Memory horse detection method based on model defense

Abstract

The invention discloses a memory horse detection method based on model defense, and the method comprises the steps: carrying out the semantic embedded coding and time sequence context correlation analysis of the memory operation behavior data of a program which is marked as a normal operation program and the memory operation behavior data of a detected program through employing an artificial intelligence technology based on deep learning; according to the method, memory operation reference behavior pattern features and memory operation detection behavior pattern features are mined respectively, and then matching analysis based on principal component features is performed on the memory operation reference behavior pattern features and the memory operation detection behavior pattern features, so that whether the detection program contains the memory horse or not is intelligently judged. Through the mode, the capability of detecting malicious programs without file traces can be effectively improved, the limitation of traditional safety protection measures is broken through, and the accuracy and efficiency of memory horse detection are improved.

Description

Technical Field

[0001] The present application relates to the field of intelligent detection, and more specifically, to a memory horse detection method based on model defense. Background Art

[0002] With the development of computer technology, software systems are becoming more and more complex, and are also facing more and more security threats. Memory Malware is a highly concealed and harmful malware that can use the process space of legitimate programs to execute malicious code, thereby evading security detection and causing potential harm to the system, including but not limited to data theft, system damage, network attacks, etc.

[0003] Memory Trojans can circumvent traditional security policies based on process trust by using the permissions of legitimate programs to perform malicious operations. In addition, since memory Trojans perform malicious operations by residing in memory without leaving obvious disk traces, it is difficult for traditional antivirus software based on file signatures to detect their existence, further increasing the difficulty of detection and defense.

[0004] Therefore, an optimized model-based defense-based memory horse detection method is expected. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a memory Trojan horse detection method based on model defense, which uses artificial intelligence technology based on deep learning to perform semantic embedding coding and temporal context association analysis on the memory operation behavior data of the program marked as normal operation and the memory operation behavior data of the program being detected, and respectively mines out the memory operation reference behavior pattern characteristics and the memory operation detection behavior pattern characteristics, and then through matching analysis of the two based on the principal component characteristics, it is possible to intelligently determine whether the detected program contains a memory Trojan horse. In this way, the detection capability of malicious programs that do not leave file traces can be effectively improved, breaking through the limitations of traditional security protection measures, and improving the accuracy and efficiency of memory Trojan horse detection.

[0006] According to one aspect of the present application, a memory horse detection method based on model defense is provided, which includes:

[0007] Obtaining a time queue of memory operation behavior data of a program marked as running normally and a time queue of memory operation behavior data of a detected program;

[0008] Embedding and encoding the time queue of the memory operation behavior data of the program marked as normal operation and the time queue of the memory operation behavior data of the detected program respectively to obtain a time queue of memory operation reference behavior embedded coding vectors and a time queue of memory operation detection behavior embedded coding vectors;

[0009] Performing feature timing propagation aggregation on the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector to obtain a memory operation reference behavior pattern timing representation vector and a memory operation detection behavior pattern timing representation vector;

[0010] Inputting the memory operation reference behavior pattern temporal representation vector and the memory operation detection behavior pattern temporal representation vector into a saliency fusion network based on feature principal component query matching to obtain a memory operation reference-detection saliency joint representation vector;

[0011] Based on the memory operation reference-detection significant joint representation vector, it is determined whether the detected program contains a memory horse.

[0012] Compared with the prior art, the present application provides a memory Trojan horse detection method based on model defense, which uses artificial intelligence technology based on deep learning to perform semantic embedding coding and temporal context association analysis on the memory operation behavior data of the program marked as normal operation and the memory operation behavior data of the program being detected, respectively mining the memory operation reference behavior pattern characteristics and the memory operation detection behavior pattern characteristics, and then through the matching analysis of the two based on the principal component characteristics, intelligently judge whether the detected program contains a memory Trojan horse. In this way, the detection capability of malicious programs that do not leave file traces can be effectively improved, breaking through the limitations of traditional security protection measures, and improving the accuracy and efficiency of memory Trojan horse detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0014] Figure 1 It is a flowchart of a memory horse detection method based on model defense according to an embodiment of the present application;

[0015] Figure 2 Schematic diagram of data flow of a memory horse detection method based on model defense according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0017] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "an" and / or "the" do not refer to the singular and may also include the plural. Generally speaking, the terms "include" and "comprise" only indicate the inclusion of the steps and elements that have been clearly identified, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements.

[0018] Although the present application makes various references to certain modules in the system according to the embodiments of the present application, any number of different modules can be used and run on the user terminal and / or server. The modules are only illustrative, and different aspects of the system and method can use different modules.

[0019] Flowcharts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps may be processed in reverse order or simultaneously as required. Meanwhile, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0020] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0021] In the technical solution of the present application, a memory horse detection method based on model defense is proposed. Figure 1 The present invention is a flowchart of a memory horse detection method based on model defense according to an embodiment of the present application. Figure 2 FIG. 1 is a data flow diagram of a memory horse detection method based on model defense according to an embodiment of the present application. Figure 1 and Figure 2As shown, according to the embodiment of the present application, the model-defense-based memory horse detection method includes the steps of: S1, obtaining the time queue of memory operation behavior data of the program marked as normal operation, and the time queue of memory operation behavior data of the program to be detected; S2, respectively embedding and encoding the time queue of memory operation behavior data of the program marked as normal operation and the time queue of memory operation behavior data of the program to be detected to obtain the time queue of memory operation reference behavior embedded coding vector and the time queue of memory operation detection behavior embedded coding vector; S3, performing feature timing propagation aggregation on the time queue of memory operation reference behavior embedded coding vector and the time queue of memory operation detection behavior embedded coding vector to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector; S4, inputting the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector into a significant fusion network based on feature principal component query matching to obtain a memory operation reference-detection significant joint representation vector; S5, determining whether the program to be detected contains a memory horse based on the memory operation reference-detection significant joint representation vector.

[0022] In particular, the S1 obtains the time queue of memory operation behavior data of the program marked as normal operation, and the time queue of memory operation behavior data of the program being detected. It should be understood that memory operation behavior data refers to various behavior records generated in the memory during the execution of the program, usually including but not limited to memory access frequency, access order, API call sequence, memory allocation and release behavior, establishment and use of stack frames, state changes of CPU registers, DLL loading behavior, etc. Since the memory operation behavior data provides direct information on the memory usage of the program, rather than static file content stored on a hard disk or other persistent storage medium, using this as the basis for memory horse detection has higher real-time and accuracy, and avoids the limitations of traditional detection methods based on file signatures. Based on this, in the technical solution of the present application, the memory operation behavior data of the normal operation program is used as a reference benchmark, and the behavior data of the detected program is compared and analyzed with the normal behavior data to identify whether the detected program contains a memory horse.

[0023] In particular, the S2, respectively embeds and codes the time queue of the memory operation behavior data of the program marked as normal operation and the time queue of the memory operation behavior data of the program being detected to obtain the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector. In a specific example of the present application, the memory operation behavior embedding matrix is ​​used to embed and code each memory operation behavior data in the time queue of the memory operation behavior data marked as normal operation program to obtain the time queue of the memory operation reference behavior embedded coding vector; and, the memory operation behavior embedding matrix is ​​used to embed and code each memory operation behavior data in the time queue of the memory operation behavior data of the program being detected to obtain the time queue of the memory operation detection behavior embedded coding vector. Considering that different memory operation behaviors may have different data formats or forms of expression, the memory operation behavior data presents complexity and diversity. Therefore, in order to standardize the data representation form and extract the content meaning of the memory operation behavior data, the present application further uses the memory operation behavior embedding matrix to semantically embed and code each memory operation behavior data in the time queue of the memory operation behavior data marked as normal operation program and the time queue of the memory operation behavior data of the program being detected. It should be understood that the memory operation behavior embedding matrix is ​​a transformation matrix that maps memory operation behavior data to a high-dimensional semantic space, which can effectively encode the operation behavior in the memory into a numerical vector with rich semantic information, thereby obtaining a time queue of the memory operation reference behavior embedding coding vector and a time queue of the memory operation detection behavior embedding coding vector, so as to facilitate subsequent data analysis and processing. In addition, by using the same memory operation behavior embedding matrix to encode the memory operation behavior data of the normal running program and the detected program, it can be ensured that the two are compared in the same semantic space, thereby improving the accuracy and reliability of the detection.

[0024] In particular, the S3 performs feature timing propagation aggregation on the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector. In a specific example of the present application, the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector are input into a feature timing forward propagation module based on feature significance attenuation annotation to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector. In order to mine the correlation and change trend of memory operation behavior data in the time dimension, so as to fully understand the operation mode and dynamic behavior characteristics of normal running programs and detected programs, in the technical solution of the present application, a feature timing forward propagation module based on feature significance attenuation annotation is introduced to process the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector respectively, and use the node energy attenuation perception mechanism to simulate the attenuation effect of information timing transmission, and dynamically adjust the weights in the feature propagation process to highlight important features and suppress noise interference, so as to extract feature representations with time context association. Specifically, the module first calculates the feature significance description factor based on the mean and variance of each behavior embedded coding vector in the input time queue to quantify the feature importance. Next, based on the distance span between each behavior embedding coding vector and the current behavior embedding coding vector (the end of the time series), a feature significance attenuation factor is constructed to simulate the attenuation effect of information propagation, and to modulate its feature significance description factor so that the behavior data information that is closer to the current moment in the feature space is given a higher weight, thereby more accurately reflecting the relative importance of the behavior data features at each time point in the overall sequence. Then, the modulated description factor is further screened using the activation function and the gating mechanism, and the original time queue data is weighted and summed with the screened description factor as the weight to obtain the memory operation reference behavior pattern time series representation vector and the memory operation detection behavior pattern time series representation vector with time context association information. In this way, the changing trend of the memory operation behavior data of the normal running program and the detected program in the time dimension can be effectively captured, thereby providing a more accurate and comprehensive analysis basis for subsequent memory horse detection.

[0025] In an embodiment of the present application, the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector are input into a feature timing forward propagation module based on feature significance attenuation annotation to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector, including: calculating the feature significance description factor of each memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector; taking the last memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector as the current memory operation reference behavior embedded coding vector, and based on the other memory operation reference behavior embedded coding vectors in the time queue of the memory operation reference behavior embedded coding vector The distance span between each memory operation reference behavior embedded coding vector and the current memory operation reference behavior embedded coding vector is used to construct the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector; the product between the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector and its feature significance description factor is calculated to obtain the time queue of the feature significance attenuation description factor; the time queue of the feature significance attenuation description factor is input into the gated mask module to obtain the time queue of the feature significance attenuation weight factor; based on the time queue of the feature significance attenuation weight factor, the weighted sum of the time queue of the memory operation reference behavior embedded coding vector is calculated to obtain the memory operation reference behavior pattern timing representation vector.

[0026] Among them, the process of calculating the feature significance description factor of each memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector includes: calculating the expected value of the fourth power of the difference between each feature value in the memory operation reference behavior embedded coding vector and its feature mean, and dividing the expected value by the square of the feature variance of the memory operation reference behavior embedded coding vector to obtain the feature significance description factor.

[0027] More specifically, based on the distance span between each other memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector and the current memory operation reference behavior embedded coding vector, the process of constructing the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector includes: calculating the difference between the maximum eigenvalue of the current memory operation reference behavior embedded coding vector and the maximum eigenvalue of each other memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector, and then dividing the difference by the number of eigenvectors between the two to obtain the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector.

[0028] In summary, in the above embodiment, the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector are input into the feature timing forward propagation module based on feature significance attenuation annotation to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector, including: processing the time queue of the memory operation reference behavior embedded coding vector with the following feature significance attenuation guided fusion formula to obtain the memory operation reference behavior pattern timing representation vector, wherein the feature significance attenuation guided fusion formula is:

[0029] X={x 1 ,x 2 ,...,x k ,...,x n}

[0030]

[0031] ws i =mask(w i )

[0032]

[0033] Wherein, X represents the time queue of the memory operation reference behavior embedded coding vector, the value of n is the number of feature vectors in the time queue of the memory operation reference behavior embedded coding vector, and x 1 、x 2 、x i 、x k and x n denote the first, second, ith, kth and current memory operation reference behavior embedding coding vectors in the time queue of the memory operation reference behavior embedding coding vector, max(·) denotes the maximum eigenvalue of the eigenvector, x i (j) represents the jth eigenvalue of the embedding encoding vector of the i-th memory operation reference behavior, μ i and σ i 4 They represent the feature mean and square of the feature variance of the embedding vector of the i-th memory operation reference behavior, E{[x i (j)-μ i ] 4} represents the fourth-order central moment of the i-th memory operation reference behavior embedding coding vector, that is, the expected value of the fourth power of the difference between each eigenvalue and its eigenmean in the i-th memory operation reference behavior embedding coding vector, i∈[0,n-1], τ i represents the feature significance attenuation factor of the embedding encoding vector of the i-th memory operation reference behavior, k irepresents the descriptive factor of the i-th feature significance attenuation, w i represents the descriptive factor of the ith normalized feature significance attenuation, ws i represents the i-th feature significance attenuation weight factor, θ is the preset threshold, mask(·) represents mask processing, V 1 A timing representation vector representing the reference behavior mode of memory operation.

[0034] In particular, in S4, the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector are input into a significant fusion network based on feature principal component query matching to obtain a memory operation reference-detection significant joint representation vector. In order to identify abnormal patterns in the memory operation behavior of the detected program, the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector are further compared and analyzed. In particular, in the technical solution of the present application, in order to improve the efficiency and accuracy of feature matching analysis, a significant fusion network based on feature principal component query matching is introduced to realize this matching analysis process. Specifically, the network first standardizes the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector to ensure that the data is distributed on a scale of zero mean and has unit variance, eliminating the influence of different dimensions and magnitudes. Next, the principal component analysis algorithm is used to calculate the sample covariance and extract the principal component features of the standardized memory operation reference behavior pattern temporal representation vector and the memory operation detection behavior pattern temporal representation vector, so as to mine the main components and remove redundant information, thereby reducing the data dimension and generating a set of principal component feature vectors of the memory operation reference behavior pattern and a set of principal component feature vectors of the memory operation detection behavior pattern. Furthermore, based on the maximum approximate query matching between feature vectors, the best matching pair is found by calculating and comparing the similarity between the two principal component feature vector sets, and the feature correlation or difference in the best matching pair is further revealed by performing fine-grained semantic joint analysis on each best matching pair. Then, the feature joint results of each best matching pair are cascaded to aggregate the core difference information of the memory operation detection behavior pattern and the memory operation reference behavior pattern, and generate a memory operation reference-detection significant joint representation vector.

[0035] In an embodiment of the present application, the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector are input into a significant fusion network based on feature principal component query matching to obtain a memory operation reference-detection significant joint representation vector, including: standardizing the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector to obtain a standardized memory operation reference behavior pattern timing representation vector and a standardized memory operation detection behavior pattern timing representation vector; respectively calculating the sample covariance matrices of the standardized memory operation reference behavior pattern timing representation vector and the standardized memory operation detection behavior pattern timing representation vector to obtain a memory operation reference behavior pattern sample covariance matrix and a memory operation detection behavior pattern sample covariance matrix; and performing standard processing on the memory operation reference behavior pattern sample covariance matrix and the memory operation detection behavior pattern sample covariance matrix. The matrix performs feature vector extraction based on matrix decomposition to obtain a set of principal component feature vectors of memory operation reference behavior patterns and a set of principal component feature vectors of memory operation detection behavior patterns; the set of principal component feature vectors of memory operation reference behavior patterns and the set of principal component feature vectors of memory operation detection behavior patterns are input into a maximum approximate query matching network to obtain a set of best matching pairs of principal component feature vectors of memory operation reference behavior patterns and principal component feature vectors of memory operation detection behavior patterns; each best matching pair in the set of best matching pairs of principal component feature vectors of memory operation reference behavior patterns and principal component feature vectors of memory operation detection behavior patterns is input into a semantic fine-grained joint analysis module to obtain a set of memory operation reference-detection principal component joint feature vectors; the set of memory operation reference-detection principal component joint feature vectors is cascaded to obtain the memory operation reference-detection significant joint representation vector.

[0036] Among them, the process of inputting the set of principal component feature vectors of the memory operation reference behavior pattern and the set of principal component feature vectors of the memory operation detection behavior pattern into the maximum approximate query matching network to obtain a set of best matching pairs of the memory operation reference behavior pattern principal component feature vectors and the memory operation detection behavior pattern principal component feature vectors includes: calculating the cosine similarity between the i-th memory operation reference behavior pattern principal component feature vector in the set of the memory operation reference behavior pattern principal component feature vectors and each memory operation detection behavior pattern principal component feature vector in the set of the memory operation detection behavior pattern principal component feature vectors to obtain a set of cosine similarities; and combining the memory operation detection behavior pattern principal component feature vector corresponding to the maximum value in the set of cosine similarities with the i-th memory operation reference behavior pattern principal component feature vector to form the best matching pair.

[0037] More specifically, the process of inputting each best matching pair in the set of best matching pairs of the memory operation reference behavior pattern principal component feature vector and the memory operation detection behavior pattern principal component feature vector into the semantic fine-grained joint analysis module to obtain a set of memory operation reference-detection principal component joint feature vectors includes: calculating the position point addition, position point subtraction and position point multiplication between the memory operation reference behavior pattern principal component feature vector and the memory operation detection behavior pattern principal component feature vector in the best matching pair to obtain a first matching fusion result, a second matching fusion result and a third matching fusion result; after cascading the first matching fusion result, the second matching fusion result and the third matching fusion result into a memory operation reference behavior pattern-memory operation detection behavior pattern principal component multi-scale fusion feature vector, one-dimensional convolution processing and maximum pooling processing are performed on it to obtain the memory operation reference-detection principal component joint feature vector.

[0038] In summary, in the above embodiment, the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector are input into a significant fusion network based on feature principal component query matching to obtain a memory operation reference-detection significant joint representation vector, including: fusing the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector with the following principal component query matching formula to obtain the memory operation reference-detection significant joint representation vector, wherein the principal component query matching formula is:

[0039]

[0040] C 1 =U 1 Λ 1 U 1 T

[0041] C 2 =U 2 Λ 2 U 2 T

[0042] U 1 =[v 11 ,v 12 ,…,v 1m ]

[0043] Λ 1 =diag(λ 11 ,λ 12 ,…,λ 1m )

[0044] U 2 =[v 21 ,v22 ,…,v 2m ]

[0045] Λ 2 =diag(λ 21 ,λ 22 ,…,λ 2m )

[0046]

[0047] V=[v p1 ;v p2 ;...v pm ]

[0048] Among them, V 1 Represents the timing representation vector of the reference behavior mode of the memory operation, μ 1 and σ 1 Respectively represent the mean and standard deviation of the timing representation vector of the memory operation reference behavior mode, V 1norm Represents the timing representation vector of the standardized memory operation reference behavior mode, V 2 Represents the timing representation vector of the memory operation detection behavior mode, μ 2 and σ 2 Respectively represent the mean and standard deviation of the time series representation vector of the memory operation detection behavior pattern, V 2norm Represents the timing representation vector of the standardized memory operation detection behavior pattern, n 1 The value is the length of the vector representing the timing of the memory operation reference behavior mode, n 2 The value is the length of the vector representing the timing of the memory operation detection behavior pattern, C 1 represents the memory operation reference behavior pattern sample covariance matrix, C 2 Represents the memory operation detection behavior pattern sample covariance matrix, U 1 represents a matrix consisting of a set of principal component eigenvectors of the memory operation reference behavior pattern obtained by performing eigenvalue decomposition on the sample covariance matrix of the memory operation reference behavior pattern, Λ 1 represents a diagonal matrix consisting of a set of principal component eigenvalues ​​of the memory operation reference behavior pattern obtained by performing eigenvalue decomposition on the sample covariance matrix of the memory operation reference behavior pattern, v 11 、v 12 、v 1i and v 1m Respectively represent the first, second, i-th and m-th memory operation reference behavior pattern principal component feature vectors in the set of the memory operation reference behavior pattern principal component feature vectors, λ 11 , 12 and λ 1mrespectively represent the first, second and mth memory operation reference behavior pattern principal component eigenvalues ​​in the set of the memory operation reference behavior pattern principal component eigenvalues, where m is the number of the memory operation reference behavior pattern principal component eigenvalues, U 2 represents a matrix consisting of a set of principal component eigenvectors of the memory operation detection behavior pattern obtained by performing eigenvalue decomposition on the memory operation detection behavior pattern sample covariance matrix, Λ 2 represents a diagonal matrix consisting of a set of principal component eigenvalues ​​of the memory operation detection behavior pattern obtained by performing eigenvalue decomposition on the sample covariance matrix of the memory operation detection behavior pattern, v 21 、v 22 、v 2j 、v 2k and v 2m denote the first, second, jth, kth and mth memory operation detection behavior pattern principal component feature vectors in the set of the memory operation detection behavior pattern principal component feature vectors, respectively, 21 , 22 and λ 2m denote the first, second and mth memory operation detection behavior pattern principal component eigenvalues ​​in the set of the memory operation detection behavior pattern principal component eigenvalues ​​respectively, diag is the diag function, which is used to construct a diagonal matrix, <·> denotes the inner product, ‖·‖ denotes the modulus of the eigenvector, argmax(·) denotes the index corresponding to the maximum value, k denotes the index of the memory operation detection behavior pattern principal component eigenvector that forms the best matching pair with the i-th memory operation reference behavior pattern principal component eigenvector, [·,·] denotes a cascade operation, MaxPool(·) denotes a maximum pooling operation, conv1D(·) denotes a one-dimensional convolution operation, ⊙ denotes a dot product, Indicates point addition, Indicates point minus, v pi represents the i-th memory run reference-detection principal component joint feature vector, and V represents the memory run reference-detection significant joint representation vector.

[0049] In particular, the S5 determines whether the detected program contains a memory horse based on the memory operation reference-detection significant joint representation vector. In a specific example of the present application, the memory operation reference-detection significant joint representation vector is input into a classifier-based memory horse detection module to obtain a detection result, and the detection result is used to indicate whether the detected program contains a memory horse.

[0050] In a preferred example, considering that the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector respectively represent the semantic embedded coding features of the memory operation behavior data of the program marked as normal operation and the semantic embedded coding features of the memory operation behavior data of the detected program, based on the significant attenuation propagation features of the timing node energy, when performing significant fusion based on feature principal component query matching, due to the difference in the distribution of timing correlation features caused by the difference in source timing distribution, superimposed on the difference in significant propagation across timing nodes, the memory operation reference-detection significant joint representation vector will also have a diversified set expression distribution of timing features. Therefore, it is expected to improve the balance between the accuracy and completeness of the regression mapping when the memory operation reference-detection significant joint representation vector is input into the memory horse detection module based on the classifier for classification regression, thereby improving the accuracy of the detection results.

[0051] Based on this, in a preferred embodiment, the memory operation reference-detection significant joint representation vector is input into a classifier-based memory horse detection module to obtain a detection result, including:

[0052] Perform L random sampling on the memory operation reference-detection saliency joint representation vector to obtain L memory operation random perturbation eigenvalues;

[0053] Arrange the L memory operation random disturbance eigenvalues ​​in order from large to small to obtain a memory operation random disturbance ordered vector;

[0054] Calculating the inner product of the memory operation reference-detection significant joint representation vector to obtain the memory operation energy modulation feature value;

[0055] Performing semantic intensity scaling on the memory operation random perturbation ordered vector based on the memory operation energy modulation characteristic value to obtain a semantically enhanced memory operation random perturbation ordered vector;

[0056] Calculating the product of the random perturbation ordered vector of the semantic reinforcement memory operation and the transposed vector of the reference-detection significant joint representation vector of the memory operation to obtain the best example prompt orthogonal modulation matrix of the memory operation;

[0057] Calculating the matrix product between the memory-running best sample hint orthogonal modulation matrix and the memory-running reference-detection significant joint representation vector to obtain an optimized memory-running reference-detection significant joint representation vector;

[0058] The optimized memory operation reference-detection significant joint representation vector is input into the classifier-based memory horse detection module to obtain the detection result.

[0059] The above optimization process is expressed as follows:

[0060] S i =∈ i ,i=1,2,...,L

[0061]

[0062] u=average(V)

[0063]

[0064] V order =Order{ S i}

[0065]

[0066]

[0067] Among them, ∈ i represents the random perturbation eigenvalue of the i-th memory operation, L represents L random samplings, N represents the Gaussian density probability function, S i represents the random perturbation eigenvalue of the memory operation, V represents the reference-detection significant joint representation vector of the memory operation, v i represents the i-th eigenvalue of the memory run reference-detection significant joint representation vector, average(·) represents the average value of the calculated vector, and L 1 denotes the length of the memory run reference-detection significant joint representation vector, u and σ 2 Respectively represent the mean and variance of the memory running reference-detection significant joint representation vector, Order{S i} indicates that the random perturbation eigenvalues ​​of memory operation are arranged in order from large to small, V order represents the ordered vector of random perturbations of memory operation, e represents the energy modulation eigenvalue of memory operation, represents the square of the vector's two-norm, ⊙ represents the point multiplication by position, represents matrix multiplication, T represents the transpose of the vector, M t represents the memory operation best sample prompt orthogonal modulation matrix, M t Representation optimized memory runtime reference-detection salient joint representation vector.

[0068] Accordingly, by randomly sampling the memory run reference-detection significant joint representation vector L times to obtain a set of new feature values ​​based on the original features but containing slight changes, randomness is introduced to explore different aspects of the feature space, and by simulating the noise or variation in the actual data, it helps the model to better generalize to unseen data. Then, these memory run random perturbation feature values ​​are arranged in order from large to small to form a memory run random perturbation ordered vector to identify which perturbation directions may be the most important for the current problem. Such an ordering not only helps the algorithm focus on the feature differences that can best distinguish different categories, but also helps to reveal hidden data structures or patterns. Subsequently, the inner product of the memory operation reference-detection significant joint representation vector is calculated to obtain the memory operation energy modulation eigenvalue, which reflects the overall strength or "energy" of the original feature vector and provides a benchmark for measuring the importance of the feature. Using this memory operation energy modulation eigenvalue as a reference point, the previously formed memory operation random perturbation ordered vector is semantically scaled to construct a semantically enhanced memory operation random perturbation ordered vector. In this way, those perturbations that appear to be more important in the original feature space are amplified, thereby enhancing the model's sensitivity to changes in key features, while also retaining relatively small but potentially useful perturbation information.

[0069] Then, the product of the random perturbation ordered vector of semantic reinforcement memory operation and the transpose of the memory operation reference-detection significant joint representation vector is calculated to obtain the memory operation best example prompt orthogonal modulation matrix, the purpose of which is to find the way in which the features interact with each other from two different perspectives. The formed matrix can be regarded as a conversion tool for capturing and representing the complex linear relationship between features. Finally, the final feature structure modulation is completed by applying the above-constructed memory operation best example prompt orthogonal modulation matrix to the original memory operation reference-detection significant joint representation vector, so that the features are more in line with the requirements of the objective function, reducing redundant information, while maximizing the retention of useful information, so as to improve learning efficiency and prediction performance.

[0070] In summary, the feature manifold optimization process of the memory running reference-detection significant joint representation vector is clarified, which is based on the fine-grained target retrieval of random perturbations to extract the best hint samples, and then guides the adversarial robust learning based on the best hint samples to complete the structure of the high-dimensional manifold of the feature vector in the feature space, so as to improve the detail and structure of the feature expression. In this way, the balanced executableness between mapping accuracy and mapping completeness is achieved in the classification and regression process based on the discretized feature distribution of the memory running reference-detection significant joint representation vector, and the accuracy of the detection results obtained by the memory horse detection module based on the classifier of the memory running reference-detection significant joint representation vector is improved.

[0071] In summary, the memory Trojan horse detection method based on model defense according to the embodiment of the present application is explained, which uses artificial intelligence technology based on deep learning to perform semantic embedding coding and temporal context association analysis on the memory operation behavior data of the program marked as normal operation and the memory operation behavior data of the program being detected, respectively mining the memory operation reference behavior pattern characteristics and the memory operation detection behavior pattern characteristics, and then through the matching analysis of the two based on the principal component characteristics, it is possible to intelligently determine whether the detected program contains a memory Trojan horse. In this way, the detection capability of malicious programs that do not leave file traces can be effectively improved, breaking through the limitations of traditional security protection measures, and improving the accuracy and efficiency of memory Trojan horse detection.

[0072] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A memory horse detection method based on model defense, characterized in that: include: Obtaining a time queue of memory operation behavior data of a program marked as running normally and a time queue of memory operation behavior data of a detected program; Embedding and encoding the time queue of the memory operation behavior data of the program marked as normal operation and the time queue of the memory operation behavior data of the detected program respectively to obtain a time queue of memory operation reference behavior embedded coding vectors and a time queue of memory operation detection behavior embedded coding vectors; Performing feature timing propagation aggregation on the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector to obtain a memory operation reference behavior pattern timing representation vector and a memory operation detection behavior pattern timing representation vector; Inputting the memory operation reference behavior pattern temporal representation vector and the memory operation detection behavior pattern temporal representation vector into a saliency fusion network based on feature principal component query matching to obtain a memory operation reference-detection saliency joint representation vector; Based on the memory operation reference-detection significant joint representation vector, it is determined whether the detected program contains a memory horse.

2. The memory horse detection method based on model defense according to claim 1 is characterized in that: The time queue of the memory operation behavior data of the program marked as normal operation and the time queue of the memory operation behavior data of the detected program are respectively embedded and encoded to obtain a time queue of the memory operation reference behavior embedded coding vector and a time queue of the memory operation detection behavior embedded coding vector, including: Use the memory operation behavior embedding matrix to embed code each memory operation behavior data in the time queue of the memory operation behavior data marked as the normal operation program to obtain the time queue of the memory operation reference behavior embedding coding vector; The memory operation behavior embedding matrix is ​​used to embed code each memory operation behavior data in the time queue of the memory operation behavior data of the detected program to obtain the time queue of the memory operation detection behavior embedded coding vector.

3. The memory horse detection method based on model defense according to claim 2 is characterized in that: Performing feature time series propagation aggregation on the time series of the memory operation reference behavior embedded coding vector and the time series of the memory operation detection behavior embedded coding vector to obtain a memory operation reference behavior pattern time series representation vector and a memory operation detection behavior pattern time series representation vector, including: The time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector are input into the feature timing forward propagation module based on feature significance attenuation annotation to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector.

4. The memory horse detection method based on model defense according to claim 3 is characterized in that: Inputting the time queue of the memory operation reference behavior embedded coding vector and the time queue of the memory operation detection behavior embedded coding vector into a feature timing forward propagation module based on feature significance attenuation annotation to obtain the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector, including: Calculating a feature significance description factor of each memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector; Taking the last memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector as the current memory operation reference behavior embedded coding vector, and constructing the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector based on the distance span between each other memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector and the current memory operation reference behavior embedded coding vector; Calculating the product of the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector and its feature significance description factor to obtain a time queue of the feature significance attenuation description factor; Inputting the time queue of the feature significance decay descriptor factor into the gated mask module to obtain the time queue of the feature significance decay weight factor; Based on the time queue of the feature significance attenuation weight factor, the weighted sum of the time queue of the memory operation reference behavior embedded coding vector is calculated to obtain the memory operation reference behavior pattern temporal representation vector.

5. The memory horse detection method based on model defense according to claim 4 is characterized in that: Calculating the feature significance description factor of each memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector includes: The expected value of the fourth power of the difference between each eigenvalue and its eigenmean in the memory operation reference behavior embedded coding vector is calculated, and the expected value is divided by the square of the eigenvariance of the memory operation reference behavior embedded coding vector to obtain the eigensignificance description factor.

6. The memory horse detection method based on model defense according to claim 5 is characterized in that: Based on the distance span between each other memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector and the current memory operation reference behavior embedded coding vector, constructing a feature significance attenuation factor of each other memory operation reference behavior embedded coding vector, including: Calculate the difference between the maximum eigenvalue of the current memory operation reference behavior embedded coding vector and the maximum eigenvalue of each other memory operation reference behavior embedded coding vector in the time queue of the memory operation reference behavior embedded coding vector, and then divide the difference by the number of eigenvectors between the two to obtain the feature significance attenuation factor of each other memory operation reference behavior embedded coding vector.

7. The memory horse detection method based on model defense according to claim 6 is characterized in that: Inputting the memory operation reference behavior pattern temporal representation vector and the memory operation detection behavior pattern temporal representation vector into a significant fusion network based on feature principal component query matching to obtain a memory operation reference-detection significant joint representation vector, including: Standardizing the memory operation reference behavior pattern timing representation vector and the memory operation detection behavior pattern timing representation vector to obtain a standardized memory operation reference behavior pattern timing representation vector and a standardized memory operation detection behavior pattern timing representation vector; Respectively calculating the sample covariance matrices of the standardized memory operation reference behavior pattern timing representation vector and the standardized memory operation detection behavior pattern timing representation vector to obtain a memory operation reference behavior pattern sample covariance matrix and a memory operation detection behavior pattern sample covariance matrix; Performing matrix decomposition-based feature vector extraction on the memory operation reference behavior pattern sample covariance matrix and the memory operation detection behavior pattern sample covariance matrix to obtain a set of memory operation reference behavior pattern principal component feature vectors and a set of memory operation detection behavior pattern principal component feature vectors; Inputting the set of principal component feature vectors of the memory operation reference behavior pattern and the set of principal component feature vectors of the memory operation detection behavior pattern into a maximum approximate query matching network to obtain a set of best matching pairs of principal component feature vectors of the memory operation reference behavior pattern and principal component feature vectors of the memory operation detection behavior pattern; Input each best matching pair in the set of best matching pairs of the memory operation reference behavior pattern principal component feature vector and the memory operation detection behavior pattern principal component feature vector into a semantic fine-grained joint analysis module to obtain a set of memory operation reference-detection principal component joint feature vectors; The set of the memory run reference-detection principal component joint feature vectors are cascaded to obtain the memory run reference-detection saliency joint representation vector.

8. The memory horse detection method based on model defense according to claim 7 is characterized in that: Inputting the set of the memory operation reference behavior pattern principal component feature vectors and the set of the memory operation detection behavior pattern principal component feature vectors into a maximum approximate query matching network to obtain a set of best matching pairs of the memory operation reference behavior pattern principal component feature vectors and the memory operation detection behavior pattern principal component feature vectors, including: Calculating the cosine similarity between the i-th memory operation reference behavior pattern principal component feature vector in the set of the memory operation reference behavior pattern principal component feature vectors and each memory operation detection behavior pattern principal component feature vector in the set of the memory operation detection behavior pattern principal component feature vectors to obtain a set of cosine similarities; The main component feature vector of the memory operation detection behavior pattern corresponding to the maximum value in the set of cosine similarities and the main component feature vector of the i-th memory operation reference behavior pattern form the best matching pair.

9. The memory horse detection method based on model defense according to claim 8 is characterized in that: Inputting each best matching pair in the set of best matching pairs of the memory operation reference behavior pattern principal component feature vector and the memory operation detection behavior pattern principal component feature vector into a semantic fine-grained joint analysis module to obtain a set of memory operation reference-detection principal component joint feature vectors, including: Calculate the position point addition, position point subtraction and position point multiplication between the principal component feature vector of the memory operation reference behavior pattern and the principal component feature vector of the memory operation detection behavior pattern in the best matching pair to obtain a first matching fusion result, a second matching fusion result and a third matching fusion result; After the first matching fusion result, the second matching fusion result and the third matching fusion result are cascaded into a memory operation reference behavior pattern-memory operation detection behavior pattern principal component multi-scale fusion feature vector, one-dimensional convolution processing and maximum value pooling processing are performed on them to obtain the memory operation reference-detection principal component joint feature vector.

10. The memory horse detection method based on model defense according to claim 9 is characterized in that: Determining whether the detected program contains a memory horse based on the memory operation reference-detection significant joint representation vector includes: The memory operation reference-detection significant joint representation vector is input into a classifier-based memory horse detection module to obtain a detection result, and the detection result is used to indicate whether the detected program contains a memory horse.

Images