Method for rapidly detecting malicious software based on electric sandbox

Abstract

The invention relates to the technical field of information security, in particular to a method for quickly detecting malicious software based on an electric sandbox, which comprises the following steps: monitoring target software; marking suspicious software; determining an abnormal state and screening out abnormal software; evaluating the attack intensity; and isolating and adjusting. The behavior of the target software is monitored in real time in the virtual power system, multiple detection mechanisms are combined, the detection accuracy of malicious software is remarkably improved, detailed analysis is conducted through the preset standard value and the parameter range, abnormal software can be effectively distinguished, misjudgment is reduced, and the detection accuracy is improved. Different power load environments are set in the sandbox environment for further evaluation, comprehensive detection of malicious software behaviors is ensured, and the method adapts to different attack modes and system states by dynamically adjusting the evaluation duration, so that the safety and stability of the system are improved, and the method is suitable for large-scale popularization and application. The problems that detection is not timely and the false alarm rate is high due to the fact that malicious software behaviors are complex and changeable and detection response time is long are effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method for quickly detecting malicious software based on a power sandbox. Background Art

[0002] With the rapid development of information technology and the complexity of network environment, the types and attack methods of malware are constantly upgrading, which brings severe challenges to the security of computer systems. Malware can not only lead to data leakage and system crash, but also affect the stability of the entire network. Therefore, real-time and accurate detection and identification of malware has become an important task in the field of network security. Against this background, traditional malware detection methods face many challenges, such as insufficient adaptability to new malware and limited ability to identify dynamic behaviors.

[0003] The patent document with publication number CN112041815A discloses a computer-implemented method for identifying malware in a computer system. The method includes: receiving multiple executable files marked as malicious or benign, using attributes extracted from the coverage associated with each of the multiple received marked executable files to train a machine learning model, receiving an unmarked executable file, using the trained machine learning model to determine whether the received unmarked executable file is malicious or benign based on the attributes extracted from the coverage associated with the received unmarked executable file, and when the received unmarked executable file is determined to be malicious, transmitting information identifying the received unmarked executable file as malicious. It can be seen that the method requires a large number of executable files marked as malicious or benign to train the machine learning model. This method may be limited by the quality and coverage of the labeled data, affecting the generalization ability and accuracy of the model, and relying on a pre-trained machine learning model to identify malware. It may not be able to detect new or unseen malware in a timely manner, and it does not consider the dynamic changes of the actual operating environment in model training and malware detection. This makes it possible that it may not reflect the actual behavior and impact of malware in different environments. Summary of the invention

[0004] To this end, the present invention provides a method for quickly detecting malware based on a power sandbox, so as to overcome the problems in the prior art of untimely detection and high false alarm rate caused by complex and changeable malware behaviors and long detection response time.

[0005] To achieve the above-mentioned object, the present invention provides a method for rapid malware detection based on a power sandbox, comprising: monitoring the real-time request frequency, real-time transmission data volume, and real-time call response duration of each target software in a virtual power system in which the power sandbox is started; Mark each target software as suspicious according to the real-time request frequency and the preset standard frequency, and obtain the suspicious software; Determine the abnormal state of each suspicious software according to all real-time request frequencies, real-time transmission data volumes, real-time call response durations and a preset parameter standard deviation range group of each suspicious software within a preset abnormal determination duration, and determine a number of abnormal software according to the number of types of the abnormal states and the preset number of standard abnormal types; Setting a plurality of power load environments in the sandbox environment of the power sandbox, monitoring the memory consumption and data transmission volume of each abnormal software within a preset evaluation period in each power load environment, determining the attack intensity according to the memory consumption and the data transmission volume, determining the malicious behavior of the abnormal software according to the attack intensity and the preset standard intensity, and determining the malware according to the number of the malicious behaviors and the preset standard number of malicious behaviors; isolating the malware from the virtual power system and generating a malware report; At the end of a single preset monitoring cycle, the number of all the malware within a preset correction time is obtained, and the evaluation time is increased or decreased according to the number of the malware and a preset malicious quantity standard deviation threshold; The preset parameter standard deviation range group includes a frequency standard deviation range, a data volume standard deviation range, and a response time standard deviation range.

[0006] Further, marking each target software as a suspicious state according to the real-time request frequency and the preset standard frequency includes: When the real-time request frequency of the target software is greater than the standard frequency, the target software is marked as being in a suspicious state.

[0007] Further, determining the abnormal state of each suspicious software according to all real-time request frequencies, real-time transmission data volumes, real-time call response durations and a preset parameter standard deviation range group of each suspicious software within a preset abnormal determination duration includes: Calculate the standard deviations of all real-time request frequencies, real-time transmission data volumes, and real-time call response durations of each of the suspicious software within the abnormal determination duration to form frequency standard deviations, data volume standard deviations, and response duration standard deviations. When the frequency standard deviation is not within the frequency standard deviation range, determine that the abnormal state of the suspicious software is a frequency abnormal state. When the data volume standard deviation is not within the data volume standard deviation range, determining that the abnormal state of the suspicious software is a data volume abnormal state; When the response time standard deviation is not within the response time standard deviation range, it is determined that the abnormal state of the suspicious software is a response abnormal state.

[0008] Furthermore, when the number of abnormal states of the standard abnormal types appears in the abnormal states of each of the suspicious software, the suspicious software is determined to be abnormal software.

[0009] Further, the setting of a plurality of power load environments in the sandbox environment of the power sandbox includes: A plurality of power load environments in which the power load increases at a preset change rate are set in the sandbox environment of the power sandbox.

[0010] Further, determining the attack intensity according to the memory consumption and the data transmission volume includes: The standard deviations of all the memory consumption and the data transmission within the evaluation time are calculated respectively to obtain the memory consumption standard deviation and the data transmission standard deviation, and the attack intensity is calculated according to the memory consumption standard deviation, the data transmission standard deviation, the preset memory weight and the preset data transmission weight.

[0011] Further, determining the malicious behavior of the abnormal software according to the attack strength and a preset standard strength includes: When the attack strength is greater than the standard strength, it is determined that the abnormal software exhibits malicious behavior.

[0012] Further, the determining of malware according to the number of malicious behaviors and a preset standard number of malicious behaviors includes: When the number of the malicious behaviors is greater than the standard number of malicious behaviors, the abnormal software is determined to be malware.

[0013] Furthermore, the malicious quantity standard deviation is calculated based on the quantity of all the malware within the correction duration. When the malicious quantity standard deviation is greater than the malicious quantity standard deviation threshold, the evaluation duration is increased based on the malicious quantity standard deviation, the malicious quantity standard deviation threshold and a preset correction coefficient.

[0014] Further, when the malicious quantity standard deviation is less than or equal to the malicious quantity standard deviation threshold, the evaluation duration is reduced according to the malicious quantity standard deviation, the malicious quantity standard deviation threshold and a preset correction coefficient.

[0015] Compared with the prior art, the beneficial effect of the present invention lies in that, by real-time monitoring of the behavior of the target software in the virtual power system and combining multiple detection mechanisms, the detection accuracy of malware is significantly improved, and detailed analysis is performed using preset standard values ​​and parameter ranges, which can effectively distinguish abnormal software and reduce misjudgments. By setting different power load environments in the sandbox environment for further evaluation, comprehensive detection of malware behavior is ensured, and by dynamically adjusting the evaluation time to adapt to different attack modes and system states, the security and stability of the system are improved, effectively solving the problems of untimely detection and high false alarm rate caused by complex and changeable malware behavior and long detection response time.

[0016] Furthermore, through the tagging mechanism, software with abnormal frequency exceeding the standard can be quickly identified, effectively narrowing the scope that requires in-depth analysis.

[0017] Furthermore, by analyzing the standard deviation of each key indicator in detail, different types of abnormal conditions can be effectively detected, improving the accuracy and comprehensiveness of abnormal behavior identification.

[0018] Furthermore, by requiring suspicious software to simultaneously meet a certain number of abnormal conditions on multiple abnormal criteria, the possibility of false positives is significantly reduced.

[0019] Furthermore, by setting a power load environment that increases at a preset change rate, the reaction of suspicious software under different power conditions can be tested more comprehensively.

[0020] Furthermore, by combining the fluctuations of memory consumption and data transmission volume and applying weights to calculate the attack intensity, the attack capabilities of malware can be more accurately identified and quantified.

[0021] Furthermore, by setting reasonable standard strengths, the system can respond promptly, identify and isolate malware when abnormal software behavior begins to threaten system stability.

[0022] Furthermore, by setting a reasonable standard number of malicious behaviors, the system can effectively distinguish occasional anomalies from real malware and avoid misjudging normal software.

[0023] Furthermore, by dynamically adjusting the evaluation duration, the system can flexibly respond to changes in the amount of malware.

[0024] Furthermore, by precisely controlling the evaluation duration, it is possible to effectively avoid unnecessary extension of the evaluation time when the number of malicious messages does not fluctuate much. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a flow chart of a method for quickly detecting malware based on a power sandbox according to this embodiment; Figure 2 A logic decision diagram for marking the status of each target software in this embodiment; Figure 3 This is a logic determination diagram for determining abnormal software in this embodiment; Figure 4 This is a logical decision diagram for determining malicious behavior of abnormal software in this embodiment. DETAILED DESCRIPTION

[0026] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0027] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0028] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0029] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0030] See also Figure 1 As shown, it is a flow chart of a method for quickly detecting malware based on a power sandbox in this embodiment; this embodiment provides a method for quickly detecting malware based on a power sandbox, including: Monitor the real-time request frequency, real-time transmission data volume, and real-time call response time of each target software in the virtual power system that starts the power sandbox; Mark each target software as suspicious according to the real-time request frequency and the preset standard frequency, and obtain the suspicious software; Determine the abnormal state of each suspicious software according to all real-time request frequencies, real-time transmission data volumes, real-time call response durations and a preset parameter standard deviation range group of each suspicious software within a preset abnormal determination duration, and determine a number of abnormal software according to the number of types of the abnormal states and the preset number of standard abnormal types; Setting a plurality of power load environments in the sandbox environment of the power sandbox, monitoring the memory consumption and data transmission volume of each abnormal software within a preset evaluation period in each power load environment, determining the attack intensity according to the memory consumption and the data transmission volume, determining the malicious behavior of the abnormal software according to the attack intensity and the preset standard intensity, and determining the malware according to the number of the malicious behaviors and the preset standard number of malicious behaviors; isolating the malware from the virtual power system and generating a malware report; At the end of a single preset monitoring cycle, the number of all the malware within a preset correction time is obtained, and the evaluation time is increased or decreased according to the number of the malware and a preset malicious quantity standard deviation threshold; The preset parameter standard deviation range group includes a frequency standard deviation range, a data volume standard deviation range, and a response time standard deviation range.

[0031] The real-time request frequency is captured and recorded using a network traffic analysis tool (such as Wireshark) or a system performance monitoring tool (such as Prometheus).

[0032] Real-time transmission data volume using data monitoring and analysis tools (such as NetFlow, sFlow).

[0033] Real-time call response time monitoring tools are obtained using performance monitoring tools (such as New Relic, AppDynamics) or custom measurement scripts.

[0034] Memory consumption can be obtained using system monitoring tools (such as Nagios, Zabbix) or performance analysis tools (such as Valgrind, Heaptrack).

[0035] Data transfer volume is measured using network traffic monitoring tools (such as NetFlow, Wireshark).

[0036] Attack intensity is calculated using a comprehensive monitoring platform (such as Splunk) combined with the standard deviation of memory and data transfer volumes.

[0037] Malicious behavior detection uses security event and information management systems (such as SIEM) for detection.

[0038] Malware isolation uses virtualization management tools (such as VMware, Hyper-V) or network isolation devices.

[0039] The preset standard frequency refers to a preset reference value for the request frequency issued by the target software in the virtual power system, which is usually determined by the normal operating load of the system and is set to the median value of the system load. In this embodiment, the preset standard frequency is 100 requests per second. Setting the standard frequency helps to quickly identify potential malicious behavior when software requests are abnormal.

[0040] The preset abnormality determination time refers to how long the behavior of the target software is observed to determine whether there is an abnormality, which usually depends on the normal operation cycle of the software and the responsiveness of the system monitoring. In this embodiment, the abnormality determination time is 10 minutes. Reasonable setting of the abnormality determination time can ensure that abnormal behavior in a short period of time is captured and reduce misjudgment.

[0041] The preset number of standard abnormality types refers to the number of abnormal states that need to be met when determining whether the target software is abnormal software, which usually depends on the diverse abnormal behaviors of the system. In this embodiment, the number of standard abnormality types is 3. Setting 3 abnormal states can improve the accuracy of abnormality detection and reduce misjudgment caused by a single abnormality.

[0042] The preset evaluation duration refers to the time to monitor the target software in the power load environment, which usually depends on the load test requirements and system performance. Setting it to 20 minutes can balance the comprehensiveness of the detection and the test time. In this embodiment, the evaluation duration is 20 minutes, which helps to accurately capture the attack strength of the target software.

[0043] The preset standard strength refers to the benchmark value used to judge the attack strength of the target software, which usually depends on the performance and normal operation load of the system. It is set to the 95th percentile value of the system load, which can effectively identify the behavior of attack strength exceeding the standard. In this embodiment, the standard strength is 100MB memory consumption and 50GB data transmission volume.

[0044] The preset standard malicious behavior number refers to the number of malicious behaviors that need to be detected when determining whether the target software is malware, which usually depends on the normal behavior pattern of the system. In this embodiment, the standard malicious behavior number is set to 5, which can effectively distinguish normal behavior from malicious behavior.

[0045] The preset monitoring period refers to the period of time during which data is regularly acquired during the detection process, which usually depends on the data acquisition frequency of the system and the level of detail required for detection. Setting it to 1 hour can balance the real-time nature of data acquisition and the consumption of system resources. In this embodiment, the monitoring period is 1 hour to ensure continuous monitoring of the behavior of the target software.

[0046] The preset correction time refers to the time used to correct the evaluation time after the test is completed, which usually depends on the stability of the test results and data fluctuations. Setting it to 2 hours can effectively reduce errors caused by accidental factors. In this embodiment, the correction time is 2 hours, which can adjust the evaluation time to ensure the accuracy of the test.

[0047] The preset malicious quantity standard deviation threshold refers to the standard deviation value used to judge the abnormality of the number of malware, which usually depends on the normal fluctuation range of the system. Setting it to 2 times the standard deviation can effectively identify a significant increase in malicious behavior. In this embodiment, the malicious quantity standard deviation threshold is 2 to ensure that the evaluation time is adjusted when the quantity fluctuates abnormally.

[0048] The frequency standard deviation range refers to the standard deviation value that defines the normal frequency fluctuation range, which usually depends on the request frequency stability of the system. Setting the standard deviation range to ±20% helps to identify abnormal request frequencies. In this embodiment, the frequency standard deviation range is ±20%.

[0049] The data volume standard deviation range refers to the standard deviation value that defines the normal data transmission volume fluctuation range, which usually depends on the normal data flow of the system. The standard deviation range set to ±15% can identify abnormal fluctuations in data transmission volume. In this embodiment, the data volume standard deviation range is ±15%.

[0050] The response time standard deviation range refers to the standard deviation value that defines the normal response time fluctuation range, which usually depends on the response time stability of the system. Setting the standard deviation range to ±10% can effectively monitor the abnormality of the response time. In this embodiment, the response time standard deviation range is ±10%.

[0051] By monitoring the real-time request frequency, data transmission volume and response time of the target software in the virtual power system of the power sandbox, the suspicious software is marked with the preset standard frequency, and then its abnormal state is judged according to the preset abnormal judgment time and parameter standard deviation range. If multiple abnormal states are detected, the software is marked as abnormal. Different power load environments are set in the sandbox environment, and the memory consumption and data transmission volume of abnormal software are monitored to calculate the attack intensity and identify malicious behavior. Finally, the malware is determined and isolated from the virtual power system, and a report is generated at the same time. At the end of the monitoring period, the evaluation time is corrected by analyzing the number of malware and the standard deviation threshold.

[0052] By real-time monitoring of the behavior of target software in the virtual power system and combining multiple detection mechanisms, the detection accuracy of malware is significantly improved. Detailed analysis using preset standard values ​​and parameter ranges can effectively distinguish abnormal software and reduce misjudgments. Further evaluation by setting different power load environments in the sandbox environment ensures comprehensive detection of malware behavior. By dynamically adjusting the evaluation time to adapt to different attack modes and system states, the security and stability of the system are improved, effectively solving the problems of untimely detection and high false alarm rate caused by complex and changeable malware behavior and long detection response time.

[0053] Please continue reading Figure 2 As shown, it is a logical decision diagram for marking the status of each target software in this embodiment; Specifically, marking each target software as being in a suspicious state according to the real-time request frequency and the preset standard frequency includes: when the real-time request frequency of the target software is greater than the standard frequency, marking the target software as being in a suspicious state; when the real-time request frequency of the target software is less than or equal to the standard frequency, marking the target software as being in a normal state.

[0054] By comparing the real-time request frequency of the target software with the preset standard frequency, when the real-time request frequency exceeds the standard frequency, the target software is marked as suspicious. This marking method helps to screen out software that may have abnormal behavior and provides a preliminary focus for subsequent detailed detection.

[0055] Through the marking mechanism, software with abnormal frequency exceeding the standard can be quickly identified, effectively narrowing the scope that requires in-depth analysis.

[0056] Specifically, determining the abnormal state of each suspicious software according to all real-time request frequencies, real-time transmission data volumes, real-time call response durations and a preset parameter standard deviation range group of each suspicious software within a preset abnormal determination time period includes: Calculate the standard deviations of all real-time request frequencies, real-time transmission data volumes, and real-time call response durations of each of the suspicious software within the abnormal determination duration to form frequency standard deviations, data volume standard deviations, and response duration standard deviations. When the frequency standard deviation is not within the frequency standard deviation range, determine that the abnormal state of the suspicious software is a frequency abnormal state. When the data volume standard deviation is not within the data volume standard deviation range, determining that the abnormal state of the suspicious software is a data volume abnormal state; When the response time standard deviation is not within the response time standard deviation range, it is determined that the abnormal state of the suspicious software is a response abnormal state.

[0057] By calculating the standard deviation of the real-time request frequency, data transmission volume and response time within the abnormal determination time, the corresponding frequency standard deviation, data volume standard deviation and response time standard deviation are formed. Then, these standard deviations are compared with the preset parameter standard deviation range, and the abnormal state of each suspicious software is determined according to whether it exceeds the range, so as to identify the software with abnormal frequency, abnormal data volume or abnormal response.

[0058] By analyzing the standard deviation of each key indicator in detail, different types of abnormal conditions can be effectively detected, improving the accuracy and comprehensiveness of abnormal behavior identification.

[0059] Please continue reading Figure 3 As shown, it is a logical determination diagram for determining abnormal software in this embodiment; Specifically, when the number of abnormal states of the standard abnormal types appears in the abnormal states of each of the suspicious software, the suspicious software is determined to be abnormal software.

[0060] When the abnormal state of suspicious software shows abnormal frequency, abnormal data volume and abnormal response of the standard abnormal number of types at the same time, the software is judged as abnormal software. This method comprehensively evaluates multiple abnormal indicators to ensure that the software is marked as abnormal only when multiple preset abnormalities occur at the same time, thus enhancing the accuracy of anomaly detection.

[0061] By requiring suspicious software to meet a certain number of abnormal conditions on multiple abnormal criteria at the same time, the possibility of false positives is significantly reduced.

[0062] Specifically, the setting of several power load environments in the sandbox environment of the power sandbox includes: A plurality of power load environments in which the power load increases at a preset change rate are set in the sandbox environment of the power sandbox.

[0063] The preset rate of change refers to the speed at which the power load set in the sandbox environment of the power sandbox changes over time, which is usually determined based on the test requirements of the system and the actual operation of the power system. In this embodiment, the preset rate of change may be set to increase the power load by 5% to 10% per minute. The advantage of this setting is that it can gradually simulate the operating state of the power system under different load conditions, thereby more accurately evaluating the performance of suspicious software in various environments and improving the accuracy of malware detection.

[0064] The power sandbox has multiple power load environments set up in the sandbox environment. The power load of these environments will gradually increase at a preset rate of change to simulate different load conditions. These environments are used to evaluate the performance of suspicious software under different power loads to determine whether it exhibits abnormal behavior.

[0065] By setting up a power load environment that increases at a preset rate of change, the response of suspicious software under different power conditions can be tested more comprehensively.

[0066] Specifically, determining the attack intensity according to the memory consumption and the data transmission volume includes: Calculate the standard deviation of all the memory consumption and the data transmission within the evaluation time period respectively to obtain the standard deviation of memory consumption and the standard deviation of data transmission, and calculate the attack intensity according to the standard deviation of memory consumption, the standard deviation of data transmission, the preset memory weight and the preset data transmission weight, wherein A=Wm×Sm+Wd×Sd, A is the attack intensity, Wm is the memory weight, Sm is the standard deviation of memory consumption, Wd is the data transmission weight, and Sd is the standard deviation of data transmission.

[0067] The preset memory weight and the preset data transmission weight respectively represent the relative importance of the standard deviation of memory consumption and the standard deviation of data transmission when calculating the attack intensity. Generally, these two weights depend on which resource consumption in the system is more representative of potential malicious behavior. Usually in some systems, if the fluctuation of memory consumption has a greater impact on system stability, the memory weight will be set to a higher value, while the data transmission weight will be set to a lower value; and vice versa. In this embodiment, memory consumption has a greater impact on malicious behavior, so Wm=0.7 and Wd=0.3 are set. Such a weight setting can highlight the impact of fluctuations in memory consumption on attack intensity, thereby more accurately detecting possible malicious behavior.

[0068] During the evaluation period, the standard deviations of the abnormal software's memory consumption and data transmission are calculated to obtain the memory consumption standard deviation and data transmission standard deviation, respectively. Then, based on the preset memory weight and data transmission weight, the two standard deviations are combined to obtain the attack strength. This process provides an objective assessment of the strength of the software's potential malicious behavior by quantifying the degree of fluctuation of memory and data.

[0069] By combining the fluctuations in memory consumption and data transfer volume and applying weights to calculate attack intensity, the attack capabilities of malware can be more accurately identified and quantified.

[0070] Please continue reading Figure 4 As shown, it is a logical determination diagram for determining malicious behavior of abnormal software in this embodiment; Specifically, determining the malicious behavior of the abnormal software according to the attack strength and a preset standard strength includes: when the attack strength is greater than the standard strength, determining that the abnormal software exhibits malicious behavior.

[0071] The attack strength of each software is determined by monitoring and calculating the standard deviation of memory consumption and data transmission. Then, the calculated attack strength is compared with the preset standard strength. When the attack strength exceeds the standard strength, the software is judged to have malicious behavior. This method can effectively identify potential malicious behavior by accurately measuring abnormal fluctuations in resource consumption and data transmission.

[0072] By setting reasonable standard strengths, the system can respond promptly, identify and isolate malware when abnormal software behavior begins to threaten system stability.

[0073] Specifically, determining malware according to the number of malicious behaviors and a preset standard number of malicious behaviors includes: When the number of the malicious behaviors is greater than the standard number of malicious behaviors, the abnormal software is determined to be malware.

[0074] First, the system monitors the number of malicious behaviors of each abnormal software and compares it with the preset standard number of malicious behaviors. When the number of malicious behaviors exceeds the standard number of malicious behaviors, the system determines that the abnormal software is malware and isolates it. This process ensures that only those abnormal software that exhibit multiple malicious behaviors will be marked as malware, thereby reducing false positives.

[0075] By setting a reasonable standard number of malicious behaviors, the system can effectively distinguish occasional anomalies from real malware and avoid misjudgment of normal software.

[0076] Specifically, the malicious quantity standard deviation is calculated based on the quantity of all the malicious software within the correction time. When the malicious quantity standard deviation is greater than the malicious quantity standard deviation threshold, the evaluation time is increased based on the malicious quantity standard deviation, the malicious quantity standard deviation threshold and a preset correction coefficient, wherein T'=T×[1+K×(S0-σ)], wherein T' is the increased evaluation time, K is the correction coefficient, S0 is the malware quantity standard deviation, and σ is the malicious quantity standard deviation threshold.

[0077] The preset correction factor is a multiplier coefficient used to adjust the evaluation time, which is set according to the system performance and detection accuracy requirements. In general, it depends on the system's tolerance for errors and the desired sensitivity to malware detection. The specific numerical setting can be adjusted according to the actual application scenario and experience to ensure the effectiveness and efficiency of the detection system. In this embodiment, the preset correction factor is set to 0.5. This setting is intended to balance the adjustment of the evaluation time with the actual response capability of the system during the detection process, so that when the standard deviation of the number of malware detected exceeds the threshold, the evaluation time can be appropriately increased, thereby improving the accuracy of detection without excessively affecting system performance.

[0078] During the correction period, the number of all detected malware is counted and its standard deviation is calculated. When the calculated standard deviation of the number of malware is greater than the preset threshold of the standard deviation of the number of malware, the system adjusts the evaluation period according to the standard deviation, the threshold and the preset correction factor, specifically by increasing the evaluation period. The purpose of this is to ensure more accurate malware detection by extending the evaluation time when the number of detected malware fluctuates greatly.

[0079] By dynamically adjusting the evaluation duration, the system can flexibly respond to changes in the amount of malware.

[0080] Specifically, when the malicious quantity standard deviation is less than or equal to the malicious quantity standard deviation threshold, the evaluation duration is reduced according to the malicious quantity standard deviation, the malicious quantity standard deviation threshold and a preset correction coefficient, wherein T”=T×[1-K×(S0-σ)], T” is the reduced evaluation duration.

[0081] After the evaluation cycle is over, the standard deviation of the current malware count is calculated and compared to the preset threshold. If the standard deviation is less than or equal to the threshold, a formula is used to adjust the evaluation time based on the preset correction factor. This process can quickly identify changes in the standard deviation and optimize the evaluation time accordingly to ensure the efficiency of the detection process.

[0082] By precisely controlling the evaluation duration, it is possible to effectively avoid unnecessary extension of the evaluation time when the number of malicious messages does not fluctuate much.

[0083] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0084] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for rapid malware detection based on power sandbox, characterized in that: include: Monitor the real-time request frequency, real-time transmission data volume, and real-time call response time of each target software in the virtual power system that starts the power sandbox; Mark each target software as suspicious according to the real-time request frequency and the preset standard frequency, and obtain the suspicious software; Determine the abnormal state of each suspicious software according to all real-time request frequencies, real-time transmission data volumes, real-time call response durations and a preset parameter standard deviation range group of each suspicious software within a preset abnormal determination duration, and determine a number of abnormal software according to the number of types of the abnormal states and the preset number of standard abnormal types; Setting a plurality of power load environments in the sandbox environment of the power sandbox, monitoring the memory consumption and data transmission volume of each abnormal software within a preset evaluation period in each power load environment, determining the attack intensity according to the memory consumption and the data transmission volume, determining the malicious behavior of the abnormal software according to the attack intensity and the preset standard intensity, and determining the malware according to the number of the malicious behaviors and the preset standard number of malicious behaviors; isolating the malware from the virtual power system and generating a malware report; At the end of a single preset monitoring cycle, the number of all the malware within a preset correction time is obtained, and the evaluation time is increased or decreased according to the number of the malware and a preset malicious quantity standard deviation threshold; The preset parameter standard deviation range group includes a frequency standard deviation range, a data volume standard deviation range, and a response time standard deviation range.

2. The method for rapid malware detection based on power sandbox according to claim 1, characterized in that: The marking of each target software as being in a suspicious state according to the real-time request frequency and the preset standard frequency includes: When the real-time request frequency of the target software is greater than the standard frequency, the target software is marked as being in a suspicious state.

3. The method for rapid malware detection based on power sandbox according to claim 2, characterized in that: Determining the abnormal state of each suspicious software according to all real-time request frequencies, real-time transmission data volumes, real-time call response durations and a preset parameter standard deviation range group of each suspicious software within a preset abnormal determination duration includes: Calculate the standard deviations of all real-time request frequencies, real-time transmission data volumes, and real-time call response durations of each of the suspicious software within the abnormal determination duration to form frequency standard deviations, data volume standard deviations, and response duration standard deviations. When the frequency standard deviation is not within the frequency standard deviation range, determine that the abnormal state of the suspicious software is a frequency abnormal state. When the data volume standard deviation is not within the data volume standard deviation range, determining that the abnormal state of the suspicious software is a data volume abnormal state; When the response time standard deviation is not within the response time standard deviation range, it is determined that the abnormal state of the suspicious software is a response abnormal state.

4. The method for rapid malware detection based on power sandbox according to claim 3 is characterized in that: When the number of abnormal states of the standard abnormal types appears in the abnormal states of each of the suspicious software, the suspicious software is determined to be abnormal software.

5. The method for rapid malware detection based on power sandbox according to claim 4, characterized in that: The setting of a plurality of power load environments in the sandbox environment of the power sandbox includes: A plurality of power load environments in which the power load increases at a preset change rate are set in the sandbox environment of the power sandbox.

6. The method for rapid malware detection based on power sandbox according to claim 5, characterized in that: Determining the attack intensity according to the memory consumption and the data transmission volume includes: The standard deviations of all the memory consumption and the data transmission within the evaluation time are calculated respectively to obtain the memory consumption standard deviation and the data transmission standard deviation, and the attack intensity is calculated according to the memory consumption standard deviation, the data transmission standard deviation, the preset memory weight and the preset data transmission weight.

7. The method for rapid malware detection based on power sandbox according to claim 6, characterized in that: Determining the malicious behavior of the abnormal software according to the attack strength and the preset standard strength includes: When the attack strength is greater than the standard strength, it is determined that the abnormal software exhibits malicious behavior.

8. According to the method for rapid malware detection based on power sandbox in claim 7, the step of determining malware according to the number of malicious behaviors and a preset standard number of malicious behaviors comprises: When the number of the malicious behaviors is greater than the standard number of malicious behaviors, the abnormal software is determined to be malware.

9. According to the method for rapid malware detection based on power sandbox in claim 8, the malicious quantity standard deviation is calculated based on the quantity of all the malware within the correction time length. When the malicious quantity standard deviation is greater than the malicious quantity standard deviation threshold, the evaluation time length is increased based on the malicious quantity standard deviation, the malicious quantity standard deviation threshold and a preset correction coefficient.

10. According to the power sandbox-based rapid malware detection method of claim 9, when the malicious quantity standard deviation is less than or equal to the malicious quantity standard deviation threshold, the evaluation duration is reduced according to the malicious quantity standard deviation, the malicious quantity standard deviation threshold and a preset correction coefficient.

Images