Virus characteristic data processing method, system and equipment

Abstract

The invention relates to the technical field of network security, in particular to a method, a system and equipment for processing virus characteristic data. The method comprises the following steps: configuring a virtual sandbox virtualization layer, initializing a running environment, setting monitoring parameters, verifying environment isolation and a running state, and generating virtual sandbox running data; acquiring virus sample data, and loading the virus sample data to the virtual sandbox to obtain sample initial state data; according to the sample initial state data and the virtual sandbox operation state data, virtual sandbox operation parameters are configured, a monitoring probe is deployed, and virtual sandbox probe deployment data are obtained; a behavior acquisition channel is established based on virtual sandbox probe deployment data, and a behavior data acquisition model is constructed. According to the method, the virus sample behavior analysis is carried out by constructing the virtual sandbox environment, the virus feature recognition process is optimized by combining feature extraction, dimension reduction and clustering analysis, and the virus detection efficiency, accuracy and real-time response capability are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system and device for processing virus feature data. Background Art

[0002] Traditional virus detection technology is mostly based on static feature matching, such as code snippets, file fingerprints or specific file structures. Although this method has a high detection rate for known viruses, it is often powerless when faced with virus variants that are obfuscated, packed or reorganized by code. Especially when viruses are frequently iterated and updated, the lag in updating the static feature library makes it impossible for the system to prevent new threats in a timely manner. In the traditional virus detection process, the extraction of feature data often stays in a single dimension, while ignoring the correlation between virus behavior features. For example, some virus behaviors appear as independent events at different time points and in different environments, but there are potential correlation links between them. The existing methods lack effective time-series correlation analysis technology and cannot fully describe the virus behavior link, resulting in limited detection accuracy. The update of the existing virus feature library mainly relies on manual analysis and manual input. The extraction and verification process of new features is time-consuming and it is easy to miss the best defense opportunity. At the same time, there are often redundant or conflicting feature data in the feature library, and effective evaluation and cleaning cannot be carried out, which affects the system's operating efficiency and detection effect. Summary of the invention

[0003] Based on this, it is necessary for the present invention to provide a method, system and device for processing virus feature data to solve at least one of the above technical problems.

[0004] To achieve the above purpose, a method for processing virus feature data includes the following steps:

[0005] Step S1: configure the virtual sandbox virtualization layer and initialize the operating environment, set monitoring parameters, verify the environment isolation and operating status, and generate virtual sandbox operating data;

[0006] Step S2: Obtain virus sample data, and load the virus sample data into a virtual sandbox to obtain sample initial state data; configure virtual sandbox operation parameters according to sample initial state data and virtual sandbox operation state data, and deploy monitoring probes to obtain virtual sandbox probe deployment data; establish a behavior collection channel based on the virtual sandbox probe deployment data, and construct a behavior data collection model;

[0007] Step S3: Use the behavior data collection model to monitor the dynamic behavior of the sample operation, and pre-process and normalize the monitoring data to obtain virus standardized behavior data; perform time series correlation analysis on the virus standardized behavior data to obtain virus behavior link data;

[0008] Step S4: extract key behavior features from the virus behavior link data to obtain virus feature description data; perform similarity calculation and cluster analysis on the virus feature description data, and build a virus behavior feature model based on the calculation and analysis results;

[0009] Step S5: Calculate the feature weight distribution according to the virus behavior feature model, and perform correlation analysis on the calculation results to obtain virus feature correlation data; perform dimensionality reduction processing and feature selection on the virus feature correlation data, and generate virus feature recognition data according to the selection results;

[0010] Step S6: Evaluate the effectiveness and stability of the virus feature recognition data, perform threshold analysis and conflict monitoring on the evaluation results, and obtain virus feature verification data; update the virus feature verification data to the cloud virus feature database.

[0011] The present invention provides a safe and reliable platform for analyzing virus sample behavior by constructing a virtual sandbox environment, combining the system virtualization layer and the application virtualization layer. The accuracy of virus behavior is ensured by monitoring the environment and verifying isolation. After the virus sample is loaded into the virtual sandbox, the virus behavior data is monitored and standardized in real time through monitoring probes and behavior data acquisition models to remove redundant information. Virus behavior link data is constructed using time series association analysis to reveal the laws of virus behavior and lay the foundation for subsequent feature extraction and cluster analysis. Through feature selection, dimensionality reduction and similarity calculation, the efficiency and accuracy of virus identification are improved, and virus family identification and new virus classification are supported. Virus feature identification data is optimized after effectiveness and stability evaluation to reduce false alarms and improve detection capabilities. Finally, the feature data is updated to the cloud database to achieve data sharing and global optimization, and improve the synergy of cross-platform virus detection.

[0012] The present invention also provides a virus feature data processing system, which is used to execute the virus feature data processing method as described above. The virus feature data processing system includes:

[0013] A virtual sandbox initialization module is used to configure the virtual sandbox virtualization layer and initialize the operating environment, set monitoring parameters, verify environmental isolation and operating status, and generate virtual sandbox operating data;

[0014] The virus sample loading module is used to obtain virus sample data and load the virus sample data into the virtual sandbox to obtain sample initial state data; configure the virtual sandbox operation parameters according to the sample initial state data and the virtual sandbox operation state data, and deploy the monitoring probe to obtain virtual sandbox probe deployment data; establish a behavior collection channel based on the virtual sandbox probe deployment data, and build a behavior data collection model;

[0015] The behavior data monitoring module is used to monitor the dynamic behavior of the sample operation using the behavior data collection model, and pre-process and normalize the monitoring data to obtain virus standardized behavior data; perform time series correlation analysis on the virus standardized behavior data to obtain virus behavior link data;

[0016] The behavior feature modeling module is used to extract key behavior features from virus behavior link data to obtain virus feature description data; perform similarity calculation and cluster analysis on the virus feature description data, and build a virus behavior feature model based on the calculation and analysis results;

[0017] The feature optimization and identification module is used to calculate the feature weight distribution according to the virus behavior feature model, and perform correlation analysis on the calculation results to obtain virus feature correlation data; perform dimensionality reduction and feature selection on the virus feature correlation data, and generate virus feature identification data based on the selection results;

[0018] The feature verification and update module is used to evaluate the effectiveness and stability of virus feature identification data, perform threshold analysis and conflict monitoring on the evaluation results, and obtain virus feature verification data; the virus feature verification data is updated to the cloud virus feature database.

[0019] The present invention provides a safe and controllable virus behavior analysis platform by configuring a virtualized environment and initializing an operating environment. By setting monitoring parameters, the isolation and reliability of the sandbox are verified to ensure a high-quality data collection foundation. The virtual sandbox operating parameters are dynamically adjusted to improve the adaptability to a variety of virus samples. By deploying monitoring probes and acquisition channels, virus behavior data is accurately captured, and preprocessing and standardization are performed to improve the accuracy of the data. Through time series correlation analysis and behavior link construction, the law of virus behavior is revealed, and feature extraction and modeling are supported. Through similarity calculation and cluster analysis, virus sample classification and family identification are achieved, and the classification efficiency of new viruses is improved. Through feature weight calculation and dimensionality reduction processing, the accuracy and efficiency of virus classification and identification are improved. Generate and optimize virus feature recognition data, reduce false positives and false negatives, and ensure the stability and effectiveness of the data. Finally, the feature data is synchronized to the cloud virus feature database, supporting cross-platform sharing and improving the synergy of the overall detection system.

[0020] The present invention also provides a virus feature data processing device, comprising a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement any one of the virus feature data processing methods described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments thereof made with reference to the following drawings:

[0022] Figure 1 A schematic diagram of the steps of a method for processing virus feature data of the present invention;

[0023] Figure 2 for Figure 1 Detailed step flow diagram of step S1;

[0024] Figure 3 for Figure 1 Detailed step flow chart of step S2 in FIG. DETAILED DESCRIPTION

[0025] The technical method of the present invention is described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0026] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor methods and / or microcontroller methods.

[0027] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0028] To achieve this, please refer to Figures 1 to 3 The present invention provides a method for evaluating mineral resource reserves based on a digital model, the method comprising the following steps:

[0029] Step S1: configure the virtual sandbox virtualization layer and initialize the operating environment, set monitoring parameters, verify the environment isolation and operating status, and generate virtual sandbox operating data;

[0030] The embodiment of the present invention defines the basic hardware parameters of the virtual sandbox, including the number of processor cores, memory size, disk space, etc. Enable hardware virtualization support to ensure the operating efficiency of the virtual machine. Set the resource allocation strategy of the virtual sandbox to ensure that the virus sample will not affect the performance of the host system when it is running. Allocate an independent network interface to isolate the communication between the virtual sandbox and the host system. Virtualize the operating system API interface to simulate the environment of common operating system versions. Set the virtualization strategy of the file system, such as simulating different file system types. Virtualize the network environment to support dynamic IP allocation and simulate abnormal states such as network disconnection and slow network. Install and configure the software environment that the virus depends on to run. Virtualize application permissions and user account settings to provide a safe sandbox testing environment. Integrate the configuration data of the system virtualization layer and the application virtualization layer to generate a complete virtual sandbox environment configuration file. Start the virtual sandbox, load the virtualization layer parameters according to the configuration file, and complete the initialization of the operating environment. Ensure that the virtual sandbox can start and run normally, and record the initialization log. Define the system status parameters that need to be monitored, including CPU usage, memory usage, network traffic, file read and write behavior, etc. Configure key monitoring points for behavior capture, such as API call records, registry changes, system service operations, etc. Set monitoring frequency and sensitivity to ensure that key behaviors are captured without affecting sandbox performance. Enable sandbox isolation level monitoring to record interactions with the external environment in real time. Test the virtual sandbox's ability to isolate the external environment, such as attempting to break through the sandbox boundary through malicious scripts, and record any abnormal behavior. Use network traffic analysis tools to detect whether there is unauthorized data packet transmission. Load preset test samples to simulate sensitive information leakage behavior and confirm that the virtual sandbox can effectively intercept leakage behavior. Simulate external environment interference of the virtual sandbox to verify the robustness of the sandbox. Run standardized test tasks in the virtual sandbox to verify whether the performance parameters meet expectations. Save the running status data of the virtual sandbox after initialization, including hardware resource allocation status, network configuration, environment variables, etc. Organize all initialization configurations, monitoring parameters, and running status data of the virtual sandbox into a structured running data file to generate virtual sandbox running data.

[0031] Step S2: Obtain virus sample data, and load the virus sample data into a virtual sandbox to obtain sample initial state data; configure virtual sandbox operation parameters according to sample initial state data and virtual sandbox operation state data, and deploy monitoring probes to obtain virtual sandbox probe deployment data; establish a behavior collection channel based on the virtual sandbox probe deployment data, and construct a behavior data collection model;

[0032] The embodiment of the present invention collects virus sample data from multiple sources. Virus sample data is received through file upload, network download or device interface. Sample data can be in various forms such as files, scripts, network traffic, processes or memory images. The obtained virus sample data is verified to ensure that the data is complete and has not been tampered with. The verification can be carried out by hash value comparison, digital signature, or preliminary scanning of the sample through a virus detection tool to ensure that the sample is correct. According to the environment type of the virtual sandbox, a suitable loading method is selected. Common methods include copying the file to the virtual file system of the sandbox, or loading it through a memory image. If the sample is an executable file, it is loaded through the simulated execution environment of the sandbox. After the sample is loaded into the sandbox, first check whether the sample can be started normally or recognized by the sandbox system. Use debugging tools, log files or API hooks to record to ensure that the virus sample is correctly loaded and ready to run. Obtain the initial state data of the sample after loading in the virtual sandbox, including information such as file operations, network activities, registry changes, process startup, etc. of the sample. Collect the behavior data of the sample when it is started through the monitoring tool of the sandbox, such as network connection requests, file generation, process calls, etc. Timestamp each monitored behavior and record the order of data occurrence to ensure the timeliness and traceability of the data. Confirm whether the initial running state of the virus sample is in line with expectations, such as whether the malicious code is started, whether the system settings are modified, etc. Ensure that the behavior of the sample in the sandbox is consistent with its malicious nature to avoid false positives of normal behavior. Dynamically adjust the sandbox's operating parameters based on the sample's initial state data. Set appropriate sandbox configuration parameters such as network, file system, or execution permissions based on the nature of the sample to ensure that the virus behavior can be fully simulated. Deploy appropriate monitoring probes in the sandbox to capture the real-time behavior of the virus. Monitoring probes can be file operation monitors, network traffic monitors, process behavior probes, etc. When deploying probes, ensure that they do not interfere with the normal execution of the virus sample to ensure the accuracy of data collection. Set the monitoring probe's collection frequency, threshold, and other parameters based on the nature of the sample and the sandbox environment. Start the monitoring probe in the sandbox to record the running behavior of the virus sample in real time, including file creation, system calls, registry changes, network communications, etc. Build a behavior data collection channel in the virtual sandbox through probes and monitoring tools. This channel is used to obtain dynamic behavioral data of all samples and transmit the data to the data storage system in real time. In order to analyze more efficiently, the channel needs to time-stamp all captured behavioral data, arrange the event sequence, and classify the behavior type. The behavioral data is stored in the local or cloud database of the sandbox through the collection channel. The collected behavioral data should be pre-processed, such as denoising and normalization, to ensure the accuracy of subsequent analysis. Based on the collected behavioral data, a behavioral data collection model is established.

[0033] Step S3: Use the behavior data collection model to monitor the dynamic behavior of the sample operation, and pre-process and normalize the monitoring data to obtain virus standardized behavior data; perform time series correlation analysis on the virus standardized behavior data to obtain virus behavior link data;

[0034] The embodiment of the present invention starts the collection model and begins to monitor various dynamic behaviors during the sample execution process. Specific behavior monitoring items include file operations, process behaviors, network activities, registry operations, and system calls. The monitoring probe collects behavior data in real time according to the configured parameters. These data are transmitted to the data storage system or the real-time processing module through the behavior collection channel. Each behavior event is accompanied by a timestamp to ensure the accuracy of the data sequence and identify the relevant event source. The captured raw behavior data is preprocessed to remove irrelevant or abnormal data. Normal behaviors that do not have virus characteristics are filtered, such as the startup of regular operating system processes, harmless system updates, etc. Statistical methods are used to identify and remove noise in the data to ensure that the data set reflects the true behavior characteristics of the virus sample. The noise comes from the normal activities of the system itself or the interference of other processes. The denoising process is to improve the accuracy of subsequent analysis. The various features in the behavior data are normalized so that they can be compared and analyzed under the same dimension. Standardization technology is used to map different types of behavior data into a unified range to ensure data consistency in the subsequent analysis process. The behavior data is adjusted by the feature scaling method to eliminate the dimensional inconsistency problem caused by differences in sample size, behavior frequency, etc. Ensure that all behavioral data are of consistent scale so that machine learning models or time series analysis can perform reasoning based on balanced input data. After the virus behavior data is standardized and denoised, use time series association analysis technology to identify the causal relationship and time sequence between virus behaviors. By building a time series analysis model, analyze the time sequence of behavior occurrence and its internal connections, and identify the pattern of virus behavior links. Based on the results of time series association analysis, build a virus behavior link diagram to reveal the complete process of the virus from launch to execution. The behavior link diagram will indicate the time point of each behavior event, the relationship between events, and the impact of each event on subsequent behaviors. Through time series association analysis, the typical path of virus behavior can be identified. Based on the results of time series analysis, generate virus behavior link data.

[0035] Step S4: extract key behavior features from the virus behavior link data to obtain virus feature description data; perform similarity calculation and cluster analysis on the virus feature description data, and build a virus behavior feature model based on the calculation and analysis results;

[0036] The embodiment of the present invention is to extract key behavior features with significant representativeness from the virus behavior link data. The frequency of virus behavior occurring during the entire sample execution process is counted. High-frequency behaviors such as frequent file operations and registry modifications are often key operations of viruses. The time interval between behavior events is analyzed. For example, some malicious behaviors will occur continuously in a very short period of time. Identifying such closely related behavior sequences is an important feature of virus behavior. According to the dependency between different events in the behavior link, the logical or causal relationship between behaviors is extracted. For example, file creation behavior usually depends on process startup. Capturing such behavior dependency helps to identify the core operation path of the virus. Behavior type is also part of the key features, such as file operation, network connection, process creation, etc. Classifying different types of behaviors can help us identify the main malicious behavior patterns of virus samples. The extracted key behavior features are summarized and organized to construct descriptive virus feature data. These feature description data include not only the type of behavior, but also related statistical data. Each virus sample can be represented by a feature vector, which contains various behavior features of the virus sample when it is executed in a virtual sandbox. Each behavior feature affects subsequent analysis steps, such as similarity calculation and cluster analysis. The feature vectors of virus samples are compared using similarity calculation methods to evaluate the similarity of different virus samples in terms of behavioral characteristics. The goal of similarity calculation is to find out which virus samples have similar behavioral patterns by comparing behavioral characteristics, thereby revealing that these samples belong to the same category or family. The behavioral feature vectors of all virus samples are compared pairwise, and the similarity scores between each sample are calculated. Samples with high similarity have commonalities in behavior, suggesting that they are the same type of virus. Based on the similarity calculation, a clustering algorithm is used to perform cluster analysis on virus samples. The goal of cluster analysis is to group virus samples with similar behavioral characteristics into the same group, thereby forming a virus family. The feature vector of each virus sample is used as input and clustered according to the similarity results. The results of cluster analysis will group virus samples, each group representing a virus family with similar behavioral patterns. Each clustering result will get a label to identify the characteristics of that type of virus. Based on the similarity calculation and cluster analysis results, a virus behavior feature model is constructed.

[0037] Step S5: Calculate the feature weight distribution according to the virus behavior feature model, and perform correlation analysis on the calculation results to obtain virus feature correlation data; perform dimensionality reduction processing and feature selection on the virus feature correlation data, and generate virus feature recognition data according to the selection results;

[0038] The virus behavior feature model constructed by the embodiment of the present invention includes the key behavior features of different virus samples. The importance of these features is evaluated, and a weighted method is usually used to calculate the weight of the feature. The contribution of the feature to distinguishing different virus samples is evaluated, and its importance is determined by calculating the information gain of the feature in the sample classification. Calculating the weight of the feature helps to understand the contribution of different behavior features to virus classification or identification, helps to screen out the most useful features, and removes redundant or irrelevant features. In the virus feature model, there is a strong correlation between certain features, and these features can be jointly processed in subsequent analysis. In order to identify these correlations, the linear relationship strength between each pair of features is calculated, the monotonic relationship between the features is evaluated, and it is applicable to nonlinear relationships. Through frequency statistics, the simultaneous occurrence of features in the same virus sample is analyzed to reveal the association pattern between the features. By identifying and analyzing the correlation between features, it is possible to understand which features affect the behavior of the virus at the same time, helping to build a more effective virus recognition model. The features in the data are usually very high-dimensional, which will increase the computational complexity and produce overfitting. Therefore, dimensionality reduction processing is an effective means to reduce model complexity, improve efficiency and accuracy. Use the selected method to reduce the dimension of the virus behavior features, reduce the dimension of the data, and retain enough information to make subsequent analysis and model training more efficient. Feature selection is to filter out the most discriminative features from the original high-dimensional features for further analysis and model training. It can be based on statistical test selection, model-based selection, recursive feature elimination, or information theory methods. After the virus behavior features are reduced in dimension, feature selection methods are used to further filter out the features that are most helpful for virus classification and remove noise and irrelevant features. The final features obtained through dimension reduction and feature selection are constructed into a concise and optimized feature set. Virus feature recognition data not only contains the key features of virus behavior, but also includes the importance weights of these features after dimension reduction and screening.

[0039] Step S6: Evaluate the effectiveness and stability of the virus feature recognition data, perform threshold analysis and conflict monitoring on the evaluation results, and obtain virus feature verification data; update the virus feature verification data to the cloud virus feature database.

[0040] The embodiment of the present invention evaluates the effectiveness of virus feature recognition data to ensure that the extracted features have practical significance and recognition capabilities and can effectively distinguish different types of virus behaviors. The virus feature recognition data is verified using a preset test sample to evaluate the accuracy, precision, recall rate and other indicators of the feature set in identifying different types of virus behaviors. By comparing the behavior of feature recognition data with known virus samples, the recognition accuracy is calculated to ensure the accuracy of virus behavior classification. The cross-validation method is used to divide the data set into multiple subsets, and the performance of the feature recognition model is evaluated on each subset to obtain a stable evaluation result. Different feature recognition data sets are compared and tested to evaluate the recognition effect of each feature set and select the best performing feature. A virus feature recognition effectiveness evaluation report is output, including analysis results such as recognition accuracy, model classification accuracy, stability, etc., to provide a basis for subsequent optimization and adjustment. Ensure the stability of virus features in different environments, that is, whether the feature recognition data remains consistent under various changes such as different operating systems, hardware platforms, and virus variants, and has robustness. Different operating environments are simulated by a virtual sandbox environment, and virus feature recognition data is executed to observe the changes in recognition results under various test environments. Select different operating systems for testing to verify the stability of feature recognition data. Simulate the behavior of viruses on different hardware platforms to ensure the consistency of feature data on different hardware. Test different versions of virus variants to verify whether feature recognition can stably identify the behavior of new variants. Output a virus feature recognition stability assessment report, including the test environment and test results, such as recognition errors and stability scores in different environments. Based on the evaluation results, determine the acceptable threshold range of virus features in actual applications, so as to screen out features that meet specific requirements and exclude unstable or poorly performing features. Determine the threshold of each virus feature based on the results of effectiveness and stability assessments. You can set a weight threshold to exclude features below this threshold, which will introduce noise. Based on the stability assessment report, determine the tolerance range of each feature in different test environments, set thresholds to screen out those features that are unstable, and ensure the reliability of features in different environments. Set thresholds for the recognition data of virus features, set a maximum error range, and the recognition data that exceeds this range is considered to be in conflict and needs further analysis and resolution. Output a virus feature threshold configuration data report, which lists the threshold range of each feature in detail, including relevant thresholds such as effectiveness, stability, and weight. Check for conflicts in virus feature recognition data, especially when certain features behave inconsistently in different environments. These conflicts need to be identified and corrected. By comparing feature recognition data and threshold reports, find features that cause recognition conflicts, especially when the same feature gives different results in different test environments. Compare the standardized behavior data of virus samples with known virus behavior links to detect whether the feature data is consistent.Analyze whether the identification data is consistent in multiple environments. If some features have too many anomalies or conflicts, they need to be marked as potential conflicting data. Output a virus feature conflict detection report, list all conflicting data found during the identification process, and provide suggestions for further correction and optimization. Based on the effectiveness evaluation report, stability evaluation report, threshold configuration data report, and conflict detection report, perform an overall verification of the virus feature identification data to ensure that the feature data used can accurately and stably identify virus behavior. Optimize the data based on the evaluation results, adjust feature weights, stability thresholds, conflict handling, etc., to further improve the performance of the identification model. Output a virus feature verification data report, including the optimized data set and the new feature recognition model, to ensure the integrity and accuracy of the data. Synchronize the verified and optimized virus feature data to the cloud virus feature database so that other detection systems can quickly access, retrieve, and use this data. The cloud database can increase the speed of virus feature retrieval, allowing the virus behavior analysis tool to identify newly emerging virus features in real time. Synchronize the virus feature verification data and feature index to the cloud database through the API or data synchronization tool. Ensure that the cloud database stores the latest and most accurate virus feature data.

[0041] Preferably, step S1 comprises the following steps:

[0042] Step S11: configuring the system virtualization layer of the virtual sandbox, and defining the virtual sandbox hardware abstraction and resource allocation parameters to obtain basic operating environment data;

[0043] The embodiment of the present invention selects a suitable virtualization platform and configures its system virtualization layer. This layer is used to implement a virtualized operating system so that the virtual sandbox can be isolated from the host system. The virtual machine manager configures the virtualization environment of the sandbox. The virtual machine manager allocates physical resources to the virtual machine to achieve resource isolation and virtualization. The actual hardware resources are abstracted through the virtualization platform so that the virtual sandbox can use these hardware resources without directly interacting with the physical hardware. According to the requirements of the virus sample operation, the resource allocation parameters of the virtual sandbox are defined, including CPU allocation, memory allocation, storage allocation and network bandwidth. The resource usage of the virtual sandbox is monitored in real time through the resource monitoring tool built into the virtualization platform. Ensure that the virtual sandbox can run smoothly under the specified resource restrictions. According to the operation requirements of the virtual sandbox, dynamically adjust resource allocation to ensure the best utilization of resources. For example, when the virus sample requires a large amount of computing resources, dynamically add CPU and memory resources. By loading a simple application in the virtual sandbox for testing, verify whether the hardware virtualization and resource allocation are working properly to ensure that the behavior of each virtual hardware is consistent with the physical hardware. According to the test feedback, adjust the resource allocation parameters to optimize the resource utilization efficiency of the virtual sandbox and avoid resource over-allocation or resource shortage. After configuring hardware abstraction and resource allocation, collect the hardware resource configuration of the virtual sandbox and the configuration parameters of the system virtualization layer to generate basic operating environment data.

[0044] Step S12: configuring the application virtualization layer of the virtual sandbox, and virtualizing the API interface, file system version and network environment to obtain application isolation environment data;

[0045] The embodiment of the present invention provides a technology for implementing application isolation in a virtualization platform. By selecting a suitable application virtualization technology, the application layer is isolated to ensure that different applications do not interfere with each other and avoid affecting the operating system or other applications. The virtualization layer includes the virtualization of the API interface, the file system, and the network environment. Through the virtualized API interface, the virus sample can only interact with the virtual system API to avoid interference or tampering with the host system API, and simulate the real system behavior through the preset API response data. File system virtualization limits the virus sample to only access files in the virtual environment to protect the host machine data from being destroyed or leaked. Network virtualization configures an independent virtual network interface and environment to ensure that the network behavior of the virus sample is limited to the virtual sandbox and does not affect the host network, and simulates external network conditions for testing. Through multi-layer environmental isolation and access control strategies, it is ensured that the virus sample runs safely in the virtual sandbox without affecting the host system or spreading network threats. At the same time, detailed configuration information is recorded to generate application isolation environment data.

[0046] Step S13: integrating the basic operating environment data and the application isolation environment data, and initializing the virtual sandbox operating environment based on the integrated data to construct a virtual sandbox, thereby obtaining virtual sandbox environment data;

[0047] The embodiment of the present invention integrates the basic operating environment data and the application isolation environment data to ensure that they are compatible in the same virtual sandbox environment. The integrated data includes hardware resource allocation, application isolation data and data integration interface. According to the integrated data, the basic hardware resources of the virtual sandbox are allocated. This process needs to consider the resource parameters configured by the system virtualization layer to ensure that the environment running in the virtual machine can stably support various sample behaviors during the test process. According to the application isolation environment data, the virtualized applications and services are initialized. Ensure that the configuration of application-level virtualization data such as the file system, API interface and network environment can be accurately loaded into the virtual sandbox. Adjust the compatibility and interaction between hardware and application virtualization to avoid unstable operation of the virtual environment due to improper configuration. Ensure that the hardware, application and network configurations in the virtual environment support each other to maximize the isolation and resource utilization efficiency of the sandbox. After the initialization process, the virtual sandbox environment data containing information such as hardware configuration, resource allocation, application isolation, file system version and network environment is recorded and generated.

[0048] Step S14: configuring the monitoring parameters of the virtual sandbox based on the virtual sandbox environment data to obtain virtual sandbox monitoring configuration data;

[0049] The embodiment of the present invention extracts the initialized virtualization environment configuration according to the virtual sandbox environment data. These data include the configuration parameters of the system virtualization layer and the application virtualization layer, such as hardware resource allocation, isolation status of virtual applications, etc. Including the monitoring of hardware resources such as CPU, memory usage, hard disk reading and writing, network traffic, etc. Parameters need to be set to monitor the resource usage of the sandbox in real time to avoid affecting sample analysis due to insufficient resources. Including monitoring of behaviors such as API interfaces, file system operations, network requests, etc. after virtualization. These monitoring parameters can help track the behavior of virus samples at the application layer and detect the calls and operations of malicious code on system components. Set the capture method of sample behavior, such as process creation, file operation, registry modification, network connection, etc. According to the configuration of the sandbox, specify monitoring probes and log recording points to ensure that the sample behavior can be fully recorded. Arrange probes in the sandbox environment, and the probes are responsible for collecting and transmitting relevant behavior data. According to environmental data and virtualization requirements, configure appropriate probe types, such as system-level probes, file monitoring probes, network traffic monitoring probes, etc. Configure the acquisition frequency, data transmission format, recorded data type, etc. of the probe to ensure that the probe can efficiently and accurately record the behavior of the virus sample. Set up monitoring tasks, such as timed detection, triggered detection, etc. By configuring trigger conditions, you can set the monitoring task to start when the virus sample performs a specific operation, record and analyze the behavior data. Configure the data collection method to ensure that the monitoring data can be collected and transmitted to the analysis system in a timely and effective manner. According to the above configuration steps, generate the virtual sandbox monitoring configuration data.

[0050] Step S15: verify the isolation of the virtual sandbox based on the monitoring parameter configuration data, detect information leakage and external interference risks, and generate virtual sandbox environment verification data by loading preset test samples to simulate environmental interference behavior;

[0051] The embodiment of the present invention obtains all monitoring parameters and configuration settings according to the monitoring parameter configuration data. These data will be used for environmental monitoring, risk detection and performance evaluation in the subsequent verification process. Configure the verification scenario to ensure that the virtual sandbox can run independently without external interference. Including the isolation of the internal and external networks of the sandbox to ensure that the operations inside the sandbox will not affect the external system; whether the operations in the sandbox can prevent external attacks or data leakage, and ensure that the virus sample cannot return data or perform other malicious operations in the sandbox. Simulate external interference, such as malicious network requests, unauthorized access attempts, etc., to detect whether the virtual sandbox can effectively prevent the influence of these external factors. In order to verify the isolation and protection capabilities of the sandbox, some preset test samples are loaded to simulate the interaction between the internal and external environments of the sandbox. After loading the test samples, start the monitoring system to verify the isolation of the virtual sandbox in real time. Detect whether there is a risk of data leakage in the sandbox. For example, monitor whether there is abnormal external communication behavior, whether there is unauthorized file access or data transmission. Detect whether the sandbox environment can remain intact under external attacks and no cross-border operations or resource sharing will occur. Ensure that even if external interference or malicious samples are running, it will not affect the normal operation of the virtual sandbox or cause the sandbox to be destroyed. According to the simulation test results, record the verification data. These data include isolation test results, information leakage risks, and external interference protection. The generated verification data can include log files, event reports, anomaly detection data, etc., to obtain virtual sandbox environment verification data.

[0052] Step S16: verifying the operation performance parameters of the virtual sandbox according to the virtual sandbox environment verification data to obtain the virtual sandbox operation status data.

[0053] The embodiment of the present invention extracts the results of isolation verification, information leakage risk detection and external interference simulation based on the virtual sandbox environment verification data. These data will be used to evaluate the protection effect of the sandbox in actual operation. By monitoring the usage of CPU, memory, disk and network resources in the sandbox, the performance of the sandbox during operation is evaluated. Monitor the CPU load in the sandbox to ensure that the sandbox can still run stably under high load. Evaluate the sandbox memory usage to determine whether there is a risk of memory leakage or resource exhaustion. Monitor the read and write speed of the disk to ensure that the sandbox file system can quickly process data operations. Analyze the changes in network traffic inside and outside the sandbox to determine whether the sandbox can effectively prevent information leakage and external attacks. Simulate the actual use scenario of the sandbox by loading preset virus samples or applications. In the configured test scenario, start the sandbox and perform performance testing. Monitor the changes in various performance parameters inside and outside the sandbox in real time, including the usage of CPU, memory, disk and network. By monitoring data, detect whether there is abnormal resource usage or performance fluctuation in the sandbox, and determine whether the sandbox can remain stable during stress testing. During the test, if abnormal behavior or performance issues are found, analyze the causes and conduct troubleshooting through log records, event reports, etc. Generate detailed virtual sandbox operation status data.

[0054] The present invention achieves resource optimization and waste reduction by defining the hardware abstraction and resource allocation parameters of the virtual sandbox, provides a unified standard hardware environment, and reduces the uncertainty caused by hardware differences. By virtualizing the API interface, file system and network environment, a highly isolated application environment is constructed to ensure the independence and authenticity of virus behavior analysis. The integration of environmental data and application isolation data improves the efficiency of sandbox construction and supports dynamic adjustment of environmental parameters to meet the needs of different virus samples. By configuring monitoring parameters, the accurate capture of virus behavior is improved, ensuring efficient monitoring and reducing resource usage. The sandbox environment is verified for isolation and stability to ensure information security and prevent interference, thereby enhancing the credibility of the analysis process. Performance parameter verification ensures that the sandbox still runs efficiently under high load, provides stable support for large-scale sample analysis, and improves the versatility and stability of the system.

[0055] Preferably, step S2 comprises the following steps:

[0056] Step S21: Obtaining the original data of the virus sample, and performing integrity and availability verification to obtain the virus sample data;

[0057] The embodiment of the present invention proposes a method for obtaining and verifying virus samples to ensure sample integrity and availability. Virus samples can be obtained through virus databases, malware sample collection sites or infection cases in the form of executable files, script files and compressed packages, etc., and contain relevant metadata. After obtaining the sample, its hash value is calculated and compared with the hash value provided by the original sample provider to ensure that no tampering or damage occurs during transmission. The sample file format is parsed to verify the validity of its type and file structure, such as checking the PE header structure or script file parsing, and verifying the rationality of the file size. The virus sample is preliminarily run in a controlled environment to test its loading and execution capabilities, and the sample behavior is observed in a virtualized sandbox, such as startup status and expected behavior data generation. The integrity and availability of the sample are recorded, and samples that fail the verification need to be repaired or re-acquired. Qualified samples are classified by type, virus family or infection method, and stored in a database or file system, and marked as "valid" samples to form a virus sample data set.

[0058] Step S22: Load the virus sample data into the virtual sandbox, and verify the loading status to obtain the sample initial status data;

[0059] According to the previously defined virtual sandbox environment, the embodiment of the present invention selects a suitable virtual sandbox instance to load the virus sample. The sandbox environment should have been initialized according to the configuration requirements of step S21 and step S23 to ensure that it can support the execution of the virus sample. The virus sample data that has passed the integrity and availability check is loaded from the storage system into the sandbox environment. This process is usually completed through a virtualization management tool or an automated script. Check the log file of the sandbox environment to confirm whether the virus sample has been successfully loaded. Check whether there is any error information, such as file loading failure, missing dependent files, or the sandbox environment does not support certain sample features. If the sample is an executable file, it is necessary to confirm whether it has been started normally. For other types of virus samples, it is necessary to confirm whether it can be correctly parsed and executed by the application or simulator in the sandbox. During the loading process, monitor the use of sandbox resources to ensure that the sandbox will not crash or be abnormal due to resource problems when the virus sample is loaded. Check the initial state in the virtual sandbox and record the key parameters of the current environment, such as the process list, network connection status, registry, file system status, etc. in the sandbox. Observe the first action after the sample is loaded. For example, check whether a new process is started, whether a file is created, or whether a system setting is modified. Ensure that these behaviors are as expected. After the virus sample is loaded, quickly collect preliminary status data related to the virus behavior in the sandbox to obtain the sample initial status data.

[0060] Step S23: adjusting the virtual sandbox operation parameters according to the sample initial state data and the virtual sandbox operation state data to obtain virtual sandbox operation parameter configuration data;

[0061] The embodiment of the present invention evaluates the behavior pattern of the virus sample after loading in the virtual sandbox according to the sample initial state data. For example, check whether there is a new process started, the system resource usage, the file system changes, etc. Analyze the consumption of sandbox resources in the initial state, such as memory usage, CPU load, disk IO, etc., and evaluate whether the resources of the virtual sandbox need to be adjusted. Check the hardware resource configuration when the virtual sandbox is running and compare it with the running requirements of the sample. If the resource configuration of the virtual sandbox is too low, it will affect the execution of the virus sample and even cause the sample to be unable to be fully loaded or executed. Monitor the state data of the virtual sandbox and identify abnormal behaviors, such as excessive resource consumption or external interference. These abnormal situations are caused during the execution of the virus sample, or are configuration problems of the sandbox itself. According to the sample initial state data and the sandbox running state data, optimize and adjust the sandbox parameters. For example, increase the memory allocated to the virtual sandbox, adjust the network configuration to support the network communication of the virus sample, or add simulators and monitoring tools to the sandbox environment to better capture the behavior of the virus sample. If it is found that the virus sample requires higher CPU or memory resources when it is started in the sandbox, it can be solved by adjusting the resource allocation of the virtual sandbox. For example, increase the number of virtual CPU cores or allocate more memory. Optimize the isolation layer of the sandbox based on the isolation issues shown in the initial state data. Ensure that virus samples do not interact with the external environment through improper means. Strengthen file and network isolation in the virtual sandbox to prevent unauthorized communication between virus samples and external systems. Adjust the sandbox's firewall, proxy server, network bandwidth limit and other configurations based on runtime data to ensure the security and stability of the experimental environment. Record the results of the sandbox parameter adjustments to generate the virtual sandbox's operating parameter configuration data.

[0062] Step S24: configuring and deploying the monitoring probe based on the virtual sandbox operation parameter configuration data to obtain virtual sandbox probe deployment data;

[0063] The embodiment of the present invention reads the virtual sandbox operation parameter configuration data generated in step S23 to obtain key information such as resource allocation, isolation configuration, and monitoring scope of the sandbox. According to the configuration data, the types of monitoring probes to be deployed and their monitoring scopes are analyzed. The system monitoring probe is used to monitor system calls, process behaviors, thread operations, etc. The network monitoring probe is used to monitor the network communication behavior of the virus sample, including domain name resolution, network data packet transmission, etc. The file monitoring probe is used to capture the virus's operation behavior on the file system, such as creating, modifying, and deleting files. The memory monitoring probe is used to track the memory usage and data injection behavior of the virus sample. According to different monitoring targets, the sampling frequency, capture granularity, storage method, etc. of the probe are set. The monitoring of file operations is set to a high priority, and the file path and operation type are recorded. A deep packet capture function is set for network communication to capture the potential remote command control behavior of the virus. In view of the diversity of virus behavior, the dynamic adjustment capability of the probe is designed, for example, the monitoring granularity of the probe can be modified in real time. Deploy corresponding monitoring probes at different levels of the virtual sandbox. Inject probes at the system layer to capture the call and access of the virus sample to system resources. Deploy network monitoring probes in the network protocol stack to monitor the inbound and outbound behaviors of data packets. Optimize the deployment method of the probes according to the virtualization layer settings of the sandbox. For example, use the embedded probe mode in the lightweight sandbox and the external agent mode in the heavy sandbox to reduce the performance impact. After deployment, run with test samples to verify whether the probe can correctly capture the behavior data. For example, verify whether the file monitoring probe can accurately record the behavior by running a sample of a file creation operation. Test the impact of the probe operation on the performance of the virtual sandbox to ensure that the probe does not significantly increase the burden on system resources or interfere with the behavior of the virus sample. Record the deployment location, parameter settings, monitoring range and other information of the probe to form the virtual sandbox probe deployment data.

[0064] Step S25: establishing a behavior data collection channel based on the virtual sandbox probe deployment data, collecting dynamic behavior data of a preset test sample through the behavior data collection channel, and obtaining behavior collection channel test data;

[0065] The embodiment of the present invention designs a behavior data collection channel so that it covers the system layer, application layer and network layer of the virtual sandbox to ensure all-round monitoring of virus sample behavior. Collection rules are defined according to the deployment type and monitoring scope of the probe. The system behavior collection rule is to record system calls such as process startup, termination, and thread switching. The file operation collection rule is to record the creation, modification, and deletion of files, and capture file path and content changes. The network communication collection rule is to record the target address, transmission protocol, and data packet content of network requests. Based on the virtual sandbox probe deployment data, the behavior data collection channel is initialized, and the necessary hardware and software resources are allocated. The collection channel is bound to the deployed probe so that the collection channel can directly receive the data captured by the probe. The real-time transmission mechanism of the collection channel is configured to ensure that the monitored dynamic behavior data can be transmitted to the data storage or analysis module in a low-latency manner. Several preset test samples are loaded in the virtual sandbox. Through automated scripts or simulated operations, the dynamic behavior of the test sample is triggered, including file operations, network communications, memory operations, etc. The dynamic behavior data of the sample is collected in real time through the behavior data collection channel, and the behavior collection channel test data is generated.

[0066] Step S26: constructing a behavior data collection model using the behavior collection channel test data.

[0067] The embodiment of the present invention removes noise or outliers in the behavior collection channel test data, such as null values, duplicate records or irrelevant behavior data generated during the collection process. Standardize data from different sources and unify them into a structured format, such as JSON, CSV or database table. Sort dynamic behavior data by timestamp to ensure the consistency of the order in which the behavior occurs. Extract static features from test data. Analyze the dynamic behavior of the sample during operation and extract its behavior pattern. Identify the correlation between sample behaviors. Encode the extracted features and construct a numerical feature matrix. Use word embedding technology to vectorize text data. Select a suitable machine learning algorithm based on the characteristics of the collected data. Use the behavior collection channel test data as a training set, input the feature matrix, and train the model to fit the virus behavior data. Use cross-validation to tune the model parameters to ensure its generalization ability. Divide a part of the collected data as a validation set. Use indicators such as accuracy, recall, and F1 score to evaluate the performance of the model. Analyze the behavior data that is misidentified, find the deficiencies of the model and optimize it. Finally, a behavior data collection model is obtained.

[0068] The present invention verifies the integrity and availability of virus samples to ensure that the data has not been tampered with, thereby improving the effectiveness and efficiency of the analysis. After the sample is successfully loaded into the virtual sandbox, the initial state data is generated and the sandbox parameters are adjusted to ensure that the environment and the sample are highly matched, optimize the operating performance and improve resource utilization. By reasonably configuring the monitoring probes, the monitoring capabilities of different virus samples are enhanced to ensure that the virus behavior is fully captured. The testing and model construction of the acquisition channel optimizes the data acquisition process, ensures the real-time and efficient capture of behavioral data, and provides high-quality data support for subsequent feature extraction and behavioral link analysis.

[0069] Preferably, step S3 comprises the following steps:

[0070] Step S31: monitoring the dynamic behavior of the virus sample based on the behavior data collection model, and capturing the behavior data to obtain the original dynamic behavior data of the virus;

[0071] The embodiment of the present invention starts the configured virtual sandbox environment to ensure that the monitoring probe has been correctly deployed and is in working state. The behavior data collection model is loaded into the monitoring system for real-time monitoring and capturing the dynamic behavior of the virus sample. The target virus sample is loaded into the virtual sandbox, and the sample is started to run. The behavior monitoring scope includes system operation behavior, network communication behavior, process behavior and registry operation. The original dynamic data of the above behaviors is captured by the monitoring probe in the virtual sandbox. Ensure that the data monitored each time contains detailed information such as timestamp, behavior category, trigger source and target path. The captured behavior data is written to the log file or database in real time to record all behaviors triggered during the operation of the virus sample. The data is formatted into structured entries, such as JSON or CSV, including timestamp, behavior type, operation object and operation result. It is classified and stored by behavior category for subsequent analysis. The sampling frequency is set according to the complexity of the sample behavior to ensure that the quickly triggered behavior can be fully captured. Abnormal behaviors detected during the collection process are marked and their context information is recorded. When the virus sample runs to the end or the monitoring time reaches the preset time limit, the dynamic behavior monitoring is stopped to obtain the original dynamic behavior data of the virus.

[0072] Step S32: preprocessing and denoising the original dynamic behavior data of the virus to obtain preprocessed behavior data;

[0073] The embodiment of the present invention verifies whether the field format of the original dynamic behavior data of the virus meets expectations. Correct or eliminate records with format errors. Check whether there are empty fields or missing values ​​in the data. If the key field is missing, discard the record. If the non-key field is missing, fill it with the default value. Detect and remove behavior records with completely repeated content. Perform repeatability judgment based on fields such as the timestamp, behavior type, and target object of the behavior. If the virus sample repeatedly triggers the same behavior in a short period of time and affects the uniqueness of the analysis result, retain the first trigger record and delete the redundant records. Identify and delete outliers in the behavior data. Identify outliers by setting upper and lower limits or using statistical methods. Remove records that are obviously unrelated to virus behavior. Match and eliminate based on the noise behavior feature library in the acquisition model. Ensure that the timestamps of all records conform to a unified format. If multiple behaviors are triggered at similar times, they can be sorted by milliseconds and merged. Name the behavior category fields uniformly, for example, classify behaviors such as "file creation" and "file writing" as "file operation". Check whether the preprocessed data is complete, non-redundant, and noise-free, and perform statistical verification on the processing results to finally obtain preprocessed behavior data.

[0074] Step S33: normalizing the preprocessed behavior data to obtain virus standardized behavior data;

[0075] The embodiment of the present invention unifies the classification of virus behaviors according to preset behavior category specifications. Adjust the field names to a standardized form. Convert all time fields to a unified time format. Use relative timestamps to represent behavior time, with the behavior monitoring start time as a benchmark. Convert the size fields involved in file operations to byte units. The network data transmission rate is uniformly expressed as kbps or Mbps. Organize behavior data from multiple sources into a unified data structure. Convert the frequency of behavior to a relative value. Network transmission behavior is normalized to a fixed range based on the amount of transmission. Constrain field values ​​within a reasonable range, for example, the data size field should be a non-negative number. For extreme outliers, the quantile adjustment method can be used to classify them into a preset interval. Save the normalized data as a standardized file. Verify the consistency of the normalized data to ensure that there are no omissions or format inconsistencies. Obtain virus standardized behavior data, the format and unit of each field are consistent, and the data is complete and comparable.

[0076] Step S34: performing correlation analysis on the virus standardized behavior data according to the time sequence of the behavior occurrence to identify the causal relationship and correlation between the virus behaviors, and constructing the behavior time series sequence to obtain the virus behavior time series correlation data;

[0077] The embodiment of the present invention sorts the behavior data in chronological order according to the timestamp field in the virus standardized behavior data to ensure that events are arranged in the order of occurrence. The causal relationship between behaviors is judged according to the predefined behavior causal rule library. For the sorted behavior data, the target objects, resource dependencies and time intervals between the behaviors are analyzed to generate a causal chain. The time intervals between behaviors are calculated and closely related behaviors are recorded. It is detected whether the behavior targets are the same or there is a correlation. The correlation strength is further determined in combination with dynamic behavior characteristics. The virus behavior is constructed into an ordered time series according to the time sequence and causal correlation to describe the logical relationship between each behavior. The behavior time series sequence is saved in the form of structured data to obtain the virus behavior time series correlation data.

[0078] Step S35: construct a virus behavior link graph using the virus behavior time series correlation data, mark each behavior node and associated path in the graph, and identify key behavior nodes to obtain virus behavior link data.

[0079] The embodiment of the present invention uses virus behavior time series correlation data to construct a virus behavior link graph, with each virus behavior as a node in the graph. The causal relationship or time dependency between behaviors is used as an edge. The node represents a certain behavior of the virus; the edge represents the time sequence or causal dependency between these behaviors. The structure of the graph can be a directed graph, in which the direction of the edge represents the order or causal relationship of the behavior. For each behavior node, its detailed information is recorded, including the behavior type, timestamp and behavior target. For each edge, its correlation description is marked, such as causal relationship and time interval. According to the connection status of the behavior nodes, determine which nodes are key nodes. The "centrality" algorithm in graph theory can be used to calculate the importance of the node and identify the key nodes. Finally, the virus behavior link data is generated.

[0080] The present invention monitors the dynamic behavior of virus samples in real time through a behavioral data collection model, ensures that key behaviors are not missed, and obtains high-quality original data. The analysis efficiency and accuracy are improved through data preprocessing, noise removal, and redundant information filtering. The data is normalized to eliminate dimensional differences, making the data more adaptable and comparable. The causal relationship between virus behaviors is mined based on the time sequence association analysis, and a virus behavior chain diagram is constructed to display the behavior evolution path and potential connections. The behavior chain diagram helps identify key behavior nodes and provides an important basis for virus protection and traceability.

[0081] Preferably, step S4 comprises the following steps:

[0082] Step S41: extract key behavior features from virus behavior link data to obtain virus feature description data;

[0083] An embodiment of the present invention proposes a feature extraction method based on virus behavior link data. Virus behavior link data consists of multiple behavior nodes and their associated paths, each node represents a specific behavior (such as file creation, process startup, network connection, etc.), and the path represents the timing or causal relationship between behaviors. By parsing the behavior link graph, the behavior type, related resources or objects (such as file path, IP address, port number), timestamp and time interval between nodes of each node are extracted, and the dependency of the behavior is analyzed. The node and path features are converted into a standardized, numerical data format, and through feature selection and refinement, key features are retained and redundant information is removed. Finally, a digital description of the virus sample is generated, that is, a virus feature description data set containing behavior type, time characteristics, dependency and object information, to provide support for subsequent analysis.

[0084] Step S42: performing similarity calculation on the virus feature description data to generate virus feature similarity data;

[0085] The virus feature description data of the embodiment of the present invention needs to be converted into a feature vector in numerical form. Each feature can be represented by a numerical value. After the feature data of each sample is vectorized, the features of all virus samples can form a high-dimensional feature space. Select a suitable similarity calculation method. Before calculating the similarity, the feature data can be standardized or normalized to eliminate the influence of dimensional differences between different features. For continuous features, normalization or standardization methods can be used to make them have the same scale. For discrete features, they can be converted into numerical data by using unique hot encoding or word bag model. Through the selected similarity calculation method, the similarity value between each pair of virus samples is calculated one by one. Through similarity calculation, virus feature similarity data is generated.

[0086] Step S43: performing cluster analysis on virus samples based on virus feature similarity data to generate virus feature cluster data;

[0087] The embodiment of the present invention selects a suitable clustering algorithm according to the characteristics of the data and the analysis requirements. Based on the virus feature similarity data, the similarity data of each virus sample is used as input to prepare for cluster analysis. Select a suitable clustering algorithm and use the similarity or distance matrix as input data. Use the selected clustering algorithm for calculation and classify samples with high similarity into the same cluster. According to the selected clustering algorithm, the clustering process will continue until the clustering conditions are met or the preset number of clusters is reached. Each virus sample will be assigned to a cluster and cluster data will be generated. The clustering result can be a cluster label containing all samples, indicating the cluster to which each sample belongs. Based on the results of the cluster analysis, virus feature clustering data is generated.

[0088] Step S44: Modeling the virus behavior characteristics according to the virus feature description data, the virus feature similarity data and the virus feature clustering data to obtain a virus behavior feature model.

[0089] When constructing a virus behavior feature model, the embodiment of the present invention needs to select and integrate key features from virus feature description data, virus feature similarity data, and virus feature clustering data. From the virus feature description data, select the most representative and discriminative behavior features. Use the virus feature similarity data to help analyze which virus samples have closer behavior features, and further confirm which features work together in virus behavior. According to the virus feature clustering data, identify the virus behavior patterns within the same cluster. The clustering results can help summarize the common features of different virus samples and remove noise or abnormal data. According to the data characteristics and requirements, select a suitable modeling method. Construction of training data set: Create a training set for training and testing based on the data set obtained from step S41 to step S43. Methods such as cross-validation can be used to improve the generalization ability of the model. Use the selected modeling method for training. Optimize the model by evaluating the accuracy, precision, recall rate and other indicators of the model. The performance of the model can be analyzed using tools such as confusion matrix and ROC curve. Apply the model to an unseen test data set to verify its generalization ability. If the model does not perform well on the test data set, you can further tune the model parameters or improve feature selection. Finally, you will get a virus behavior feature model.

[0090] The present invention structures complex behavior data by parsing virus behavior link data and extracting key nodes and paths, facilitating subsequent analysis and storage. By marking behavior types and frequencies, virus behavior pattern analysis is supported. The extracted key behavior features optimize data processing and feature extraction efficiency. Similarity analysis reveals the correlation between virus samples, laying the foundation for virus classification, clustering and family relationship identification. Cluster analysis helps identify virus transmission patterns and formulate protection strategies. Finally, the features, similarities and clustering data are integrated to form a unified virus behavior feature model, improving detection efficiency and wide adaptability.

[0091] Preferably, step S5 comprises the following steps:

[0092] Step S51: Analyze the importance of each behavior feature according to the virus behavior feature model, and quantify the feature weight to obtain virus feature weight distribution data;

[0093] In order to quantify the importance of each behavioral feature, the embodiment of the present invention can be based on the model's feature importance calculation, the statistical feature importance analysis, or the model's interpretability method. Based on the above analysis method, the weight of the feature is quantified by calculating the contribution of each feature. The feature weight value is usually expressed as a numerical value between 0 and 1, where 1 represents the most important feature and 0 represents the least important feature. In order to ensure that the weights of each feature can be compared, it is usually standardized so that the sum of all feature weights is 1. The feature weights are scaled to the range of [0,1]. The feature weights are standardized by the mean and standard deviation to ensure that the weight distribution of each feature has a zero mean and a unit standard deviation. Through the above calculation and quantification process, the virus feature weight distribution data can be obtained.

[0094] Step S52: performing correlation analysis on the features based on the virus feature weight distribution data to generate virus feature correlation data;

[0095] The embodiment of the present invention proposes a feature correlation analysis method based on virus feature weight distribution data, which is used to evaluate the relationship strength and dependence between virus features. The linear relationship is analyzed by the Pearson correlation coefficient, and the strong positive correlation between file operation features is found; the nonlinear or non-normal distribution features are processed by the Spearman rank correlation coefficient; the amount of information shared between features is measured by mutual information to identify redundant features; the strength of the feature change relationship is revealed by the covariance matrix. The feature importance is calculated in combination with the machine learning model, the contribution of each feature to the prediction result is evaluated, and potential associations are mined. Based on the above method, a feature correlation matrix is ​​generated, and the correlation coefficient or information measurement of the feature pair is recorded. Highly correlated feature pairs are screened out according to a preset threshold. These feature pairs can reflect the virus behavior pattern, and virus feature correlation data is generated for virus behavior analysis and model optimization.

[0096] Step S53: reducing the dimension of the virus feature associated data to obtain reduced-dimensional virus feature data;

[0097] The embodiment of the present invention screens out important features with high correlation based on the importance evaluation index of each feature in the virus feature association data, removes redundant or low correlation features, and thus realizes dimensionality reduction. Using the principal component analysis algorithm, the virus feature association data is projected into a new feature space, and the principal component whose cumulative contribution rate reaches a preset threshold is selected as the feature data after dimensionality reduction by calculating the eigenvalue and eigenvector. For classification problems, a linear discriminant analysis method can be used to select a feature subset with distinguishability as dimensionality reduction data by maximizing inter-class differences and minimizing intra-class differences. For virus feature data with nonlinear associations, methods such as t-SNE or autoencoders can be used to generate a data set that can better retain the information of the original data feature association in a low-dimensional space. Cluster analysis is performed on the virus feature association data, and features with high similarity are classified into one category, and the class features are represented by calculating the class center or class representative features, and finally dimensionality reduction is realized. Finally, the virus feature data after dimensionality reduction is output to form simplified and optimized dimensionality reduction virus feature data.

[0098] Step S54: performing core feature selection on the dimension-reduced virus feature data based on preset user requirements to generate virus feature selection data;

[0099] The embodiment of the present invention determines the goal of core feature selection according to the actual needs of the user, such as improving the accuracy of virus detection, optimizing the detection speed, or adapting to specific hardware resources. The user needs are converted into specific feature selection criteria, such as feature correlation thresholds, contribution ranges, or feature quantity limits. Based on statistical methods: by calculating the influence of each feature on virus classification or behavior recognition, the features in the reduced-dimensional virus feature data are sorted, and the top-ranked features are selected as core features. Based on machine learning models: using algorithms such as support vector machines and random forests, the importance of features is evaluated, and features with greater contributions are selected according to user needs. Combined with the feature selection goals preset by the user, genetic algorithms, particle swarm optimization, and other methods are used to automatically search for the optimal feature subset. For complex user needs, a multi-objective optimization method can be used to generate a core feature set that meets the trade-off conditions. The initially selected core feature set is applied to the virus feature recognition task to evaluate its performance; if the recognition effect does not meet the user's needs, the feature selection strategy or parameters are adjusted and the core features are reselected. The core feature set is output as virus feature selection data.

[0100] Step S55: Structuring the virus feature selection data to generate virus feature recognition data.

[0101] The embodiment of the present invention proposes a method for generating virus feature recognition data based on core feature selection. By quantifying the importance of features, the most representative core features are selected from the virus feature data after dimensionality reduction to reflect the key patterns, sequences or events of virus behavior. The core features are structured and converted into a standardized table or database format, where each row represents a virus sample or behavior record, and each column represents a virus feature. Feature data is standardized by Z-score or Min-Max normalization to ensure dimensional consistency; classification data is processed using unique hot encoding or label encoding. External database or log file information is integrated to enhance the comprehensiveness of the data set, and stored in a table, database or JSON format for subsequent analysis. For classification tasks, virus category labels are annotated for each sample, and the annotation can be completed by manual or automatic classification. Finally, virus feature recognition data containing key features of virus behavior and category labels is generated to provide support for machine learning, statistical analysis and feature recognition.

[0102] The present invention quantifies the weights of virus behavior features, highlights the importance of core features, and optimizes resource utilization and analysis efficiency. The feature weight distribution shows the contribution of each feature to virus behavior, and discovers potential rules through correlation analysis to simplify redundant data. Dimensionality reduction processing reduces data dimensions, improves computing performance and storage requirements, while retaining core feature information. The screening of core features is customized according to user needs to ensure that the data has high discrimination and improve the accuracy of virus detection and classification. The feature recognition data after structured processing is suitable for a variety of analysis and storage tools, supporting system optimization and improvement.

[0103] Preferably, step S53 includes the following steps:

[0104] Step S531: performing feature correlation calculation on the virus feature association data to identify redundant features and generate a virus feature correlation matrix;

[0105] The embodiment of the present invention identifies redundant features by calculating the correlation between features. The correlation is calculated for all virus features and the results are stored in a matrix, usually called a correlation matrix. Each element in the matrix represents the correlation coefficient between feature i and feature j. By analyzing the correlation matrix, highly correlated feature pairs are identified. These feature pairs usually have high correlation coefficients, and these redundant features can be processed through subsequent dimensionality reduction steps. Finally, the virus feature correlation matrix is ​​output.

[0106] Step S532: using a dimensionality reduction algorithm to reduce the dimension of the virus feature association data based on the virus feature correlation matrix to obtain preliminary reduced-dimensional virus feature data;

[0107] In this step of the embodiment of the present invention, it is assumed that PCA is selected as the dimensionality reduction algorithm. The virus feature-related data is standardized to ensure that all features have an equal impact on the dimensionality reduction algorithm. Based on the standardized data, the covariance matrix between the features is calculated, which describes the relationship between the features. The covariance matrix is ​​eigenvalue decomposed to obtain eigenvalues ​​and eigenvectors. The larger the eigenvalue, the greater the contribution of the feature of the corresponding eigenvector to the variance of the data. The first k principal components (eigenvectors) are selected, which retain the main variance information of the data. The selection of k can be determined by the cumulative variance contribution rate, and the principal components with a variance contribution rate of more than 90% are usually selected. The data is projected using the selected principal components to obtain a low-dimensional feature representation. The data after dimensionality reduction is the preliminary dimensionality reduction virus feature data.

[0108] Step S533: Verify the accuracy of the preliminary dimensionality reduction virus feature data and generate dimensionality reduction effect evaluation data;

[0109] The embodiment of the present invention proposes a method for evaluating the effect of dimensionality reduction, which ensures the effectiveness of dimensionality reduction by verifying the information retention and classification performance of the dimensionality reduction data. If a reversible dimensionality reduction algorithm such as PCA is used, the original data is reconstructed by reverse mapping, and the reconstruction error is calculated to evaluate the degree of information loss. The smaller the error, the better the dimensionality reduction effect. For labeled data, the data after dimensionality reduction is used for classification or regression modeling, and the model performance is compared through indicators such as accuracy, recall rate, and F1 score to verify whether the main features of the data are retained. The distribution of the data after dimensionality reduction is analyzed through two-dimensional or three-dimensional visualization, and the clarity of the category division or structural features is observed to further evaluate the quality of dimensionality reduction. Combined with the reconstruction error and classification performance, dimensionality reduction effect evaluation data is generated to provide a basis for subsequent data processing and model application.

[0110] Step S534: adjusting the dimension reduction algorithm parameters according to the dimension reduction effect evaluation data to obtain optimized dimension reduction algorithm parameter data;

[0111] According to the embodiment of the present invention, if the data after dimensionality reduction is not ideal, such as too large reconstruction error, poor classification performance, or unclear data distribution in the visualization diagram, it indicates that the current dimensionality reduction algorithm parameters fail to fully retain the key information of the data. The evaluation data will reveal which features are lost more in the dimensionality reduction process, or which features are not fully utilized. According to the evaluation results of the dimensionality reduction effect, appropriate dimensionality reduction algorithm parameters are selected for adjustment. If the reconstruction error after dimensionality reduction is large, you can try to increase the dimension after dimensionality reduction to allow more information to be retained. On the contrary, if the data after dimensionality reduction still contains redundant information, the data can be further simplified and the noise can be reduced by reducing the dimension. For example, for the PCA algorithm, adjust the number of principal components; for the t-SNE algorithm, adjust parameters such as perplexity or learning rate to see if these changes can improve the separability and structural retention of the data. If a deep learning method such as an autoencoder is used, adjusting the network structure or training parameters can improve the dimensionality reduction effect. If the dimensionality reduction method currently used fails to obtain ideal results, other dimensionality reduction methods such as t-SNE, LLE, UMAP, etc. can be tried to select a dimensionality reduction technology suitable for the data characteristics. The parameter adjustment methods of various dimensionality reduction algorithms are different. Choose appropriate parameters according to the specific algorithm. Based on the above evaluation results and adjustment strategies, modify the parameters of the dimensionality reduction algorithm and re-execute the dimensionality reduction process. By adjusting the parameters, the expression of features can be optimized and information loss can be further reduced. After adjustment, the optimized dimensionality reduction algorithm parameter data is obtained.

[0112] Step S535: Optimize and reduce the dimension of the preliminary reduced-dimensionality virus feature data based on the optimized dimensionality reduction algorithm parameter data to obtain the final reduced-dimensionality virus feature data.

[0113] The embodiment of the present invention reprocesses the preliminary dimension reduction virus feature data according to the optimized dimension reduction algorithm parameter data. The process involves applying the algorithm parameters adjusted in step S534, such as increasing the dimension, optimizing the learning rate or adjusting other configurations of the dimension reduction algorithm, to optimize the dimension reduction effect of the data. According to the characteristics of the data and the dimension reduction target, select an appropriate algorithm. According to the optimized dimension reduction algorithm parameter data, adjust the parameters and apply the new dimension reduction algorithm configuration. At this stage, the dimension reduction algorithm is re-executed based on the optimized parameters to perform dimension reduction processing on the virus feature data. This processing can generate a feature representation with a lower dimension but retaining the main information of the data. Ensure that the data after dimension reduction can reduce the computational complexity at the same time, while avoiding over-simplification of the data, resulting in information loss. After optimizing the dimension reduction, the generated data is the virus feature data after dimension reduction, which has a lower dimension but effectively retains the key feature information. These data provide higher quality input for subsequent virus analysis. After completing the optimization dimension reduction, the final dimension reduction virus feature data is generated.

[0114] The present invention calculates the correlation of virus features, generates a feature correlation matrix, identifies redundant and strongly correlated features, and provides a basis for dimensionality reduction. Preliminary dimensionality reduction removes redundant features and retains important information, reduces data dimensions, improves model efficiency, and reduces the risk of overfitting. The data after dimensionality reduction is more streamlined and reliable, ensuring the adaptability of the model to new data. By evaluating the dimensionality reduction effect, the algorithm parameters are adjusted to optimize the dimensionality reduction process to ensure accuracy and stability. Finally, the key features are retained in the dimensionality reduction data set to provide high-quality input for subsequent feature selection and modeling, and improve overall processing efficiency and effect.

[0115] Preferably, step S6 comprises the following steps:

[0116] Step S61: Use a preset test sample to evaluate the effectiveness of the virus feature selection data to obtain a virus feature recognition effectiveness evaluation report;

[0117] The embodiment of the present invention uses evaluation methods related to virus detection, such as accuracy, recall, F1 value, feature discrimination, etc., and uses these evaluation criteria to measure the effectiveness of virus feature selection data in actual samples. Test whether the virus feature can correctly identify the virus sample and distinguish it from the non-virus sample. Ensure that the virus feature selection data can not only correctly identify the virus sample, but also avoid misidentifying the non-virus sample as a virus as much as possible. Use the receiving operating characteristic curve (ROC) and the area under the curve (AUC) to evaluate the discriminative ability of the feature. Input the preset test sample into the virus feature selection model, and use these virus feature data to process the test sample. Predict by model and compare the prediction result with the actual label, and calculate the relevant evaluation index. According to the output results of the model, evaluate the performance of the virus feature selection data in the actual test. This includes checking the classification accuracy of different virus samples and non-virus samples to ensure that the virus feature can effectively distinguish different types of virus and non-virus samples. If it is found during the evaluation process that a specific feature cannot effectively distinguish between virus and non-virus samples, it is necessary to further adjust the feature selection process or add new features. Based on the evaluation results, generate a virus feature recognition effectiveness evaluation report.

[0118] Step S62: using a virtual sandbox to perform stability testing on virus feature recognition data in various operating environments to obtain a virus feature recognition stability assessment report;

[0119] The embodiment of the present invention creates multiple virtual sandboxes with different configurations according to actual application scenarios. Each sandbox simulates a different operating environment, such as different versions of operating systems, different hardware resources, and different network conditions. Ensure that the simulated environment covers a variety of common operating scenarios to test the cross-platform and cross-environment stability of the virus feature recognition system. In each virtual sandbox, the selected and optimized virus feature recognition data is imported into the test environment to simulate the recognition process of virus behavior. Run the virus feature recognition data in the virtual sandbox to observe whether the system can correctly and stably identify virus features and whether the performance is consistent in each environment. During operation, the system processes various types of input data and attempts to detect the virus behavior patterns therein. For each test environment, record the key performance indicators in the virus feature recognition process, such as recognition speed, accuracy, stability, and resource consumption. Collect test data in each virtual sandbox environment and analyze the stability of virus feature recognition in different operating environments. Generate a virus feature recognition stability evaluation report based on the test results.

[0120] Step S63: Performing a threshold analysis on the weight of the virus feature based on the virus feature recognition effectiveness evaluation report and the virus feature recognition stability evaluation report, and generating a virus feature threshold configuration data report;

[0121] The embodiment of the present invention assigns weights to virus features based on the recognition accuracy data in the effectiveness evaluation report and the environmental adaptability analysis in the stability evaluation report. Through these evaluation data, the importance score of each virus feature is calculated. Based on the feature weight analysis, the "threshold" of each feature is determined. These thresholds are the recognition criteria for features, which can help the model determine whether the features have sufficient discrimination to continue to participate in virus identification. Only when the weight of the feature is higher than the set threshold will the feature be included in the decision-making process of virus identification. Based on the aforementioned weight and threshold analysis results, a virus feature threshold configuration data report is generated.

[0122] Step S64: Detect conflict anomalies in the virus feature recognition data based on the virus feature threshold configuration data report, mark the conflict anomalies, and obtain a virus feature conflict detection report;

[0123] The embodiment of the present invention determines whether there is a conflict between different features in the virus feature identification data by analyzing the feature weights and thresholds in the virus feature threshold configuration data report. For example, if the threshold settings of two features are too close, and their behaviors have similar effects on the results in virus feature identification, redundancy or misidentification will result, thereby affecting the identification effect. If feature A and feature B have similar effects on the determination of the virus type under the same conditions, and their threshold ranges overlap, then the two features conflict in the identification, resulting in inaccurate identification. At the same time, it is also necessary to pay attention to whether there are abnormal situations. For example, although some features have higher weights, these features behave abnormally due to environmental changes or some unforeseen factors. By comparing the thresholds of the features, abnormal data can be identified. The recognition accuracy of feature C in certain environments is much lower than expected because the data is incomplete or the test environment does not match the actual environment. For the identified conflicts or abnormal situations, they need to be marked in the virus feature identification data. This can be done by labeling each conflicting or abnormal feature and recording their specific problem sources. "Conflict Mark" and "Abnormal Mark" fields can be added to the data record to indicate whether there is a problem with each feature and record the cause of the conflict or abnormality in detail. According to the types of conflicts and anomalies, the feature data is classified, and the results of conflict and anomaly marking are organized into a virus feature conflict detection report.

[0124] Step S65: Verify and optimize the virus feature recognition data according to the virus feature recognition effectiveness evaluation report, the virus feature recognition stability evaluation report, the virus feature threshold configuration data report, and the virus feature conflict detection report to generate virus feature verification data;

[0125] The embodiment of the present invention provides a virus feature data verification and optimization method, which ensures the accuracy and practicality of the features through multi-dimensional evaluation of effectiveness, stability, threshold configuration and conflict detection. Based on the effectiveness evaluation, eliminate or replace features with outdated, invalid or redundant information; through stability evaluation, optimize features that behave abnormally in different environments to enhance consistency; verify threshold configuration data, adjust unreasonable feature weights and thresholds to avoid misjudgment or missed judgment; according to the conflict detection report, optimize or delete conflicting features to eliminate redundancy and labeling errors. By adjusting weights, thresholds, adding new features and other methods, the feature data set is comprehensively optimized to ensure that it efficiently and stably supports virus behavior identification. After the optimization is completed, virus feature verification data is generated to provide support for accurate and stable virus identification.

[0126] Step S66: construct a feature index based on the virus feature verification data, and synchronize the virus feature verification data and the feature index to the cloud virus feature database.

[0127] The embodiment of the present invention uses an efficient data structure to organize and index virus feature data. By assigning a unique identifier to each feature and generating an index structure based on the relationship between features, it is ensured that the required features can be quickly retrieved. According to the access frequency and query requirements of the features, the storage method of the feature index is optimized to ensure that the features used frequently can be indexed first, thereby improving the speed and efficiency of subsequent retrieval. The virus feature data and its index after index processing will be synchronized to the cloud virus feature database. By using efficient distributed database technology, such as NoSQL database or distributed file system, it is ensured that the virus feature data and index can be stored and accessed quickly and stably. The cloud database will adopt redundant backup and distributed storage to ensure the security, availability and scalability of the data. The synchronization of virus features includes not only the data itself, but also the index, metadata and related historical information of the features, so that multi-dimensional queries and analysis can be performed according to different requirements in the future. By building and optimizing the index, the query speed of virus feature data is improved.

[0128] The present invention evaluates the effectiveness and stability of virus feature selection data through preset test samples to ensure that the selected features can accurately reflect virus behavior and perform stably in diverse test scenarios. Optimize feature recognition data through stability testing to improve its adaptability to different virtual environments. Combined with effectiveness evaluation, threshold analysis is performed to optimize feature weight distribution, enhance the focus on key features, and improve detection accuracy and efficiency. Eliminate invalid features through conflict detection to ensure data consistency and improve the credibility of results. After verification and optimization, feature data is more targeted and model efficiency is improved. Optimize cloud database queries through feature indexing, reduce detection time, and support dynamic virus defense.

[0129] Preferably, the present invention further provides a virus feature data processing system for executing the virus feature data processing method as described above, the virus feature data processing system comprising:

[0130] A virtual sandbox initialization module is used to configure the virtual sandbox virtualization layer and initialize the operating environment, set monitoring parameters, verify environmental isolation and operating status, and generate virtual sandbox operating data;

[0131] The virus sample loading module is used to obtain virus sample data and load the virus sample data into the virtual sandbox to obtain sample initial state data; configure the virtual sandbox operation parameters according to the sample initial state data and the virtual sandbox operation state data, and deploy the monitoring probe to obtain virtual sandbox probe deployment data; establish a behavior collection channel based on the virtual sandbox probe deployment data, and build a behavior data collection model;

[0132] The behavior data monitoring module is used to monitor the dynamic behavior of the sample operation using the behavior data collection model, and pre-process and normalize the monitoring data to obtain virus standardized behavior data; perform time series correlation analysis on the virus standardized behavior data to obtain virus behavior link data;

[0133] The behavior feature modeling module is used to extract key behavior features from virus behavior link data to obtain virus feature description data; perform similarity calculation and cluster analysis on the virus feature description data, and build a virus behavior feature model based on the calculation and analysis results;

[0134] The feature optimization and identification module is used to calculate the feature weight distribution according to the virus behavior feature model, and perform correlation analysis on the calculation results to obtain virus feature correlation data; perform dimensionality reduction and feature selection on the virus feature correlation data, and generate virus feature identification data based on the selection results;

[0135] The feature verification and update module is used to evaluate the effectiveness and stability of virus feature identification data, perform threshold analysis and conflict monitoring on the evaluation results, and obtain virus feature verification data; the virus feature verification data is updated to the cloud virus feature database.

[0136] The present invention also provides a virus feature data processing device, comprising a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement any one of the virus feature data processing methods described above.

[0137] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is not limited by the above description, so it is intended to include all changes within the meaning and scope of the equivalent elements of the application documents in the present invention.

[0138] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A method for processing virus feature data, characterized in that: Applied to a virtual sandbox, the virtual sandbox includes a virtualization layer, an operating system layer, and a resource and security management layer; the method for processing virus feature data includes the following steps: Step S1: configure the virtual sandbox virtualization layer and initialize the operating environment, set monitoring parameters, verify the environment isolation and operating status, and generate virtual sandbox operating data; Step S2: Obtain virus sample data, and load the virus sample data into a virtual sandbox to obtain sample initial state data; configure virtual sandbox operation parameters according to sample initial state data and virtual sandbox operation state data, and deploy monitoring probes to obtain virtual sandbox probe deployment data; establish a behavior collection channel based on the virtual sandbox probe deployment data, and construct a behavior data collection model; Step S3: Use the behavior data collection model to monitor the dynamic behavior of the sample operation, and pre-process and normalize the monitoring data to obtain virus standardized behavior data; perform time series correlation analysis on the virus standardized behavior data to obtain virus behavior link data; Step S4: extract key behavior features from the virus behavior link data to obtain virus feature description data; perform similarity calculation and cluster analysis on the virus feature description data, and build a virus behavior feature model based on the calculation and analysis results; Step S5: Calculate the feature weight distribution according to the virus behavior feature model, and perform correlation analysis on the calculation results to obtain virus feature correlation data; perform dimensionality reduction processing and feature selection on the virus feature correlation data, and generate virus feature recognition data according to the selection results; Step S6: Evaluate the effectiveness and stability of the virus feature recognition data, perform threshold analysis and conflict monitoring on the evaluation results, and obtain virus feature verification data; update the virus feature verification data to the cloud virus feature database.

2. The method for processing virus feature data according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: configuring the system virtualization layer of the virtual sandbox, and defining the virtual sandbox hardware abstraction and resource allocation parameters to obtain basic operating environment data; Step S12: configuring the application virtualization layer of the virtual sandbox, and virtualizing the API interface, file system version and network environment to obtain application isolation environment data; Step S13: integrating the basic operating environment data and the application isolation environment data, and initializing the virtual sandbox operating environment based on the integrated data to construct a virtual sandbox, thereby obtaining virtual sandbox environment data; Step S14: configuring the monitoring parameters of the virtual sandbox based on the virtual sandbox environment data to obtain virtual sandbox monitoring configuration data; Step S15: verify the isolation of the virtual sandbox based on the monitoring parameter configuration data, detect information leakage and external interference risks, and generate virtual sandbox environment verification data by loading preset test samples to simulate environmental interference behavior; Step S16: verifying the operation performance parameters of the virtual sandbox according to the virtual sandbox environment verification data to obtain the virtual sandbox operation status data.

3. The method for processing virus feature data according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: Obtaining the original data of the virus sample, and performing integrity and availability verification to obtain the virus sample data; Step S22: Load the virus sample data into the virtual sandbox, and verify the loading status to obtain the sample initial status data; Step S23: adjusting the virtual sandbox operation parameters according to the sample initial state data and the virtual sandbox operation state data to obtain virtual sandbox operation parameter configuration data; Step S24: configuring and deploying the monitoring probe based on the virtual sandbox operation parameter configuration data to obtain virtual sandbox probe deployment data; Step S25: establishing a behavior data collection channel based on the virtual sandbox probe deployment data, collecting dynamic behavior data of a preset test sample through the behavior data collection channel, and obtaining behavior collection channel test data; Step S26: constructing a behavior data collection model using the behavior collection channel test data.

4. The method for processing virus feature data according to claim 1, characterized in that: Step S3 includes the following steps: Step S31: monitoring the dynamic behavior of the virus sample based on the behavior data collection model, and capturing the behavior data to obtain the original dynamic behavior data of the virus; Step S32: preprocessing and denoising the original dynamic behavior data of the virus to obtain preprocessed behavior data; Step S33: normalizing the preprocessed behavior data to obtain virus standardized behavior data; Step S34: performing correlation analysis on the virus standardized behavior data according to the time sequence of the behavior occurrence to identify the causal relationship and correlation between the virus behaviors, and constructing the behavior time series sequence to obtain the virus behavior time series correlation data; Step S35: construct a virus behavior link graph using the virus behavior time series correlation data, mark each behavior node and associated path in the graph, and identify key behavior nodes to obtain virus behavior link data.

5. The method for processing virus feature data according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: extract key behavior features from virus behavior link data to obtain virus feature description data; Step S42: performing similarity calculation on the virus feature description data to generate virus feature similarity data; Step S43: performing cluster analysis on virus samples based on virus feature similarity data to generate virus feature cluster data; Step S44: Modeling the virus behavior characteristics according to the virus feature description data, the virus feature similarity data and the virus feature clustering data to obtain a virus behavior feature model.

6. The method for processing virus feature data according to claim 1, characterized in that: Step S5 includes the following steps: Step S51: Analyze the importance of each behavior feature according to the virus behavior feature model, and quantify the feature weight to obtain virus feature weight distribution data; Step S52: performing correlation analysis on the features based on the virus feature weight distribution data to generate virus feature correlation data; Step S53: reducing the dimension of the virus feature associated data to obtain reduced-dimensional virus feature data; Step S54: performing core feature selection on the dimension-reduced virus feature data based on preset user requirements to generate virus feature selection data; Step S55: Structuring the virus feature selection data to generate virus feature recognition data.

7. The method for processing virus feature data according to claim 6, characterized in that: Step S53 includes the following steps: Step S531: performing feature correlation calculation on the virus feature association data to identify redundant features and generate a virus feature correlation matrix; Step S532: using a dimensionality reduction algorithm to reduce the dimension of the virus feature association data based on the virus feature correlation matrix to obtain preliminary reduced-dimensional virus feature data; Step S533: Verify the accuracy of the preliminary dimensionality reduction virus feature data and generate dimensionality reduction effect evaluation data; Step S534: adjusting the dimension reduction algorithm parameters according to the dimension reduction effect evaluation data to obtain optimized dimension reduction algorithm parameter data; Step S535: Optimize and reduce the dimension of the preliminary reduced-dimensionality virus feature data based on the optimized dimensionality reduction algorithm parameter data to obtain the final reduced-dimensionality virus feature data.

8. The method for processing virus feature data according to claim 1, characterized in that: Step S6 includes the following steps: Step S61: Use a preset test sample to evaluate the effectiveness of the virus feature selection data to obtain a virus feature recognition effectiveness evaluation report; Step S62: using a virtual sandbox to perform stability testing on virus feature recognition data in various operating environments to obtain a virus feature recognition stability assessment report; Step S63: Performing a threshold analysis on the weight of the virus feature based on the virus feature recognition effectiveness evaluation report and the virus feature recognition stability evaluation report, and generating a virus feature threshold configuration data report; Step S64: Detect conflict anomalies in the virus feature recognition data based on the virus feature threshold configuration data report, mark the conflict anomalies, and obtain a virus feature conflict detection report; Step S65: Verify and optimize the virus feature recognition data according to the virus feature recognition effectiveness evaluation report, the virus feature recognition stability evaluation report, the virus feature threshold configuration data report, and the virus feature conflict detection report to generate virus feature verification data; Step S66: construct a feature index based on the virus feature verification data, and synchronize the virus feature verification data and the feature index to the cloud virus feature database.

9. A virus feature data processing system, characterized in that: The system comprises: A virtual sandbox initialization module is used to configure the virtual sandbox virtualization layer and initialize the operating environment, set monitoring parameters, verify environmental isolation and operating status, and generate virtual sandbox operating data; The virus sample loading module is used to obtain virus sample data and load the virus sample data into the virtual sandbox to obtain sample initial state data; configure the virtual sandbox operation parameters according to the sample initial state data and the virtual sandbox operation state data, and deploy the monitoring probe to obtain virtual sandbox probe deployment data; establish a behavior collection channel based on the virtual sandbox probe deployment data, and build a behavior data collection model; The behavior data monitoring module is used to monitor the dynamic behavior of the sample operation using the behavior data collection model, and pre-process and normalize the monitoring data to obtain virus standardized behavior data; perform time series correlation analysis on the virus standardized behavior data to obtain virus behavior link data; The behavior feature modeling module is used to extract key behavior features from virus behavior link data to obtain virus feature description data; perform similarity calculation and cluster analysis on the virus feature description data, and build a virus behavior feature model based on the calculation and analysis results; The feature optimization and identification module is used to calculate the feature weight distribution according to the virus behavior feature model, and perform correlation analysis on the calculation results to obtain virus feature correlation data; perform dimensionality reduction and feature selection on the virus feature correlation data, and generate virus feature identification data based on the selection results; The feature verification and update module is used to evaluate the effectiveness and stability of virus feature identification data, perform threshold analysis and conflict monitoring on the evaluation results, and obtain virus feature verification data; the virus feature verification data is updated to the cloud virus feature database.

10. A device for processing virus characteristic data, characterized in that: It comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the method for processing virus feature data as claimed in any one of claims 1 to 8.

Images