use, initialize the isolation zone environment, and complete a data transmission isolation use.

[0015] Preferably, the method for preprocessing the data in the USB flash drive includes known virus detection and data integrity check;

[0016] The method for detecting known viruses on the data in the USB flash drive is as follows:

[0017] Creating a sample center, which includes characteristic strings in known virus samples;

[0018] Divide the data in the USB flash drive into u blocks, read them one by one, and convert the data content of each small block into a byte stream;

[0019] Use a matching algorithm to search for the characteristic string of each block in the byte stream and match the characteristic string with the sample center. If the match is successful, the data of the corresponding block is determined to be infected with a virus, the location of the matching block and the identifier of the characteristic string are recorded, and isolation, deletion or repair is performed. If the match fails, it is determined that the data is not infected with a known virus and data transmission continues;

[0020] Collect the data composed of blocks after the matching algorithm is processed, which is recorded as pre-data. The method for checking the data integrity of the pre-data is as follows:

[0021] The data of each block is read in binary mode, and the SHA-256 algorithm is used to perform hash calculation on the read data to generate a hash value Ha_s(i) with a fixed length and save it;

[0022] Obtain the hash value Ha_y(i) of the original data corresponding to the data in each block, and compare the hash value Ha_y(i) with the hash value Ha_s(i). If they are equal, the data in block i is complete and consistent with the original data content; if they are not equal, the data in block i can be tampered with or damaged, and it should be deleted or marked for storage;

[0023] Among them, Ha_s(i) represents the hash value of the i-th block data in the isolation zone, and Ha_y(i) represents the hash value of the i-th block data in the original data.

[0024] Preferably, the method of dividing the data in the USB disk into u blocks and reading them one by one includes:

[0025] Use a machine learning model to determine the size of the block. The machine learning model is based on a neural network or a deep learning model. Set the input of the machine learning model to be the number of bytes of data, and the output to be the size of the block. Set the constraint condition to the best balance between memory usage and I / O efficiency. Collect the number of bytes of historical data and the size of the corresponding output block as a sample set. Use the sample set to train the machine learning model to obtain a trained machine learning model. Input the number of bytes of the original data in the current U disk into the trained machine learning model to obtain the block size, set it to Kua, and use the block size Kua output by the current model to divide the data in the U disk into small blocks.

[0026] Read the data transferred from the USB flash drive to the isolation zone in binary mode, read the data block by block through a loop structure, read a block of data with a size of Kua each time, until the remaining number of bytes is less than Kua, then directly read all the remaining data;

[0027] Each time a block of data is read, the matching algorithm is used immediately to match the feature string. After processing, the next block is read. If the length of the feature string is greater than the block size Kua, the maximum length of the feature string at the end of the previous block is concatenated with the beginning of the current block, and then matched again until all the data is completely read.

[0028] Preferably, the method of using a matching algorithm to search for a characteristic string of each block in the byte stream and matching the characteristic string with the sample center includes:

[0029] The matching algorithm is based on the KMP algorithm and the Boyer-Moore algorithm. The bad character table and good suffix table of the Boyer-Moore algorithm are constructed for the preliminary matching stage, and the prefix function of the KMP algorithm is constructed for the fine matching stage:

[0030] The calculation method of the prefix function is π[j] = max{k: k < j and P[0…k - 1] = P[j - k…j - 1]}, where π[j] represents the prefix function value, that is, the length of the longest identical prefix and suffix of the first j characters of the pattern string P, P represents the pattern string, j represents the current position or index, k represents the length variable, that is, the length of the prefix, P[0…k - 1] represents the prefix of the first k characters of the pattern string P, and P[j - k…j - 1] represents the substring of the pattern string P from position j - k to position j - 1;

[0031] The calculation method of the bad character table is BC[c] = max{j: P[j] = c}, where BC[c] represents the rightmost occurrence position of the character c in the pattern string. If the character c is not in the pattern string, then BC[c] = -1, and P[j] = c is used to check whether the j-th character in the pattern string P is equal to the character c. The calculation method of the good suffix table is GS[j] = the smallest k such that P[j - k…m - k - 1] = P[m - k…m - 1], where GS[j] represents the minimum number of positions by which the pattern string is shifted to the right when the character P[j] in the pattern string does not match, the smallest k represents the minimum number of positions by which the good suffix of the pattern string is shifted, P[j - k…m - k - 1] represents the substring of the pattern string P from position j - k to m - k - 1, where m is the total length of the pattern string, and P[m - k…m - 1] represents the substring of the pattern string P from position m - k to m - 1;

[0032] Calculate the number of positions by which the pattern string is shifted in the bad character table and the good suffix table, select the larger of the two as the number of positions by which the pattern string is shifted, and then obtain the potential matching position. Perform character-by-character matching within the potential matching position using the prefix function. If the matching fails, calculate the number of positions by which the pattern string is shifted using the prefix function value and continue the matching. If the matching succeeds, record the matching position and continue to search for the next match.

[0033] Preferably, the construction method of the multi-layer virtual boundary is as follows:

[0034] Set the hierarchical structure of the multi-layer virtual boundary to include layer L0, layer L1, and layer L2. Layer L0 is the physical host, layer L1 is the management virtual machine, and layer L2 is the sub-virtual machine. Set the resource allocation of layer L1 to be half of that of layer L0. The resources include the number of CPU cores, the size of the running memory, and the size of the storage space. Create G_h sub-virtual machines of layer L2 in the management virtual machine of layer L1;

[0035] Set the resource allocation of each sub-virtual machine to be where VM u_CPU represents the number of CPU cores allocated to the u-th sub-virtual machine, C_L1 represents the number of CPU cores allocated to the L1 layer, and VM u _NC represents the size of the running memory allocated to the u-th sub-virtual machine, M_L1 represents the size of the running memory allocated to the L1 layer, and VM u _CC represents the size of the storage space allocated to the u-th sub-virtual machine, and D_L1 represents the size of the storage space allocated to the L1 layer.

[0036] Preferably, the method for virus detection of metadata using the heuristic sandbox algorithm includes:

[0037] The metadata includes y_u blocks, and the heuristic sandbox algorithm is used to gradually process the data corresponding to each block;

[0038] Each block is scored through a predefined rule of heuristic analysis. It is set that the score obtained by the predefined rule for the a-th block is Pf_a, and Pf_a ∈ [0, 1]. If Pf_a < Yz1, the data corresponding to the block is marked as low risk and directly released for continued transmission; if Yz1 ≤ Pf_a < Yz2, the file is marked as medium risk and requires sandbox analysis; if Pf_a ≥ Yz2, the file is marked as high risk, immediately isolated and marked as non-transmissible;

[0039] The sandbox analysis scores each block marked as medium risk through behavioral characteristics. It is set that the score obtained by the predefined rule for the b-th block is Pf_b, and Pf_b ∈ [0, 1]. If Pf_b < Yg1, the data corresponding to the block is marked as safe and normally transmitted; if Pf_b ≥ Yg1, the file is marked as non-safe and isolated, deleted, and an alarm is issued;

[0040] Among them, Yz1, Yz2, and Yg1 are preset thresholds;

[0041] All blocks marked as low risk and safe are aggregated to form shadow data.

[0042] Preferably, the method for scoring each block through a predefined rule of heuristic analysis includes:

[0043] Extract the data of each block and convert it into the representation of a feature vector X(F) = {x 1 (F), …, x v (F)}, and set that x m (F) is the m-th feature of sample F, and m = 1, …, v. Collect E_l groups of samples to form a training dataset. Each group of samples includes an input and an output. The input is the feature vector of the sample, the output is the predefined rule and weight, and the label of the sample is 1 or 0, where 1 represents abnormal data and 0 represents normal data;

[0044] Set the decision tree as the predefined rule output model, use the training data set to train the decision tree model, use the binary cross entropy loss as the target loss function, use gradient descent to minimize the loss function, update the model parameters until the value of the target loss function is minimized and no longer changes, and then get the trained decision tree model;

[0045] Determine the feature vector of the metadata and import it into the trained decision tree model to obtain J_K predefined rules and their corresponding weights, and calculate the comprehensive output score of the predefined rules Where d is the index of the predefined rule, ωd represents the weight corresponding to the d-th predefined rule, and Tg_d represents the attribute value of the m-th feature in the data;

[0046] Sandbox analysis scores each block marked as medium risk by behavioral characteristics, including:

[0047] According to the number of CPU cores, running memory size and storage space size set in the multi-layer virtual world, different parameters are combined to simulate the dynamic environment;

[0048] For the data corresponding to each block in the dynamic environment, calculate the score of the behavioral characteristics of the data of the sth block in the time series R_t Among them, w represents the index of the dynamic environment parameter combination, R_d represents the number of dynamic environment parameter combinations, αw represents the weight of the wth dynamic environment parameter combination, Represents the label corresponding to the behavioral feature of the sth block at time t, R_t represents the number of times, and t represents the index of time.

[0049] A USB disk virus isolation data transmission system, comprising:

[0050] Fence processing module: used to establish an isolation zone between the USB flash drive and the target device, perform known virus detection and data integrity check on the USB flash drive data within the isolation zone, and obtain metadata;

[0051] Virtual module: used to build a multi-layer virtual world and transfer metadata from the isolation zone to the multi-layer virtual world;

[0052] Data analysis and processing module: Design heuristic sandbox algorithm through heuristic analysis and sandbox analysis, use the heuristic sandbox algorithm to process and analyze metadata, and obtain shadow data;

[0053] Terminal transmission module: used to transmit shadow data from multi-layer virtual world to target device in one direction, completing data transmission after isolating viruses.

[0054] A USB flash drive comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, a USB flash drive virus isolation data transmission method is implemented.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] In the present invention, by establishing an isolation zone and multiple virtual boundaries, it is ensured that the data in the USB flash drive will not directly contact the target device during the transmission process, thereby preventing the virus from directly spreading to the target device. This isolation mechanism effectively prevents the risk of the virus spreading to the target device through the USB flash drive;

[0057] By performing known virus detection and data integrity checks on the data in the USB flash drive, known virus infections can be identified and processed before data transmission, and the integrity of the data can be ensured. This preprocessing step can effectively reduce the risk of virus transmission and ensure the reliability of data during transmission; by performing virus detection on metadata using the heuristic sandbox algorithm, unknown viruses can be identified and processed. The combination of heuristic analysis and sandbox analysis can simulate different operating conditions in a multi-layer virtual environment, detect potential malicious behavior, and thus improve the ability to detect unknown viruses;

[0058] By using secure transmission tools such as SCP or SFTP, the detected and processed data is transmitted unidirectionally to the target device, ensuring the security and integrity of data transmission while avoiding the potential security risks caused by data backflow; by using machine learning models to determine the data block size and combining KMP and Boyer-Moore algorithms for feature string matching, the efficiency of data processing and virus detection is improved. This method can optimize the speed of data processing and resource usage while ensuring detection accuracy;

[0059] Through multi-level isolation, detection and analysis mechanisms, it solves the virus propagation and data security problems that may be encountered during USB data transmission, and provides an efficient and secure USB data transmission solution. The adaptive control and optimization mechanism continuously improves the overall efficiency of intelligent analysis. Multiple modules work together to achieve comprehensive data collection, processing and analysis, provide real-time and accurate analysis of detection data, and realize the detection and analysis of abnormal data carrying viruses during USB disk isolation virus data transmission, thereby improving the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A schematic diagram of the steps of a method for transmitting virus-isolated data using a USB flash drive is provided in the present invention;

[0061] Figure 2 It is a structural schematic diagram of the method for transmitting virus-isolated data using a USB flash drive in the present invention. DETAILED DESCRIPTION

[0062] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0063] Embodiment 1

[0064] Reference Figure 1 and Figure 2 Embodiment 1 further illustrates a method for isolating virus data from a USB flash drive proposed by the present invention.

[0065] When using USB flash drives for data transfer, especially when considering virus isolation, you may encounter USB flash drive malware infection. Some viruses hide or disguise as normal data, which may be mistaken for legitimate data during transmission and spread to other computers. Some complex malware may not exhibit malicious behavior immediately, but may be triggered under specific conditions. This makes even USB flash drives that appear to be harmless on the surface potentially a threat in the future.

[0066] USB drive malware infection refers to the situation where a USB drive is infected by malware (such as viruses, worms, Trojan horses, etc.) when it is connected to a computer. This infection may cause the data on the USB drive to be modified or deleted, or even make the USB drive a carrier for the spread of malware.

[0067] Malware often disguises itself as legitimate data types, such as documents, images, or executable data (such as .exe data). When the user opens this data, the malware will execute and infect the system. Some malware will exploit vulnerabilities in the data system to hide or execute malicious code. For example, by exploiting the characteristics of the NTFS data system, malware can create a malicious data folder named "$Recycle.Bin" and disguise it as a system data folder to evade the user's attention.

[0068] Some malware may encrypt the data in the USB drive, similar to the behavior of ransomware, requiring the user to pay a ransom to decrypt the data. Other malware may directly destroy the data in the USB drive, making it unrecoverable and causing data loss. Malware may tamper with the data system or boot sector of the USB drive, making the USB drive unable to be used normally, and even in some cases, the USB drive may become unreadable or unwritable. Some malware may cause the space in the USB drive to display abnormally, such as incorrect capacity display or the USB drive cannot be formatted.

[0069] Once a USB drive is infected with malware, it may attempt to infect every computer it is connected to. The malware may automatically run each time the USB drive is plugged into a computer and infect other drives or network shares on that computer. In a shared environment such as a company or school, malware infected with a USB drive may spread to multiple devices, causing a wide range of infections.

[0070] The following is a technical solution to solve the above problems, the specific contents are as follows:

[0071] Step S1: Establish an isolation zone, connect the USB flash drive to the target device through the isolation zone, and use the isolation zone to pre-process the data in the USB flash drive;

[0072] Fence processing module: used to establish an isolation zone between the USB flash drive and the target device, perform known virus detection and data integrity check on the USB flash drive data within the isolation zone, and obtain metadata;

[0073] The isolation zone includes isolation devices (such as hardware isolation cards, isolation network gates, USB isolators, isolation gateways or isolation servers). The use of the isolation zone includes:

[0074] Select an isolation device and set it between the USB drive and the target device;

[0075] Configure the direction and rules of data transmission. Set the direction of data transmission to one-way transmission from the USB flash drive to the target device, and the rules of data transmission to monitoring and logging.

[0076] Start the isolation device, and the data in the USB flash drive is first transferred to the isolation zone, where the data in the USB flash drive is pre-processed to preliminarily determine whether the data is safe. If the data is safe, the data continues to be transferred; otherwise, the transfer is interrupted and the connection between the isolation device and the USB flash drive is automatically disconnected;

[0077] Clean up all the data in the isolation zone after use, initialize the isolation zone environment, and complete a data transmission isolation use.

[0078] By establishing an isolation zone, not only is the direct electrical connection between the USB flash drive and the target device blocked, but data is only allowed to be transmitted in one direction, such as from the USB flash drive to the isolation device, or from the isolation device to the target device. Regular review is performed through log records (data transmission time, data name, scan results), which facilitates analysis of whether there are any abnormal behaviors or potential security threats, and implements preliminary security detection of the data in the USB flash drive.

[0079] Methods for preprocessing data in the USB flash drive include known virus detection and data integrity check;

[0080] The method for detecting known viruses on the data in the USB flash drive is as follows:

[0081] Creating a sample center, which includes characteristic strings in known virus samples;

[0082] By analyzing known virus samples, we can extract virus-specific byte sequences or strings. These sequences or strings are usually part of the virus code and are unique and stable. We can match all virus samples with their byte sequences or strings and establish a virus sample center, which contains a large number of characteristic byte sequences or strings of known viruses. These strings are obtained through reverse engineering and analysis of virus samples.

[0083] Divide the data in the USB disk into u blocks and read them one by one to save memory, and convert the data content of each small block into a byte stream;

[0084] Use a matching algorithm to search for the characteristic string of each block in the byte stream and match the characteristic string with the sample center. If the match is successful, the data of the corresponding block is determined to be infected with a virus, the location of the matching block and the identifier of the characteristic string are recorded, and isolation, deletion or repair is performed. If the match fails, it is determined that the data is not infected with a known virus and data transmission continues;

[0085] Collect the data composed of blocks after the matching algorithm is processed, which is recorded as pre-data. The method for checking the data integrity of the pre-data is as follows:

[0086] The data of each block is read in binary mode, and the read data is hashed using the SHA-256 algorithm to generate a hash value Ha_s(i) with a fixed length and save it; the hash value Ha_s(i) is calculated on the data after it is transmitted to the isolation zone.

[0087] Obtain the hash value Ha_y(i) of the original data corresponding to the data in each block. The hash value Ha_y(i) of the original data can be calculated and saved before the data is first generated or transmitted, and stored on a certain medium; compare the hash value Ha_y(i) with the hash value Ha_s(i). If they are equal, the data in block i is complete and consistent with the original data content; if they are not equal, the data in block i can be tampered with or damaged, and it is deleted or marked for sealing;

[0088] Among them, Ha_s(i) represents the hash value of the i-th block data in the isolation zone, and Ha_y(i) represents the hash value of the i-th block data in the original data.

[0089] In the data integrity check, it is crucial to ensure that the data content and original data have not been tampered with or damaged. Data in storage media such as USB flash drives may be affected by malware or accidental damage, so in order to ensure system security and data reliability, detailed data verification and data consistency checks are necessary. Through the above methods, it is possible to effectively identify whether the data has been maliciously modified or damaged, ensuring the data security and integrity of the system.

[0090] The method of dividing the data in the USB disk into u blocks and reading them one by one includes:

[0091] Use a machine learning model to determine the size of the block. The machine learning model is based on a neural network or a deep learning model. Set the input of the machine learning model to be the number of bytes of data, and the output to be the size of the block. Set the constraint condition to the best balance between memory usage and I / O efficiency. Collect the number of bytes of historical data and the size of the corresponding output block as a sample set. Use the sample set to train the machine learning model to obtain a trained machine learning model. Input the number of bytes of the original data in the current U disk into the trained machine learning model to obtain the block size, set it to Kua, and use the block size Kua output by the current model to divide the data in the U disk into small blocks.

[0092] The best balance between memory usage and I / O efficiency means that when the memory usage is high, the I / O efficiency is also excellent, that is, the block size output is performed when the comprehensive performance of memory usage and I / O efficiency is optimal.

[0093] Read the data transferred from the USB flash drive to the isolation zone in binary mode, read the data block by block through a loop structure, read a block of data with a size of Kua each time, until the remaining number of bytes is less than Kua, then directly read all the remaining data;

[0094] Each time a block of data is read, the matching algorithm is used immediately to match the feature string. After processing, the next block is read. If the length of the feature string is greater than the block size Kua, the maximum length of the feature string at the end of the previous block is concatenated with the beginning of the current block, and then matched again until all the data is completely read.

[0095] Through the above steps, the data in the USB flash drive can be effectively read and processed in blocks. Block reading can effectively reduce memory usage and improve scanning efficiency; reduce network bandwidth usage and improve transmission reliability; effectively process large data sets and avoid memory overflow; improve backup and recovery speed and reduce system resource usage.

[0096] Use a matching algorithm to search for the characteristic string of each block in the byte stream and match the characteristic string with the sample center. The specific methods include:

[0097] The matching algorithm is based on the KMP algorithm and the Boyer-Moore algorithm. It constructs the bad character table and the good suffix table of the Boyer-Moore algorithm for the preliminary matching stage, and constructs the prefix function (partial match table) of the KMP algorithm for the refined matching stage:

[0098] Set the calculation method of the prefix function as π[j] = max{k: k < j and P[0…k - 1] = P[j - k…j - 1]}, where π[j] represents the value of the prefix function, that is, the length of the longest identical prefix and suffix of the first j characters of the pattern string P, P represents the pattern string, j represents the current position or index, k represents the length variable, that is, the length of the prefix, P[0…k - 1] represents the prefix of the first k characters of the pattern string P, and P[j - k…j - 1] represents the substring of the pattern string P from position j - k to position j - 1;

[0099] The bad character table (Bad Character Table) is used to record the rightmost occurrence position of each character in the pattern string. In this way, when a character mismatch occurs, the number of positions the pattern string should move can be determined. The calculation method of the bad character table is BC[c] = max{j: P[j] = c}, where BC[c] represents the rightmost occurrence position of character c in the pattern string. If character c is not in the pattern string, then BC[c] = -1, and P[j] = c is used to check whether the j-th character in the pattern string P is equal to character c. The good suffix table (Good Suffix Table) is used to record the matching information of the good suffix of the pattern string to help move the pattern string more effectively when the matching fails. The calculation method of the good suffix table is GS[j] = the smallest k such that P[j - k…m - k - 1] = P[m - k…m - 1], where GS[j] represents the minimum number of positions the pattern string moves to the right when the character P[j] in the pattern string does not match, the smallest k represents the minimum number of positions the good suffix of the pattern string moves, P[j - k…m - k - 1] represents the substring of the pattern string P from position j - k to m - k - 1, where m is the total length of the pattern string, and P[m - k…m - 1] represents the substring of the pattern string P from position m - k to m - 1;

[0100] Calculate the number of positions the pattern string moves in the bad character table and the good suffix table, select the larger of the two as the number of positions the pattern string moves, and then obtain the potential matching positions. Perform character-by-character matching within the potential matching positions through the prefix function. If the matching fails, use the value of the prefix function to calculate the number of positions the pattern string moves and continue the matching. If the matching is successful, record the matching position and continue to find the next match.

[0101] Combining the KMP algorithm with the Boyer-Moore algorithm for feature string matching can fully utilize the advantages of both and improve matching efficiency; the KMP algorithm preprocesses the pattern string and builds a partial matching table (also known as the "prefix function"), thereby avoiding repeated scanning during the matching process and improving matching efficiency. The Boyer-Moore algorithm scans the pattern string from right to left and uses the "bad character rule" and "good suffix rule" to jump the matching position, thereby accelerating the matching process.

[0102] Step S2: setting the pre-processed data in the USB flash drive as metadata, constructing a multi-layer virtual world, and transferring the metadata from the isolation zone to the multi-layer virtual world;

[0103] Virtual module: used to build a multi-layer virtual world and transfer metadata from the isolation zone to the multi-layer virtual world;

[0104] The construction method of multi-layer virtual world is as follows:

[0105] The hierarchical structure of the multi-layer virtual world includes L0, L1 and L2 layers. L0 is the physical host, L1 is the management virtual machine, and L2 is the child virtual machine. That is, L0 represents the actual physical server or computer, which is used to run the virtualization management program (Hypervisor) and is responsible for the allocation and management of virtualization resources. L1 runs on L0 and is used to manage and monitor multiple child virtual machines (L2), including operating systems and virtualization software. L2 runs on L1 and performs specific tasks, such as data processing, malware analysis, etc.

[0106] Set the resource allocation of L1 layer to half of L0 layer, including the number of CPU cores, running memory size and storage space size. Create G_h L2 layer sub-virtual machines in the management virtual machine of L1 layer. The number of G_h is set according to the task type. For example, G_h=3, then sub-virtual machine VM1 is used for data processing and data scanning, sub-virtual machine VM2 is used for malware analysis and sandbox operation, and sub-virtual machine VM3 is used for network isolation and security testing. Set the resource allocation of each sub-virtual machine to Among them, VM u _CPU indicates the number of CPU cores allocated to the u-th child virtual machine, C_L1 indicates the number of CPU cores allocated to the L1 layer, and VM u _NC indicates the size of the operating memory allocated to the u-th child virtual machine, M_L1 indicates the size of the operating memory allocated to the L1 layer, and VM u _CC represents the storage space size allocated to the u-th child virtual machine, and D_L1 represents the storage space size allocated to the L1 layer.

[0107] The design scheme of multi-layer virtualization involves the selection of physical hosts, the configuration of virtualization hypervisors, the allocation of resources for managing virtual machines, and the configuration and management of sub-virtual machines. By reasonably configuring each layer, an efficient virtualization environment can be achieved to support various task requirements.

[0108] Configure automatic snapshot creation in the multi-layer virtual world, especially before performing high-risk operations (such as malware analysis). In the L1 layer management virtual machine, strictly control user permissions to ensure that only authorized users can create, modify, or delete sub-virtual machines. Configure multi-factor authentication for access to the management virtual machine and sub-virtual machines to increase security.

[0109] Enable detailed logging in the L1 layer management virtual machine to record all operations such as the startup, shutdown, snapshot creation, and network activities of all virtual machines. Use monitoring tools (such as Nagios, Zabbix) to monitor the resource usage and network activities of virtual machines in real time, discover abnormal behaviors in a timely manner, configure the resource scheduling function of virtualization software, dynamically adjust the allocation of CPU, memory, and storage resources according to the actual needs of sub-virtual machines, and set resource limits for each sub-virtual machine to prevent a certain sub-virtual machine from consuming excessive resources and affecting the performance of other virtual machines.

[0110] Step S3: In the multi-layer virtual world, use the heuristic sandbox algorithm to detect viruses in the metadata and obtain the shadow data;

[0111] Data analysis and processing module: Design the heuristic sandbox algorithm through heuristic analysis and sandbox analysis, and use the heuristic sandbox algorithm to process and analyze the metadata to obtain the shadow data;

[0112] The method of using the heuristic sandbox algorithm to detect viruses in the metadata includes:

[0113] The metadata includes y_u blocks, and the heuristic sandbox algorithm is used to gradually process the data corresponding to each block;

[0114] Each block is scored through pre-defined rules of heuristic analysis. Let the score obtained by the pre-defined rules for the a-th block be Pf_a, and Pf_a ∈ [0,1]. If Pf_a < Yz1, the data corresponding to the block is marked as low risk and directly released for continued transmission; if Yz1 ≤ Pf_a < Yz2, the file is marked as medium risk and requires sandbox analysis; if Pf_a ≥ Yz2, the file is marked as high risk, immediately isolated, and marked as non-transmissible;

[0115] Among them, Yz1 and Yz2 are pre-defined thresholds, satisfying 0 ≤ Yz1 < Yz2 ≤ 1, and Yz1 and Yz2 are set according to experimental data analysis or experience.

[0116] Sandbox analysis scores each block marked as medium risk based on behavioral characteristics. The score of the b-th block obtained by predefined rules is set as Pf_b, and Pf_b ∈ [0, 1]. If Pf_b < Yg1, the data corresponding to the block is marked as safe and transmitted normally; if Pf_b ≥ Yg1, the file is marked as unsafe and isolated, deleted, and an alarm is issued.

[0117] Among them, Yz1, Yz2, and Yg1 are preset thresholds.

[0118] All blocks marked as low risk and safe are aggregated to form shadow data.

[0119] The heuristic sandbox algorithm that combines heuristic analysis and sandbox analysis can detect malicious data in the USB flash drive and improve the detection accuracy through two-step processes of preliminary screening and in-depth analysis. Heuristic analysis provides a preliminary judgment based on predefined rules, while sandbox analysis provides in-depth security analysis through predefined behavioral characteristics. By integrating the results of these two methods, potential malicious data, that is, viruses, can be identified and processed more effectively.

[0120] The method of scoring each block through predefined rules in heuristic analysis includes:

[0121] Extract the data of each block and convert it into the representation of a feature vector X(F) = {x 1 (F), …, x v (F)}, where x m (F) is the m-th feature of sample F, and m = 1, …, v. Collect E_l groups of samples to form a training dataset. Each group of samples includes input and output. The input is the feature vector of the sample, and the output is the predefined rules and weights. The features can be file size, hash value, code snippet, and other attributes that can represent the characteristics of the data. The label of the sample is 1 or 0, where 1 represents abnormal data, that is, data containing viruses, and 0 represents normal data, that is, safe data.

[0122] Set the decision tree as the predefined rule output model, train the decision tree model using the training dataset, use binary cross-entropy loss as the target loss function, and adopt gradient descent to minimize the loss function and update the model parameters until the value of the target loss function is minimized and no longer changes, then stop to obtain the trained decision tree model.

[0123] Determine the feature vector of the metadata and import it into the trained decision tree model to obtain J_K predefined rules and their corresponding weights, and calculate the comprehensive output score of the predefined rules. Among them, d is the index of the predefined rule, ωd represents the weight corresponding to the d-th predefined rule, and Tg_d represents the attribute value of the m-th feature in the data; the attribute value can be used to represent the iconic numerical value of the feature, which can be pre-set manually or through experimental data analysis. The iconic numerical value of the feature in the metadata is generated according to the decision tree model.

[0124] Sandbox analysis scores each block marked as medium risk by behavioral characteristics, including:

[0125] According to the number of CPU cores, running memory size and storage space size set in the multi-layer virtual world, different parameters are combined to simulate the dynamic environment. Combining different parameters means that within the set limits of the number of CPU cores, running memory size and storage space size, for each item, random values ​​are taken and combined into different configurations. Sandbox analysis is run in each configuration to simulate the dynamic simulation environment.

[0126] For the data corresponding to each block in the dynamic environment, calculate the score of the behavioral characteristics of the data of the sth block in the time series R_t Where w represents the index of the dynamic environment parameter combination, R_d represents the number of dynamic environment parameter combinations, αw represents the weight of the wth dynamic environment parameter combination, Rg t w (s) represents the label corresponding to the behavior feature of the sth block at time t, R_t represents the number of times, and t represents the index of time;

[0127] Among them, the labels corresponding to the behavioral characteristics are identified through a machine learning model. The machine learning model is a binary classification learning model, which can be a neural network model or a deep learning model or other models that can achieve the desired effect.

[0128] Step S4: Use SCP or SFTP transmission tools to unidirectionally transfer the shadow data from the multi-layer virtual world to the target device, and extract and warn of the deleted missing blocks.

[0129] Terminal transmission module: used to transmit shadow data from multi-layer virtual world to target device in one direction, completing data transmission after isolating viruses.

[0130] When transferring shadow data from the multi-layer virtual world to the target device in one direction and confirming safety, initialize the multi-layer virtual world, that is, delete the snapshot of the virtual machine to avoid occupying too much disk space, restore to the previous snapshot or reinstall the virtual machine operating system.

[0131] After extracting and alerting the deleted missing blocks, the user re-uploads the file or performs other processing according to the prompts.

[0132] Embodiment 2

[0133] Reference Figure 1 and Figure 2 , Example 2 further illustrates a USB disk virus isolation data transmission method proposed by the present invention.

[0134] A method for transmitting virus-isolated data on a USB flash drive, comprising the following steps:

[0135] Step S1: Establish an isolation zone, connect the USB flash drive to the target device through the isolation zone, and use the isolation zone to pre-process the data in the USB flash drive;

[0136] Step S2: setting the pre-processed data in the USB flash drive as metadata, constructing a multi-layer virtual world, and transferring the metadata from the isolation zone to the multi-layer virtual world;

[0137] Step S3: In the multi-layer virtual world, use the heuristic sandbox algorithm to perform virus detection on the metadata and obtain the shadow data;

[0138] Step S4: Use SCP or SFTP transmission tools to unidirectionally transfer the shadow data from the multi-layer virtual world to the target device, and extract and warn of the deleted missing blocks.

[0139] A USB disk virus isolation data transmission system, applied to a USB disk virus isolation data transmission method, includes:

[0140] Fence processing module: used to establish an isolation zone between the USB flash drive and the target device, perform known virus detection and data integrity check on the USB flash drive data within the isolation zone, and obtain metadata;

[0141] Virtual module: used to build a multi-layer virtual world and transfer metadata from the isolation zone to the multi-layer virtual world;

[0142] Data analysis and processing module: Design heuristic sandbox algorithm through heuristic analysis and sandbox analysis, use the heuristic sandbox algorithm to process and analyze metadata, and obtain shadow data;

[0143] Terminal transmission module: used to transmit shadow data from multi-layer virtual world to target device in one direction, completing data transmission after isolating viruses;

[0144] The modules are connected to each other via wired and / or wireless means.

[0145] In addition, according to the implementation of the present application, the process described in the attached figure of a method for transmitting virus data by isolating a USB flash drive can be implemented as a computer software program. For example, the present application provides a non-transitory machine-readable storage medium, which stores machine-readable instructions, and the machine-readable instructions can be executed by a processor to execute instructions corresponding to the method steps provided by the present application. Of course, the architecture shown in the attached figure of a method for transmitting virus data by isolating a USB flash drive is only exemplary. When implementing different devices, adaptive selection or adjustment can be made according to actual needs.

[0146] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0147] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for transmitting virus-isolated data on a USB flash drive, characterized in that: The U disk virus-isolated data transmission method includes: Step S1: Establish an isolation zone, connect the U disk to the target device through the isolation zone, and use the isolation zone to preprocess the data in the U disk; The isolation zone includes isolation devices, and the usage method of the isolation zone includes: Select the isolation device and set the isolation device between the U disk and the target device; Configure the direction and rules of data transmission, set the direction of data transmission as one-way transmission from the U disk to the target device, and the rules of data transmission as monitoring and logging; Start the isolation device. The data in the U disk is first transmitted into the isolation zone, and the data in the U disk is preprocessed in the isolation zone to initially judge whether the data is safe. If the data is determined to be safe, the data continues to be transmitted; otherwise, the transmission is interrupted, and the connection between the isolation device and the U disk is automatically disconnected; Clear all data in the isolation zone after use, initialize the isolation zone environment, and complete one isolation use of data transmission; Step S2: Set the data in the U disk after preprocessing as metadata, construct a multi-layer virtual world, and transmit the metadata from the isolation zone to the multi-layer virtual world; The construction method of the multi-layer virtual world is: Set the hierarchical structure of the multi-layer virtual world to include layer L0, layer L1, and layer L2. Layer L0 is the physical host, layer L1 is the management virtual machine, and layer L2 is the sub-virtual machine. Set the resource allocation of layer L1 to be half of that of layer L0. The resources include the number of CPU cores, the size of the running memory, and the size of the storage space. Create G_h sub-virtual machines of layer L2 in the management virtual machine of layer L1; Set the resource allocation for each child virtual machine to Among them, VM u _CPU indicates the number of CPU cores allocated to the u-th child virtual machine, C_L1 indicates the number of CPU cores allocated to the L1 layer, and VM u _NC indicates the size of the operating memory allocated to the u-th child virtual machine, M_L1 indicates the size of the operating memory allocated to the L1 layer, and VM u _CC represents the storage space size allocated to the u-th child virtual machine, and D_L1 represents the storage space size allocated to the L1 layer; Step S3: In the multi-layer virtual world, use the heuristic sandbox algorithm to detect viruses in the metadata and obtain the shadow data; The method of using the heuristic sandbox algorithm to detect viruses in the metadata includes: The metadata includes y_u blocks, and the heuristic sandbox algorithm is used to gradually process the data corresponding to each block; Score each block through the predefined rules of heuristic analysis. Set the score obtained by the predefined rules for the a-th block as Pf_a, and Pf_a ∈ [0, 1]. If Pf_a < Yz1, the data corresponding to the block is marked as low risk and directly released for continued transmission; if Yz1 ≤ Pf_a < Yz2, the file is marked as medium risk and needs to be analyzed by the sandbox; if Pf_a ≥ Yz2, the file is marked as high risk, immediately isolated and marked as non-transmissible; The sandbox analysis scores each block marked as medium risk through behavioral characteristics. Set the score obtained by the predefined rules for the b-th block as Pf_b, and Pf_b ∈ [0, 1]. If Pf_b < Yg1, the data corresponding to the block is marked as safe and normally transmitted; if Pf_b ≥ Yg1, the file is marked as non-safe and isolated, deleted, and an alarm is issued; Among them, Yz1, Yz2, and Yg1 are preset thresholds; Collect all the blocks marked as low risk and safe to form the shadow data; Step S4: Use the SCP or SFTP transmission tool to unidirectionally transmit the shadow data from the multi-layer virtual world to the target device, and extract and warn about the deleted missing blocks.

2. The USB disk virus isolation data transmission method according to claim 1, characterized in that: The method for preprocessing the data in the USB flash drive includes known virus detection and data integrity check; The method for detecting known viruses on the data in the USB flash drive is as follows: Creating a sample center, which includes characteristic strings in known virus samples; Divide the data in the USB flash drive into u blocks, read them one by one, and convert the data content of each small block into a byte stream; Use a matching algorithm to search for the characteristic string of each block in the byte stream and match the characteristic string with the sample center. If the match is successful, the data of the corresponding block is determined to be infected with a virus, the location of the matching block and the identifier of the characteristic string are recorded, and isolation, deletion or repair is performed. If the match fails, it is determined that the data is not infected with a known virus and data transmission continues; Collect the data composed of blocks after the matching algorithm is processed, which is recorded as pre-data. The method for checking the data integrity of the pre-data is as follows: The data of each block is read in binary mode, and the SHA-256 algorithm is used to perform hash calculation on the read data to generate a hash value Ha_s(i) with a fixed length and save it; Obtain the hash value Ha_y(i) of the original data corresponding to the data in each block, and compare the hash value Ha_y(i) with the hash value Ha_s(i). If they are equal, the data in block i is complete and consistent with the original data content; if they are not equal, the data in block i can be tampered with or damaged, and it should be deleted or marked for storage; Among them, Ha_s(i) represents the hash value of the i-th block data in the isolation zone, and Ha_y(i) represents the hash value of the i-th block data in the original data.

3. The USB disk virus isolation data transmission method according to claim 2, characterized in that: The method of dividing the data in the USB disk into u blocks and reading them one by one includes: Use a machine learning model to determine the size of the block. The machine learning model is based on a neural network or a deep learning model. Set the input of the machine learning model to be the number of bytes of data, and the output to be the size of the block. Set the constraint condition to the best balance between memory usage and I / O efficiency. Collect the number of bytes of historical data and the size of the corresponding output block as a sample set. Use the sample set to train the machine learning model to obtain a trained machine learning model. Input the number of bytes of the original data in the current U disk into the trained machine learning model to obtain the block size, set it to Kua, and use the block size Kua output by the current model to divide the data in the U disk into small blocks. Read the data transferred from the USB flash drive to the isolation zone in binary mode, read the data block by block through a loop structure, read a block of data with a size of Kua each time, until the remaining number of bytes is less than Kua, then directly read all the remaining data; Each time a block of data is read, the matching algorithm is used immediately to match the feature string. After processing, the next block is read. If the length of the feature string is greater than the block size Kua, the maximum length of the feature string at the end of the previous block is concatenated with the beginning of the current block, and then matched again until all the data is completely read.

4. The USB disk virus isolation data transmission method according to claim 3 is characterized in that: Search for the feature strings of each block in the byte stream using a matching algorithm and match the feature strings with the sample center. The specific method includes: The matching algorithm is based on the KMP algorithm and the Boyer-Moore algorithm. Build the bad character table and good suffix table of the Boyer-Moore algorithm for the preliminary matching stage, and build the prefix function of the KMP algorithm for the fine matching stage: Set the calculation method of the prefix function as π[j] = max{k: k < j and P[0…k - 1] = P[j - k…j - 1]}, where π[j] represents the value of the prefix function, that is, the length of the longest identical prefix and suffix of the first j characters of the pattern string P, P represents the pattern string, j represents the current position or index, k represents the length variable, that is, the length of the prefix, P[0…k - 1] represents the prefix of the first k characters of the pattern string P, and P[j - k…j - 1] represents the substring of the pattern string P from position j - k to position j - 1; The calculation method of the bad character table is BC[c] = max{j: P[j] = c}, where BC[c] represents the rightmost occurrence position of character c in the pattern string. If character c is not in the pattern string, then BC[c] = -1. P[j] = c is used to check whether the j-th character in the pattern string P is equal to character c. The calculation method of the good suffix table is GS[j] = the smallest k such that P[j - k…m - k - 1] = P[m - k…m - 1], where GS[j] represents the minimum number of positions the pattern string moves to the right when the character P[j] in the pattern string does not match. The smallest k represents the minimum number of positions the good suffix of the pattern string moves. P[j - k…m - k - 1] represents the substring of the pattern string P from position j - k to m - k - 1, where m is the total length of the pattern string, and P[m - k…m - 1] represents the substring of the pattern string P from position m - k to m - 1; Calculate the number of positions the pattern string moves in the bad character table and the good suffix table, and select the larger of the two as the number of positions the pattern string moves, thereby obtaining potential matching positions. Perform character-by-character matching within the potential matching positions using the prefix function. If the matching fails, calculate the number of positions the pattern string moves using the prefix function value and continue the matching. If the matching succeeds, record the matching position and continue to find the next match.

5. The USB disk virus isolation data transmission method according to claim 4, characterized in that: The method of scoring each block through heuristic analysis of predefined rules includes: Extract the data of each block and convert it into a feature vector representation X(F) = {x1(F),…,x v (F)}, set x m (F) is the mth feature of sample F, and m = 1, ..., v. Collect E_l groups of samples to form a training set. Each group of samples includes input and output. The input is the feature vector of the sample, and the output is the predefined rules and weights. The label of the sample is 1 or 0, 1 represents abnormal data, and 0 represents normal data. Set the decision tree as the predefined rule output model, train the decision tree model using the training dataset, use binary cross-entropy loss as the target loss function, and adopt gradient descent to minimize the loss function and update the model parameters until the value of the target loss function is minimized and no longer changes, then stop to obtain the trained decision tree model; Determine the feature vector of the metadata and import it into the trained decision tree model to obtain J_K predefined rules and their corresponding weights, and calculate the comprehensive output score of the predefined rules Where d is the index of the predefined rule, ωd represents the weight corresponding to the d-th predefined rule, and Tg_d represents the attribute value of the m-th feature in the data; Sandbox analysis scores each block marked as medium risk through behavioral characteristics. The specific method includes: According to the number of CPU cores, the size of the running memory, and the size of the storage space set in the multi-layer virtual world, combine different parameters to simulate a dynamic environment; For the data corresponding to each block in the dynamic environment, calculate the score of the behavioral characteristics of the data of the sth block in the time series R_t Among them, w represents the index of the dynamic environment parameter combination, R_d represents the number of dynamic environment parameter combinations, αw represents the weight of the wth dynamic environment parameter combination, Represents the label corresponding to the behavioral feature of the sth block at time t, R_t represents the number of times, and t represents the index of time.

6. A USB disk virus isolation data transmission system, used to implement the USB disk virus isolation data transmission method according to any one of claims 1 to 5, characterized in that: Include: Fence processing module: used to establish an isolation zone between the USB flash drive and the target device, perform known virus detection and data integrity check on the USB flash drive data within the isolation zone, and obtain metadata; Virtual module: used to build a multi-layer virtual world and transfer metadata from the isolation zone to the multi-layer virtual world; Data analysis and processing module: Design heuristic sandbox algorithm through heuristic analysis and sandbox analysis, use the heuristic sandbox algorithm to process and analyze metadata, and obtain shadow data; Terminal transmission module: used to transmit shadow data from multi-layer virtual world to target device in one direction, completing data transmission after isolating viruses.

7. A USB flash drive comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the USB flash drive virus isolation data transmission method according to any one of claims 1 to 5 is implemented.

Images