A method for rapid detection of malware based on power sandbox

Abstract

The present application relates to the technical field of information security, and more particularly to a method for rapidly detecting malicious software based on a power sandbox, comprising monitoring target software, marking suspicious software, determining abnormal states and screening out abnormal software, evaluating attack strength, isolating and adjusting, wherein the present application significantly improves the detection accuracy of malicious software by monitoring the behavior of target software in real time in a virtual power system and combining multiple detection mechanisms, detailed analysis is performed using preset standard values and parameter ranges, abnormal software can be effectively distinguished, false positives are reduced, further evaluation is performed by setting different power load environments in the sandbox environment, comprehensive detection of malicious software behavior is ensured, and the security and stability of the system are improved by dynamically adjusting the evaluation duration to adapt to different attack modes and system states, thereby effectively solving the problems of untimely detection and high false positive rate caused by the complex and variable behavior of malicious software and long detection response time.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method for rapid detection of malware based on a power sandbox. Background Technology

[0002] With the rapid development of information technology and the increasing complexity of the network environment, the types and attack methods of malware are constantly evolving, posing a severe challenge to the security of computer systems. Malware can not only lead to data leaks and system crashes, but also affect the stability of the entire network. Therefore, real-time and accurate detection and identification of malware has become an important task in the field of network security. Against this backdrop, traditional malware detection methods face many challenges, such as insufficient adaptability to new types of malware and limited ability to identify dynamic behavior.

[0003] Patent document CN112041815A discloses a computer-implemented method for identifying malware in a computer system. The method includes: receiving a plurality of executable files labeled as malicious or benign; training a machine learning model using attributes extracted from coverages associated with each of the plurality of received labeled executable files; receiving unlabeled executable files; using the trained machine learning model to determine whether the received unlabeled executable file is malicious or benign based on attributes extracted from coverages associated with the received unlabeled executable file; and when it is determined that the received unlabeled executable file is malicious, transmitting information identifying the received unlabeled executable file as malicious. It is evident that this method requires a large number of executable files labeled as malicious or benign to train the machine learning model. This method may be limited by the quality and coverage of the labeled data, affecting the model's generalization ability and accuracy. Furthermore, it relies on a pre-trained machine learning model to identify malware, and may not be able to detect novel or unseen malware in a timely manner. It also does not consider the dynamic changes of the actual operating environment in model training and malware detection. This makes it impossible to reflect the actual behavior and impact of malware in different environments. Summary of the Invention

[0004] To address this, the present invention provides a rapid method for detecting malware based on a power sandbox, which overcomes the problems of untimely detection and high false alarm rate caused by the complex and variable behavior of malware and long detection response time in the prior art.

[0005] To achieve the above objectives, the present invention provides a method for rapid detection of malware based on a power sandbox, comprising: monitoring the real-time request frequency, real-time data transmission volume, and real-time call response time of each target software in a virtual power system in which the power sandbox is activated;

[0006] Based on the real-time request frequency and the preset standard frequency, each target software is marked as suspicious, thus obtaining the suspicious software.

[0007] The abnormal state of each suspicious software is determined based on the real-time request frequency, real-time data transmission volume, real-time call response time, and a preset parameter standard deviation range within a preset anomaly determination time. Several abnormal software are then determined based on the number of types of abnormal states and the preset number of standard anomaly types.

[0008] Several power load environments are set up in the sandbox environment of the power sandbox. The memory consumption and data transmission volume of each abnormal software in each power load environment are monitored within a preset evaluation time. The attack intensity is determined based on the memory consumption and data transmission volume. The malicious behavior of the abnormal software is determined based on the attack intensity and a preset standard intensity. The malicious software is determined based on the number of malicious behaviors and a preset standard number of malicious behaviors.

[0009] Isolate the malware from the virtual power system and generate a malware report;

[0010] At the end of a single preset monitoring period, the total number of all said malware within a preset correction period is obtained, and the evaluation period is increased or decreased according to the number of said malware and a preset standard deviation threshold for the number of malware.

[0011] The preset parameter standard deviation range group includes the frequency standard deviation range, the data volume standard deviation range, and the response time standard deviation range.

[0012] Furthermore, marking each target software as suspicious based on the real-time request frequency and a preset standard frequency includes:

[0013] When the real-time request frequency of the target software is greater than the standard frequency, the target software is marked as suspicious.

[0014] Furthermore, determining the abnormal state of each suspicious software based on the real-time request frequency, real-time data transmission volume, real-time call response time, and a preset set of parameter standard deviations within a preset anomaly determination time period includes:

[0015] Calculate the standard deviation of all real-time request frequency, real-time data transmission volume, and real-time call response time for each of the suspicious software within the anomaly determination time period to form frequency standard deviation, data volume standard deviation, and response time standard deviation. When the frequency standard deviation is not within the frequency standard deviation range, the abnormal state of the suspicious software is determined to be a frequency abnormal state.

[0016] When the standard deviation of the data volume is not within the range of the standard deviation of the data volume, the abnormal state of the suspicious software is determined to be an abnormal state of data volume.

[0017] When the standard deviation of the response duration is not within the range of the standard deviation of the response duration, the abnormal state of the suspicious software is determined to be an abnormal response state.

[0018] Furthermore, when an abnormal state of the number of the standard abnormal types appears in the abnormal states of each of the suspected software, the suspected software is determined to be abnormal software.

[0019] Furthermore, the provision of several power load environments within the sandbox environment of the power sandbox includes:

[0020] Several power load environments are set up in the sandbox environment of the power sandbox, where the power load increases at a preset rate of change.

[0021] Furthermore, determining the attack strength based on the memory consumption and the data transfer volume includes:

[0022] Calculate the standard deviation of all memory consumption and data transmission within the evaluation period, respectively, to obtain the standard deviation of memory consumption and data transmission. Calculate the attack strength based on the standard deviation of memory consumption, the standard deviation of data transmission, a preset memory weight, and a preset data transmission weight.

[0023] Furthermore, determining the malicious behavior of the anomalous software based on the attack strength and a preset standard strength includes:

[0024] When the attack intensity exceeds the standard intensity, the abnormal software is determined to have engaged in malicious behavior.

[0025] Furthermore, determining the malware based on the number of malicious acts and a preset standard number of malicious acts includes:

[0026] When the number of malicious behaviors exceeds the standard number of malicious behaviors, the abnormal software is determined to be malicious software.

[0027] Furthermore, the standard deviation of the number of malicious software is calculated based on the total number of malicious software within the correction period. When the standard deviation of the number of malicious software is greater than the standard deviation threshold of the number of malicious software, the evaluation period is increased based on the standard deviation of the number of malicious software, the standard deviation threshold of the number of malicious software, and a preset correction coefficient.

[0028] Furthermore, when the standard deviation of the number of malicious attacks is less than or equal to the standard deviation threshold of the number of malicious attacks, the evaluation time is reduced based on the standard deviation of the number of malicious attacks, the standard deviation threshold of the number of malicious attacks, and a preset correction coefficient.

[0029] Compared with existing technologies, the beneficial effects of this invention are as follows: by monitoring the behavior of target software in real time in a virtual power system and combining multiple detection mechanisms, the detection accuracy of malicious software is significantly improved. Detailed analysis using preset standard values ​​and parameter ranges can effectively distinguish abnormal software and reduce false positives. Further evaluation by setting different power load environments in a sandbox environment ensures comprehensive detection of malicious software behavior. By dynamically adjusting the evaluation time to adapt to different attack modes and system states, the security and stability of the system are improved. This effectively solves the problems of untimely detection and high false alarm rates caused by the complex and variable behavior of malicious software and long detection response time.

[0030] Furthermore, the labeling mechanism can quickly identify software with abnormal frequencies exceeding the standard, effectively narrowing down the scope that requires in-depth analysis.

[0031] Furthermore, by analyzing the standard deviation of various key indicators in detail, different types of abnormal states can be effectively detected, improving the accuracy and comprehensiveness of abnormal behavior identification.

[0032] Furthermore, by requiring suspicious software to simultaneously meet a certain number of abnormal states across multiple anomaly criteria, the likelihood of false alarms is significantly reduced.

[0033] Furthermore, by setting up a power load environment that increases at a preset rate of change, it is possible to more comprehensively test the response of suspected software under different power conditions.

[0034] Furthermore, by combining fluctuations in memory consumption and data transfer volume, and applying weights to calculate attack strength, the attack capabilities of malware can be identified and quantified more accurately.

[0035] Furthermore, by setting reasonable standard strengths, the system can react promptly when abnormal software behavior begins to threaten system stability, identifying and isolating malicious software.

[0036] Furthermore, by setting a reasonable standard number of malicious behaviors, the system can effectively distinguish between occasional anomalies and genuine malicious software, avoiding misjudgments of normal software.

[0037] Furthermore, by dynamically adjusting the evaluation duration, the system can flexibly respond to changes in the number of malware programs.

[0038] Furthermore, by precisely controlling the assessment duration, unnecessary extensions in assessment time can be effectively avoided when the number of malicious attacks does not fluctuate significantly. Attached Figure Description

[0039] Figure 1This is a flowchart of the rapid malware detection method based on a power sandbox in this embodiment;

[0040] Figure 2 A logic decision diagram for marking the state of each target software in this embodiment;

[0041] Figure 3 This is a logic diagram for determining abnormal software in this embodiment;

[0042] Figure 4 This is a logic diagram for determining the malicious behavior of abnormal software in this embodiment. Detailed Implementation

[0043] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0044] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0045] It should be noted that in the description of this invention, the terms "upper", "lower", "left", "right", "inner", "outer", etc., which indicate directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and is not intended to indicate or imply that the device or element must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of this invention.

[0046] Furthermore, it should be noted that, in the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0047] Please see Figure 1 The diagram shown is a flowchart of a rapid malware detection method based on a power grid sandbox in this embodiment. This embodiment provides a rapid malware detection method based on a power grid sandbox, including:

[0048] Monitor the real-time request frequency, real-time data transmission volume, and real-time call response time of each target software in the virtual power system of the power sandbox.

[0049] Based on the real-time request frequency and the preset standard frequency, each target software is marked as suspicious, thus obtaining the suspicious software.

[0050] The abnormal state of each suspicious software is determined based on the real-time request frequency, real-time data transmission volume, real-time call response time, and a preset parameter standard deviation range within a preset anomaly determination time. Several abnormal software are then determined based on the number of types of abnormal states and the preset number of standard anomaly types.

[0051] Several power load environments are set up in the sandbox environment of the power sandbox. The memory consumption and data transmission volume of each abnormal software in each power load environment are monitored within a preset evaluation time. The attack intensity is determined based on the memory consumption and data transmission volume. The malicious behavior of the abnormal software is determined based on the attack intensity and a preset standard intensity. The malicious software is determined based on the number of malicious behaviors and a preset standard number of malicious behaviors.

[0052] Isolate the malware from the virtual power system and generate a malware report;

[0053] At the end of a single preset monitoring period, the total number of all said malware within a preset correction period is obtained, and the evaluation period is increased or decreased according to the number of said malware and a preset standard deviation threshold for the number of malware.

[0054] The preset parameter standard deviation range group includes the frequency standard deviation range, the data volume standard deviation range, and the response time standard deviation range.

[0055] The real-time request frequency is captured and recorded using network traffic analysis tools (such as Wireshark) or system performance monitoring tools (such as Prometheus).

[0056] Real-time data transmission volume is monitored and analyzed using data monitoring and analysis tools (such as NetFlow and sFlow).

[0057] Real-time call response time monitoring tools can be obtained using performance monitoring tools (such as New Relic, AppDynamics) or custom measurement scripts.

[0058] Memory consumption can be obtained using system monitoring tools (such as Nagios, Zabbix) or performance analysis tools (such as Valgrind, Heaptrack).

[0059] Data transfer volume is measured using network traffic monitoring tools such as NetFlow and Wireshark.

[0060] Attack strength is calculated using a comprehensive monitoring platform (such as Splunk) in conjunction with the standard deviation of memory and data transfer volumes.

[0061] Malicious behavior detection employs security incident and information management systems (such as SIEM).

[0062] Malware isolation uses virtualization management tools (such as VMware, Hyper-V) or network isolation devices.

[0063] The preset standard frequency refers to a preset baseline value for the frequency of requests issued by the target software in the virtual power system. It typically depends on the normal operating load of the system and is set to the median value of the system load. In this embodiment, the preset standard frequency is 100 requests per second. Setting a standard frequency helps to quickly identify potential malicious behavior when software requests are abnormal.

[0064] The preset anomaly detection duration refers to the timeframe for observing the target software's behavior to determine if an anomaly exists. This typically depends on the software's normal operating cycle and the system monitoring's responsiveness. In this embodiment, the anomaly detection duration is 10 minutes. Setting a reasonable anomaly detection duration ensures that abnormal behavior within a short period is captured, reducing false positives.

[0065] The preset number of standard anomaly types refers to the number of abnormal states that must be satisfied when determining whether a target software is abnormal. This typically depends on the diverse abnormal behaviors of the system. In this embodiment, the number of standard anomaly types is 3. Setting three anomaly states can improve the accuracy of anomaly detection and reduce false positives caused by a single anomaly.

[0066] The preset evaluation duration refers to the time spent monitoring the target software in a power load environment, which typically depends on the load testing requirements and system performance. Setting it to 20 minutes balances the comprehensiveness of the detection with the testing time. In this embodiment, the evaluation duration is 20 minutes, which helps to accurately capture the attack strength of the target software.

[0067] The preset standard strength refers to a benchmark value used to judge the attack strength of target software, which usually depends on the system's performance and normal operating load. Setting it to the 95th percentile of the system load can effectively identify attacks exceeding the standard strength. In this embodiment, the standard strength is 100MB of memory consumption and 50GB of data transfer.

[0068] The preset standard malicious behavior count refers to the number of malicious behaviors that need to be detected when determining whether target software is malware, and it usually depends on the normal behavior pattern of the system. In this embodiment, the standard malicious behavior count is set to 5, which can effectively distinguish between normal and malicious behaviors.

[0069] The preset monitoring period refers to the time interval for periodically acquiring data during the detection process, which typically depends on the system's data acquisition frequency and the required level of detail in the detection. Setting it to 1 hour balances the real-time nature of data acquisition with the consumption of system resources. In this embodiment, the monitoring period is 1 hour to ensure continuous monitoring of the target software's behavior.

[0070] The preset correction time refers to the time used to correct the evaluation time after the detection is completed, and it usually depends on the stability of the detection results and data fluctuations. Setting it to 2 hours can effectively reduce errors caused by occasional factors. In this embodiment, the correction time is 2 hours, which allows for adjustment of the evaluation time and ensures the accuracy of the detection.

[0071] The preset standard deviation threshold for malicious activity refers to the standard deviation value used to determine abnormal numbers of malicious software, and it typically depends on the normal fluctuation range of the system. Setting it to twice the standard deviation can effectively identify a significant increase in malicious behavior. In this embodiment, the standard deviation threshold for malicious activity is 2, ensuring that the evaluation time is adjusted when there are abnormal fluctuations in the number of malicious activities.

[0072] The frequency standard deviation range refers to the standard deviation value that defines the normal frequency fluctuation range, and it typically depends on the stability of the system's requested frequency. Setting a standard deviation range of ±20% helps identify requested frequency anomalies. In this embodiment, the frequency standard deviation range is ±20%.

[0073] The standard deviation range of data volume refers to the standard deviation value that defines the range of fluctuations in normal data transmission volume, and it usually depends on the normal data traffic of the system. Setting a standard deviation range of ±15% can identify abnormal fluctuations in data transmission volume. In this embodiment, the standard deviation range of data volume is ±15%.

[0074] The standard deviation range of response time refers to the standard deviation value that defines the normal range of response time fluctuations, and it usually depends on the stability of the system's response time. Setting a standard deviation range of ±10% can effectively monitor anomalies in response time. In this embodiment, the standard deviation range of response time is ±10%.

[0075] This method monitors the real-time request frequency, data transfer volume, and response time of target software within a virtual power system in a power sandbox. Suspicious software is flagged using preset standard frequencies, and its abnormal state is determined based on preset anomaly judgment time and parameter standard deviation range. If multiple abnormal states are detected, the software is marked as abnormal. Different power load environments are set up in the sandbox environment to monitor the memory consumption and data transfer volume of abnormal software to calculate attack strength and identify malicious behavior. Ultimately, malicious software is identified and isolated from the virtual power system, generating a report. At the end of the monitoring period, the evaluation time is adjusted by analyzing the number of malicious software instances and the standard deviation threshold.

[0076] By monitoring the behavior of target software in real time within a virtual power system and combining multiple detection mechanisms, the accuracy of malware detection is significantly improved. Detailed analysis using preset standard values ​​and parameter ranges can effectively distinguish abnormal software and reduce false positives. Further evaluation by setting different power load environments in a sandbox environment ensures comprehensive detection of malware behavior. By dynamically adjusting the evaluation duration to adapt to different attack modes and system states, the system's security and stability are improved. This effectively solves the problems of untimely detection and high false alarm rates caused by the complex and variable behavior of malware and long detection response times.

[0077] Please continue reading. Figure 2 As shown, it is a logic decision diagram for marking the state of each target software in this embodiment;

[0078] Specifically, marking each target software as suspicious based on the real-time request frequency and the preset standard frequency includes: marking the target software as suspicious when the real-time request frequency of the target software is greater than the standard frequency; and marking the target software as normal when the real-time request frequency of the target software is less than or equal to the standard frequency.

[0079] By comparing the real-time request frequency of the target software with a preset standard frequency, the target software is marked as suspicious when the real-time request frequency exceeds the standard frequency. This marking method helps to filter out software that may exhibit abnormal behavior, providing an initial focus for subsequent detailed testing.

[0080] The tagging mechanism can quickly identify software with abnormal frequencies exceeding the standard, effectively narrowing down the scope that requires in-depth analysis.

[0081] Specifically, determining the abnormal state of each suspicious software based on the real-time request frequency, real-time data transmission volume, real-time call response time, and a preset set of parameter standard deviations within a preset anomaly determination time period includes:

[0082] Calculate the standard deviation of all real-time request frequency, real-time data transmission volume, and real-time call response time for each of the suspicious software within the anomaly determination time period to form frequency standard deviation, data volume standard deviation, and response time standard deviation. When the frequency standard deviation is not within the frequency standard deviation range, the abnormal state of the suspicious software is determined to be a frequency abnormal state.

[0083] When the standard deviation of the data volume is not within the range of the standard deviation of the data volume, the abnormal state of the suspicious software is determined to be an abnormal state of data volume.

[0084] When the standard deviation of the response duration is not within the range of the standard deviation of the response duration, the abnormal state of the suspicious software is determined to be an abnormal response state.

[0085] By calculating the standard deviations of real-time request frequency, data transmission volume, and response time within the anomaly detection period, corresponding frequency standard deviations, data transmission volume standard deviations, and response time standard deviations are generated. These standard deviations are then compared to preset parameter standard deviation ranges. Whether these ranges are exceeded determines the abnormal state of each suspicious software, thereby identifying software with abnormal frequency, abnormal data volume, or abnormal response.

[0086] By analyzing the standard deviation of various key indicators in detail, different types of abnormal states can be effectively detected, improving the accuracy and comprehensiveness of abnormal behavior identification.

[0087] Please continue reading. Figure 3 As shown, it is the logic decision diagram for determining abnormal software in this embodiment;

[0088] Specifically, when the number of the standard anomaly types appears in the abnormal states of each of the suspicious software, the suspicious software is determined to be abnormal software.

[0089] When suspicious software exhibits abnormalities in the frequency of standard anomaly types, data volume, and response simultaneously, it is deemed an abnormal software. This method enhances the accuracy of anomaly detection by comprehensively evaluating multiple anomaly indicators, ensuring that software is only flagged as abnormal when multiple preset anomalies occur simultaneously.

[0090] By requiring suspicious software to simultaneously meet a certain number of abnormal states across multiple anomaly criteria, the likelihood of false alarms is significantly reduced.

[0091] Specifically, setting up several power load environments in the sandbox environment of the power sandbox includes:

[0092] Several power load environments are set up in the sandbox environment of the power sandbox, where the power load increases at a preset rate of change.

[0093] The preset rate of change refers to the speed at which the power load changes over time within the sandbox environment of the power sandbox. It is typically determined based on the system's testing requirements and the actual operating conditions of the power system. In this embodiment, the preset rate of change may be set to increase the power load by 5% to 10% per minute. This setting allows for the gradual simulation of the power system's operation under different load conditions, thereby more accurately assessing the performance of suspicious software in various environments and improving the accuracy of malware detection.

[0094] The power sandbox environment contains multiple power load environments. The power load in these environments gradually increases at a preset rate of change to simulate different load conditions. These environments are used to evaluate the performance of suspicious software under different power loads to determine whether it exhibits anomalous behavior.

[0095] By setting up a power load environment that increases at a preset rate of change, it is possible to more comprehensively test the response of suspected software under different power conditions.

[0096] Specifically, determining the attack strength based on the memory consumption and the data transfer volume includes:

[0097] Calculate the standard deviations of all memory consumption and data transfer volume within the evaluation period to obtain the standard deviations of memory consumption and data transfer volume. Calculate the attack strength based on the standard deviations of memory consumption and data transfer volume, a preset memory weight, and a preset data transfer weight, where A = Wm × Sm + Wd × Sd, A is the attack strength, Wm is the memory weight, Sm is the standard deviation of memory consumption, Wd is the data transfer weight, and Sd is the standard deviation of data transfer volume.

[0098] The preset memory weight and preset data transfer weight represent the relative importance of the standard deviation of memory consumption and the standard deviation of data transfer, respectively, when calculating attack strength. Typically, these two weights depend on which resource consumption in the system is more representative of potential malicious behavior. In some systems, if fluctuations in memory consumption have a greater impact on system stability, the memory weight will be set to a higher value, while the data transfer weight will be set to a lower value; and vice versa. In this embodiment, memory consumption has a greater impact on malicious behavior, so Wm = 0.7 and Wd = 0.3 are set. This weight setting highlights the impact of fluctuations in memory consumption on attack strength, thereby more accurately detecting potential malicious behavior.

[0099] Within the assessment period, the standard deviations of the abnormal software's memory consumption and data transfer volume are calculated, yielding the standard deviations for memory consumption and data transfer volume, respectively. Then, based on preset memory and data transfer weights, these two standard deviations are combined to calculate the final attack strength. This process provides an objective assessment of the strength of potential malicious software behavior by quantifying the fluctuations in memory and data.

[0100] By combining fluctuations in memory consumption and data transfer volume, and applying weights to calculate attack strength, the attack capabilities of malware can be more accurately identified and quantified.

[0101] Please continue reading. Figure 4 As shown, it is a logic diagram for determining the malicious behavior of abnormal software in this embodiment.

[0102] Specifically, determining the malicious behavior of the abnormal software based on the attack strength and the preset standard strength includes: determining that the abnormal software has engaged in malicious behavior when the attack strength is greater than the standard strength.

[0103] The attack strength of each piece of software is determined by monitoring and calculating the standard deviation of memory consumption and data transfer volume. Then, the calculated attack strength is compared with a preset standard strength; when the attack strength exceeds the standard strength, the software is deemed to be engaging in malicious behavior. This method effectively identifies potential malicious activities by accurately measuring abnormal fluctuations in resource consumption and data transfer.

[0104] By setting reasonable standard strength, the system can react promptly when abnormal software behavior begins to threaten system stability, identifying and isolating malicious software.

[0105] Specifically, determining the malware based on the number of malicious behaviors and a preset standard number of malicious behaviors includes:

[0106] When the number of malicious behaviors exceeds the standard number of malicious behaviors, the abnormal software is determined to be malicious software.

[0107] First, the system monitors the number of malicious behaviors of each anomalous software and compares it to a preset standard number of malicious behaviors. When the number of malicious behaviors exceeds the standard number, the system identifies the anomalous software as malware and isolates it. This process ensures that only anomalous software exhibiting multiple malicious behaviors is flagged as malware, thus reducing false positives.

[0108] By setting a reasonable standard number of malicious behaviors, the system can effectively distinguish between occasional anomalies and genuine malware, avoiding misjudgments of normal software.

[0109] Specifically, the standard deviation of the number of malicious software is calculated based on the total number of malicious software within the correction period. When the standard deviation of the number of malicious software is greater than the standard deviation threshold of the number of malicious software, the evaluation period is increased based on the standard deviation of the number of malicious software, the standard deviation threshold of the number of malicious software, and a preset correction coefficient, where T' = T × [1 + K × (S0 - σ)], where T' is the increased evaluation period, K is the correction coefficient, S0 is the standard deviation of the number of malicious software, and σ is the standard deviation threshold of the number of malicious software.

[0110] The preset correction factor is a multiplier used to adjust the evaluation time, set according to system performance and detection accuracy requirements. Generally, it depends on the system's tolerance for error and the desired sensitivity to malware detection. Specific numerical settings can be adjusted based on actual application scenarios and experience to ensure the effectiveness and efficiency of the detection system. In this embodiment, the preset correction factor is set to 0.5. This setting aims to balance the adjustment of the evaluation time with the system's actual responsiveness during detection, so that when the standard deviation of the number of detected malware exceeds a threshold, the evaluation time can be moderately increased to improve detection accuracy without excessively impacting system performance.

[0111] Within the adjusted time period, the system counts the number of all detected malware and calculates its standard deviation. When the calculated standard deviation of malware count exceeds a preset threshold, the system adjusts the evaluation time based on this standard deviation, the threshold, and a preset correction coefficient, specifically by increasing the evaluation time. This is done to ensure more accurate malware detection when the number of detected malware fluctuates significantly, by extending the evaluation time.

[0112] By dynamically adjusting the evaluation duration, the system can flexibly respond to changes in the number of malware.

[0113] Specifically, when the standard deviation of the number of malicious attacks is less than or equal to the threshold of the standard deviation of the number of malicious attacks, the evaluation time is reduced according to the standard deviation of the number of malicious attacks, the threshold of the standard deviation of the number of malicious attacks, and a preset correction coefficient, where T”=T×[1-K×(S0-σ)], and T” is the reduced evaluation time.

[0114] At the end of the evaluation period, the standard deviation of the current number of malware instances is calculated and compared to a preset threshold. If the standard deviation is less than or equal to the threshold, the evaluation duration is adjusted using a formula based on a preset correction factor. This process can quickly identify changes in the standard deviation and optimize the evaluation duration accordingly to ensure the efficiency of the detection process.

[0115] By precisely controlling the assessment duration, it is possible to effectively avoid unnecessary extensions in assessment time when the number of malicious attacks does not fluctuate significantly.

[0116] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

[0117] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for rapid detection of malware based on a power sandbox, characterized in that, include: Monitor the real-time request frequency, real-time data transmission volume, and real-time call response time of each target software in the virtual power system of the power sandbox. Based on the real-time request frequency and the preset standard frequency, each target software is marked as suspicious, thus obtaining the suspicious software. The abnormal state of each suspicious software is determined based on the real-time request frequency, real-time data transmission volume, real-time call response time, and a preset parameter standard deviation range within a preset anomaly determination time. Several abnormal software are then determined based on the number of types of abnormal states and the preset number of standard anomaly types. Several power load environments are set up in the sandbox environment of the power sandbox. The memory consumption and data transmission volume of each abnormal software in each power load environment are monitored within a preset evaluation time. The attack intensity is determined based on the memory consumption and data transmission volume. The malicious behavior of the abnormal software is determined based on the attack intensity and a preset standard intensity. The malicious software is determined based on the number of malicious behaviors and a preset standard number of malicious behaviors. Isolate the malware from the virtual power system and generate a malware report; At the end of a single preset monitoring period, the total number of all said malware within a preset correction period is obtained, and the evaluation period is increased or decreased according to the number of said malware and a preset standard deviation threshold for the number of malware. The preset parameter standard deviation range group includes the frequency standard deviation range, the data volume standard deviation range, and the response time standard deviation range.

2. The method for rapid detection of malware based on a power sandbox according to claim 1, characterized in that, The step of marking each target software as suspicious based on the real-time request frequency and a preset standard frequency includes: When the real-time request frequency of the target software is greater than the standard frequency, the target software is marked as suspicious.

3. The method for rapid detection of malware based on a power sandbox according to claim 2, characterized in that, The process of determining the abnormal state of each suspicious software based on the real-time request frequency, real-time data transmission volume, real-time call response time, and a preset set of parameter standard deviations within a preset anomaly determination time period includes: Calculate the standard deviation of all real-time request frequency, real-time data transmission volume, and real-time call response time for each of the suspicious software within the anomaly determination time period to form frequency standard deviation, data volume standard deviation, and response time standard deviation. When the frequency standard deviation is not within the frequency standard deviation range, the abnormal state of the suspicious software is determined to be a frequency abnormal state. When the standard deviation of the data volume is not within the range of the standard deviation of the data volume, the abnormal state of the suspicious software is determined to be an abnormal state of data volume. When the standard deviation of the response duration is not within the range of the standard deviation of the response duration, the abnormal state of the suspicious software is determined to be an abnormal response state.

4. The method for rapid detection of malware based on a power sandbox according to claim 3, characterized in that, When the number of abnormal states of the standard abnormal types appears in the abnormal states of each of the aforementioned suspicious software, the suspicious software is determined to be abnormal software.

5. The method for rapid detection of malware based on a power sandbox according to claim 4, characterized in that, The provision of several power load environments within the sandbox environment of the power sandbox includes: Several power load environments are set up in the sandbox environment of the power sandbox, where the power load increases at a preset rate of change.

6. The method for rapid detection of malware based on a power sandbox according to claim 5, characterized in that, Determining the attack strength based on the memory consumption and the data transfer volume includes: Calculate the standard deviation of all memory consumption and data transmission within the evaluation period, respectively, to obtain the standard deviation of memory consumption and data transmission. Calculate the attack strength based on the standard deviation of memory consumption, the standard deviation of data transmission, a preset memory weight, and a preset data transmission weight.

7. The method for rapid detection of malware based on a power sandbox according to claim 6, characterized in that, The determination of the malicious behavior of the abnormal software based on the attack strength and the preset standard strength includes: When the attack intensity exceeds the standard intensity, the abnormal software is determined to have engaged in malicious behavior.

8. The method for rapid detection of malware based on a power sandbox according to claim 7, wherein determining malware based on the number of malicious behaviors and a preset standard number of malicious behaviors includes: When the number of malicious behaviors exceeds the standard number of malicious behaviors, the abnormal software is determined to be malicious software.

9. The method for rapid detection of malware based on power sandbox according to claim 8, wherein the standard deviation of the number of malware is calculated based on the total number of malware within the correction time, and when the standard deviation of the number of malware is greater than the standard deviation threshold of the number of malware, the evaluation time is increased based on the standard deviation of the number of malware, the standard deviation threshold of the number of malware, and a preset correction coefficient.

10. The method for rapid detection of malware based on power sandbox according to claim 9, wherein when the standard deviation of the number of malicious programs is less than or equal to the threshold of the standard deviation of the number of malicious programs, the evaluation time is reduced according to the standard deviation of the number of malicious programs, the threshold of the standard deviation of the number of malicious programs, and a preset correction coefficient.

Images