Ransomware classification method and system based on large model

Abstract

The invention provides a ransomware classification method and system based on a large model, and the method comprises the steps: carrying out the feature learning and extraction of preprocessed data through a deep learning large model, and obtaining advanced feature representation, and the deep learning large model is a large model which is subjected to the unsupervised or semi-supervised pre-training, and then is subjected to the fine adjustment based on the feature corpus fine adjustment of SFT supervision; performing preliminary classification and refined classification on the ransomware virus according to the advanced feature representation; and dynamically adjusting model parameters according to the novel ransomware sample. According to the method, by introducing a large model technology, limitation and defects in an existing ransomware detection and classification method are overcome, efficient detection and accurate classification of diversified ransomware viruses are achieved, the generalization ability of the model is enhanced, resource consumption is reduced, and usability and applicability of the system are improved; and the method is suitable for a large-scale data environment and quickly evolved ransomware ecology. According to the method, the overall level of network security defense is remarkably improved, and a more reliable and efficient ransomware virus protection scheme is provided for users.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a large model-based ransomware virus classification method and system. Background Art

[0002] As cyberattacks become increasingly sophisticated, ransomware has become a major threat in the current cybersecurity field. Traditional ransomware detection and classification methods usually rely on signature matching or behavior-based detection methods. However, these methods gradually show their limitations when faced with new ransomware with frequent mutations and complex encryption methods. In the prior art, ransomware detection and classification methods based on machine learning have made some progress, but there are still the following problems and shortcomings:

[0003] 1. Limitations of feature extraction: Traditional machine learning methods rely on manually designed features or simple automated feature extraction when dealing with ransomware classification. This method often fails to capture the subtle differences between virus variants when faced with diverse ransomware, resulting in low classification accuracy.

[0004] 2. Insufficient model generalization ability: Existing machine learning models often perform poorly when faced with unseen ransomware variants because these models have limited generalization ability and are unable to cope with the diversity within the virus family. During training, the model is usually unable to effectively learn the deep-level patterns and behavioral characteristics of the ransomware, resulting in a low recognition rate for new viruses.

[0005] 3. High cost of dynamic analysis: Although behavior-based dynamic analysis can effectively deal with encrypted and obfuscated ransomware, its analysis process is time-consuming and resource-intensive, making it difficult to apply to large-scale data sets. In this paper, the application of dynamic analysis in ransomware detection is discussed, and its limitations in actual deployment are pointed out, especially when dealing with large-scale network environments.

[0006] 4. Complexity and ease of use of existing technologies: Most existing ransomware detection and classification systems have complex configuration and operation difficulties, requiring users to have high professional knowledge, which limits their popularization and application in small and medium-sized enterprises or individual users. The complexity of most existing ransomware defense systems on the market is one of the important factors affecting user experience.

[0007] The root cause of the above problems is that existing methods are difficult to balance the expressiveness of features and the generalization performance of models, and are unable to cope with the rapidly changing ransomware ecosystem. In the process of solving these problems, traditional methods often encounter difficulties in how to improve detection accuracy while reducing resource consumption and operational complexity. Therefore, a more reliable and efficient ransomware protection solution is needed. Summary of the invention

[0008] The present invention aims to solve the problems of low efficiency, poor generalization ability, high resource consumption, and complex system of ransomware detection and classification, and provides a ransomware classification method and system based on a large model. By introducing large model technology, the limitations and deficiencies in existing ransomware detection and classification methods are overcome, and efficient detection and accurate classification of diversified ransomware are achieved, the generalization ability of the model is enhanced, resource consumption is reduced, the usability and applicability of the system are improved, and the system is adapted to large-scale data environments and rapidly evolving ransomware ecology. The present invention will significantly improve the overall level of network security defense and provide users with a more reliable and efficient ransomware protection solution.

[0009] With the rapid development of information technology and the widespread popularity of the Internet, ransomware has become a very threatening means of network attack. These viruses encrypt the victim's key data files and force the victim to pay a ransom to restore access rights. Although the existing ransomware detection and classification methods have achieved certain results in certain specific scenarios, they still face a series of difficult-to-overcome technical difficulties. To this end, the present invention proposes a ransomware classification method and system based on a large model to improve the detection accuracy, classification accuracy and overall performance of the ransomware system in response to the defects and deficiencies in the prior art.

[0010] (1) Improve the detection and classification capabilities of ransomware variants: Existing ransomware detection methods rely on signature matching or behavioral analysis, which are often powerless when faced with frequently mutated ransomware. Signature matching methods cannot cope with obfuscated or encrypted virus variants, and behavioral analysis methods are difficult to be widely used due to high computational overhead. The present invention uses large model technology to automatically learn deep feature representations from a large number of virus samples and capture the essential characteristics of ransomware through a higher-dimensional feature space. In this way, even when faced with new variants that have never been seen before, the present invention can effectively detect and accurately classify them, thereby improving the comprehensiveness and accuracy of ransomware detection.

[0011] (2) Enhance the generalization ability of the model: The generalization ability of existing machine learning models is insufficient, which is mainly reflected in the low classification accuracy when facing new ransomware. This is mainly because these models find it difficult to learn a sufficiently wide range of virus features during the training process, especially the common features across multiple virus families. The present invention uses a large model to learn a more general feature representation, so that the model can show stronger robustness and generalization ability when facing different virus families and variants, thereby significantly improving the recognition rate of new ransomware.

[0012] (3) Reduce resource consumption during detection and classification: Although dynamic analysis has advantages in dealing with obfuscated or encrypted ransomware, its computational overhead and time consumption are extremely large, which limits its application in actual scenarios. Static analysis performs poorly when faced with complex variants. The present invention reduces the reliance on dynamic analysis and improves the effectiveness of static analysis by combining the feature learning capabilities of large models. In this way, without significantly increasing computing resource consumption, the present invention can provide an efficient ransomware detection and classification solution that is suitable for real-time threat detection in large-scale network environments.

[0013] (4) Improve the usability and applicability of the system: Existing ransomware detection and classification systems are usually complex in design, difficult to operate, and require high professional skills from users, which limits their popularity in practical applications. Especially in small and medium-sized enterprises and individual users, in the absence of professional knowledge and technical support, existing systems are difficult to play their due role. The present invention designs an easy-to-use ransomware classification system, which reduces the reliance on manual intervention and professional knowledge by introducing automated feature extraction and classification processes, so that ordinary users can also quickly deploy and use the system to effectively defend against the threat of ransomware.

[0014] (5) Solve the classification problem in large-scale data sets: With the explosive growth of network data, existing ransomware detection systems often face the problems of insufficient computing resources and slow processing speed when processing large-scale data sets. The present invention improves the processing efficiency on large-scale data sets by adopting parallel computing technology and optimized large model structure, so that the system can quickly identify and classify ransomware in massive network traffic, meeting the real-time detection needs in modern network environments.

[0015] (6) Responding to the rapidly evolving ransomware ecosystem: The development of ransomware shows a trend of rapid evolution and diversification. Traditional detection and classification methods cannot keep up with the evolution of the virus family in a timely manner, resulting in a decrease in detection effect. The present invention uses the adaptive learning ability of a large model to continuously adjust and optimize the classification model during the changes in the virus ecosystem, thereby always maintaining efficient detection and accurate classification of new ransomware and reducing security risks in the network environment.

[0016] The present invention provides a method for classifying ransomware viruses based on a large model, comprising the following steps:

[0017] S1, the data collection and preprocessing module collects data and captures ransomware data for preprocessing to obtain preprocessed data;

[0018] S2, the large model training and feature extraction module uses a deep learning large model to learn and extract features from the preprocessed data to obtain advanced feature representations. The deep learning large model is a large model that has undergone unsupervised or semi-supervised pre-training and then fine-tuned based on the SFT-supervised feature corpus fine-tuning;

[0019] S3. The multi-level classification module performs multi-level classification on the ransomware according to the high-level feature representation. The multi-level classification includes preliminary classification and refined classification. In the preliminary classification, the ransomware samples are classified into virus families or types according to the high-level features. In the refined classification, the graph-level feature vectors of the ransomware samples are extracted through the graph neural network, and the graph-level feature vectors are classified using the classifier to identify the variants and behavior patterns of the ransomware. It is determined whether the identified ransomware is a new ransomware sample. If yes, it proceeds to step S4. If not, it proceeds to step S5.

[0020] S4, the dynamic adaptive update module dynamically adjusts the parameters of the deep learning large model according to the new ransomware virus sample, and enters step S5;

[0021] S5. The user performs ransomware classification through the user interaction and management module, and a ransomware classification method based on a large model is completed.

[0022] The ransomware classification method based on a large model described in the present invention is, as a preferred embodiment, in step S1, the data collection and preprocessing module collects historical network traffic data, historical file system data, historical behavior logs and network traffic data to be analyzed, file system data to be analyzed, and behavior logs to be analyzed for training the deep learning large model, and the ransomware data includes traffic features related to the ransomware extracted from network communication data packets, suspected ransomware samples / behavior logs captured from file system data, and operation behavior records in the system;

[0023] Traffic features related to ransomware include: suspicious IP addresses, port usage, attack payload, packet length, and file type HASH. Suspected ransomware samples / behavior logs include: suspicious file generation and modification records, and operation behavior records include file access and process startup.

[0024] Preprocessing methods include data cleaning, formatting, normalization and feature selection. The data cleaning method is to remove invalid, duplicate or noisy data; the formatting method is to convert data from different sources into a unified format; the normalization method is to normalize numerical features; the feature selection method is to select the most representative data features according to predefined criteria.

[0025] The method for classifying ransomware based on a large model described in the present invention is preferably such that step S2 includes the following steps:

[0026] S21. Use the collected historical ransomware virus data to train the deep learning large model. The historical ransomware virus data is the historical network traffic data, historical file system data, and historical behavior logs collected by the data collection and preprocessing module. The historical ransomware virus data includes virus families and virus variants.

[0027] S22. Use the deep learning big model to extract features and generate pseudo labels. The pseudo labels include family features, sample features, and intelligence features of the ransomware virus. The pseudo labels are combined with manually annotated real data to obtain a fine-tuning dedicated data set and fine-tune the deep learning big model.

[0028] S23. Through the self-attention mechanism combined with the retraining of the embedding layer, the deep learning large model can map the input data to the corresponding feature space and generate high-level feature representation.

[0029] The method for classifying ransomware based on a large model described in the present invention is, as a preferred embodiment, in step S22, the method for fine-tuning the deep learning large model includes:

[0030] S221. In the feature extraction stage, the deep learning model generates pseudo labels based on specific variant features.

[0031]

[0032] Among them, x i is the feature vector of the original ransomware sample, ∫ is the feature extraction function, and the specific variant features include encryption algorithm and propagation method;

[0033]

[0034] Among them, C(x i ) is a special encryption algorithm, S(x i ) is the file structure difference;

[0035] S222. Use multi-level feature representation learning to capture both high-level family features and fine-grained variant features:

[0036] z i =Concat(h f ,h u );

[0037] Among them, z i is the joint feature, h f is a high-level family feature, h u It is a fine-grained variant feature;

[0038] S223. By optimizing the objective function L, the joint loss of family and variant features is learned at the same time:

[0039] L=L family (h f )L variant (h u );

[0040] Among them, L is the joint loss function, L family is the family classification loss, L variant is the variant classification loss;

[0041] S224. For new variant data, the deep learning model introduces an adaptive learning mechanism, and updates the parameters through the gradient descent method at each training iteration:

[0042] θ t+1 =θ t -αΔ θ L(x new ,θ t );

[0043] Among them, α is the learning rate dynamically adjusted according to the new variant data, Δ θ L is the gradient of the joint loss function L with respect to the model parameter θ, Δ θ is the update amount of the model parameters;

[0044] S225. Generate adversarial samples x through adversarial training method adu , adversarial sample x adu By adding a perturbation term ∈·sign(Δ x L(x,y)) to generate:

[0045] x adu =x+∈·sign(Δ x L(x,y));

[0046] Among them, ∈ controls the size of the disturbance, sign(Δ x L(x,y)) is the sign of the gradient of the loss function with respect to the input x, Δ x is the disturbance or change of the input data;

[0047] S226. Use the LoRA method to adjust the parameters of the deep learning large model. LoRA decomposes the original weight matrix W into low-rank matrices A and B. The dimensions of A and B are smaller than the original weight matrix W.

[0048] Freeze the original weight matrix W and do not update it. Only train the newly added low-rank matrices A and B. During the training process, only the newly added low-rank matrices AA and BB are involved in the gradient update, and the original weight matrix W remains unchanged:

[0049] The fine-tuned weight W'=W+ΔW.

[0050] The method for classifying ransomware based on a large model described in the present invention is preferably such that, in step S226, ΔW=A×B;

[0051] The dimension of the low-rank matrix A is d×r, and the dimension of the low-rank matrix B is r×k, where r is the rank number and r is smaller than d and k.

[0052] The ransomware classification method based on a large model described in the present invention is, as a preferred method, in step S23, the deep learning large model extracts basic features and abstract features from the input data during the training process, the basic features include byte frequency and operating system calls; the abstract features include the behavior pattern of the virus and the file encryption method; the high-level features are represented by the complex behavior patterns and features that can reflect the virus output after the deep learning large model understands the input data;

[0053] Inputting raw data or processed data including raw feature representation of virus samples into an embedding layer, the embedding layer maps discrete inputs into a continuous vector space, and learns distributed representations of words or byte sequences, wherein the discrete inputs include words or byte sequences;

[0054] In the feature extraction stage:

[0055] H l =Attention(H l-1 )·W l ;

[0056] Among them, H l is the feature representation of the lth layer, Attention(H l-1 ) is the feature representation H in the previous layer l-1 The representation obtained by applying the self-attention mechanism on l is the weight matrix of the lth layer.

[0057] The ransomware classification method based on a large model described in the present invention is preferably configured such that, in step S3, a graph neural network is used as a refined classification model;

[0058] The refined classification model represents the behavior patterns, file encryption methods, and ransom demand characteristics of ransomware samples as nodes in a graph, and uses edges to represent the dependencies or similarities between nodes;

[0059] During the training process, each node receives information from neighboring nodes through a message passing mechanism and updates its own feature representation to capture the complex associations in virus samples;

[0060] Then, the graph pooling operation is used to aggregate the features of the entire graph into a graph-level feature vector to facilitate subsequent refined classification;

[0061] Finally, the graph-level feature vectors are classified through the classifier to identify the specific variants, infection routes, and impact range of the ransomware. The classification results include the specific ransomware variant name, infection route, and impact range.

[0062] The ransomware classification method based on a large model described in the present invention is a preferred method. In the process of refined classification, the classifier classifies the extracted graph-level feature vectors to identify specific variants of the ransomware. The classification relies on the feature vectors obtained from the graph neural network. The feature vectors are the behavior pattern, encryption method, and ransom demand of the ransomware sample.

[0063] The classifier is based on a fully connected neural network, which gradually maps the input high-dimensional feature vector into a lower-dimensional space for classification through multiple layers of linear transformation and nonlinear activation functions;

[0064] The feature vector is processed through multiple layers of a fully connected neural network, each of which linearly transforms the original vector and applies a nonlinear activation function, allowing the deep learning large model to learn the classification boundaries;

[0065] The output of each layer is:

[0066] h (l+1) =σ(W (l) ·h (l) +b (l) );

[0067] Among them, h (l) is the input feature of the lth layer, W (l) is the weight matrix, b (l) is the bias term, σ is the nonlinear activation function;

[0068] The last layer is the Softmax classification layer, which is used to convert the output of the neural network into a probability distribution. Each output value represents the probability that the input feature vector belongs to a certain ransomware variant:

[0069]

[0070] Among them, z i is the i-th joint feature output by the last layer, C is the number of classification categories, P(y i |x) is the probability that the input sample is classified as the i-th category.

[0071] The ransomware classification method based on a large model described in the present invention is, as a preferred embodiment, in step S4, the ransomware classification system incorporates new ransomware samples into the training set, and uses incremental learning to update the parameters of the deep learning large model;

[0072] The ransomware classification system can deeply learn large models in real time;

[0073] The ransomware classification system has established a user feedback mechanism, allowing security experts or users to verify and provide feedback on the classification results.

[0074] The present invention provides a ransomware virus classification system based on a large model, the ransomware virus classification system comprises a data collection and preprocessing module, a large model training and feature extraction module, a multi-level classification module, and a dynamic adaptive update module and a user interaction and management module which are electrically connected in sequence to the large model training and feature extraction module;

[0075] The deep learning model is a Transformer model or a GPT model, and the classifier of the multi-level classification module is based on a fully connected neural network;

[0076] The user interaction and management module provides a user interface and API interface, supports users to perform system configuration, data input, result viewing and management operations, and sets up a permission management mechanism. Users configure system parameters, upload data and view classification results through the user interface. The graphical user interface also supports chart display, and users can view statistical analysis and trend changes of classification results. The user interaction and management module provides a RESTful API, supports programmatic docking with external systems, and performs data input, classification result output and model management.

[0077] This invention overcomes the limitations and deficiencies of existing ransomware detection and classification methods by introducing large model technology, realizes efficient detection and accurate classification of diversified ransomware, enhances the generalization ability of the model, reduces resource consumption, improves the usability and applicability of the system, and adapts to large-scale data environments and rapidly evolving ransomware ecosystems. These technical improvements will significantly improve the overall level of network security defense and provide users with a more reliable and efficient ransomware protection solution.

[0078] The present invention proposes a ransomware classification method and system based on a large model, aiming to solve the problems of low ransomware detection and classification efficiency, poor generalization ability, high resource consumption, and complex system in the prior art. The technical solution of the present invention has the following key features and innovations:

[0079] Feature extraction and classification driven by big models: This paper uses a deep learning big model and uses its powerful feature learning ability to automatically extract features from ransomware samples. By learning from massive amounts of historical ransomware data, the big model can generate highly abstract feature representations that can not only accurately distinguish different types of ransomware, but also effectively identify new variants and families.

[0080] Multi-level classification architecture: In order to improve the accuracy and efficiency of classification, the present invention designs a multi-level classification architecture. At the first level, the system preliminarily classifies the ransomware based on the extracted high-level features and classifies it into a specific virus family or category. In subsequent levels, the system further analyzes the specific behavior patterns and characteristics of the virus to complete the refined classification. This hierarchical structure ensures that the system can still maintain efficient and accurate classification capabilities when facing complex virus samples.

[0081] Dynamic adaptive model update: This invention introduces a dynamic adaptive model update mechanism. When new ransomware samples or variants appear, the system can quickly update the existing large model parameters through incremental learning to ensure that the model can adapt to changes in the virus ecology in a timely manner. This mechanism reduces the need for manual intervention while ensuring the continued efficiency and accuracy of the system.

[0082] Efficient resource utilization and parallel computing: In response to the large-scale data processing requirements that may be encountered during ransomware detection and classification, the present invention optimizes the computing architecture of the model and adopts parallel computing technology and efficient resource allocation strategies. This enables the system to maintain low resource consumption and efficient operation speed when processing massive data, and is suitable for large-scale deployment in actual network environments.

[0083] Simplified user interface and automated operation: The present invention pays special attention to the ease of use of the system, designs a simplified user interface, and introduces a highly automated operation process. Users only need to make a small amount of configuration to start the system and perform ransomware virus detection and classification, which significantly reduces the threshold for using the system and expands its applicability in small and medium-sized enterprises and individual users.

[0084] This invention introduces large model technology and innovative classification architecture to construct an efficient, accurate and easy-to-use ransomware classification method and system, which can significantly improve the detection and defense effects of ransomware in practical applications. This technical solution not only covers a wide range of ransomware types and variants, but also can adapt to the rapidly changing network threat environment and provide users with comprehensive security protection.

[0085] The present invention has the following advantages:

[0086] (1) Highly intelligent detection and classification: The present invention realizes intelligent detection and classification of ransomware through the deep learning ability of large models. Compared with the traditional feature code matching method, the present invention can automatically learn and extract deep-level features, thereby effectively dealing with frequently mutated ransomware. This not only improves the accuracy of detection, but also significantly reduces the reliance on manual intervention and reduces false positives and false negatives.

[0087] (2) Strong generalization ability: Traditional machine learning models often fail when dealing with new ransomware, especially when virus variants evolve rapidly. The large model of the present invention enables the system to have stronger generalization ability by learning the common features of a wide range of virus families. This means that the system can better deal with different types of ransomware, regardless of which virus family it belongs to, ensuring efficient detection and classification effects.

[0088] (3) Efficient resource utilization and parallel processing: When processing large-scale data sets, traditional dynamic analysis methods often face bottlenecks such as high consumption of computing resources and slow processing speed. The present invention significantly improves resource utilization by adopting parallel computing technology and optimized model architecture, allowing the system to maintain efficient operation in a massive data environment. This high efficiency provides technical support for real-time detection and classification, which is difficult to achieve with traditional methods.

[0089] (4) Simplified user experience: Compared with traditional systems, the present invention places special emphasis on the ease of use of the system, and designs a simplified user interface and automated operation process. Users can easily complete the configuration and operation of the system without having to have deep professional knowledge, which lowers the technical threshold and expands the system's applicable population, including small and medium-sized enterprises and individual users. This is a significant advantage over existing complex systems with high operating requirements.

[0090] (5) Real-time adaptation to ransomware ecological changes: Traditional systems are usually slow to respond to changes in the virus ecology and have difficulty adapting to new threats. The present invention uses a dynamic adaptive model update mechanism to quickly adjust system parameters to respond to the emergence of new ransomware. This real-time adaptability allows the system to remain forward-looking in the process of responding to the evolution of ransomware, reducing potential security risks.

[0091] (6) Compared with the existing technology, the present invention has significant advantages in intelligent detection, resource utilization, user experience, data fusion, ecological adaptability and defense system integration. These beneficial effects not only improve the overall level of ransomware detection and defense, but also provide users with more efficient and comprehensive security protection solutions, far exceeding the capabilities of traditional technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Figure 1It is a large-model-based ransomware classification method and system architecture and flow chart;

[0093] Figure 2 This is a data preprocessing flow chart of a ransomware classification method and system based on a large model;

[0094] Figure 3 This is a big model training and feature extraction flow chart of a big model-based ransomware classification method and system;

[0095] Figure 4 A flowchart of a ransomware classification method based on a large model and a multi-level classification module of the system for hierarchical classification of ransomware;

[0096] Figure 5 The present invention is a large-model-based ransomware classification method and a flow chart of the system's dynamic adaptive update module. DETAILED DESCRIPTION

[0097] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0098] Example 1

[0099] like Figures 1 to 5 As shown, the present invention provides a ransomware virus classification method and system based on a large model, which is mainly composed of a data preprocessing module, a large model feature extraction module, a multi-level classification module, a dynamic update module and a user interaction module.

[0100] like Figure 1 As shown in the figure, the overall architecture of the ransomware classification system based on the big model includes multiple modules such as data collection and preprocessing, big model training and feature extraction, multi-level classification, dynamic adaptive update, and user interaction and management. Each module interacts with data and instructions through the internal interface to form a complete ransomware classification and defense system.

[0101] Data collection and preprocessing module: This module is responsible for collecting data from various sources such as network traffic, file systems, behavior logs, etc., and performing preprocessing operations such as cleaning, formatting, and normalization on the data to ensure the quality and consistency of the input data.

[0102] Large model training and feature extraction module: Using the deep learning large model, the preprocessed data is trained and extracted to generate high-level feature representations. These features will be used in the subsequent classification steps.

[0103] Multi-level classification module: Based on the features extracted from the large model, the system performs multi-level classification of ransomware, including preliminary classification and refined classification. Preliminary classification is responsible for identifying the virus family or type, while refined classification further identifies the specific variants and behavior patterns of the virus.

[0104] Dynamic adaptive update module: When a new ransomware sample appears, this module is responsible for dynamically adjusting the parameters of the large model and ensuring that the model can adapt to the new threat environment in a timely manner through incremental learning.

[0105] User interaction and management module: provides user interface and API interface, allowing users to perform system configuration, data input, result viewing and other operations.

[0106] Step 1: Data collection and preprocessing module

[0107] like Figure 2 As shown, the data collection and preprocessing module is the basis of the entire system, responsible for collecting information from multiple data sources and normalizing it.

[0108] ① Data collection: Network traffic data: By capturing data packets in network communications, traffic features related to ransomware are extracted, such as suspicious IP addresses, port usage, attack payload, data packet length, file type HASH, etc. File system data: Scan the file system to capture possible ransomware samples and behavior logs, such as the generation and modification records of suspicious files. Behavior logs: Record various operating behaviors in the system, including file access, process startup, etc., for analyzing potential ransomware activities.

[0109] ② Data preprocessing: Data cleaning: Remove invalid, duplicate or noisy data to ensure the accuracy of subsequent processing. Formatting: Convert data from different sources into a unified format for subsequent module processing. Normalization: Normalize numerical features to prevent data of different scales from affecting classification results. Feature selection: Select the most representative data features according to predefined criteria to reduce dimensionality and computational complexity.

[0110] Step 2: Large model training and feature extraction module

[0111] like Figure 3 As shown in the figure, after data preprocessing is completed, the core large model training and feature extraction module will be carried out through a deep learning model (such as a Transformer or GPT model). This module relies on the self-attention mechanism of the model to extract important features from the input complex ransomware data.

[0112] Large model selection: The system uses pre-trained large models, such as the Transformer model, which have strong learning capabilities and can extract abstract features from large amounts of complex data. After pre-training on large-scale data sets (such as the Transformer and GPT models), they have acquired rich language and sequence feature learning capabilities, especially in terms of text structure and time dependencies. Through fine-tuning, these models can quickly adapt to ransomware detection tasks and be optimized according to specific needs to ensure the best results in ransomware classification tasks.

[0113] Model training: Use the collected historical ransomware data to train the model. The training data should include samples of different virus families and variants to ensure that the model can learn the diversity characteristics of the virus. Through supervised learning, the model learns to map the input data to the corresponding feature space and generate high-level feature representations. At the same time, select a dedicated data set related to ransomware to fine-tune the pre-trained model. During fine-tuning, use multiple types of ransomware samples to ensure that the model can learn the characteristics of different families and variants. Fine-tune using supervised learning, and use classification labels to guide the model's learning process. During the fine-tuning process, focus on the model's performance in identifying virus variants to ensure its generalization ability. During the training process, feature extraction is not limited to the original features, but also generates more abstract high-level feature representations, which further improves the detection effect of the model.

[0114] Model fine-tuning: Based on the fine-tuning of the feature corpus supervised by SFT, the large model is first pre-trained in an unsupervised or semi-supervised manner to output a model with preliminary feature learning capabilities that can identify basic ransomware features. Next, pseudo-labels are generated through feature extraction, including family features of ransomware (such as specific encryption algorithms and propagation methods), sample features (such as file structure and code patterns), and intelligence features (such as associated IP addresses, domain names, etc.). These pseudo-labels are combined with manually annotated real data to form a comprehensive dataset for fine-tuning.

[0115] During the fine-tuning process, we paid special attention to the model's performance in identifying ransomware variants. To this end, we adopted a series of technical means to improve the model's variant recognition ability: First, in the feature extraction stage, we generated fine-grained pseudo-labels (including special encryption algorithms, propagation methods, etc.) for the virus variant features, and based on these pseudo-labels generated by the features, we marked the unique features of the virus variant. In the feature extraction stage, assuming that the feature vector of the original ransomware sample is x i , pseudo label Generated based on specific variant features (such as encryption algorithm, propagation method, etc.).

[0116]

[0117] Among them, ∫ is a feature extraction function, targeting the specific variant behaviors of the ransomware, such as the special encryption algorithm C, the file structure difference S, etc.:

[0118]

[0119] This process generates fine-grained pseudo-labels to annotate the unique features of variants. The dataset annotated with pseudo-labels contains virus family characteristics (such as typical ransomware behavior patterns) and variant characteristics (such as slight differences in file structure).

[0120] Secondly, by using multi-level feature representation learning, we can capture both high-level family features and fine-grained variant features, thus improving the ability to classify different virus variants. f , the fine-grained variant feature is represented as h u , the joint features learned by the neural network are expressed as:

[0121] z i =Concat(h f ,h u );

[0122] The joint feature is obtained by concatenating high-level family features h f and fine-grained variant features h u This feature represents a combination of family-level features and detailed features of specific variants, which is used to distinguish and classify virus families and specific variants;

[0123] By optimizing the objective function L, the joint loss of learning family and variant features is: L = L family (h f )L variant (h u );

[0124] The joint loss function L is used to simultaneously optimize the family classification loss L family and variant classification loss L variant . It ensures that the model learns both family-level and variant-level feature representations during training to improve the ability to distinguish virus families and variants.

[0125] For new variant data, the model introduces an adaptive learning mechanism. Assume that the feature representation of the new data is x new , the model parameters θ are dynamically adjusted through the online update mechanism, and the learning rate α is adaptively adjusted.

[0126] θ t+1 =θ t -αΔ θ L(x new,θ t )

[0127] Among them, α is dynamically adjusted according to the data of the new variant to ensure that the model has good adaptability when facing new variants. In each training iteration, the parameters are updated by gradient descent. The learning rate α controls the step size of each update, Δ θ L is the gradient of the loss function L with respect to the model parameters θ, Δ θ It is the update amount of the model parameters, which are iteratively updated through optimization algorithms such as gradient descent during the training process to reduce the prediction error of the model.

[0128] At the same time, through the adversarial training method, the adversarial sample x is generated adu , imitating possible variant behaviors, adversarial samples are generated by the following formula:

[0129] x adu =x+∈·sign(Δ x L(x,y)

[0130] By adding a perturbation term ∈·sign(Δ x L(x,y)) to generate adversarial samples x adu Here, ∈ controls the size of the perturbation, sign(Δ x L(x,y)) represents the sign of the gradient of the loss function with respect to the input x, Δ x The perturbation or change in the input data is usually used in adversarial training to enhance the robustness of the model to small changes by introducing perturbations. This formula is used to generate adversarial samples that are misleading to the model to improve the robustness of the model and its ability to defend against adversarial attacks.

[0131] In addition, meta-learning technology is used to ensure that the model can quickly adapt to a small amount of variant data and improve the classification accuracy of new variants. Subsequently, the message segmentation model and message status model are trained separately to ensure that the model can accurately parse the feature information in the message.

[0132] In order to reduce the computational scale, the final output optimized lightweight model version uses the LoRA (Low-Rank Adaptation) method for parameter adjustment. The core idea is to reduce the consumption of computing resources by reducing the number of parameters that need to be trained. Specifically, LoRA focuses on the weight matrix of the self-attention layer in the model and decomposes it into a low-rank matrix, thereby reducing the number of parameters while maintaining the expressiveness of the model.

[0133] Specific steps for parameter adjustment of LoRA method

[0134] Low-rank decomposition of the original weight matrix

[0135] The core of the Transformer model is the self-attention mechanism, in which the weight matrix W usually has high dimensions. In the LoRA method, the original weight matrix W is decomposed into two smaller low-rank matrices A and B, satisfying W≈A×B, where the dimensions of A and B are much smaller than the original matrix W.

[0136] ΔW=A×B

[0137] Among them, A is a low-rank matrix, whose dimension is usually d×r, and B is another low-rank matrix, whose dimension is r×k, where r represents the rank number, that is, the degree of dimensionality reduction. In order to achieve a significant reduction in the number of parameters, r is usually much smaller than d and k, thereby reducing computational complexity and memory consumption while maintaining model performance.

[0138] Specifically, d and k are the dimensions of the original weight matrix, and r is a smaller value used to approximate these dimensions. By limiting the size of r, the LoRA method can only fine-tune the newly added low-rank matrices A and B while keeping the original weight matrix W unchanged, thereby effectively reducing the computational overhead.

[0139] During the fine-tuning phase, LoRA freezes the original weight matrix W in the Transformer model and does not update it. Instead, it only trains the newly added low-rank matrices A and B. Since the number of parameters of A and B is much smaller than W, this greatly reduces the number of parameters that need to be fine-tuned.

[0140] During the training process, only the newly added low-rank matrices AA and BB participate in the gradient update, while the original weight matrix W remains unchanged. This method can reduce computational overhead and improve training efficiency, and is particularly suitable for processing large-scale models. The fine-tuned weight W'=W+ΔW, that is, W'=W+A×B, and A and B are the core parts of the training. A significant advantage of the LoRA method is that it concentrates the additional computational burden of the model on the low-rank matrix, keeping the model lightweight. Therefore, the model fine-tuned by LoRA can significantly reduce the demand for computing resources while maintaining high performance, generating a more efficient ransomware classification model.

[0141] Feature extraction: After training, the model can automatically extract distinguishing features from the input data, which will be used for subsequent virus classification. The feature extraction process is automated, and the system selects the appropriate level for feature extraction based on the different types and complexity of the data. In this process, the processing of the Embedding layer and the generation of high-level feature representations are particularly important;

[0142] Feature extraction process: During the training process, the model automatically extracts discriminative features from the input data. These features include low-level basic features (such as byte frequency, operating system calls, etc.) and higher-level abstract features (such as virus behavior patterns, file encryption methods, etc.).

[0143] Processing of the Embedding layer: Input: raw data or processed data, usually including the original feature representation of the virus sample. The Embedding layer learns the distributed representation of vocabulary or byte sequences by mapping discrete inputs (such as vocabulary or byte sequences) into a continuous vector space. The feature vectors generated by the retrained Embedding layer can better capture the contextual information of the input data and improve the ability of subsequent layers to understand the data.

[0144] High-level feature representation: During the feature extraction phase, the model generates more abstract high-level feature representations that can capture the deep structure and patterns of the data, thereby improving classification performance.

[0145] When using Transformer or similar deep learning models, the generation of feature representation can be expressed by the following formula:

[0146] H l =Attention(H l-1 )·W l

[0147] Among them, H l is the feature representation of the lth layer, Attention (H l-1 ) indicates that the feature representation H in the previous layer l-1 The representation obtained by applying the self-attention mechanism on l is the weight matrix of this layer. In this representation, the model focuses on different parts of the input data through the self-attention mechanism to generate meaningful feature representations of the input data. These high-level features are usually the model's deep understanding of the input data and can reflect the complex behavior patterns and characteristics of the virus.

[0148] Through these steps, the model is able to extract highly discriminative features from the input data, which play a key role in classification tasks. The retraining of the Embedding layer ensures that the feature representation can adapt to the new data requirements, while the generation of high-level feature representation provides an understanding of the deep structure of the data.

[0149] Step 3: Multi-level classification module

[0150] like Figure 4As shown, this module is responsible for hierarchical classification of ransomware based on the extracted features, including preliminary classification and refined classification.

[0151] Preliminary classification: The system first performs preliminary classification of ransomware samples based on the extracted high-level features. The goal of preliminary classification is to classify the virus into a specific virus family or type (such as WannaCry, Locky, etc.). Ensure classification speed and preliminary accuracy.

[0152] Refined classification: After the initial classification is completed, the system further refines the classification of virus samples. Refined classification analyzes the specific behavior patterns, file encryption methods, ransom demands and other features of the virus. The refined classification model uses a graph neural network. First, the behavior patterns, file encryption methods, ransom demands and other features of the ransomware samples are represented as nodes in the graph, and the dependencies or similarities between these nodes are represented by edges. During the training process, each node receives information from neighboring nodes through a message passing mechanism and updates its own feature representation, which can capture the complex associations in the virus samples. Next, the graph pooling operation is used to aggregate the features of the entire graph into a graph-level feature vector, which is convenient for subsequent refined classification. Finally, these feature vectors are classified by the designed classifier to identify the specific variants, infection routes and impact range of the ransomware. The classification results include detailed information such as the specific ransomware variant name, infection route, and impact range.

[0153] In the process of refined classification, the core role of the classifier is to classify the extracted graph-level feature vectors and identify specific variants of the ransomware. The classification step here relies on feature vectors obtained from the graph neural network (GNN), which represent high-level information such as the behavior pattern, encryption method, and ransom demand of the ransomware sample.

[0154] Steps for the classifier to classify the feature vector: After being processed by the graph neural network (GNN), the ransomware sample is represented as a graph-level feature vector. This feature vector contains all the associated features extracted from information such as behavior patterns, encryption methods, and ransom demands, and is a high-dimensional representation of the ransomware sample.

[0155] The classifier is based on fully connected neural network technology, which is able to handle high-dimensional feature vectors well and classify complex patterns. Fully connected neural networks gradually map the input high-dimensional feature vectors into a lower-dimensional space through multiple layers of linear transformations and nonlinear activation functions (such as ReLU or Sigmoid) to achieve classification.

[0156] The feature vector is processed by multiple layers of a fully connected neural network. Each layer linearly transforms the original vector (i.e., through the transformation of the weight matrix and the bias term) and applies a nonlinear activation function, so that the model can learn complex classification boundaries. The output of each layer can be expressed as:

[0157] h (l+1) =σ(W (l) ·h (l) +b (l) )

[0158] Among them, h (l) is the input feature of the lth layer, W (l) is the weight matrix, b (l) is the bias term, and σ is a nonlinear activation function, such as ReLU.

[0159] The last layer is usually a Softmax classification layer, which is used to convert the output of the neural network into a probability distribution. Each output value represents the probability that the input feature vector belongs to a certain ransomware variant.

[0160]

[0161] Among them, z i is the i-th element of the last layer output, C is the number of classification categories, P(y i |x) represents the probability that the input sample is classified as the i-th category.

[0162] Through the probability value output by the Softmax layer, the model can determine which variant has the highest probability and use the variant as the classification result of the ransomware. The classification result is not only the specific variant name of the virus, but also includes detailed information such as **infection path, impact range**. This information comes from various high-dimensional information in the feature vector, such as behavior patterns, encryption methods, ransom demands, etc. The classifier classifies the graph-level feature vector extracted by the graph neural network, uses a fully connected neural network to gradually refine the high-dimensional information, and uses the Softmax layer to generate classification probabilities, and finally identifies the specific variant of the ransomware and its related features, such as infection path and impact range. This process can effectively distinguish different variants of the virus and improve the precision and accuracy of ransomware detection.

[0163] Step 4: Dynamically Adaptive Update Module

[0164] like Figure 5 As shown, in order to cope with the continuous evolution of ransomware viruses, the present invention designs a dynamic adaptive update mechanism to perform incremental learning, real-time updates and feedback to ensure that the system can adapt to new threats in a timely manner.

[0165] Incremental learning: When new ransomware samples are detected, the system automatically incorporates these samples into the training set and uses incremental learning technology to update the parameters of the large model. Incremental learning ensures that the model can quickly adapt to new ransomware without completely retraining.

[0166] Real-time update: The system supports real-time model update, so that in actual applications, the classifier can immediately use the latest data for detection and classification. The real-time update mechanism ensures that the model update is completed without affecting system performance by optimizing algorithms and resource scheduling.

[0167] Feedback mechanism: The system has established a user feedback mechanism, allowing security experts or users to verify and provide feedback on the classification results. The feedback information will serve as an important reference for model optimization and further improve the accuracy of the system.

[0168] Step 5: User interaction and management module

[0169] This module provides a user interface and API interface to support users in system configuration, data input, result viewing and management operations.

[0170] User interface: Provides a friendly graphical user interface (GUI), through which users can intuitively configure system parameters, upload data and view classification results. The interface also supports chart display, and users can view statistical analysis, trend changes and other information of classification results.

[0171] API interface: The system provides RESTful API, which supports programmatic connection with external systems to achieve data input, classification result output, model management and other operations. The API interface is simple in design and easy to integrate, and can be seamlessly connected with existing security defense systems or other applications.

[0172] Permission management: The system has a built-in multi-level permission management mechanism, and different user roles have different operation permissions. Administrators can control advanced operations such as system configuration, model update, data management, etc., while ordinary users can only perform routine operations such as data upload and result viewing.

[0173] Through the above detailed description, the various modules and operation steps of the ransomware classification method and system based on the large model of the present invention have been clearly described. Through the collaborative work of multiple innovative technical modules, the system can effectively improve the accuracy, real-time and ease of use of ransomware detection and classification, and is suitable for a wide range of network security protection needs.

[0174] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A ransomware virus classification method based on a large model, characterized by: The following steps are involved: S1, the data collection and preprocessing module collects data and captures ransomware data for preprocessing to obtain preprocessed data; S2, the large model training and feature extraction module uses a deep learning large model to perform feature learning and extraction on the preprocessed data to obtain a high-level feature representation, wherein the deep learning large model is a large model that has undergone unsupervised or semi-supervised pre-training and then fine-tuned based on the feature corpus supervised by SFT; S3, the multi-level classification module performs multi-level classification on the ransomware virus according to the high-level feature representation, and the multi-level classification includes preliminary classification and refined classification; in the preliminary classification, the ransomware virus sample is classified into a virus family or type according to the high-level feature, and in the refined classification, the graph-level feature vector of the ransomware virus sample is extracted through the graph neural network, and the graph-level feature vector is classified by the classifier to identify the variant and behavior pattern of the ransomware virus; it is determined whether the identified ransomware virus is a new ransomware virus sample, if yes, proceed to step S4, if not, proceed to step S5; S4, the dynamic adaptive update module dynamically adjusts the parameters of the deep learning large model according to the new ransomware virus sample, and enters step S5; S5. The user performs ransomware classification through the user interaction and management module, and a ransomware classification method based on a large model is completed.

2. According to a large model-based ransomware virus classification method according to claim 1, it is characterized by: In step S1, the data collection and preprocessing module collects historical network traffic data, historical file system data, historical behavior logs for training the deep learning large model, and network traffic data to be analyzed, file system data to be analyzed, and behavior logs to be analyzed for analysis. The ransomware data includes traffic features related to the ransomware extracted from network communication data packets, suspected ransomware samples / behavior logs captured from file system data, and operation behavior records in the system; The traffic features related to ransomware include: suspicious IP addresses, port usage, attack payload, data packet length and file type HASH; the suspected ransomware samples / behavior logs include: suspicious file generation and modification records; the operation behavior records include file access and process startup; Preprocessing methods include data cleaning, formatting, normalization and feature selection. The data cleaning method is to remove invalid, duplicate or noisy data; the formatting method is to convert data from different sources into a unified format; the normalization method is to normalize numerical features; the feature selection method is to select the most representative data features according to predefined criteria.

3. According to a large model-based ransomware virus classification method according to claim 1, it is characterized by: Step S2 includes the following steps: S21. Use the collected historical ransomware virus data to train the deep learning large model, where the historical ransomware virus data is the historical network traffic data, historical file system data, and historical behavior logs collected by the data collection and preprocessing module, and the historical ransomware virus data includes virus families and virus variants; S22, using the deep learning big model to perform feature extraction to generate pseudo labels, wherein the pseudo labels include family features, sample features, and intelligence features of the ransomware virus, and the pseudo labels are combined with manually annotated real data to obtain a fine-tuning dedicated data set and fine-tune the deep learning big model; S23. Through the self-attention mechanism combined with the retraining of the embedding layer, the deep learning large model maps the input data into the corresponding feature space and generates the high-level feature representation.

4. According to a large model-based ransomware virus classification method according to claim 2, it is characterized by: In step S22, the method for fine-tuning the deep learning large model includes: S221, in the feature extraction stage, the deep learning model generates pseudo labels based on specific variant features Among them, x i is the feature vector of the original ransomware sample, ∫ is the feature extraction function, and the specific variant features include encryption algorithm and propagation method; Among them, C(x i ) is a special encryption algorithm, S(x i ) is the file structure difference; S222. Use multi-level feature representation learning to capture both high-level family features and fine-grained variant features: z i =Concat(h f ,h u ); Among them, z i is the joint feature, h f is a high-level family feature, h u It is a fine-grained variant feature; S223. By optimizing the objective function L, the joint loss of family and variant features is learned at the same time: L=L family (h f )L variant (h u ); Among them, L is the joint loss function, L family is the family classification loss, L variant is the variant classification loss; S224. For new variant data, the deep learning large model introduces an adaptive learning mechanism, and updates parameters by gradient descent method in each training iteration: i t+1 =θ t -aD θ L(x new ,the t ); Among them, α is the learning rate dynamically adjusted according to the new variant data, Δ θ L is the gradient of the joint loss function L with respect to the model parameter θ, and Δθ is the update amount of the model parameter; S225. Generate adversarial samples x through adversarial training method adu , the adversarial sample x adu By adding a perturbation term ∈·sign(Δ x L(x,y)) to generate: x adu =x+∈·sign(Δ x L(x,y)); Among them, ∈ controls the size of the disturbance, sign(Δ x L(x, y)) is the sign of the gradient of the loss function with respect to the input x, Δ x is the disturbance or change of the input data; S226, using the LoRA method to adjust the parameters of the deep learning large model, LoRA decomposes the original weight matrix W into low-rank matrices A and B, and the dimensions of A and B are smaller than the original weight matrix W; Freeze the original weight matrix W and do not update it. Only train the newly added low-rank matrices A and B. During the training process, only the newly added low-rank matrices AA and BB are involved in the gradient update, and the original weight matrix W remains unchanged: The fine-tuned weight W'=W+ΔW.

5. According to the large model-based ransomware virus classification method of claim 4, it is characterized by: In step S226, ΔW=A×B; The dimension of the low-rank matrix A is d×r, and the dimension of the low-rank matrix B is r×k, where r is the rank number and r is smaller than d and k.

6. According to a large model-based ransomware virus classification method according to claim 4, it is characterized in that: In step S23, the deep learning big model extracts basic features and abstract features from the input data during the training process, wherein the basic features include byte frequency and operating system calls; the abstract features include virus behavior patterns and file encryption methods; the high-level features are represented by complex behavior patterns and features that can reflect the virus and are output by the deep learning big model after understanding the input data; Inputting raw data or processed data including raw feature representation of virus samples into an embedding layer, the embedding layer maps discrete inputs into a continuous vector space, and learns a distributed representation of a vocabulary or a byte sequence, wherein the discrete inputs include vocabulary or a byte sequence; In the feature extraction stage: H l =Attention(H l-1 )·W l ; Among them, H l is the feature representation of the lth layer, Attention(H l-1 ) is the feature representation H in the previous layer l-1 The representation obtained by applying the self-attention mechanism on l is the weight matrix of the lth layer.

7. The method for classifying ransomware based on a large model according to claim 1, characterized in that: In step S3, the refined classification model adopts a graph neural network; The refined classification model represents the behavior pattern, file encryption method, and ransom demand characteristics of the ransomware sample as nodes in a graph, and represents the dependency or similarity between the nodes through edges; During the training process, each node receives information from neighboring nodes through a message passing mechanism and updates its own feature representation to capture the complex associations in virus samples; Then, the graph pooling operation is used to aggregate the features of the entire graph into a graph-level feature vector to facilitate subsequent refined classification; Finally, the graph-level feature vectors are classified by a classifier to identify specific variants, infection pathways, and impact ranges of the ransomware virus. The classification results include specific ransomware virus variant names, infection pathways, and impact ranges.

8. A method for classifying ransomware based on a large model according to claim 7, characterized in that: In the process of refined classification, the classifier classifies the extracted graph-level feature vectors to identify specific variants of the ransomware virus. The classification relies on the feature vectors obtained from the graph neural network. The feature vectors are the behavior pattern, encryption method, and ransom demand of the ransomware virus sample. The classifier is based on a fully connected neural network, which gradually maps the input high-dimensional feature vector into a lower-dimensional space for classification through multiple layers of linear transformation and nonlinear activation functions; The feature vector is processed through multiple levels of a fully connected neural network, each of which linearly transforms the original vector and applies a nonlinear activation function so that the deep learning model learns the classification boundaries; The output of each layer is: h (l+1) =σ(W (l) ·h (l) +b (l) ); Among them, h (l) is the input feature of the lth layer, W (l) is the weight matrix, b (l) is the bias term, σ is the nonlinear activation function; The last layer is the Softmax classification layer, which is used to convert the output of the neural network into a probability distribution. Each output value represents the probability that the input feature vector belongs to a certain ransomware variant: Among them, z i is the i-th joint feature output by the last layer, C is the number of classification categories, and P(yi|x) is the probability that the input sample is classified as the i-th category.

9. According to the large model-based ransomware virus classification method of claim 1, it is characterized by: In step S4, the ransomware classification system incorporates the new ransomware sample into the training set and uses incremental learning to update the parameters of the deep learning large model; The ransomware classification system can implement the deep learning big model in real time; The ransomware classification system establishes a user feedback mechanism, allowing security experts or users to verify and provide feedback on the classification results.

10. A large model-based ransomware classification system according to any one of claims 1 to 9, characterized in that: The ransomware classification system includes the data collection and preprocessing module, the large model training and feature extraction module, the multi-level classification module, and the dynamic adaptive update module and the user interaction and management module, which are electrically connected in sequence to the large model training and feature extraction module; The deep learning model is a Transformer model or a GPT model, and the classifier of the multi-level classification module is based on a fully connected neural network; The user interaction and management module provides a user interface and an API interface, supports users to perform system configuration, data input, result viewing and management operations, and sets up a permission management mechanism. Users configure system parameters, upload data and view classification results through the user interface. The graphical user interface also supports chart display, and users can view statistical analysis and trend changes of classification results. The user interaction and management module provides a RESTful API, supports docking with external systems in a programmatic manner, and performs data input, classification result output and model management.

Images