Network hostile attack monitoring method and system based on deep neural model

Abstract

The invention discloses a network hostile attack monitoring method and system based on a deep neural model, and the method comprises the steps: receiving an unknown program code, and carrying out the feature matching of the unknown program code; if the known malicious program code features are matched, marking unknown program codes as high-risk program codes, and inputting the high-risk program codes into the first neural network model to obtain deep features; cyclically executing the high-risk program code to obtain a seed value of a hard code and a malicious behavior mode; if the malicious behavior mode is a DGA mode, determining a DGA domain name list according to the seed value; inputting the domain name list into a hybrid model to obtain local semantic information; mapping the deep feature, the malicious behavior pattern, the DGA domain name and the local semantic information into a network security knowledge graph to obtain an event graph; analyzing the event graph, determining a potential attack chain and a threat level, updating a circulation step and a graph reasoning step, dynamically loading to an execution unit, and displaying the potential attack chain and the threat level.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of program code monitoring, and in particular to a method and system for monitoring network malicious attacks based on a deep neural model. Background Art

[0002] With the rapid development of information technology and the widespread application of the Internet, network security issues have become increasingly prominent. Network attack methods have continued to evolve, from simple viruses and worms in the early days to today's advanced persistent threats (APTs), zero-day vulnerability exploits, and complex social engineering attacks. Attackers continue to innovate attack techniques, using advanced technologies such as artificial intelligence and machine learning to enhance the stealth and effectiveness of attacks. At the same time, with the popularization of emerging technologies such as cloud computing, the Internet of Things, and 5G, the attack surface continues to expand, providing attackers with more opportunities for intrusion, making network security defense face unprecedented challenges.

[0003] Traditional static detection methods mainly rely on predefined rules and feature libraries to identify known threats. In common static detection methods, security software maintains a feature code database of known malware and identifies malware by comparing the binary program code or hash value of the file. For example, a specific virus can have a unique byte sequence, and the security software will scan the file to find the byte sequence.

[0004] However, among the commonly used static detection methods mentioned above, static detection mainly relies on the characteristics of known threats and is often powerless against newly emerged, unlisted malware or attack patterns. Advanced attackers often use zero-day vulnerabilities or brand-new attack techniques that are difficult to be captured by static detection methods. Therefore, traditional static detection methods cannot effectively deal with new and advanced threats. Summary of the invention

[0005] The embodiments of the present application provide a method and system for monitoring network malicious attacks based on a deep neural model, which are used to effectively respond to new and advanced threats.

[0006] To achieve the above objectives, the embodiments of the present application adopt the following technical solutions:

[0007] In a first aspect, a network malicious attack monitoring method based on a deep neural model is provided, which is applied to a network malicious attack monitoring system. The network malicious attack monitoring system includes a server, and the server is deployed with a network security module. The network security module includes a first neural network model and an execution unit. The execution unit includes a loop step and a graph reasoning step. The method includes:

[0008] In response to receiving the unknown program code, performing feature matching on the unknown program code according to a preset malicious program code feature library to determine whether there is a known malicious program code feature;

[0009] In the case where there are known features of the malicious program code, marking the unknown program code as high-risk program code, and inputting the high-risk program code into the first neural network model to obtain deep features, wherein the first neural network model is obtained based on the fusion of a convolutional neural network and a recurrent neural network;

[0010] The high-risk program code is loaded into a preset security sandbox environment, and the high-risk program code is cyclically executed using a loop step to obtain a hard-coded seed value in the high-risk program code and a malicious behavior pattern of the high-risk program code;

[0011] In a case where the malicious behavior mode is a DGA mode, determining a DGA domain name list according to the hard-coded seed value;

[0012] Input the DGA domain name list into a pre-trained hybrid model to obtain a character-level graph structure, wherein the hybrid model is obtained by fusing a graph convolutional network with an attention mechanism, and the character-level graph structure is used to determine local semantic information in the DGA domain name;

[0013] Mapping the deep features, the malicious behavior patterns, the DGA domain names, and the local semantic information into a pre-built network security knowledge graph to obtain an event graph;

[0014] The event graph is analyzed by using the graph reasoning step to determine a potential attack chain and a threat level, and the loop step and the graph reasoning step are updated according to the potential attack chain and the threat level to obtain an updated loop step and an updated graph reasoning step;

[0015] The updated loop steps and the updated graph reasoning steps are dynamically loaded into the execution unit, and the potential attack chain and the threat level are displayed.

[0016] In a possible implementation of the first aspect, the looping step includes:

[0017] Obtaining initial input parameters and initial environment variables for executing the high-risk program code;

[0018] Inserting a monitoring instruction and a tracing instruction at each branch point of the high-risk program code execution, and executing the high-risk program code according to the initial input parameters and the initial environment variables, so as to capture all program code behaviors of the high-risk program code through the monitoring instruction, and capture the execution path of the high-risk program code through the tracing instruction;

[0019] When executing the high-risk program code, identifying all the program code behaviors of the high-risk program code to determine the behavior pattern of the high-risk program code;

[0020] Determining the execution logic of the high-risk program code when executing according to the execution path;

[0021] Using a preset memory forensics tool to obtain a memory snapshot of the high-risk program code at a preset time;

[0022] Analyze the memory snapshot and the execution logic to obtain hard codes in the high-risk program code and a seed value corresponding to the hard codes;

[0023] Performing fuzzy matching on the behavior pattern in a preset malicious behavior feature library, determining a malicious behavior pattern in the behavior pattern, wherein the malicious behavior feature library stores malicious behavior sequences;

[0024] A preset random number generator is used to randomly generate new input parameters and new environment variables, and the new input parameters are used as initial input parameters for the next execution of the high-risk program code, and the new environment variables are used as initial environment variables for the next execution of the high-risk program code.

[0025] In another possible implementation of the first aspect, the network security module further includes a second neural network model, and the identifying the program code behavior of the high-risk program code and determining the behavior pattern of the high-risk program code includes:

[0026] Determining, according to the program code behavior of the high-risk program code, a time sequence relationship and a behavior frequency of all the program code behaviors of the high-risk program code;

[0027] The initial input parameters, the initial environment variables, the timing relationship and the behavior frequency are input into the second neural network model to obtain the behavior pattern of the high-risk program code.

[0028] In another possible implementation of the first aspect, fuzzy matching the behavior pattern in a preset malicious behavior feature library and determining the malicious behavior pattern in the behavior pattern includes:

[0029] For any one of the behavior patterns, a behavior sequence diagram is created according to the behavior pattern, and a key API call sequence is extracted from the behavior sequence diagram, wherein the key API call sequence includes at least two sequence segments;

[0030] According to the key API call sequence, using a preset sequence comparison algorithm, determining whether there is a malicious behavior sequence matching at least two of the sequence segments in the malicious behavior feature library;

[0031] In the case where there is a malicious behavior sequence that matches at least two of the sequence segments, at least two of the sequence segments are used as target sequence segments, and the position, execution frequency, context relevance, and resource access level of the target sequence segment in the behavior sequence diagram are determined, wherein the position is used to characterize the program code execution stage where the target sequence segment is located, the execution frequency is used to characterize the frequency of execution of the target sequence in the high-risk program code, the context relevance is used to characterize the before-after relevance of the target sequence segment in the high-risk program code, and the resource access level is used to characterize the permission operation level of the target sequence segment in the high-risk program code;

[0032] Using a preset scoring rule, determine a first score for the location, a second score for the execution frequency, a third score for the context relevance, and a fourth score for the resource access level;

[0033] When the sum of the first score, the second score, the third score and the fourth score is greater than a preset threshold, the behavior pattern is determined to be a malicious behavior pattern.

[0034] In another possible implementation of the first aspect, the analyzing the memory snapshot and the execution logic to obtain the hard code in the high-risk program code and the seed value corresponding to the hard code includes:

[0035] Determining whether a preset character string exists in the memory snapshot;

[0036] In the case where the character string exists, determining that the hard code in the high-risk program code is the character string;

[0037] In the absence of the character string, using a preset disassembly tool to analyze the execution logic of the high-risk program code to obtain a disassembled program code;

[0038] Determine the hard codes in the high-risk program code according to the disassembled program code, and determine a random number generation calling function and / or an encryption calling function in the hard codes;

[0039] Acquire function parameters of the random number generation calling function and / or the encryption calling function, and determine that the function parameters are seed values ​​corresponding to the hard code.

[0040] In another possible implementation manner of the first aspect, when the malicious behavior mode is a DGA mode, determining a DGA domain name list according to the hard-coded seed value includes:

[0041] In the case where the malicious behavior mode is a DGA mode, the DGA process of the high-risk program code is simulated according to the hard-coded seed value to obtain a DGA domain name list, wherein the DGA domain name list includes at least one high-risk domain name.

[0042] In another possible implementation manner of the first aspect, the event graph includes nodes and edges, the nodes are used to represent threat entities, the edges are used to represent relationships between the threat entities, and the graph reasoning step includes:

[0043] Using a preset graph traversal algorithm to traverse the event graph and determine the association relationship between any two nodes;

[0044] Among all the association relationships, determine a node sequence with a time sequence relationship, and form a potential attack chain with the node sequence;

[0045] An APT threat probability of the potential attack chain is determined, and a threat level of the potential attack chain is determined according to the APT threat probability.

[0046] In another possible implementation of the first aspect, determining the APT threat probability of the potential attack chain, and determining the threat level of the potential attack chain according to the APT threat probability, includes:

[0047] Extracting features of the potential attack chain to obtain attack chain features;

[0048] Building an attacker profile according to the attack chain characteristics, the attacker profile including attack time pattern, attack language characteristics and attack intensity;

[0049] Mapping the attack time pattern and the attack language feature to a preset APT feature library to determine the APT threat probability;

[0050] The threat level of the potential attack chain is determined according to the APT threat probability and the attack intensity.

[0051] In another possible implementation of the first aspect, determining the threat level of the potential attack chain according to the APT threat probability and the attack intensity includes:

[0052] Determine the target quadrant of a preset two-dimensional scoring matrix where the APT threat probability and the attack intensity are located, wherein the horizontal axis of the two-dimensional scoring matrix is ​​the APT threat probability, the vertical axis is the attack intensity, and the horizontal axis and the vertical axis of the two-dimensional scoring matrix divide the two-dimensional scoring matrix into a first quadrant, a second quadrant, a third quadrant, and a fourth quadrant, the threat level corresponding to the first quadrant is low, the threat level corresponding to the second quadrant is medium, the threat level corresponding to the third quadrant is high, and the threat level corresponding to the fourth quadrant is severe;

[0053] According to the target quadrant, a threat level of the potential attack chain is determined.

[0054] In a second aspect, the present application provides a network malicious attack monitoring system, comprising:

[0055] a memory configured to store instructions; and

[0056] The server is configured to call the instructions from the memory and implement the above-mentioned network malicious attack monitoring method based on the deep neural model when executing the instructions.

[0057] Through the above technical solutions, firstly, on the basis of traditional static detection, deep learning technology is introduced. Through the first neural network model (integrating convolutional neural network and recurrent neural network), deep feature extraction of high-risk program code is performed, which greatly enhances the system's ability to identify unknown threats and makes up for the defect that traditional static detection is powerless against emerging malware or attack patterns. Secondly, by adopting a secure sandbox environment and a loop execution step, the behavior of high-risk program code can be dynamically analyzed to capture complex attack techniques and behavior patterns that are difficult to find in static analysis. Through character-level graph structure analysis using a pre-trained hybrid model (based on graph convolutional network and attention mechanism), malicious communication attempts using dynamically generated domain names can be effectively identified and defended. By mapping deep features, malicious behavior patterns, DGA domain names, and local semantic information into a pre-built network security knowledge graph to form an event graph, and analyzing it through a graph reasoning step, it is not only possible to identify a single attack behavior, but also to reveal potential attack chains, thereby providing comprehensive insights into complex multi-stage attacks. In addition, the loop steps and graph reasoning steps are dynamically updated according to the analysis results, achieving adaptive learning and continuous optimization, making it possible to continuously adapt to new attack methods, effectively solving the problem of lagging updates in traditional static detection methods. By combining deep learning technology, it can effectively fight against attackers who use advanced technologies such as artificial intelligence and machine learning, while also adapting to the expansion of attack surfaces brought about by emerging technologies such as cloud computing, the Internet of Things, and 5G. In summary, it effectively solves the limitations of traditional static detection methods and can effectively respond to new and advanced threats compared to traditional static detection methods.

[0058] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A flowchart of a network malicious attack monitoring method based on a deep neural model provided in an embodiment of the present application;

[0060] Figure 2 A schematic diagram of the structure of a network malicious attack monitoring system provided in an embodiment of the present application;

[0061] Figure 3 A schematic diagram of a flow chart of a cycle step provided in an embodiment of the present application;

[0062] Figure 4 A flowchart of a graph reasoning step provided in an embodiment of the present application;

[0063] Figure 5 A simplified schematic diagram of an instruction sequence provided in an embodiment of the present application;

[0064] Figure 6 A pseudo code schematic diagram of using an updated network security module provided in an embodiment of the present application;

[0065] Figure 7 A schematic diagram of a two-dimensional scoring matrix provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0067] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back...), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0068] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0069] Figure 1 The flowchart of a method for monitoring malicious network attacks based on a deep neural model according to an embodiment of the present application is schematically shown. Figure 1 As shown, the embodiment of the present application provides a network malicious attack monitoring method based on a deep neural model, which is applied to Figure 2 The network malicious attack monitoring system shown in the figure includes a server, and the server is deployed with a network security module. The network security module includes a first neural network model and an execution unit. The execution unit includes a loop step and a graph reasoning step. The method may include the following steps.

[0070] S110, in response to receiving the unknown program code, performing feature matching on the unknown program code according to a preset malicious program code feature library to determine whether there is a known malicious program code feature;

[0071] S120. In the case where there are known malicious program code features, the unknown program code is marked as a high-risk program code, and the high-risk program code is input into a first neural network model to obtain deep features, wherein the first neural network model is obtained based on the fusion of a convolutional neural network and a recurrent neural network;

[0072] S130, loading the high-risk program code into a preset security sandbox environment, and executing the high-risk program code in a loop step to obtain a hard-coded seed value in the high-risk program code and a malicious behavior pattern of the high-risk program code;

[0073] S140, when the malicious behavior mode is a DGA mode, determining a DGA domain name list according to a hard-coded seed value;

[0074] S150, inputting the DGA domain name list into a pre-trained hybrid model to obtain a character-level graph structure, where the hybrid model is obtained based on the fusion of a graph convolutional network and an attention mechanism, and the character-level graph structure is used to determine local semantic information in the DGA domain name;

[0075] S160, mapping deep features, malicious behavior patterns, DGA domain names, and local semantic information to a pre-built network security knowledge graph to obtain an event graph;

[0076] S170, using a graph reasoning step to analyze the event graph, determine a potential attack chain and a threat level, and update a loop step and a graph reasoning step according to the potential attack chain and the threat level to obtain an updated loop step and an updated graph reasoning step;

[0077] S180, dynamically load the updated loop steps and the updated graph reasoning steps into the execution unit, and display the potential attack chain and threat level.

[0078] In this embodiment, a known malicious program code feature library is used to perform preliminary screening of unknown program codes. The malicious program code feature library stores a feature set of known malicious program codes. The feature set may include hash values, byte sequences, API call patterns, file structure features, etc. of the known malicious program codes.

[0079] In the specific implementation, first, the hash value of the unknown program code is calculated and compared with the hash value of the known malicious program code in the malicious program code feature library. If the comparison is successful, the unknown program code is marked as high-risk program code. If the hash value comparison fails, other features are compared, such as byte sequence, API call mode, file structure features, etc.

[0080] For example, you can check whether the unknown program code contains known malicious function names, suspicious API call combinations (such as the simultaneous appearance of file operations and network communication functions), or specific encryption algorithm usage patterns. In addition, you can also analyze the overall structure of the unknown program code, such as whether there are a large number of obfuscated or encrypted program code segments. If there are a large number of obfuscated or encrypted program code segments, it indicates that the unknown program code is the program code used by malware to evade detection.

[0081] In order to further detect unknown program codes, the high-risk program codes that have been initially marked are input into the first deep learning model to extract deeper features. The first neural network model combines convolutional neural networks (CNN) and recurrent neural networks (RNN), which can capture the spatial and temporal features of program codes at the same time.

[0082] Specifically, CNN is mainly used to extract local features and patterns of program code. It can identify feature patterns of various lengths, such as specific instruction sequences or API call combinations, by sliding convolution kernels of different sizes on the program code sequence. Local features are used to identify common patterns in malicious program code. Since malicious behavior is often reflected in the overall execution sequence of program code, not just local features, RNN can be a long short-term memory network (LSTM) to capture long-term dependencies and timing features in program code, which helps to understand the execution process and context of program code. For example, CNN can identify feature fragments in high-risk program code, such as the use of encryption functions, and RNN can capture the call order and frequency of the above encryption functions during the entire program code execution process. Through the processing of the multi-layer neural network of the first deep learning model, a high-dimensional vector can be output in the end, which is called a deep feature. The deep feature contains the essential characteristics of the high-risk program code, which can include the structural information, behavior patterns, potential purposes, etc. of the high-risk program code.

[0083] In a specific implementation, the program code can first be converted into a format suitable for neural network processing, for example, the program code instructions or API call sequences are converted into numerical vectors. Then, the numerical vectors pass through the CNN layer and the RNN layer in sequence. The CNN layer includes multiple convolutional layers and pooling layers to extract local features of different scales. The RNN layer is used to process the sequence of local features and generate a representation that can reflect the characteristics of the entire program code sequence. Finally, through the fully connected layer, the final deep feature representation is generated.

[0084] Specifically, the high-risk program code is first converted into an embedding vector, each of which represents an instruction or API call. The embedding vector sequence passes through multiple 1D convolutional layers, each of which uses convolution kernels of different sizes to capture patterns of different lengths. The output of the convolutional layer is fed into the LSTM layer, which processes the entire embedding vector sequence and outputs a fixed-length vector that contains the global features of the high-risk program code. Finally, the vector passes through a fully connected layer to further extract and combine features, ultimately outputting a high-dimensional deep feature vector.

[0085] In order to facilitate further monitoring of high-risk program codes, suspicious program codes are executed in a controlled virtual environment (i.e., a secure sandbox environment) to observe their actual behavior without causing harm to the real system. The secure sandbox environment is used to provide an isolated environment and simulate the resources and interfaces of the real system, while strictly controlling the execution permissions of program codes and access to external resources.

[0086] In a secure sandbox environment, high-risk program code (hereinafter referred to as program code) is repeatedly executed using loop steps. Each time it is executed, different input parameters and environment variables are randomly generated to trigger different execution paths of the program code. During the execution process, all behaviors of the program code can be monitored, including system calls, network connection attempts, file system operations, etc. At the same time, tracking instructions can be inserted at key points in the program code to record the execution path of the program code. Combining the above data, the behavior pattern of the program code can be identified. For example, if the program code frequently attempts to access a specific network address or modify a specific system file, the above behavior will be recorded. In addition, memory forensics tools can be used to obtain memory snapshots at different times when the program code is executed. By analyzing this memory snapshot and the execution logic of the program code, hard-coded information and related seed values ​​in the program code can be extracted. The seed value can be used to generate dynamic domain names or encrypt communications.

[0087] The purpose of the execution loop is to trigger all possible execution paths in the program code, including malicious functions that may be activated only under certain conditions.

[0088] In the specific implementation, dynamic binary instrumentation technology can be used. First, load the high-risk program code in a secure sandbox environment, and then use the instrumentation tool to insert monitoring instructions at key points in the program code. The monitoring instructions can record the execution path, memory access mode, system call, network communication and other behaviors of the program code.

[0089] During the loop execution, different execution paths can be triggered by changing input parameters, system time, network status and other environmental variables. For example, different system dates can be simulated to trigger the time trigger mechanism; different types of files can be provided as input to observe how the program code handles different data; different network connection states can also be simulated to see whether the program code will attempt to conduct malicious communications.

[0090] During execution, you need to pay attention to hard-coded values ​​in the program code, which can be used to generate domain names or seeds for encrypted communications. At the same time, record all suspicious behavior patterns, such as attempts to modify key system files, establish abnormal network connections, and perform unauthorized system operations.

[0091] The hard-coded seed value can be used to predict the dynamic domain name that the program code can generate. The subject of the malicious behavior pattern can be ransomware, backdoor program code, botnet client, etc.

[0092] Based on the hard-coded seed value extracted from the high-risk program code, the running process of the domain generation algorithm (DGA) is simulated to predict the list of domain names that can be used for malicious communications. DGA is a common technique used to evade static blacklist detection. It dynamically generates a large number of domain names through an algorithm, making the traditional defense method based on a fixed domain name blacklist ineffective. Usually, the DGA algorithm uses some input parameters (such as the current date, random seeds, etc.) to generate a series of domain names that appear random but are actually deterministic.

[0093] The DGA algorithm in the malicious program code can be analyzed through reverse engineering, and then the algorithm can be re-implemented in a safe environment. The specific process may include: 1. Analyze the extracted seed value. The seed value can be a fixed value or a value derived based on system parameters (such as the current date). 2. Determine the algorithm type. The DGA algorithm can be based on mathematical operations, hash functions, or encryption algorithms. 3. Identify other input parameters, such as timestamps, specific string constants, etc. 4. Implement the identified DGA algorithm. 5. Use the extracted seed value to run the identified DGA algorithm to generate a domain name list.

[0094] For example, a DGA could use the following logic: Use the current date and a hard-coded seed value as input. Combine the values ​​and pass them through a hash function (such as SHA-256). Convert the hash result into a series of characters that will be used as part of a domain name. Add a predefined top-level domain (such as .com, .net, etc.).

[0095] In this way, a list of potential malicious domain names can be generated, such as: -a1b2c3d4e5.com, -f6g7h8i9j0.net, -k1l2m3n4o5.org, etc.

[0096] Afterwards, the generated DGA domain name list is deeply analyzed using a pre-trained hybrid model to extract more fine-grained feature information. The hybrid model combines a graph convolutional network (GCN) and an attention mechanism to effectively capture character-level semantic information and structural features in domain names.

[0097] The use of graph convolutional networks allows the model to consider the relationship and overall structure between characters in a domain name, rather than just analyzing each character individually. The attention mechanism enables the model to focus on the most important or characteristic parts of the domain name, improving the accuracy of the analysis.

[0098] One way to implement this step may include domain name preprocessing, graph structure construction, node feature encoding, graph convolution operation, attention mechanism application, feature aggregation, and outputting local semantic information.

[0099] Specifically, domain name preprocessing includes: converting each domain name into a character sequence; creating a node for each character to form an initial graph structure. Graph structure construction includes: establishing edges between adjacent characters based on the positional relationship of the characters; adding additional edges, such as connecting all vowels, or connecting repeated characters. Node feature encoding includes: creating an initial feature vector for each character node, which may include information such as ASCII value, character type (such as vowel / consonant), and position in the domain name. Graph convolution operation includes: using a multi-layer graph convolution network to process the constructed graph structure; each layer of GCN updates the features of the node and integrates the information of neighboring nodes. 5. Attention mechanism application includes: applying the attention mechanism on the output of GCN to assign different importance weights to different nodes or features, which helps the model identify the most critical part for judging the nature of the domain name. Feature aggregation includes: aggregating the node features after attention weighting to generate a representation vector for the entire domain name. Outputting local semantic information includes: extracting local semantic information of the domain name based on the aggregated features, such as the possible language origin, structural complexity, degree of randomness, etc.

[0100] For example, for the domain name "a1b2c3d4e5.com", the model will pay special attention to the alternating pattern of numbers and letters, recognizing that this structure is not a legitimate domain name. For "malwarehub.net", the model will notice the word "malware" indicating that this is a domain related to malware.

[0101] In actual implementation, the model first preprocesses the input domain name, including character encoding and graph structure construction. Then, the GCN layer performs multi-level feature extraction on the graph structure, and each layer can capture higher-level character combination features. The attention layer dynamically adjusts the attention to different character positions according to the importance of the current task. The combination of these two mechanisms enables the model to consider both local structure and global association at the same time, greatly improving the ability to recognize DGA domain name features.

[0102] The character-level graph structure output by the model is actually a multidimensional tensor that contains the semantic information of each character position. This information not only reflects the characteristics of a single character, but also includes the contextual relationship of the character in the entire domain name. By analyzing this graph structure, specific semantic patterns in DGA domain names can be identified, such as repeated character combinations, uncommon character sequences, etc., which are key features for distinguishing DGA domain names from legitimate domain names. This can adapt to various types of DGA algorithms, including those that use complex character combinations or changing rules. At the same time, because the model is pre-trained on a large number of known DGA and legitimate domain names, it has strong generalization capabilities and can recognize DGA patterns that have not been seen before.

[0103] Map deep features, malicious behavior patterns, DGA domain names and local semantic information into a pre-built network security knowledge graph. In other words, unify multi-source heterogeneous security-related information into a structured knowledge representation framework to form a comprehensive event graph.

[0104] First, the pre-built cybersecurity knowledge graph is a structured database containing a large amount of knowledge in the field of cybersecurity. It usually includes various entities (such as IP addresses, domain names, vulnerabilities, attack techniques, etc.) and the relationships between these entities (such as utilization, belonging, association, etc.). The knowledge graph is built based on a large number of historical security events, expert knowledge, and public threat intelligence.

[0105] In the mapping process, various input information must first be converted into entities and relationships in the knowledge graph. For example, deep features correspond to certain specific attack techniques or tools, malicious behavior patterns are mapped to known attack patterns or tactics, and DGA domain names are directly added to the graph as domain name entities. Local semantic information is used to enrich the attributes of domain name entities or establish associations between domain names.

[0106] The specific mapping methods can be: 1. Entity matching: Use string matching, fuzzy matching and other technologies to match the input information with the existing entities in the knowledge graph. 2. Relationship inference: Infer the relationship between the newly added entity and the existing entity based on rules or machine learning models. 3. Attribute filling: Fill in deep features and local semantic information as the attributes of the entity to enrich the description of the entity. 4. Subgraph construction: Build a local subgraph around the core entity (such as the detected DGA domain name), containing related entities and relationships.

[0107] The result of this process is an event graph, which is a dynamic extension of the original knowledge graph and contains all relevant information about the current security incident. The event graph includes not only the specific threat indicators detected (such as DGA domain names), but also the broader contextual information such as attack techniques, attackers, and victims that these indicators can be associated with.

[0108] The event graph is analyzed using a graph reasoning step, aiming to extract valuable security insights from the constructed knowledge structure. The core of graph reasoning is to discover hidden patterns and relationships on the graph structure. In this embodiment, the following operations can be performed: 1. Path analysis: Find paths in the graph that connect known malicious entities (such as DGA domain names) and potential targets (such as important assets). These paths can represent potential attack chains. 2. Pattern matching: Compare known attack patterns (stored in the knowledge graph) with the current event graph to identify similar attack behaviors. 3. Centrality analysis: Calculate the centrality indicators (such as degree centrality, etc.) of each node in the graph and identify key nodes, which can be key links or important targets of the attack. 4. Anomaly detection: Use a graph anomaly detection algorithm to identify abnormal patterns in the graph structure, which can indicate new or unknown attack techniques.

[0109] An attack chain usually includes initial access, lateral movement, and privilege escalation, and each stage can correspond to a series of nodes and edges in the graph. At the same time, the threat level of each identified attack chain is evaluated, and factors to be considered may include: the integrity of the attack chain, that is, whether it contains the complete path from the initial entry to the final target; the severity of the potential impact, such as the importance of the assets that can be attacked. The threat level is classified into four levels: severe, high, medium, and low.

[0110] Finally, based on the analysis results, the loop steps and graph reasoning steps are updated. Specifically, they include: adjusting the weights of feature extraction to focus more on features related to high-threat attack chains. Optimizing graph construction strategies to increase attention to specific types of relationships. Updating the parameters of the graph reasoning algorithm to increase sensitivity to newly discovered attack patterns. Expanding the knowledge graph to include newly identified attack patterns and relationships. This dynamic update mechanism enables the system to continuously adapt to new threat environments and improve the ability to detect and analyze similar attacks in the future.

[0111] The updated loop steps and graph reasoning steps are dynamically loaded into the execution unit, and the potential attack chain and threat level are displayed. Specifically, the execution unit is a modular software system that can flexibly receive and execute different analysis modules. This dynamic loading mechanism allows the system to update its analysis capabilities in real time without interrupting the current operation. The updated loop steps can include optimized feature extraction algorithms, improved DGA detection models, etc. to improve the ability to identify new or variant DGAs.

[0112] The visualization interface for displaying potential attack chains and threat levels includes: 1. Using directed graphs or tree structures to represent the various stages of an attack and the relationships between them. 2. Highlighting key nodes, using different colors, sizes, or shapes to identify key links in the attack chain. 3. Displaying threat levels, using color coding or numerical labels to visually represent the threat level of each attack chain or node. 4. Allowing in-depth viewing of detailed information on a specific node, or dynamically adjusting the amount of information displayed. 5. Timeline display. If the attack chain involves a time series, a timeline view can be displayed to show the evolution of the attack.

[0113] Suppose a potential attack chain is identified: 1. Initial infection: implanting malicious code through phishing emails; 2. Privilege escalation: exploiting system vulnerabilities to obtain administrator privileges; 3. Lateral movement: scanning and infecting other devices in the intranet; 4. Data theft: collecting sensitive information and encrypting it; 5. External communication: trying to connect to the C&C server to send data; the threat level is assessed as high.

[0114] Based on the attack chain and threat level, the loop steps and graph reasoning steps are updated. The updated loop steps are: 1. Increase the scanning frequency and depth of email attachments and links; 2. Focus on monitoring system calls related to privilege escalation during code execution; 3. Increase the detection sensitivity of intranet scanning behavior; 4. More stringent monitoring of file encryption operations; 5. Increase the detection of suspicious external communication. The updated graph reasoning steps: 1. Strengthen the association between phishing attacks, privilege escalation vulnerabilities, and lateral movement technologies in the knowledge graph; 2. Adjust the graph analysis algorithm to improve the recognition ability of multi-stage attack chains; 3. Increase the reasoning weight of the combination of data encryption and external connection behavior; 4. Expand the graph structure to include more feature information about the C&C server; 5. Optimize the reasoning logic to identify similar attack patterns more quickly.

[0115] in, Figure 6 A pseudo code using an updated network security module provided in an embodiment of the present application is shown, referring to Figure 6, indicating that a possible attack sequence has been identified, starting with phishing emails, passing through privilege escalation and data theft, and finally attempting outbound communication. The threat level is assessed as high. The update_steps method of the security module is called to update the system's loop steps and graph reasoning steps based on the detected attack chain and threat level. This includes adjusting the monitoring frequency, updating the behavior patterns to focus on, and adjusting the knowledge graph and reasoning depth. Simulate the situation of encountering suspicious code. The loop step analyzes this suspicious code based on the previously updated monitoring frequency and behavior patterns. Check whether there are behavior patterns related to "privilege escalation" and "data theft" in the code, and simulate the process of reasoning based on the knowledge graph. Given "phishing email" as the starting point, predict possible subsequent attack steps. Generate a potential attack path based on the previously updated knowledge graph and reasoning depth. Figure 6 It shows how to dynamically adjust its behavior based on detected threats, and then apply these updates to analyze suspicious code and predict possible attack paths. This allows for adaptive adaptation based on the current threat landscape, improving defenses against emerging or ongoing attacks.

[0116] This embodiment first introduces deep learning technology on the basis of traditional static detection, and extracts deep features of high-risk program codes through the first neural network model (fusion of convolutional neural network and recurrent neural network), which greatly enhances the system's ability to identify unknown threats and makes up for the defect that traditional static detection is powerless against emerging malware or attack patterns. Secondly, by using a secure sandbox environment and a loop execution step, the behavior of high-risk program codes can be dynamically analyzed to capture complex attack techniques and behavior patterns that are difficult to find in static analysis. Character-level graph structure analysis is performed through a pre-trained hybrid model (based on graph convolutional network and attention mechanism), which can effectively identify and defend against malicious communication attempts using dynamically generated domain names. By mapping deep features, malicious behavior patterns, DGA domain names, and local semantic information to a pre-built network security knowledge graph, an event graph is formed, and analyzed through a graph reasoning step, not only a single attack behavior can be identified, but also potential attack chains can be revealed, thereby providing comprehensive insights into complex multi-stage attacks. In addition, the loop steps and graph reasoning steps are dynamically updated according to the analysis results, and adaptive learning and continuous optimization are achieved, so that new attack methods can be continuously adapted, effectively solving the problem of delayed updates of traditional static detection methods. By combining deep learning technology, it can effectively fight against attackers who use advanced technologies such as artificial intelligence and machine learning, and can also adapt to the expansion of attack surfaces brought about by emerging technologies such as cloud computing, the Internet of Things, and 5G. In summary, it effectively solves the limitations of traditional static detection methods and can effectively deal with new and advanced threats compared to traditional static detection methods.

[0117] Reference Figure 3 In one implementation of this embodiment, the loop step includes:

[0118] S210, obtaining initial input parameters and initial environment variables for executing high-risk program codes;

[0119] S220, inserting monitoring instructions and tracing instructions at each branch point of the high-risk program code execution, and executing the high-risk program code according to the initial input parameters and the initial environment variables, so as to capture the program code behavior of the high-risk program code through the monitoring instructions, and capture the execution path of the high-risk program code through the tracing instructions, wherein the program code behavior includes system calls, network connection attempts, file system operations, memory access modes and / or API call sequences;

[0120] S230, when executing the high-risk program code, identifying the program code behavior of the high-risk program code and determining the behavior pattern of the high-risk program code;

[0121] S240, determining the execution logic of the high-risk program code when executing according to the execution path;

[0122] S250, using a preset memory forensics tool to determine a memory snapshot of the high-risk program code;

[0123] S260, analyzing the memory snapshot and the execution logic to obtain hard codes in the high-risk program code and seed values ​​corresponding to the hard codes;

[0124] S270, fuzzy matching the behavior pattern in a preset malicious behavior feature library to determine the malicious behavior pattern;

[0125] S280. Use a preset random number generator to randomly generate new input parameters and new environment variables, use the new input parameters as initial input parameters for the next execution of the high-risk program code, and use the new environment variables as initial environment variables for the next execution of the high-risk program code.

[0126] Initial input parameters may include command line parameters, function call parameters, or other data input required when the program code is running. For example, for a file processing program code, the input parameters may include the file path to be processed, the processing mode (such as read, write, append), etc. These parameters directly affect the execution flow and behavior of the program code.

[0127] Initial environment variables include operating system type, version number, system time, network configuration, etc., which are used to provide background information for program code execution and can affect the execution mode of program code. For example, some malicious program code can choose different attack strategies according to the operating system type, or decide whether to trigger specific behavior according to the system time.

[0128] The specific method of obtaining the initial input parameters and initial environment variables may vary depending on the programming language and operating environment. In the C / C++ environment, command line parameters can be obtained through the parameters argc and argv of the main function. Environment variables can be obtained through the getenv() function. In Python, sys.argv can be used to obtain command line parameters and os.environ can be used to obtain environment variables.

[0129] In specific implementation, a function can be created to store initial input parameters and initial environment variables. The function can traverse all command line parameters and store them in a data structure (such as an array or dictionary). At the same time, a set of predefined environment variables, such as "OS", "PATH", "TEMP", etc., can also be queried and the information can be stored.

[0130] Insert monitoring instructions and tracking instructions at each branch point of high-risk program code, and execute the program code based on initial conditions to capture program code behavior and execution path, and observe the running status and behavior of the program code in real time.

[0131] Inserting monitoring instructions and tracing instructions is achieved through program code instrumentation. Program code instrumentation can add additional instructions to the program code without changing the original program code function. For compiled languages, instrumentation can be performed at the compile stage; for interpreted languages, the interpreter can be modified or a special execution environment can be used.

[0132] Monitoring instructions are mainly used to capture the behavior of program code, including system calls, network connection attempts, file system operations, memory access patterns, and API call sequences. For example, you can use the ptrace system call to monitor system calls of other processes, use the libpcap library to monitor network activities, use the inotify mechanism to monitor file system operations, and use memory breakpoints or page protection mechanisms to monitor memory access.

[0133] Tracing instructions are used to record the execution path of program code. Tracing instructions can insert a unique identifier at the beginning of each basic block and record the sequence of these identifiers during execution to accurately track the execution flow of program code, including conditional branches, loops, and function calls.

[0134] In actual implementation, a dynamic binary instrumentation tool such as Pin can be used to insert instructions in real time while the program code is running, without modifying the source program code or recompiling.

[0135] For example, using the Pin tool, you can write an instrumentation script to insert a callback function at the beginning of each basic block. The callback function can record the address of the current basic block to build the execution path. At the same time, you can use the Pin API to intercept system calls, memory accesses and other operations to achieve behavior monitoring.

[0136] When executing high-risk program code, the initial input parameters and environment variables obtained in step S210 are used to ensure that the program code runs under the same conditions as the original environment, which helps to observe environment-dependent behavior.

[0137] During the execution of high-risk program code, its program code behavior is identified in real time and its behavior pattern is determined. This process is a continuation of dynamic analysis and aims to extract meaningful patterns and features from the observed original behavior.

[0138] The identification of program code behavior first requires the classification and aggregation of the captured initial input parameters and initial environment variables. For example, system calls can be classified into categories such as file operations, network operations, and process management according to their functions. For network connection attempts, they can be grouped according to the target IP and port number. File system operations can be classified according to the operation type (read, write, delete, etc.) and the operation object (system files, user files, etc.).

[0139] In actual implementation, a state machine can be used to implement behavior recognition. For example, a series of states and transition rules can be defined, and when a specific sequence of system calls or API calls is observed, the state machine will transition to the corresponding state, thereby identifying a certain behavior pattern.

[0140] For example, to identify file encryption behavior: first observe the system call to open the file, then the call to read the file content, followed by a series of CPU-intensive calculations that can represent encryption operations (which can be inferred by monitoring memory access patterns), and finally write the processed data back to the file and close the file. Such a call sequence can be identified as potential file encryption behavior.

[0141] The determination of behavioral patterns is to further analyze the timing, frequency, and context of these behaviors after identifying a single behavior. For example, if it is observed that the program code first scans important directories of the system, then attempts to modify multiple system files, and then establishes multiple external network connections, this behavior sequence can be determined as a system intrusion and data leakage pattern.

[0142] In a specific implementation, a machine learning algorithm such as a long short-term memory network (LSTM) can be used to learn and identify complex behavior patterns. The model can be trained on a large amount of normal program code and known malicious program code behavior data, so that new malicious behavior patterns can be identified.

[0143] The determination of the behavior pattern also needs to consider the context and environment of the program code. For example, a normal system maintenance tool and a malicious program code can perform similar file operations, but their execution environments and trigger conditions are different. Therefore, when determining the behavior pattern, it is also necessary to combine the environmental variables and input parameters obtained in step S210 to make a comprehensive judgment.

[0144] According to the execution path captured in step S220, the specific logic of the high-risk program code during execution is determined.

[0145] The execution path is represented as a sequence of basic blocks. Each basic block is a linearly executed program code without branches or jumps (except the end). By analyzing the sequence of these basic blocks, the control flow graph of the program code can be reconstructed.

[0146] In actual implementation, graph theory algorithms can be used to analyze execution paths. First, each basic block is considered as a node in the graph, and the jump relationships between basic blocks are considered as edges. Then, the depth-first search (DFS) or breadth-first search (BFS) algorithm is used to traverse the graph to understand the overall structure of the program code.

[0147] For example, suppose the observed execution path is a sequence of basic blocks: A→B→C→D→B→C→E. By analyzing this sequence, we can infer that there is a loop in the program code (B→C→D→B), as well as a conditional branch (from C to D or E).

[0148] When determining the execution logic, it is also necessary to consider the basis for conditional branches, which can be inferred by analyzing the instruction sequence before each branch point. For example, if a comparison operation on a variable is observed before the branch, then the variable is the key factor controlling the branch.

[0149] In terms of implementation, the execution logic can be analyzed using symbolic execution technology. Symbolic execution treats input variables as symbols rather than specific values, and explores all execution paths by simulating program code execution to discover hidden execution branches and potential trigger conditions.

[0150] In addition, by analyzing the loop structure and the number of iterations, the time complexity and performance bottleneck of the program code can be inferred. For example, if a nested loop structure is observed, and the number of iterations of the inner loop grows with the variable of the outer loop, it can be suggested that an O(n 2 )’s time complexity.

[0151] Since many advanced malware will try to hide their behavior, their activities in memory are usually difficult to completely conceal. Therefore, a preset memory forensics tool can be used to determine the memory snapshot of high-risk program code to capture sensitive information, malicious program code fragments or abnormal states hidden in the memory. Specifically, the memory forensics tool can be Volatility, which can take memory snapshots of running processes. Memory forensics is used to capture and analyze data in the computer system memory.

[0152] In actual implementation, you first need to obtain memory snapshots at key points in the execution of high-risk program code. This includes key time points such as after the program code is started, before and after key operations are performed, and before the program code exits. After obtaining the memory snapshot, you can use memory forensics tools for analysis.

[0153] The process first requires choosing an appropriate memory forensics tool, such as Volatility, Rekall, or WinDbg, etc. These tools are able to create snapshots of the system memory and provide the ability to analyze the memory contents.

[0154] In practice, you first need to run the high-risk program code on the target system, and then use the selected memory forensics tool to obtain a memory snapshot at the critical moment of the program code execution. The snapshot contains the complete state of the current system memory, including running processes, loaded modules, network connections, open files and other information. After obtaining the snapshot, use the analysis function provided by the tool to examine the data structure, string, stack content, etc. in the memory.

[0155] After obtaining the memory snapshot, the memory snapshot and execution logic are analyzed to identify hard-coded content in high-risk program codes and the corresponding seed values.

[0156] First, the analysis of the memory snapshot involves looking at the contents of the program code segment, data segment, heap, and stack areas. Special attention should be paid to the static data area and the heap area, as hard-coded values ​​are often stored in these areas. Using a hex editor or a pre-set memory analysis tool, you can search for specific byte patterns or strings that can represent hard-coded values.

[0157] At the same time, the execution logic of the program code can be analyzed by disassembling the program code, tracing function calls, analyzing the control flow graph, etc. By analyzing the execution logic of the program code, the location and method of using hard-coded values ​​in the program code can be identified. For example, if it is found that some fixed values ​​or strings are directly used in the program code, the fixed values ​​or strings are most likely hard-coded.

[0158] In actual operation, disassembly tools such as IDAPro can be used to analyze the execution logic of program code. For example, if instructions similar to "mov eax, 0x1234ABCD" are found in the disassembled program code, 0x1234ABCD is most likely a hard-coded value. Combined with dynamic analysis, it is possible to observe whether these values ​​are used or modified during the execution of the program code, thereby determining whether the value is hard-coded.

[0159] To identify the seed value, you need to pay attention to the function calls related to random number generation or encryption. For example, if a function like srand() or InitializeCryptographicContext() is used in the program code, its parameter is the seed value. By analyzing the calls and parameters of these functions, you can determine the source and usage of the seed value.

[0160] The behavior patterns obtained from the above analysis are fuzzy matched with the preset malicious behavior feature library to determine the possible malicious behavior patterns.

[0161] Specifically, the malicious behavior feature library is a database containing malicious behavior sequences. The malicious behavior feature library includes but is not limited to: file system operations (such as creating, modifying, and deleting sensitive files), network activities (such as establishing hidden connections and data leakage), system modifications (such as modifying the registry and installing backdoors), process operations (such as injecting other processes and creating hidden processes), etc.

[0162] Next, the high-risk program code behavior patterns are converted into a format that can be matched, which can include creating behavior sequence diagrams, extracting key API call sequences, generating data flow diagrams, etc., to capture the dynamic behavior characteristics of program code.

[0163] The algorithms used in the fuzzy matching process may include but are not limited to: 1. string similarity algorithm; 2. sequence alignment algorithm; 3. graph structure similarity algorithm; 4. machine learning model.

[0164] For example, suppose the high-risk program code behavior sequence obtained through analysis is: "open file → read system information → encrypt data → establish network connection → send data".

[0165] Using a sequence comparison algorithm, the sequence can be compared with known malicious behavior patterns in the feature library. If a similar pattern is found, such as "read system information → encrypt data → send data", it can indicate that the program code has information stealing behavior.

[0166] Fuzzy matching can identify behaviors that are similar but not identical to known patterns, and can effectively detect variants or new malicious behaviors. Even if the program code uses some obfuscation techniques or changes the order of certain operations, fuzzy matching can still detect its malicious intent.

[0167] Finally, by randomly generating new input parameters and environment variables, different initial conditions are created for the next execution of high-risk program code, which helps to explore the behavior of program code in different situations and increase the possibility of discovering potential vulnerabilities or hidden functions.

[0168] First, the random number generator can be a random number function built into the programming language, such as Python's random module, or a secure random number generator, such as / dev / urandom (in Unix systems) or CryptGenRandom (in Windows systems) provided by the operating system.

[0169] When generating new input parameters, you need to consider the type, range, and constraints of the parameters. For example, if a parameter is an integer type, you need to determine its reasonable range; if it is a string type, you need to consider its length and the allowed character set. For example, suppose that the high-risk program code accepts three parameters: an integer, a string, and a Boolean value. You can generate new input parameters: 1. Integer parameter: random.randint(-1000000,1000000), 2. String parameter: ".join(random.choice(string.ascii_letters+string.digits)for_inrange(random.randint(1,100))), 3. Boolean parameter: random.choice([True,False]).

[0170] For environment variables, you need to consider the characteristics of the operating system and the environment variables that the program code can use. You can randomly modify the existing environment variable values, or you can create new environment variables. For example: 1. Modify the PATH variable: randomly add or delete paths based on the existing PATH, 2. Create a new environment variable: such as "RANDOM_VAR_" + str(random.randint(1,100)) = random_string().

[0171] In actual applications, some key environment variables can be kept unchanged to ensure that the basic functions of the system are not affected. At the same time, different system configurations can also be simulated, such as different operating system versions, different hardware configurations, etc.

[0172] By changing input parameters and environment variables, malicious behaviors or vulnerabilities that are only triggered under certain conditions can be discovered. For example, some malicious program codes can only activate their malicious functions under certain dates or system configurations. By constantly changing the execution environment, the probability of discovering such hidden behaviors is increased.

[0173] This implementation method can capture the actual state of the program code when it is running through memory forensics, revealing dynamic behaviors that may be missed by static analysis. The analysis of memory snapshots and execution logic further deepens the understanding of the program code structure and key parameters, especially identifying hard-coded and seed values ​​that may be used for malicious purposes. Fuzzy matching the extracted behavior patterns with known malicious behavior features can not only quickly identify potential threats, but also discover new or variant malicious behaviors. Finally, by randomly generating new input parameters and environmental variables, diverse test conditions are created, which greatly increases the possibility of discovering hidden vulnerabilities and abnormal behaviors, and greatly improves the effectiveness and efficiency of network security defense.

[0174] In one implementation of this embodiment, the network security module further includes a second neural network model, which identifies the program code behavior of the high-risk program code and determines the behavior pattern of the high-risk program code, including the following steps:

[0175] S310, determining the time sequence relationship and behavior frequency of all program code behaviors of the high-risk program code according to the program code behavior of the high-risk program code;

[0176] S320, inputting the initial input parameters, initial environment variables, time sequence relationships and behavior frequencies into the second neural network model to obtain the behavior pattern of the high-risk program code.

[0177] The temporal relationship reflects the sequence and time interval between different program code behaviors, while the behavior frequency indicates the number of times or proportion of a specific behavior occurring during the entire execution process.

[0178] Dynamic analysis techniques can be used to execute high-risk program code in a controlled environment, while monitoring tools can be used to record the execution time and frequency of each program code behavior. Program code can be run in an isolated environment to prevent potential malicious behavior from causing harm to the actual system. The monitoring tool can be a customized program code instrumentation framework that can insert tracking instructions at key points in the program code and record the start and end time of each behavior, as well as the number of executions.

[0179] For example, suppose there is a high-risk program code that contains the following behavior sequence: file reading, network connection, data encryption, file writing. Through dynamic analysis, the following information can be obtained:

[0180] 1. File reading: start time 0s, end time 0.5s, appears 3 times;

[0181] 2. Network connection: start time 1s, end time 2s, occurs once;

[0182] 3. Data encryption: start time 2.5s, end time 3s, appears 2 times;

[0183] 4. File writing: start time 3.5s, end time 4s, occurs 3 times.

[0184] Based on this data, a timing diagram can be constructed to show the time dependency between the behaviors. For example, network connection behavior always occurs after file reading, and data encryption after network connection. At the same time, the frequency of each behavior can be calculated, such as file reading and writing each account for 33.33% of the total behavior, data encryption accounts for 22.22%, and network connection accounts for 11.11%.

[0185] This analysis is not limited to a single execution, but can be performed multiple times to obtain more robust statistics. This helps identify patterns and anomalies in the behavior of program code, such as whether certain behaviors always occur in a specific order, or whether certain behaviors are only executed under certain conditions.

[0186] By understanding the timing and frequency characteristics of program code behavior, it is easier to distinguish normal behavior from abnormal behavior, thereby improving the accuracy of malicious program code detection.

[0187] Various features obtained from the behavior analysis of high-risk program codes are used as input, and the behavior pattern of the program code is finally output through the nonlinear transformation of the second neural network model. The second neural network model is a trained deep learning model that can extract high-level features and complex patterns from multi-dimensional input data. The second neural network model can be a long short-term memory network (LSTM) to process sequence data and time-related information. The input data includes initial input parameters (such as file names, network addresses, etc.), initial environment variables (such as operating system versions, installed software, etc.), timing relationships (execution order and time interval of each behavior) and behavior frequency (number of occurrences or proportions of each behavior).

[0188] For example, the input data can be encoded as a multi-dimensional vector sequence. Suppose there is a sequence of 100 time steps, each of which contains the following features: 1. Initial input parameters: encoded as a 10-dimensional vector; 2. Initial environment variables: encoded as a 20-dimensional vector; 3. The currently executed behavior: encoded as a one-hot vector (assuming there are 5 possible behaviors);

[0189] 4. The time interval from the previous behavior: a scalar value; 5. The cumulative frequency of the current behavior: a scalar value.

[0190] In this way, the input of each time step is a 37-dimensional vector (10+20+5+1+1). The entire sequence forms a 100x37 matrix as the input of the neural network.

[0191] The neural network model can contain multiple LSTM layers, connecting the fully connected layer and the output layer. The LSTM layer can capture long-term dependencies and is suitable for processing time series data. The fully connected layer further processes the output of the LSTM layer to extract more advanced features. Finally, the output layer maps the results to different behavior pattern categories and outputs the probability of each behavior pattern.

[0192] For example, a probability distribution can be output to represent the likelihood that the program code belongs to various predefined behavior patterns: 1. Data theft pattern: 0.05; 2. Ransomware pattern: 0.8; 3. Botnet pattern: 0.1; 4. Mining pattern: 0.03; 5. Normal behavior pattern: 0.02.

[0193] In the above example, the second neural network model determines that the program code is ransomware with a probability of 80%.

[0194] This implementation method first establishes a behavioral feature set by accurately capturing the temporal relationship and frequency of program code behavior. The features in the behavioral feature set not only reflect the static properties of the program code, but also contain key information in its dynamic execution process. Then, using the second neural network model, the complex multi-dimensional features are converted into clear behavioral pattern classification. In this way, potential malicious program codes can be identified earlier and more accurately, improving the efficiency and effectiveness of network security defense. This technology is not only applicable to known types of malicious program codes, but can also detect emerging and variant threats.

[0195] In one implementation of this embodiment, fuzzy matching is performed on the behavior pattern in a preset malicious behavior feature library to determine the malicious behavior pattern, including the following steps:

[0196] S410, for one of the behavior patterns, create a behavior sequence diagram according to the behavior pattern, and extract a key API call sequence from the behavior sequence diagram, where the key API call sequence includes at least two sequence segments;

[0197] S420, according to the key API call sequence, using a preset sequence comparison algorithm, determining whether there is a malicious behavior sequence matching at least two sequence segments in the malicious behavior feature library;

[0198] S430. In the case where there is a malicious behavior sequence matching at least two sequence segments, the at least two sequence segments are used as target sequence segments, and the position, execution frequency, context relevance, and resource access level of the target sequence segment in the behavior sequence diagram are determined, wherein the position is used to characterize the program code execution stage where the target sequence segment is located, the execution frequency is used to characterize the frequency of execution of the target sequence in the high-risk program code, the context relevance is used to characterize the before-after relevance of the target sequence segment in the high-risk program code, and the resource access level is used to characterize the permission operation level of the target sequence segment in the high-risk program code;

[0199] S440, using a preset scoring rule to determine a first score for the location, a second score for the execution frequency, a third score for the context relevance, and a fourth score for the resource access level;

[0200] S450: When the sum of the first score, the second score, the third score and the fourth score is greater than a preset threshold, determine that the behavior pattern is a malicious behavior pattern.

[0201] First, for a given behavior pattern, create a behavior sequence diagram. The behavior sequence diagram is a visualization tool used to describe the behavior flow of a system or program code. During the creation process, attention should be paid to the order and relationship of API calls. For example, the sequence diagram of a high-risk program code may include key behaviors such as file system operations, network connection attempts, and registry modifications. From the sequence diagram, extract the key API call sequences. These key sequences represent the core functions or malicious behaviors of the program code. For example, a typical key API call sequence can be: CreateFile()→WriteFile()→CloseHandle()→socket()→connect()→send(). This sequence can indicate that the program code creates a file, writes data, and then attempts to send information over the network. During the extraction process, these API calls are split into at least two sequence segments, each of which represents a relatively independent but interrelated set of operations. This helps to analyze the behavior pattern of the program code in more detail and can better match the patterns in the malicious behavior feature library.

[0202] Next, a preset sequence alignment algorithm is used to compare the extracted key API call sequence with the known patterns in the malicious behavior feature library. The sequence alignment algorithm can be a Smith-Waterman algorithm, which can handle insertions, deletions, and substitutions in the sequence, thereby identifying similar but not identical patterns. For example, if the key API call sequence is ABCDE, and there is a malicious behavior sequence ABXDE in the malicious behavior feature library, then the two sequences can be considered to be highly similar because they only differ in one element. In this embodiment, if at least two sequence segments can match, it indicates that there is a stronger similarity, and these matching sequence segments are marked as target sequence segments.

[0203] After determining the target sequence segment, a more detailed context analysis of the target sequence segment is required, including four key aspects: location, execution frequency, context relevance, and resource access level.

[0204] First, location analysis involves determining the stage of the target sequence segment in the entire program code execution process. The program code execution process can be divided into multiple stages, such as initialization, main operation, cleanup, etc., and then determine the stage to which each target sequence segment belongs. Execution frequency analysis focuses on the number of times these sequences are called in the program code. High frequency of execution can mean that this is the core function of the program code, or a recurring malicious operation. This indicator can be quantified by counting the number of times each API call appears in the entire execution process. Context relevance analysis aims to understand the relationship between the target sequence segment and its surrounding program code, including checking whether there are conditional statements controlling the execution of these sequences, or whether these sequences are closely connected to specific data structures or variables. Highly related contexts can indicate that these sequences are an important part of the program code logic. Finally, resource access level analysis focuses on the permission level of these sequences to access system resources. For example, attempts to modify system critical files or registry entries usually require higher permissions and therefore need to be more vigilant. This indicator can be evaluated by analyzing the permission level required for each API call and whether the program code attempts to elevate permissions.

[0205] Based on the detailed analysis of the target sequence segment, a preset scoring rule can be used to quantify the importance of each aspect. The scoring rule can reflect the relative importance of different factors in identifying malicious behavior. For the scoring of location (first scoring), different weights can be assigned according to the importance of different execution stages. For example, if the target sequence segment appears in the initialization phase of the program code, a higher score is assigned because many malware will perform key malicious operations at the beginning. Specifically, a scoring standard of 1-10 can be set, where the program code initialization phase scores 9-10, the main operation phase scores 6-8, and the cleanup phase scores 3-5. The scoring of execution frequency (second scoring) can be based on the number of occurrences of the target sequence segment during the entire program code execution process. If the number of executions of a sequence segment exceeds 5% of the total number of program code instructions, a full score of 10 points is given, and if it is less than 1%, a minimum score of 1 point is given, and the intermediate scores are calculated proportionally. The scoring of context relevance (third scoring) can be determined by analyzing the logical relationship between the target sequence segment and the surrounding program code. For example, if the target sequence segment is directly controlled by a conditional statement or has direct interaction with a key data structure, a higher score can be given. A checklist can be designed to list several typical high-correlation situations. Each item that meets the criteria will be scored 1 to 2 points, with a maximum of 10 points. The resource access level score (the fourth score) can be divided according to the sensitivity of the operation. For example, reading ordinary files can only get 1 to 2 points, while modifying system configuration files can get 8 to 9 points, and attempting to increase system permissions can get a full score of 10 points.

[0206] After all four aspects are scored, the scores are added together and compared to a preset threshold. If the total score of a behavior pattern exceeds the threshold, it is judged as a malicious behavior pattern.

[0207] The multi-dimensional, quantitative analysis method of this embodiment can effectively improve the accuracy and reliability of malicious behavior detection. By creating a detailed behavior sequence diagram, the overall behavior pattern of the program code can be visualized. Extracting key API call sequences and comparing them with known malicious patterns can quickly identify potential threats. In-depth analysis of matching sequence segments, including location, frequency, context, and permission level, provides a more comprehensive basis for evaluation. The quantitative scoring system makes the process more objective and consistent, not only detecting known malicious behavior patterns, but also effectively identifying new or variant threats because it focuses on behavioral characteristics rather than fixed signatures.

[0208] In one implementation of this embodiment, analyzing the memory snapshot and the execution logic to obtain the hard codes in the high-risk program code and the seed value corresponding to the hard codes includes the following steps:

[0209] S510, determining whether a preset character string exists in the memory snapshot;

[0210] S520: if a character string exists, determine that the hard code in the high-risk program code is a character string;

[0211] S530: In the absence of a character string, using a preset disassembly tool to analyze the execution logic of the high-risk program code to obtain a disassembled program code;

[0212] S540, determining hard codes in high-risk program codes according to the disassembled program codes, and determining random number generation calling functions and / or encryption calling functions in the hard codes;

[0213] S550: Obtain function parameters of a random number generation calling function and / or an encryption calling function, and determine that the function parameters are seed values ​​corresponding to the hard code.

[0214] First, the memory snapshot is analyzed to determine if a preset string exists. A memory snapshot is a complete copy of the memory state of the program code at a specific moment, containing the program code, data, and stack information of the program code. In this step, a string search algorithm can be used to check each byte sequence in the memory snapshot to find a specific string pattern in a large amount of data. The preset string can be a known malicious program code identifier, encryption key, command and control server address, etc. For example, if the preset string is "malware_identifier_123", the algorithm will look for this exact character sequence in the entire memory snapshot.

[0215] If there is a preset string in the memory snapshot, it is confirmed that the string is hard-coded in the high-risk program code. In the specific implementation, it is necessary to further analyze the location and context of the string in memory. First, it is necessary to determine the exact location of the string in memory, including the memory page and offset where it is located. Then, analyze whether the memory area belongs to the program code segment or the data segment. If the string is in the program code segment, it is directly hard-coded in the program code. If it is in the data segment, it is necessary to further analyze whether there is a program code that references the location, which can be done by looking for read or write operations on the memory address. For example, if an instruction similar to "mov eax, [0x12345678]" is found, where 0x12345678 is the address where the string is located, it indicates that the program code is indeed using the string. In addition, it is necessary to check the memory content around the string to determine whether there is any related program code or data structure. You can use a memory analysis tool to check the memory structure and program code references in detail.

[0216] If the preset string is not found in the memory snapshot, the preset disassembly tool is used to analyze the execution logic of the high-risk program code to obtain the disassembled program code. Disassembly is the process of converting machine program code back to assembly language. The disassembly tool can be IDAPro. The disassembly process first needs to determine the entry point of the program code, which is usually the main function of the program code or the entry function of the DLL. Then, starting from the entry point, each machine instruction is analyzed step by step and converted into the corresponding assembly language representation. In this process, the disassembly tool will try to identify function boundaries, jump targets, and data references. For example, for the x86 architecture, a machine instruction "8B 4508" can be disassembled into "mov eax, [ebp + 8]". The disassembly tool can also try to reconstruct the control flow graph of the program code to show the jump and call relationship between different program code blocks. The obtained disassembled program code provides a clear view of the program code structure and execution logic for subsequent analysis, which is the basis for further identifying hard-coded and potential malicious behaviors.

[0217] Determine the hard-coded values ​​in the high-risk program code based on the disassembled program code, and determine the random number generation call function and / or encryption call function in the hard-coded values. First, it is necessary to identify the constant values ​​and string references in the program code, which are expressed as immediate operands or references to data segments in the assembly program code. For example, in x86 assembly, the "mov eax,0x1234" instruction directly uses a hard-coded value. For the instruction of the string "lea esi,[ebp-20h]", [ebp-20h] points to the address of a string.

[0218] Next, identify calls to random number generation and encryption functions. For example, in Windows systems, you can call the CryptGenRandom function to generate random numbers, or call the CryptEncrypt function to perform encryption operations. In Linux systems, you can read from / dev / urandom or call OpenSSL library functions. Identifying these function calls requires not only looking at the direct function name, but also analyzing the function calling convention and parameter passing mode. For example, in x86 systems, function parameters are usually passed through the stack, so the push instruction sequence needs to be analyzed. In some cases, the malicious program code can use custom encryption or random number generation functions, and its functionality needs to be inferred by analyzing the internal logic of the function.

[0219] Finally, obtain the function parameters of the random number generation calling function and / or the encryption calling function, and determine that these parameters are the seed values ​​corresponding to the hard-coded ones. This process requires careful analysis of the parameter preparation process before the function call. At the assembly level, this is usually manifested as a series of data movement and stack push operations. Figure 5As shown, for example, for a typical function call, there is the following instruction sequence:

[0220] ```

[0221] push 0x1000; buffer size

[0222] lea eax,[ebp-20h]

[0223] push eax; buffer address

[0224] call RandomFunction

[0225] ```

[0226] In this example, 0x1000 and [ebp-20h] are the parameters passed to RandomFunction. For example, if an instruction like "push0x12345678" is immediately followed by a random number generation function call, then 0x12345678 is the seed value for the random number generation. For cryptographic functions, attention needs to be paid to the keys or initialization vectors (IVs) passed. These are typically fixed-length sequences of bytes that are either hard-coded directly in the instruction or stored in the data segment and passed via pointers. This detailed parameter analysis allows the hard-coded seed value to be accurately determined, which is critical to understanding and potentially breaking the encryption or randomization process.

[0227] This implementation method can quickly find obvious malicious signs by first searching for preset strings in the memory snapshot. If it fails, it turns to a deeper disassembly analysis, which can not only find the hard-coded code that is hidden deeper, but also reveal the overall structure and behavior of the program code. In particular, by identifying the calls of random number generation and encryption functions, and analyzing the parameters of these functions, the core mechanism of the malicious program code can be deeply understood. This multi-level analysis method can effectively deal with various obfuscation and hiding techniques, and improve the accuracy and comprehensiveness of malicious program code detection and analysis.

[0228] In one implementation of this embodiment, when the malicious behavior mode is a DGA mode, determining a DGA domain name list according to a hard-coded seed value includes the following steps:

[0229] S610: When the malicious behavior mode is the DGA mode, simulate the DGA process of the high-risk program code according to the hard-coded seed value to obtain a DGA domain name list, where the DGA domain name list includes at least one high-risk domain name.

[0230] This embodiment can simulate the domain generation algorithm (DGA) used in malware to predict domain names that can be used for command and control (C&C) communications. DGA is a technique for dynamically generating a large number of domain names, usually used to evade static blacklist detection. This process requires the exact replication of the DGA algorithm in the malware and the use of the same seed value to generate a list of domain names.

[0231] First, analyze the malware sample and extract the DGA algorithm and seed value. Static analysis and dynamic analysis can be used. Static analysis is to check the program code structure of the malware and identify the functions and algorithms used to generate domain names. Dynamic analysis is to run the malware in a controlled environment, observe its behavior and capture the generated domain names.

[0232] After the DGA algorithm and seed value are identified, re-implement the algorithm in a safe environment. For example, suppose the analysis finds that a malware uses the following simplified DGA algorithm: 1. Use the current date as the seed value (e.g. 20240101); 2. Multiply the seed value by a fixed prime number (e.g. 31337); 3. Modulo the result to get a number between 0-25; 4. Convert the number to the corresponding letter (0=a, 1=b,…, 25=z); 5. Repeat steps 2-4 to generate a domain name of the required length; 6. Add a fixed top-level domain name (e.g. .com).

[0233] Using this algorithm, a series of domain names can be simulated. For example, for the seed value 20240101, the first iteration can generate: 20240101*31337=633940537337, 633940537337%26=11, 11 corresponds to the letter "l".

[0234] Continue this process and eventually a domain name like "l rxpqt.com" can be generated.

[0235] By running this simulation process repeatedly, a complete list of DGA domains can be generated. This list can contain hundreds or thousands of potentially high-risk domains that may be used by malware for communication.

[0236] By generating a list of potential high-risk domains, DNS filters and firewall rules can be updated to block communications with these domains. And monitor network traffic for suspicious activities associated with these domains. In addition, by analyzing the generated domain list, security researchers can gain insight into the characteristics and patterns of DGAs.

[0237] This implementation greatly improves the detection and defense capabilities of malware using DGA technology by simulating the DGA process and generating a list of high-risk domain names. It can not only predict and block potential malicious communication channels, but also provide intelligence resources for security teams, helping to more fully understand the strategies and techniques of attackers.

[0238] Reference Figure 4 In one implementation of this embodiment, the event graph includes nodes and edges, the nodes are used to represent threat entities, and the edges are used to represent the relationship between threat entities. The graph reasoning steps include:

[0239] S710, using a preset graph traversal algorithm to traverse the event graph and determine the association relationship between any two nodes;

[0240] S720: Determine a node sequence with a time sequence relationship among all association relationships, and form a potential attack chain with the node sequence;

[0241] S730: Determine the APT threat probability of the potential attack chain, and determine the threat level of the potential attack chain according to the APT threat probability.

[0242] First, a preset graph traversal algorithm is used to traverse all possible node connections in the event graph. Graph traversal algorithms include two main types: depth-first search (DFS) and breadth-first search (BFS). The DFS algorithm will prioritize exploring the depth of the graph, follow a path all the way to the bottom, then backtrack to the previous node and continue exploring other paths. The BFS algorithm will first explore all nodes close to the starting node, and then expand outward layer by layer. In practical applications, you can choose a suitable traversal algorithm based on specific needs.

[0243] One implementation method is to use an improved depth-first search algorithm. First, a node in the graph is selected as the starting point. Starting from this node, the adjacent nodes are explored along the edges, and the explored paths are recorded. When a node with no unexplored neighboring nodes is reached, the algorithm will backtrack to the previous node and continue to explore other unvisited neighboring nodes. This process will continue until all nodes have been visited. To improve efficiency, a hash table can be used to record visited nodes to avoid repeated visits. At the same time, a maximum depth limit can be set to prevent falling into too deep recursion in complex graphs.

[0244] For example, suppose there is a simple event graph with nodes A, B, C, D, E, and edge connections AB, BC, CD, BE. Starting from node A, the algorithm will first explore path ABCD, then backtrack to B and continue exploring BE. In this way, the algorithm can find all possible node connection paths, such as AB, ABC, ABCD, ABE, etc.

[0245] Among all the associations obtained in step S710, the node sequences with time series relationships are screened out, and these sequences are constructed into potential attack chains. One implementation method is to first add a timestamp attribute to each node in the graph to indicate the time when the event occurred. Then, all the associations obtained in step S710 are verified in time order. Specifically, each association path can be traversed to check whether the timestamps of adjacent nodes on the path conform to the order of precedence. Only those paths with timestamps in ascending order will be retained as potential attack chains. For example, suppose there is an association path containing nodes A (timestamp: 2023-01-01 10:00), B (timestamp: 2023-01-01 11:30), C (timestamp: 2023-01-0114:00), and D (timestamp: 2023-01-01 13:00). When verifying the time series relationship, it will be found that the order of ABC conforms to the time increment, but CD does not, so the potential attack chain finally retained is ABC.

[0246] Further analysis and assessment of potential attack chains are performed to determine their APT threat probability and corresponding threat level.

[0247] Specifically, a probability model based on a Bayesian network is used to calculate the APT threat probability. First, a basic success probability is assigned to each node in the attack chain (representing an attack step), which can be determined based on historical data. Then, a Bayesian network is constructed considering the conditional dependencies between nodes. Through this network, the probability of success of the entire attack chain, that is, the APT threat probability, can be calculated.

[0248] For example, suppose a simple attack chain consists of three steps: A (initial intrusion, success probability 0.3), B (privilege escalation, success probability 0.5 if A succeeds), C (data theft, success probability 0.8 if B succeeds). Using Bayes' theorem, the probability of success of the entire attack chain can be calculated: P(A,B,C) = P(A)*P(B|A)*P(C|B) = 0.3*0.5*0.8 = 0.12, or 12%.

[0249] Next, the threat level is determined based on the calculated APT threat probability. This can be achieved through a preset probability interval. For example: 0% to 5%: low risk; 5% to 15%: medium risk; 15% to 30%: high risk; and above 30%: severe risk.

[0250] Based on the 12% threat probability calculated in the above example, this attack chain would be rated as medium risk.

[0251] This implementation provides a quantitative assessment method for complex network security threats through graph reasoning and probabilistic analysis. It can not only discover potential attack paths, but also evaluate the threat level of each path. By combining graph theory, time series analysis and probabilistic models, this solution can process large-scale and complex security data and identify hidden threats that can be ignored by traditional methods. It helps to better understand and respond to advanced persistent threats (APTs) and improve overall security defense capabilities.

[0252] In one implementation of this embodiment, determining the APT threat probability of a potential attack chain, and determining the threat level of the potential attack chain according to the APT threat probability, includes the following steps:

[0253] S810, extracting features of potential attack chains to obtain attack chain features;

[0254] S820. Construct an attacker profile based on the attack chain characteristics. The attacker profile includes attack time pattern, attack language characteristics, and attack intensity.

[0255] S830, mapping the attack time pattern and the attack language feature to a preset APT feature library to determine the APT threat probability;

[0256] S840. Determine the threat level of the potential attack chain based on the APT threat probability and attack intensity.

[0257] First, feature extraction is performed on the potential attack chain to obtain attack chain features. Feature extraction can be performed from multiple dimensions, including time dimension, space dimension, behavior dimension, and impact dimension. In the time dimension, the duration of the attack, the time interval between each attack stage, the specific time point when the attack occurs, etc. can be analyzed. For example, the start and end time of each attack step can be recorded, and the total duration of the entire attack chain and the time difference between each step can be calculated.

[0258] In the spatial dimension, the geographical distribution of the attack source IP addresses, the type and location of the target assets, etc. can be examined. Feature extraction in the behavioral dimension focuses on the techniques, tools, and methods used by attackers, such as specific vulnerability exploits, malware types, command and control communication patterns, etc. In-depth analysis of network traffic, system logs, and malicious program code samples is required. The impact dimension evaluates the actual or potential impact of the attack on the target system and data, such as the number of affected systems, the extent of data leakage, the severity of service interruptions, etc. The results of feature extraction are expressed in the form of vectors or matrices. For example, a feature vector can be constructed that contains values ​​such as the duration of the attack, the number of IP addresses involved, the number of vulnerability types used, and the number of affected systems.

[0259] Next, an attacker profile is constructed based on the extracted attack chain features, including attack time patterns, attack language features, and attack intensity. The analysis of attack time patterns aims to identify the attacker's activity patterns and time preferences. This can be achieved through time series analysis methods. For example, attack events can be aggregated by hour, day, or week, and then the ARIMA model can be used to predict the possibility of future attacks. If the attack frequency is found to increase significantly in certain time periods (such as weekday evenings), it can imply the attacker's working hours and geographical location. The analysis of attack language features focuses on the programming language, program code style, command syntax, etc. used by the attacker. This can be achieved through natural language processing techniques, such as word frequency analysis, grammatical structure analysis, and program code style matching. For example, keywords and grammatical structures in malicious scripts can be extracted and compared with known attacker preferences. If a specific programming language (such as PowerShell) or a unique program code comment style is found to be used extensively. The assessment of attack intensity takes into account the complexity, duration, and potential impact of the attack. Different factors can be weighted. For example, you can score based on factors such as the number of advanced techniques used (such as zero-day vulnerabilities), the duration of the attack, the importance of the affected system, etc. The score range for each factor is 0-10, and then the weighted average is calculated as the final attack intensity score.

[0260] Then, the attack time pattern and attack language features are mapped to the preset APT feature library to determine the APT threat probability. The APT (Advanced Persistent Threat) feature library contains typical attack patterns, common tools and language features of known APT organizations. The mapping process can use a machine learning classifier, such as a support vector machine (SVM), to comprehensively consider multiple features and give a classification result. For example, a multi-class classifier can be trained with the extracted time and language features as input and the output as the probability of belonging to each known APT organization. The final APT threat probability can be obtained by combining the results of these different methods. For example, a weighted average method can be used to give different weights (such as 0.3, 0.3, 0.4) to the results of time pattern matching, language feature matching and machine learning classifiers, and then calculate the final APT threat probability.

[0261] Finally, the threat level of the potential attack chain is determined based on the APT threat probability and attack intensity. A two-dimensional scoring matrix can be designed, with the horizontal axis representing the APT threat probability and the vertical axis representing the attack intensity. The APT threat probability can be used directly based on the above calculation results, usually expressed as a value between 0 and 1. The attack intensity can use the results of the previously defined multidimensional scoring system, such as a score from 0 to 10. The threat level can be divided into multiple levels, such as low, medium, high, and severe. The specific mapping can be defined as follows: when the APT threat probability is lower than 0.3 and the attack intensity is lower than 5, the threat level is low; when the APT threat probability is between 0.3 and 0.6 or the attack intensity is between 5 and 7, the threat level is medium; when the APT threat probability is between 0.6 and 0.8 or the attack intensity is between 7 and 9, the threat level is high; when the APT threat probability is higher than 0.8 or the attack intensity is higher than 9, the threat level is severe. For example, if an attack chain has an APT threat probability of 0.75 and an attack intensity of 8, it will be classified as a high-level threat.

[0262] Comprehensive effect: This method based on deep analysis and multi-dimensional evaluation can effectively identify and classify complex network attack threats, especially for the detection of APT (advanced persistent threat).

[0263] This implementation method can capture subtle features of the attack chain through feature extraction; deeply understand the attacker's behavior patterns and technical preferences by building an attacker portrait; accurately assess the probability of APT threats by matching with the APT feature library; finally, determine a clear threat level assessment by comprehensively considering the APT threat probability and attack intensity, thereby effectively improving the detection accuracy of advanced threats.

[0264] In one implementation of this embodiment, determining the threat level of a potential attack chain according to the APT threat probability and attack intensity includes the following steps:

[0265] S910, determining the target quadrant of a preset two-dimensional scoring matrix where the APT threat probability and the attack intensity are located, wherein the horizontal axis of the two-dimensional scoring matrix is ​​the APT threat probability, and the vertical axis is the attack intensity. The horizontal axis and the vertical axis of the two-dimensional scoring matrix divide the two-dimensional scoring matrix into a first quadrant, a second quadrant, a third quadrant, and a fourth quadrant. The threat level corresponding to the first quadrant is low, the threat level corresponding to the second quadrant is medium, the threat level corresponding to the third quadrant is high, and the threat level corresponding to the fourth quadrant is severe.

[0266] S920. Determine the threat level of the potential attack chain based on the target quadrant.

[0267] Reference Figure 7In this embodiment, first, a two-dimensional scoring matrix is ​​constructed to visualize and quantify the relationship between APT threat probability and attack intensity. The horizontal axis of the two-dimensional scoring matrix represents the APT threat probability, and the vertical axis represents the attack intensity. By dividing the matrix into four quadrants, each quadrant corresponding to a different threat level, the standardization and simplification of threat assessment is achieved. Specifically, the matrix is ​​divided into the first quadrant (low threat), the second quadrant (medium threat), the third quadrant (high threat), and the fourth quadrant (severe threat).

[0268] One implementation is to quantify both the APT threat probability and attack intensity as values ​​from 0 to 10. For example, suppose an assessment yields an APT threat probability of 7 and an attack intensity of 8. First, locate the point (7, 8) in the two-dimensional scoring matrix. If the matrix is ​​divided equally, then the point (5, 5) will be the intersection of the four quadrants. Since (7, 8) is in the third quadrant (i.e., the upper right quadrant), the threat level of this potential attack chain will be judged as high.

[0269] After that, based on the target quadrant, it is directly mapped to the corresponding threat level. One implementation method is to set a standardized threat level mapping rule. For example, point (7, 8) is located in the third quadrant, and the corresponding threat level is high. This means that the potential attack chain is considered to be highly threatening and corresponding defensive measures need to be taken immediately.

[0270] This implementation not only takes into account the two key factors of threat probability and attack intensity by establishing a two-dimensional scoring matrix and a threat level mapping mechanism, but also intuitively presents the evaluation results in a visual manner, greatly improving the efficiency and accuracy of threat assessment.

[0271] Reference Figure 2 The present application also provides a network malicious attack monitoring system, including:

[0272] a memory configured to store instructions; and

[0273] The server is configured to call instructions from the memory and implement the above-mentioned network malicious attack monitoring method based on the deep neural model when executing the instructions.

[0274] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned network malicious attack monitoring method based on a deep neural model.

[0275] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0276] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of the processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0277] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0278] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0279] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0280] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0281] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0282] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0283] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A network malicious attack monitoring method based on a deep neural model, characterized in that: Applied to a network malicious attack monitoring system, the network malicious attack monitoring system includes a server, the server is deployed with a network security module, the network security module includes a first neural network model and an execution unit, the execution unit includes a loop step and a graph reasoning step, the method includes: In response to receiving the unknown program code, performing feature matching on the unknown program code according to a preset malicious program code feature library to determine whether there is a known malicious program code feature; In the case where there are known features of the malicious program code, marking the unknown program code as high-risk program code, and inputting the high-risk program code into the first neural network model to obtain deep features; The high-risk program code is loaded into a preset security sandbox environment, and the high-risk program code is cyclically executed using a loop step to obtain a hard-coded seed value in the high-risk program code and a malicious behavior pattern of the high-risk program code; In a case where the malicious behavior mode is a DGA mode, determining a DGA domain name list according to the hard-coded seed value; Input the DGA domain name list into a pre-trained hybrid model to obtain a character-level graph structure, wherein the hybrid model is obtained by fusing a graph convolutional network with an attention mechanism, and the character-level graph structure is used to determine local semantic information in the DGA domain name; Mapping the deep features, the malicious behavior patterns, the DGA domain names, and the local semantic information into a pre-built network security knowledge graph to obtain an event graph; The event graph is analyzed by using the graph reasoning step to determine a potential attack chain and a threat level, and the loop step and the graph reasoning step are updated according to the potential attack chain and the threat level to obtain an updated loop step and an updated graph reasoning step; The updated loop steps and the updated graph reasoning steps are dynamically loaded into the execution unit, and the potential attack chain and the threat level are displayed.

2. The method according to claim 1, characterized in that The cycle steps include: Obtaining initial input parameters and initial environment variables for executing the high-risk program code; Inserting a monitoring instruction and a tracing instruction at each branch point of the high-risk program code execution, and executing the high-risk program code according to the initial input parameters and the initial environment variables, so as to capture all program code behaviors of the high-risk program code through the monitoring instruction, and capture the execution path of the high-risk program code through the tracing instruction; When executing the high-risk program code, identifying all the program code behaviors of the high-risk program code to determine the behavior pattern of the high-risk program code; Determining the execution logic of the high-risk program code when executing according to the execution path; Using a preset memory forensics tool to obtain a memory snapshot of the high-risk program code at a preset time; Analyze the memory snapshot and the execution logic to obtain hard codes in the high-risk program code and a seed value corresponding to the hard codes; Performing fuzzy matching on the behavior pattern in a preset malicious behavior feature library, determining a malicious behavior pattern in the behavior pattern, wherein the malicious behavior feature library stores malicious behavior sequences; A preset random number generator is used to randomly generate new input parameters and new environment variables, and the new input parameters are used as initial input parameters for the next execution of the high-risk program code, and the new environment variables are used as initial environment variables for the next execution of the high-risk program code.

3. The method according to claim 2, characterized in that The network security module further includes a second neural network model, and the identifying the program code behavior of the high-risk program code and determining the behavior pattern of the high-risk program code includes: Determining, according to the program code behavior of the high-risk program code, a time sequence relationship and a behavior frequency of all the program code behaviors of the high-risk program code; The initial input parameters, the initial environment variables, the timing relationship and the behavior frequency are input into the second neural network model to obtain the behavior pattern of the high-risk program code.

4. The method according to claim 2, characterized in that: The step of fuzzily matching the behavior pattern in a preset malicious behavior feature library and determining the malicious behavior pattern in the behavior pattern includes: For any one of the behavior patterns, a behavior sequence diagram is created according to the behavior pattern, and a key API call sequence is extracted from the behavior sequence diagram, wherein the key API call sequence includes at least two sequence segments; According to the key API call sequence, using a preset sequence comparison algorithm, determining whether there is a malicious behavior sequence matching at least two of the sequence segments in the malicious behavior feature library; In the case where there is a malicious behavior sequence that matches at least two of the sequence segments, at least two of the sequence segments are used as target sequence segments, and the position, execution frequency, context relevance, and resource access level of the target sequence segment in the behavior sequence diagram are determined, wherein the position is used to characterize the program code execution stage where the target sequence segment is located, the execution frequency is used to characterize the frequency of execution of the target sequence in the high-risk program code, the context relevance is used to characterize the before-after relevance of the target sequence segment in the high-risk program code, and the resource access level is used to characterize the permission operation level of the target sequence segment in the high-risk program code; Using a preset scoring rule, determine a first score for the location, a second score for the execution frequency, a third score for the context relevance, and a fourth score for the resource access level; When the sum of the first score, the second score, the third score and the fourth score is greater than a preset threshold, the behavior pattern is determined to be a malicious behavior pattern.

5. The method according to claim 2, characterized in that: The analyzing the memory snapshot and the execution logic to obtain the hard codes in the high-risk program code and the seed value corresponding to the hard codes includes: Determining whether a preset character string exists in the memory snapshot; In the case where the character string exists, determining that the hard code in the high-risk program code is the character string; In the absence of the character string, using a preset disassembly tool to analyze the execution logic of the high-risk program code to obtain a disassembled program code; Determine the hard codes in the high-risk program code according to the disassembled program code, and determine a random number generation calling function and / or an encryption calling function in the hard codes; Acquire function parameters of the random number generation calling function and / or the encryption calling function, and determine that the function parameters are seed values ​​corresponding to the hard code.

6. The method according to claim 1, characterized in that When the malicious behavior mode is a DGA mode, determining a DGA domain name list according to the hard-coded seed value includes: In the case where the malicious behavior mode is a DGA mode, the DGA process of the high-risk program code is simulated according to the hard-coded seed value to obtain a DGA domain name list, wherein the DGA domain name list includes at least one high-risk domain name.

7. The method according to claim 1, characterized in that The event graph includes nodes and edges, the nodes are used to represent threat entities, and the edges are used to represent the relationship between the threat entities. The graph reasoning steps include: Using a preset graph traversal algorithm, traverse the event graph to determine the association relationship between any two nodes; Among all the association relationships, determine a node sequence with a time sequence relationship, and form a potential attack chain with the node sequence; An APT threat probability of the potential attack chain is determined, and a threat level of the potential attack chain is determined according to the APT threat probability.

8. The method according to claim 7, characterized in that Determining the APT threat probability of the potential attack chain, and determining the threat level of the potential attack chain according to the APT threat probability, includes: Extracting features of the potential attack chain to obtain attack chain features; Building an attacker profile according to the attack chain characteristics, the attacker profile including attack time pattern, attack language characteristics and attack intensity; Mapping the attack time pattern and the attack language feature to a preset APT feature library to determine the APT threat probability; The threat level of the potential attack chain is determined according to the APT threat probability and the attack intensity.

9. The method according to claim 7, characterized in that: Determining the threat level of the potential attack chain according to the APT threat probability and the attack intensity includes: Determine the target quadrant of a preset two-dimensional scoring matrix where the APT threat probability and the attack intensity are located, wherein the horizontal axis of the two-dimensional scoring matrix is ​​the APT threat probability, the vertical axis is the attack intensity, and the horizontal axis and the vertical axis of the two-dimensional scoring matrix divide the two-dimensional scoring matrix into a first quadrant, a second quadrant, a third quadrant, and a fourth quadrant, the threat level corresponding to the first quadrant is low, the threat level corresponding to the second quadrant is medium, the threat level corresponding to the third quadrant is high, and the threat level corresponding to the fourth quadrant is severe; According to the target quadrant, a threat level of the potential attack chain is determined.

10. A network malicious attack monitoring system, characterized in that: include: a memory configured to store instructions; as well as The server is configured to call the instructions from the memory and implement the network malicious attack monitoring method based on the deep neural model according to any one of claims 1 to 9 when executing the instructions.

Images