Computer virus detection method and computer equipment

Abstract

The invention belongs to the technical field of computer information security, and discloses a computer virus detection method and computer device.According to the scheme, a to-be-detected target process is matched with a virus feature code, and the to-be-detected target process is matched with a virus behavior feature; the risk assessment on the dynamic real-time behavior of the target process is realized, and the computer virus detection result is more reliable; moreover, a feature frequent item set of the process behavior features is also constructed, feature association rules are generated for the feature frequent item set, the feature association rules with the confidence degree reaching a preset threshold value or above are determined as strong association rules, and when the process behaviors executed in the target process are matched with preconditions in the strong association rules, the target process is determined to be the target process. The method further predicts the security level of the subsequent behavior of the target process, realizes early warning of possible risks before the dangerous behavior occurs, is convenient for further treatment in advance, and can improve the security of a computer system.

Description

Technical Field

[0001] The present application relates to the technical field of computer information security, and in particular to a computer virus detection method and computer equipment. Background Art

[0002] In the prior art, computer virus intrusion detection is performed at the network entrance. When it is found that the detection object meets the preset virus signature code, the detection object is considered to be a computer virus and is intercepted.

[0003] Due to the changeable implementation rules of computer viruses, especially ransomware, the existing technical solutions determine whether the detection object is a computer virus based on whether the detection object meets the preset virus signature code. The detection rules are prone to failure, resulting in missed detections; and the detection results are simply divided into computer viruses or not. For suspicious detection objects that do not fully meet the preset virus signature code, no further judgment can be made, and no warning can be issued for potential subsequent risk behaviors. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides a computer virus detection method and a computer device.

[0005] According to one aspect of an embodiment of the present application, a computer virus detection method is disclosed, the computer virus detection method comprising:

[0006] Matching the target process to be detected with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process, wherein the target process contains one or more of the process behaviors;

[0007] Building a feature frequent item set of process behavior features based on virus behavior features matched by the process behavior contained in the target process;

[0008] Generate feature association rules for the feature frequent item sets, and determine feature association rules whose confidence reaches a preset threshold value as strong association rules;

[0009] When the executed process behavior in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is predicted, wherein the strong association rule includes the process behavior feature corresponding to the subsequent behavior.

[0010] In some embodiments, matching the target process to be detected with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process includes:

[0011] Match the target process to be detected with the virus signature;

[0012] If the target process successfully matches the virus signature, the target process is determined to be a dangerous process;

[0013] If the target process fails to match the virus signature, the probability values ​​of the process behaviors included in the target process corresponding to various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior.

[0014] In some embodiments, after matching the target process to be detected with the virus signature, the method further includes:

[0015] When the target process is determined to be a dangerous process, all process behaviors included in the target process are blocked and an alarm signal is issued;

[0016] If the target process fails to match the virus signature, the target process is determined to be a process of concern; if the security level corresponding to any process behavior contained in the target process is determined to be a dangerous behavior, the target process is changed from a process of concern to a dangerous process; if the security level corresponding to all process behaviors contained in the target process is determined to be a safe behavior, the target process is changed from a process of concern to a safe process, and all process behaviors contained in the target process are allowed; if the security level corresponding to some process behaviors contained in the target process is determined to be a behavior of concern, the target process is maintained as a process of concern, and process behaviors with a security level of safe behavior in the target process are allowed.

[0017] In some embodiments, the determining that the target process is a dangerous process includes: marking the target process as a black process; the determining that the target process is a concern process includes: marking the target process as a gray process; the changing the target process from a concern process to a safe process includes: changing the target process from a gray process to a white process; the dangerous behavior is a black behavior, the concern behavior is a gray behavior, and the safe behavior is a white behavior.

[0018] In some embodiments, the step of constructing a feature frequent item set of process behavior features based on virus behavior features matched by process behaviors contained in the target process includes:

[0019] Traversing a process behavior list of a target process in a process list whose process behavior matches the virus behavior feature, obtaining a first candidate item set, wherein the first candidate item set includes the process behavior and the support degree corresponding to the process behavior, and the process list includes a plurality of the target processes;

[0020] Eliminate the items in the first candidate item set whose support is below the support threshold to obtain a second candidate item set;

[0021] Traversing the second candidate item set, combining the process behaviors included in the second candidate item set in pairs, and obtaining the combined support corresponding to the process behavior combinations after the pairwise combination based on the process behavior list of the target process in the process list that matches the virus behavior characteristics, and obtaining a third candidate item set including the process behavior combinations after the pairwise combination and the combined support;

[0022] Iterative execution is performed to obtain a candidate item set Lk containing k-1 process behavior combinations and combination support according to the process behaviors contained in the candidate item set Lk-1 and the process behavior list of the target process in the process list that matches the virus behavior characteristics, until the candidate item set Lk is an empty set, where k represents the sequence number of the candidate item set and k is an integer greater than or equal to 4.

[0023] In some embodiments, the process behavior list including k-1 process behavior combinations and combination support obtained according to the process behavior included in the candidate item set Lk-1 and the process behavior list including the target process in the process list and the virus behavior characteristics includes:

[0024] Traversing the candidate item set Lk-1, for each process behavior included in the candidate item set Lk-1, storing a pointer to the next process behavior, wherein the next process behavior is k-2 process behaviors in the process behavior combination included in the candidate item set Lk-1;

[0025] Combine every k-1 process behaviors included in the candidate item set Lk-1, and obtain the combined support corresponding to the process behavior combination after k-1 process behaviors are combined based on the process behavior list that matches the virus behavior characteristics contained in the target process in the process list, and obtain the candidate item set Lk containing the process behavior combination and the combined support after k-1 process behaviors are combined.

[0026] In some embodiments, generating feature association rules for the feature frequent item sets and determining feature association rules with confidence levels above a preset threshold as strong association rules includes:

[0027] Using an association rule mining algorithm to mine association rules for the process behavior features in the feature frequent item set, to obtain multiple feature association rules;

[0028] Based on the relationship Confidence(A->B)=support(A&B) / support(A), the confidence of each feature association rule is calculated, wherein A and B represent the process behavior feature or a combination of at least two process behavior features occurring simultaneously;

[0029] The confidence of each feature association rule is compared with a preset threshold, and when the confidence of the feature association rule reaches above the preset threshold, the feature association rule is determined as a strong association rule.

[0030] In some embodiments, the predicting the security level of the subsequent behavior of the target process includes:

[0031] Calculating the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behavior, the concerned behavior and the safe behavior respectively;

[0032] The security level with the largest probability value is used as the security level of the subsequent behavior of the target process, and the security level is one of the dangerous behavior, the concerned behavior, and the safe behavior;

[0033] When the subsequent behavior of the target process is predicted to be a dangerous behavior, an alarm signal is issued.

[0034] In some embodiments, the calculating of the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behaviors, the concerned behaviors, and the safe behaviors respectively includes:

[0035] Based on relational Calculating the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behavior, the concerned behavior and the safe behavior respectively;

[0036] Among them, P(Y=security level|X={behavior}) represents the probability value that the subsequent behavior of the target process is at a certain security level, P(security level) represents the prior probability that the process behavior is at a certain security level, P(behavior|security level) represents the probability of a certain process behavior occurring under the condition that the process behavior is at a certain security level, P9behavior) represents the prior probability of a certain process behavior, α represents the smoothing coefficient, and z represents the number of features.

[0037] According to one aspect of an embodiment of the present application, a computer device is disclosed, which includes one or more processors and a memory, wherein the memory is used to store one or more computer programs, and when the one or more computer programs are executed by the one or more processors, the processor implements the computer virus detection method as described above.

[0038] The technical solution provided by the embodiments of the present application includes at least the following beneficial effects:

[0039] The scheme disclosed in the present application, in addition to matching the target process to be detected with the virus signature code, also matches the target process to be detected with the virus behavior characteristics, thereby realizing risk assessment of the dynamic real-time behavior of the target process, and making the computer virus detection result more reliable; furthermore, a feature frequent item set of the process behavior characteristics is constructed, and feature association rules are generated for the feature frequent item set, and feature association rules with a confidence level above a preset threshold are determined as strong association rules. When the executed process behavior in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is further predicted, thereby realizing early warning of possible risks before dangerous behavior occurs, facilitating further disposal in advance, and improving the security of the computer system. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0041] Figure 1 A schematic diagram showing an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied;

[0042] Figure 2 A flowchart of a computer virus detection method according to an embodiment of the present application is shown;

[0043] Figure 3 Shows Figure 2 Detailed flow chart of an embodiment of step S202;

[0044] Figure 4 Shows Figure 2 Detailed flow chart of another embodiment of step S202;

[0045] Figure 5 Shows Figure 2 Detailed flow chart of another embodiment of step S202;

[0046] Figure 6 Shows Figure 2 Detailed flow chart of an embodiment of step S203;

[0047] Figure 7 Shows Figure 2 Detailed flow chart of an embodiment of step S204;

[0048] Figure 8 Shows Figure 2Detailed flow chart of an embodiment of step S206;

[0049] Fig. 9 A block diagram showing the composition of a computer device according to an embodiment of the present application is shown;

[0050] Fig.10 A block diagram of a computer system structure for implementing some embodiments of the present application is shown.

[0051] The following are the descriptions of the reference numerals:

[0052] 101. Monitoring module; 102. Backup data acquisition module; 103. Tamper-proof storage system; 900. Computer equipment; 901. Processor; 902. Memory; 1000. Computer system; 1001. CPU; 1002. ROM; 1003. RAM; 1004. Bus; 1005. I / O interface; 1006. Input part; 1007. Output part; 1008. Storage part; 1009. Communication part; 1010. Drive; 1011. Removable media. DETAILED DESCRIPTION

[0053] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of this application will be more comprehensive and complete, and the concept of the example embodiments will be fully conveyed to those skilled in the art.

[0054] The terms "first", "second", "third", etc. are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first", "second", "third", etc. may explicitly or implicitly include one or more features.

[0055] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0056] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0057] In this application, some professional terms are explained as follows:

[0058] Distributed system: A loosely coupled system consisting of multiple processors interconnected by communication lines. It has the following four characteristics: distribution, autonomy, parallelism, and globality.

[0059] Distributed system node: The various sub-nodes that make up the distributed system, each of which contains its own processor and memory, and each has the function of independently processing data.

[0060] Ransomware: A computer virus that is mainly spread in the form of emails, program Trojans, and web page Trojans. This virus is extremely harmful and will cause immeasurable losses to users once infected. This virus uses various encryption algorithms to encrypt files, and the infected person is generally unable to decrypt them. The decryption can only be possible if the private key is obtained.

[0061] Apriori algorithm: an association rule mining algorithm used to mine the associations between process behavior features.

[0062] Support: The ratio of the number of transactions that contain both X and Y to the number of all transactions in a transaction set, reflecting the frequency with which X and Y appear simultaneously in the transaction set.

[0063] Confidence: The ratio of the number of transactions that contain both X and Y to the number of transactions that contain X, reflecting the probability of Y appearing in the transactions that contain X.

[0064] Frequent item set: refers to a set of feature items whose probability of appearing together is greater than the specified minimum support.

[0065] Virus signature: It is a characteristic binary content that can be used to identify viruses. Generally, the detected target is compared with the signature to determine whether the detected target is a virus.

[0066] Three-color marking: For the processes running on the system nodes, a sample data set is formed according to virus signature matching and behavior signature matching, and the sample data set is classified using knowledge of probability statistics. The risk level of the process is then graded and classified into three colors, with corresponding different disposal methods.

[0067] Snapshot mechanism: A technology that records the state of data at a certain point in time. Its characteristic is that it does not change with subsequent data changes, but maintains the data state at the time of creation and can be used to restore data.

[0068] The existing computer virus detection solutions have the problems of easy missed detection and failure to warn of potential subsequent risk behaviors. The reasons are that the implementation rules of computer viruses are changeable, especially for ransomware viruses, and the detection rules are easy to fail; and virus detection is only based on the process behavior that has already occurred, without considering the subsequent behavior of the process.

[0069] To this end, the present application provides a new computer virus detection method, computer equipment and computer-readable storage medium to achieve risk assessment of the dynamic real-time behavior of the target process to be detected, thereby improving the reliability of computer virus detection results; at the same time, it can achieve early warning of possible risks before dangerous behaviors occur, facilitate further disposal in advance, and improve the security of computer systems.

[0070] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiment of the present application can be applied is shown. Figure 1 As shown, the system architecture may include a monitoring module 101, a backup data acquisition module 102, and an anti-tampering storage system 103. Among them, the monitoring module 101 is resident in a distributed system node and is configured to execute all or part of the steps of the computer detection method in this application. The backup data acquisition module 102 is connected to the distributed nodes of the distributed system and is used to obtain the data to be protected on the distributed nodes in real time. The backup data acquisition module 102 includes a change recognition thread and a data pulling thread, wherein the change recognition thread is used to identify the changes of the protected data in real time and send the change notification to the data pulling thread, and the data pulling thread is used to pull the changed data from the distributed system node and write it into the anti-tampering storage system 103 when receiving the change notification. Among them, the backup data acquisition module 102 can send data to the anti-tampering storage system 103 by timed sending, for example, sending data to the anti-tampering storage system 103 every 1 minute; or it can send data to the anti-tampering storage system 103 by quantitative sending, for example, when the content changes to 100M, the data is sent to the anti-tampering storage system 103. The tamper-proof storage system 103 is a distributed storage system that supports tamper-proof functions. It is deployed in an independent network area and only opens the corresponding port of the data receiving interface to the backup data acquisition module 102 for data synchronization. When the data receiving interface receives data, it is forwarded to the data landing interface, and the data landing interface lands the data to the disk through a snapshot mechanism.

[0071] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0072] Figure 2 A flowchart of a computer virus detection method according to an embodiment of the present application is shown. Figure 2 As shown, the computer virus detection method can be executed by a monitoring module, and the monitoring module can be Figure 1 The monitoring module 101 shown in . The computer virus detection method at least includes a virus feature acquisition step, a feature matching step, a frequent item set construction step, a strong association rule determination step, and a subsequent behavior risk prediction step, which correspond to the following steps S201 to S204 and steps S205-S206, respectively, and are described in detail as follows:

[0073] In step S201, a virus feature library is obtained, wherein the virus feature library includes virus feature codes and virus behavior features.

[0074] In some embodiments, virus behavior characteristics include privilege escalation (DD1), modification of domain settings (DD2), vulnerability scanning (DD3), port scanning (DD4), network sniffing (DD5), system information collection (SD1), large-scale data reading and external transmission (SD2), deletion of protected data (ND1), modification of protected data (ND2), and addition of protected data (ND3).

[0075] Among them, privilege escalation (DD1) refers to increasing the permissions of the process itself through commands, such as chmod; modifying domain settings (DD2) refers to modifying the domain to which the process belongs through commands; vulnerability scanning (DD3) refers to scanning system vulnerabilities through tools and commands; port scanning (DD4) refers to scanning system open ports through commands; network sniffing (DD5) refers to sniffing other open machine IPs in the network through commands; system information collection (SD1) refers to collecting system information such as CPU model, memory information, operating system information, other software information, etc.; reading large amounts of data and transmitting it to the outside (SD2) includes reading the collected information and transmitting it to the outside through the network; deleting protected data (ND1) refers to attempting to delete protected data, including but not limited to databases, files, etc.; modifying protected data (ND2) refers to attempting to modify protected data, including but not limited to databases, files, etc.; adding protected data (ND3) refers to attempting to add new protected data content, including but not limited to databases, files, etc.

[0076] It is understandable that the virus behavior characteristics including the ten behavior characteristics listed above is only an exemplary embodiment of the present application. In other embodiments, the virus behavior characteristics may further include other behavior characteristics, or only include some of the ten behavior characteristics listed above.

[0077] In step S202, the target process to be detected is matched with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process.

[0078] The target process includes one or more process behaviors.

[0079] Figure 3 Shows Figure 2 The detailed flow chart of step S202 in an embodiment is as follows: Figure 3 As shown, in an exemplary embodiment, step S202 includes the following steps S301 to S304, which are described in detail as follows:

[0080] In step S301, the target process to be detected is matched with the virus signature. If the target process matches the virus signature successfully, the process proceeds to step S302; if the target process matches the virus signature unsuccessfully, the process proceeds to step S303.

[0081] Specifically, in step S301, a disassembly operation is performed on the newly started process binary file, that is, the target process, to identify the code structure and library functions of the target process and match them with the virus signature.

[0082] In step S302, it is determined that the target process is a dangerous process.

[0083] In step S303, the probability values ​​of the process behaviors included in the target process corresponding to each security level are calculated. Then, the process proceeds to step S304.

[0084] In step S304, the security level with the largest probability value is determined as the security level corresponding to the process behavior.

[0085] exist Figure 3 In the illustrated embodiment, if the target process fails to match the virus signature, the probability values ​​of the process behaviors contained in the target process corresponding to various security levels are further calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior. The security level judgment result of the process behavior has high reliability.

[0086] Figure 4 Shows Figure 2 A detailed flow chart of another embodiment of step S202 is shown in FIG. Figure 4 As shown, in an exemplary embodiment, step S202 includes the following steps S401 to S409, which are described in detail as follows:

[0087] In step S401, the target process to be detected is matched with the virus signature. If the target process matches the virus signature successfully, the process proceeds to step S402; if the target process matches the virus signature unsuccessfully, the process proceeds to step S403.

[0088] In step S402, the target process is determined to be a dangerous process, all process behaviors of the target process are blocked and an alarm signal is issued.

[0089] In step S403, it is determined that the target process is a process of interest. Then, the process proceeds to step S404.

[0090] In step S404, the probability values ​​of the process behaviors included in the target process corresponding to the various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior. Then, the process proceeds to step S405.

[0091] In step S405, it is determined whether the target process contains a process behavior with a security level of dangerous behavior. If so, the process proceeds to step S406; otherwise, the process proceeds to step S407.

[0092] In step S406, the target process is changed from a concerned process to a dangerous process.

[0093] In step S407, it is determined whether the security levels of all process behaviors included in the target process are safe behaviors. If so, the process proceeds to step S408; otherwise, the process proceeds to step S409.

[0094] In step S408, the target process is changed from a concern process to a safe process, and all process behaviors included in the target process are allowed.

[0095] In step S409, the target process is kept as a focus process, and process behaviors with a security level of safe behaviors in the target process are allowed.

[0096] exist Figure 4 In the illustrated embodiment, if the target process fails to match the virus signature, the security level of the target process is further determined based on the security level of the process behavior, and the process security level judgment result is highly reliable; moreover, it can accurately determine whether the process behavior of the target process is allowed, which provides better security.

[0097] In some embodiments, a three-color marking method is used to mark the security level of the target process. Figure 4 In the steps shown, determining the target process as a dangerous process is specifically: marking the target process as a black process; determining the target process as a concern process is specifically: marking the target process as a gray process; changing the target process from a concern process to a safe process is specifically: changing the target process from a gray process to a white process.

[0098] Specifically, if the target process successfully matches the virus signature, the target process is marked as a black process. If the target process fails to match the virus signature, the security level of the target process may be gray or white, and the target process is first marked as a gray process in the initialization phase, and then the security level of the target process is determined according to the security level of the process behavior of the target process, and then the target process is marked as a white process, or the target process is kept as a gray process.

[0099] In detail, for the target process marked as a gray process in the initialization phase, if it is determined that the security levels corresponding to all process behaviors contained in the target process are safe behaviors, the target process mark is changed to a white process; if it is determined that the security levels corresponding to some process behaviors contained in the target process are concern behaviors, the target process remains a gray process.

[0100] In some embodiments, a three-color marking method is used to mark the security level of the process behavior of the target process, wherein dangerous behaviors are marked as black behaviors, concerning behaviors are marked as gray behaviors, and safe behaviors are marked as white behaviors.

[0101] In an exemplary embodiment, if Figure 5 As shown, step S202 includes the following steps S501 to S509, which are described in detail as follows:

[0102] In step S501, the target process to be detected is matched with the virus signature. If the target process matches the virus signature successfully, the process proceeds to step S502; if the target process matches the virus signature unsuccessfully, the process proceeds to step S503.

[0103] In step S502, the target process is marked as a black process, all process behaviors of the target process are blocked and an alarm signal is issued.

[0104] In step S503, the target process is marked as a gray process. Then, the process proceeds to step S504.

[0105] In step S504, the probability values ​​of the process behaviors included in the target process corresponding to the various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior. Then, the process proceeds to step S505.

[0106] In step S505, determine whether the target process contains black behavior, if so, proceed to step S506; otherwise, proceed to step S507.

[0107] In step S506, the target process is changed from a gray process to a black process.

[0108] In step S507, it is determined whether all process behaviors included in the target process are white behaviors. If so, the process proceeds to step S508; otherwise, the process proceeds to step S509.

[0109] In step S508, the target process is changed from a gray process to a white process, and all process behaviors included in the target process are allowed.

[0110] In step S509, the target process is kept as a gray process, and white behaviors in the target process are allowed.

[0111] Exemplarily, the initialization mapping relationship table between the process security level mark and the virus signature matching result and the virus behavior signature matching result is shown in Table 1 below:

[0112] Table 1

[0113]

[0114] Among them, 1 in Table 1 indicates a successful match, and 0 indicates an unsuccessful match.

[0115] Below, the process of determining the process behavior security level of the present application is described by taking a specific embodiment as an example.

[0116] Process B initiates a behavior request, and it is determined that process B fails to match the virus signature, and matches suspected behaviors: "collecting system information SD1" and "modifying domain settings DD2", then a calculation is performed to determine the security level of the suspected behavior.

[0117] Among them, the relevant process behavior matching is shown in Table 2 below:

[0118] Table 2

[0119]

[0120] Among them, 1 in Table 2 indicates a successful match, and 0 indicates an unsuccessful match.

[0121] First, based on Table 2 above, the probability values ​​of the security levels of the process behavior being black, gray, and white are calculated when the process behavior matches SD1 and DD2.

[0122] Specifically, the probability value of the security level of the process behavior being black is calculated based on equation 1:

[0123]

[0124] Among them, P(Y=Black|X={SD1,DD2}) represents the probability value of the security level being black, P9(black) represents the prior probability of the process behavior being black, P9(SD1|black) represents the probability of SD1 occurring under the condition that the process behavior is black, P(DD2|black) represents the probability of DD2 occurring under the condition that the process behavior is black, P(SD1) represents the prior probability of SD1, P(DD2) represents the prior probability of DD2, α represents the smoothing coefficient, and z represents the number of features. In this embodiment, α is 1 and z is 5.

[0125] Substituting P(black), P(SD1|black), P(DD2|black), P(SD1), P(DD2), α, and z into equation 1, we can get

[0126] The probability value of the gray security level of the process behavior is calculated based on equation 2:

[0127]

[0128] Among them, P(Y=gray|X={SD1,DD2}) represents the probability value of the security level being gray, P(gray) represents the prior probability of the process behavior being gray, P(SD1|gray) represents the probability of SD1 occurring under the condition that the process behavior is gray, P(DD2|gray) represents the probability of DD2 occurring under the condition that the process behavior is gray, P(SD1) represents the prior probability of SD1, P(DD2) represents the prior probability of DD2, α represents the smoothing coefficient, and z represents the number of features. In this embodiment, α is 1 and z is 5.

[0129] Substituting P(gray), P(SD1|gray), P(DD2|gray), P(SD1), P(DD2), α, and z into equation 2, we can get

[0130] The probability value of the security level of the process behavior being white is calculated based on equation 3:

[0131]

[0132] Wherein, P(Y=white|X={SD1,DD2}) represents the probability value of the security level being white, P(white) represents the prior probability of the process behavior being white, P(SD1|white) represents the probability of SD1 occurring under the condition that the process behavior is white, P(DD2|white) represents the probability of DD2 occurring under the condition that the process behavior is white, P(SD1) represents the prior probability of SD1, P(DD2) represents the prior probability of DD2, α represents the smoothing coefficient, and z represents the number of features. In this embodiment, α is 1 and z is 5.

[0133] Substituting P(white), P(SD1|white), P(DD2|white), P(SD1), P(DD2), α, and z into equation 3, we can get

[0134] According to the above calculation results, P(Y=gray|X={SD1, DD2}) is the largest, and the security level of the process behavior is determined to be gray behavior.

[0135] In the process of calculating the probability value of the security level of the process behavior, a certain probability value may be calculated to be 0, which is obviously illogical. Therefore, in the above embodiment, a smoothing coefficient is set to avoid this situation.

[0136] In step S203, a feature frequent item set of the process behavior feature is constructed based on the virus behavior feature matched by the process behavior contained in the target process.

[0137] Figure 6 Shows Figure 2 The detailed flow chart of step S203 in an embodiment is as follows: Figure 6 As shown, in an exemplary embodiment, step S203 includes the following steps S601 to S604, which are described in detail as follows:

[0138] In step S601, the process behavior list of the target process in the process list that matches the virus behavior feature is traversed to obtain a first candidate item set. Then, the process proceeds to step S602.

[0139] The first candidate set includes process behaviors and the support corresponding to the process behaviors. The process list includes multiple target processes.

[0140] In step S602, items whose support is below the support threshold are removed from the first candidate item set to obtain a second candidate item set. Then, the process proceeds to step S603.

[0141] In step S603, the second candidate item set is traversed, the process behaviors included in the second candidate item set are combined in pairs, and the combined support corresponding to the process behavior combinations after the two-by-two combinations are obtained based on the process behavior list of the target process in the process list that matches the virus behavior characteristics, and the third candidate item set including the process behavior combinations after the two-by-two combinations and the combined support is obtained. Then, step S604 is entered.

[0142] In step S604, iterative execution is performed to obtain a candidate item set Lk containing k-1 process behavior combinations and combination support according to the process behaviors contained in the candidate item set Lk-1 and the process behavior list of the target process in the process list that matches the virus behavior characteristics, until the candidate item set Lk is an empty set.

[0143] Wherein, k represents the sequence number of the candidate item set, and k is an integer greater than or equal to 4.

[0144] Among them, the process behavior included in the candidate set can be represented by the behavior characteristics that match the process behavior with the virus behavior characteristics, and the support corresponding to the process behavior can be represented by the support corresponding to the behavior characteristics of the process behavior, as shown in Tables 3 to 7 below.

[0145] In this way, all feature frequent item sets are obtained, so that subsequent steps can be further performed to predict the security level of subsequent behaviors of the target process.

[0146] In some embodiments, step S604 includes: traversing the candidate item set Lk-1, storing a pointer to the next process behavior for each process behavior included in the candidate item set Lk-1; combining every k-1 process behaviors included in the candidate item set Lk-1, and obtaining the combined support corresponding to the process behavior combination after the k-1 process behaviors are combined based on the process behavior list that matches the virus behavior characteristics included in the target process in the process list, and obtaining the candidate item set Lk containing the process behavior combination after the k-1 process behaviors are combined and the combined support.

[0147] Among them, the next process behavior is k-2 process behaviors in the process behavior combination included in the candidate item set Lk-1. Exemplarily, the candidate item set Lk-1 is the third candidate item set, and k-2 process behaviors are two process behaviors, that is, the next process behavior is the other two process behaviors in the process behavior combination included in the third candidate item set except the current process behavior. Exemplarily, the candidate item set Lk-1 is the fourth candidate item set, and k-2 process behaviors are three process behaviors, that is, the next process behavior is the other three process behaviors in the process behavior combination included in the fourth candidate item set except the current process behavior.

[0148] For each process behavior included in the candidate item set Lk-1, a pointer to the next process behavior is stored. The required candidate item set Lk can be obtained by traversing each process behavior included in the candidate item set Lk-1 by k elements, and the calculation amount is small.

[0149] In step S204, feature association rules are generated for feature frequent item sets, and feature association rules whose confidence level is above a preset threshold are determined as strong association rules.

[0150] Figure 7 Shows Figure 2 The detailed flow chart of step S204 in an embodiment is as follows: Figure 7 As shown, in an exemplary embodiment, step S204 includes the following steps S701 to S704, which are described in detail as follows:

[0151] In step S701, an association rule mining algorithm is used to mine association rules for process behavior features in feature frequent item sets to obtain multiple feature association rules. Then, the process proceeds to step S702.

[0152] In step S702, based on the relationship Confidence(A->B)=support(A&B) / support(A), the confidence of each feature association rule is calculated. Then, the process proceeds to step S703.

[0153] Wherein, A and B represent process behavior characteristics or a combination of at least two process behavior characteristics occurring simultaneously.

[0154] In step S703, it is determined whether the confidence of each feature association rule reaches or exceeds a preset threshold. If the confidence of a feature association rule reaches or exceeds the preset threshold, the process proceeds to step S704.

[0155] In step S704, the feature association rule is determined to be a strong association rule.

[0156] exist Figure 7 In the illustrated embodiment, feature association rules whose confidence levels are above a preset threshold are determined as strong association rules, which can improve the accuracy of prediction of subsequent behaviors of the process, so as to further predict the security level of subsequent behaviors of the target process.

[0157] In step S205, it is determined whether the process behavior executed in the target process matches the prerequisite in the strong association rule. If so, the process proceeds to step S206.

[0158] In step S206, the security level of the subsequent behavior of the target process is predicted.

[0159] The strong association rule includes the process behavior characteristics corresponding to the subsequent behavior. That is, the process behavior characteristics corresponding to the subsequent behavior are the association results in the strong association rule.

[0160] Figure 8 Shows Figure 2 The detailed flow chart of step S206 in an embodiment is as follows: Figure 8 As shown, in an exemplary embodiment, step S206 includes the following steps S801 to S802, which are described in detail as follows:

[0161] In step S801, the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behavior, the concerned behavior and the safe behavior are calculated. Then, the process proceeds to step S802.

[0162] In some embodiments, in step S801, based on the relation Calculate the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors respectively.

[0163] Among them, P(Y=security level|X={behavior}) represents the probability value of the subsequent behavior of the target process being a certain security level, P(security level) represents the prior probability of the process behavior being a certain security level, P(behavior|security level) represents the probability of a certain process behavior occurring under the condition that the process behavior is a certain security level, P(behavior) represents the prior probability of a certain process behavior, α represents the smoothing coefficient, and z represents the number of features. For example, α takes a value of 1.

[0164] In step S802, the security level with the maximum probability value is used as the security level of the subsequent behavior of the target process.

[0165] The safety level is one of dangerous behavior, concerned behavior, and safe behavior. As described in the above embodiment, dangerous behavior can be marked as black behavior, concerned behavior can be marked as gray behavior, and safe behavior can be marked as white behavior.

[0166] Figure 8 In the illustrated embodiment, the probability values ​​of the subsequent behaviors of the target process corresponding to dangerous behaviors, concerning behaviors, and safe behaviors are first calculated, and the security level with the largest probability value is used as the security level of the subsequent behaviors of the target process. The security level judgment result of the subsequent behaviors has high reliability.

[0167] Furthermore, in some embodiments, when the subsequent behavior of the target process is predicted to be a dangerous behavior, an alarm signal is issued to facilitate further processing in advance, thereby improving the security of the computer system.

[0168] Below, taking a specific embodiment as an example, the frequent item set construction step, the strong association rule determination step and the subsequent behavior risk prediction step are explained.

[0169] Exemplarily, the process behavior list of the target process in the process list that matches the virus behavior characteristics is shown in Table 3 below:

[0170] Table 3

[0171]

[0172]

[0173] In the frequent item set construction step, first, the process behavior list of the target process in the process list that matches the virus behavior characteristics is traversed to obtain the first candidate item set L1, as shown in Table 4 below:

[0174] Table 4

[0175] Behavior Name Support DD1 1 DD2 5 SD1 6 SD2 3 ND1 7 ND2 2

[0176] Among them, the support in Table 4 indicates the number of times the process behavior appears in the process list.

[0177] Then, the support threshold is set to 4, and the second candidate item set L2 is generated from the first candidate item set L1 according to the support threshold. Among them, the process behaviors with support less than 4 in the first candidate item set L1 will be pruned. The obtained second candidate item set L2 is shown in the following Table 5:

[0178] Table 5

[0179] Behavior Name Support DD2 5 SD1 6 ND1 7

[0180] Next, based on the second candidate item set L2, the third candidate item set L3 is generated. Specifically, the second candidate item set L2 is traversed to store the corresponding process behaviors and the related process behaviors pointed to; all the ongoing behaviors here have no related behaviors, so the second candidate item set L2 obtained here is a set of combinations of each item and the corresponding combination support. The third candidate item set L3 obtained is shown in Table 6 below:

[0181] Table 6

[0182]

[0183]

[0184] Next, based on the third candidate item set L3, the fourth candidate item set L4 is generated. In detail, the third candidate item set L3 is traversed, and the corresponding process behaviors and the related process behaviors pointed to are stored as follows: (DD2, pointer SD1, pointer ND1), (SD1, pointer DD2, pointer ND1), (ND1, pointer DD2, pointer SD1); a circular linked list is formed; after the construction is completed, only 3 elements of each element need to be traversed to obtain the required L4. The fourth candidate item set L4 obtained is shown in Table 7 below:

[0185] Table 7

[0186] Behavior Name Support DD2,SD1,ND1 4

[0187] Repeat the above steps and execute iteratively to generate candidate item set Lk based on candidate item set Lk-1; traverse candidate item set LK-1, and for each element p in it, store a pointer to the next hop to form a circular linked list; you only need to traverse each element k elements to get the required Lk.

[0188] And so on, until the candidate item set Lk = empty set. At this point, all candidate item sets are obtained, that is, all feature frequent item sets are obtained.

[0189] In the step of determining strong association rules, the association rule mining algorithm (Apriori algorithm) is first used to perform association evaluation on the process behavior features in each feature frequent item set, generate feature association rules, and calculate the confidence of each feature association rule.

[0190] Among them, the confidence calculation formula of the feature association rule is:

[0191] Confidence(A->B)=P(A|B)=support(A&B) / support(A).

[0192] Wherein, A and B represent process behavior characteristics or a combination of at least two process behavior characteristics occurring simultaneously.

[0193] For example, for the feature frequent item set {DD2, SD1, ND1}, the generated feature association rules and the confidence corresponding to the feature association rules are as follows:

[0194] (DD2&SD1)->ND1 confidence=4 / 4=100%;

[0195] (DD2&ND1)->SD1 confidence=4 / 5=80%;

[0196] (SD1&ND1)->DD2 confidence=4 / 6=66.67%;

[0197] DD2->(SD1&ND1)confidence=4 / 5=80%;

[0198] SD1->(DD2&ND1)confidence=4 / 6=66.67%;

[0199] ND1->(DD2&SD1)confidence=4 / 7=57.14%.

[0200] Then, the confidence threshold (min_confidence) is set to 70%, and the confidence greater than 70% is a strong association rule; all association rules with confidence greater than the confidence threshold are recorded in the database, and the strong association rules are obtained as follows:

[0201] (DD2&SD1)->ND1 confidence=4 / 4=100%>min_confidence;

[0202] (DD2&ND1)->SD1 confidence=4 / 5=80%>min_confidence;

[0203] DD2->(SD1&ND1)confidence=4 / 5=80%>min_confidence.

[0204] In the subsequent behavior risk prediction step, according to the strong association rules listed in the strong association rule determination step, it can be seen that the probability of ND1 occurring is 100%.

[0205] According to the strong association rule: (DD2&SD1)->ND1, under the premise of DD2 and SD1, the confidence probability of predicting the occurrence of ND1 behavior is 100% (greater than the confidence threshold of 70%). Therefore, based on the following relationship, the safety level of ND1 is calculated in combination with the aforementioned Table 2.

[0206]

[0207] According to the above calculation results, P(Y=black|X={ND1}) is the largest, and it is predicted that the occurrence of ND1 behavior will cause the process behavior to turn black and send out an alarm signal.

[0208] It should be noted that in the above exemplary embodiments, only the feature frequent item set {DD2, SD1, ND1} and the strong association rule: (DD2&SD1)->ND1 are used as examples for illustration. It can be understood that when implementing the method of the present application, for other feature frequent item sets containing process behavior feature combinations (for example, the third candidate item set L3), it is also necessary to perform association evaluation and further obtain strong association rules, which are not listed one by one here.

[0209] In summary, in addition to matching the target process to be detected with the virus signature code, the present application also matches the target process to be detected with the virus behavior characteristics, thereby realizing risk assessment of the dynamic real-time behavior of the target process, and making the computer virus detection results more reliable; moreover, a feature frequent item set of the process behavior characteristics is constructed, and feature association rules are generated for the feature frequent item set, and the feature association rules with a confidence level above a preset threshold are determined as strong association rules. When the executed process behavior in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is further predicted, thereby realizing early warning of possible risks before dangerous behavior occurs, facilitating further disposal in advance, and improving the security of the computer system.

[0210] In addition, the protected data is backed up in real time and an incremental snapshot mechanism is used to enforce tamper-proofing, which can meet the requirements of system data recovery even if the computer system is invaded by a ransomware virus.

[0211] See next Fig. 9This embodiment provides a computer device 900, which includes one or more processors 901 and a memory 902. The memory 902 is used to store one or more programs. When the one or more programs are executed by the one or more processors 901, the computer device 900 implements the computer virus detection method of the present application.

[0212] Fig.10 A block diagram of a computer system structure for implementing some embodiments of the present application is shown. It should be noted that: Fig.10 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0213] like Fig.10 As shown, the computer system 1000 includes a CPU (Central Processing Unit) 1001, which can perform various appropriate actions and processes according to the program stored in the ROM (Read-Only Memory) 1002 or the program loaded from the storage part 1008 to the RAM (Random Access Memory) 1003, such as executing the computer virus detection method in the above embodiment. In the RAM 1003, various programs and data required for system operation are also stored. The CPU 1001, the ROM 1002 and the RAM 1003 are connected to each other through the bus 1004. The I / O (Input / Output) interface 1005 is also connected to the bus 1004.

[0214] The following components are connected to the I / O interface 1005: an input section 1006 including a keyboard, a mouse, etc.; an output section 1007 including a CRT (Cathode Ray Tube), an LCD (Liquid Crystal Display), etc., and a speaker, etc.; a storage section 1008 including a hard disk, etc.; and a communication section 1009 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed so that a computer program read therefrom is installed into the storage section 1008 as needed.

[0215] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing all or part of the steps shown in the flowchart in the computer virus detection method. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the central processing unit (CPU) 1001, various functions defined in the system of the present application are executed.

[0216] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0217] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0218] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0219] As another aspect, the present application also provides a computer-readable medium, which may be included in the computer device described in the above embodiment; or may exist independently without being assembled into the computer device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a computer device, the computer device implements the method in the above embodiment.

[0220] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0221] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0222] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the appended claims.

Claims

1. A computer virus detection method, characterized in that: include: Matching the target process to be detected with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process, wherein the target process contains one or more of the process behaviors; Building a feature frequent item set of process behavior features based on virus behavior features matched by the process behavior contained in the target process; Generate feature association rules for the feature frequent item sets, and determine feature association rules whose confidence reaches a preset threshold value as strong association rules; When the executed process behavior in the target process matches the prerequisite in the strong association rule, the security level of the subsequent behavior of the target process is predicted, wherein the strong association rule includes the process behavior feature corresponding to the subsequent behavior.

2. The method according to claim 1, characterized in that The step of matching the target process to be detected with the virus signature and the virus behavior signature to determine the security level of the target process and / or the process behavior of the target process includes: Match the target process to be detected with the virus signature; If the target process successfully matches the virus signature, the target process is determined to be a dangerous process; If the target process fails to match the virus signature, the probability values ​​of the process behaviors included in the target process corresponding to various security levels are calculated, and the security level with the largest probability value is determined as the security level corresponding to the process behavior.

3. The method according to claim 2, characterized in that After matching the target process to be detected with the virus signature, the method further includes: When the target process is determined to be a dangerous process, all process behaviors included in the target process are blocked and an alarm signal is issued; If the target process fails to match the virus signature, the target process is determined to be a process of concern; if the security level corresponding to any process behavior contained in the target process is determined to be a dangerous behavior, the target process is changed from a process of concern to a dangerous process; if the security level corresponding to all process behaviors contained in the target process is determined to be a safe behavior, the target process is changed from a process of concern to a safe process, and all process behaviors contained in the target process are allowed; if the security level corresponding to some process behaviors contained in the target process is determined to be a behavior of concern, the target process is maintained as a process of concern, and process behaviors with a security level of safe behavior in the target process are allowed.

4. The method according to claim 3, characterized in that The determining that the target process is a dangerous process includes: marking the target process as a black process; The determining that the target process is a process of interest includes: marking the target process as a gray process; Changing the target process from a concerned process to a safe process includes: changing the target process from a grey process to a white process; The dangerous behavior is black behavior, the concerning behavior is gray behavior, and the safe behavior is white behavior.

5. The method according to any one of claims 1 to 4, characterized in that: The step of constructing a feature frequent item set of process behavior features based on the virus behavior features matched by the process behavior contained in the target process includes: Traversing a process behavior list of a target process in a process list whose process behavior matches the virus behavior feature, obtaining a first candidate item set, wherein the first candidate item set includes the process behavior and the support degree corresponding to the process behavior, and the process list includes a plurality of the target processes; Eliminate the items in the first candidate item set whose support is below the support threshold to obtain a second candidate item set; Traversing the second candidate item set, combining the process behaviors included in the second candidate item set in pairs, and obtaining the combined support corresponding to the process behavior combinations after the pairwise combination based on the process behavior list of the target process in the process list that matches the virus behavior characteristics, and obtaining a third candidate item set including the process behavior combinations after the pairwise combination and the combined support; Iterative execution is performed to obtain a candidate item set Lk containing k-1 process behavior combinations and combination support according to the process behaviors contained in the candidate item set Lk-1 and the process behavior list of the target process in the process list that matches the virus behavior characteristics, until the candidate item set Lk is an empty set, where k represents the sequence number of the candidate item set and k is an integer greater than or equal to 4.

6. The method according to claim 5, characterized in that The process behavior list of the process behavior included in the candidate item set Lk-1 and the target process in the process list that matches the virus behavior characteristics is obtained by obtaining a process behavior combination and a combination support after k-1 process behavior combinations, including: Traversing the candidate item set Lk-1, for each process behavior included in the candidate item set Lk-1, storing a pointer to the next process behavior, wherein the next process behavior is k-2 process behaviors in the process behavior combination included in the candidate item set Lk-1; Combine every k-1 process behaviors included in the candidate item set Lk-1, and obtain the combined support corresponding to the process behavior combination after k-1 process behaviors are combined based on the process behavior list that matches the virus behavior characteristics contained in the target process in the process list, and obtain the candidate item set Lk containing the process behavior combination and the combined support after k-1 process behaviors are combined.

7. The method according to any one of claims 1 to 4, characterized in that: The generating of feature association rules for the feature frequent item sets and determining the feature association rules whose confidence reaches a preset threshold value as strong association rules includes: Using an association rule mining algorithm to mine association rules for the process behavior features in the feature frequent item set, to obtain multiple feature association rules; Based on the relationship Confidence(A->B)=support(A&B) / support(A), the confidence of each feature association rule is calculated, wherein A and B represent the process behavior feature or a combination of at least two process behavior features occurring simultaneously; The confidence of each feature association rule is compared with a preset threshold, and when the confidence of the feature association rule reaches above the preset threshold, the feature association rule is determined as a strong association rule.

8. The method according to any one of claims 1 to 4, characterized in that: The predicting of the security level of the subsequent behavior of the target process includes: Calculating the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behavior, the concerned behavior and the safe behavior respectively; The security level with the largest probability value is used as the security level of the subsequent behavior of the target process, and the security level is one of the dangerous behavior, the concerned behavior, and the safe behavior; When the subsequent behavior of the target process is predicted to be a dangerous behavior, an alarm signal is issued.

9. The method according to claim 8, characterized in that The calculating the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behaviors, the concerned behaviors and the safe behaviors respectively includes: Based on relational Calculating the probability values ​​of the subsequent behaviors of the target process corresponding to the dangerous behavior, the concerned behavior and the safe behavior respectively; Among them, P(Y=security level|X={behavior}) represents the probability value of the subsequent behavior of the target process being at a certain security level, P(security level) represents the prior probability of the process behavior being at a certain security level, P(behavior|security level) represents the probability of a certain process behavior occurring under the condition that the process behavior is at a certain security level, P(behavior) represents the prior probability of a certain process behavior, α represents the smoothing coefficient, and z represents the number of features.

10. A computer device, characterized in that: include: one or more processors; A memory for storing one or more computer programs, which, when executed by the one or more processors, enables the processors to implement the method according to any one of claims 1 to 9.

Images