Terminal antivirus management system for deep learning based on Internet
By deploying intelligent data acquisition modules and analysis modules on terminal devices, and combining cloud deep learning security engines and confidential communication modules, traditional antivirus software is solved by not being able to detect new and complex virus variants, and powerful security protection for terminal devices and efficient confidentiality of communication data.
Patent Information
- Application Number
- CN202411926294.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-25
- Publication Date
- 2025-04-18
AI Technical Summary
Traditional terminal antivirus software is difficult to effectively detect and remove new and complex virus variants and malicious behaviors of stealing information through hidden communication channels.
The Internet-based deep learning terminal anti-virus management system is adopted, which includes an intelligent data acquisition module, an analysis module, a cloud-based deep learning security engine, a confidential communication module, a monitoring center and a security policy management center. The system realizes security monitoring and protection of terminal devices through deep neural network architecture, generative adversarial networks, autoencoders, semi-supervised learning algorithms, federated learning technology, hybrid encryption algorithms, blockchains and smart contracts and other technical means.
The system can quickly identify and prevent all kinds of known and unknown viruses and malware, effectively respond to the threats of new and complex virus variants, ensure the security of terminal devices and the confidentiality of communication data, and improve the intelligence level and adaptability of network security management.
Smart Images
Figure CN119848848A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer security technology, and more specifically, to a terminal antivirus management system based on Internet deep learning. Background Art
[0002] In today's digital age, terminal devices (such as computers, smart phones, servers, etc.) are widely used in various fields, including personal privacy data storage, corporate business secrets processing, and government sensitive information interaction. However, these terminal devices face many security threats from the Internet, such as attacks from various viruses and malware, as well as the risk of information leakage during communication.
[0003] Although traditional terminal antivirus software can detect and remove known viruses to a certain extent, it is often unable to cope with new and complex virus variants and malicious behaviors that steal information through covert communication channels. At the same time, in terms of ensuring communication security, the security of existing encryption technology is also challenged when facing advanced persistent threats (APT) and quantum computing attacks. In view of this, we propose a terminal antivirus management system based on Internet deep learning. Summary of the invention
[0004] The purpose of the present invention is to provide a terminal antivirus management system based on Internet deep learning, aiming to solve the problem that traditional terminal antivirus software, although able to detect and remove known viruses to a certain extent, is often unable to cope with new and complex virus variants and malicious acts of stealing information through covert communication channels.
[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a terminal antivirus management system based on Internet deep learning, the system includes an intelligent data acquisition module, an analysis module, a cloud-based deep learning security engine, a confidential communication module, a monitoring center and a security policy management center;
[0006] The intelligent data collection module is deployed on the terminal device to collect device operation and communication data, and the collected data includes system kernel call sequence, process memory access mode, five-tuple information of network data packets, and application program API call frequency and sequence;
[0007] The analysis module is deployed on the terminal device, and based on the local deep learning model, the collected device operation and communication data are initially analyzed by the local deep learning model and then encrypted and transmitted to the cloud;
[0008] The cloud-based deep learning security engine is based on a deep neural network architecture and uses security data training to identify various security threats and send detection and killing instructions and strategies to the terminal, and can self-update and optimize;
[0009] The confidential communication module is integrated on the terminal communication device, adopts a hybrid encryption algorithm to ensure the confidentiality and integrity of communication data, and has a key exchange and data verification mechanism;
[0010] The monitoring center is located in the cloud and performs fine-grained monitoring of terminal devices, including in-depth analysis of network traffic of specific applications, real-time verification of the integrity of key system files, and assessment of the physical location of the device and the security of the access network;
[0011] The security policy management center is located in the cloud, formulates and issues security policies to terminals, monitors the security status of devices and provides feedback and adjustments, and provides visual security situation reports.
[0012] Preferably, the local deep learning model adopts a lightweight neural network architecture based on the attention mechanism, which can quickly focus on key data features to make preliminary judgments on abnormal behaviors with low computing resource consumption. It also has incremental learning capabilities and can update its own parameters in real time according to newly collected data to adapt to dynamic changes in the operating status of the terminal device.
[0013] Preferably, the deep neural network architecture integrates generative adversarial networks and autoencoder technology. The generative adversarial network is used to generate simulated malicious samples to enhance the model's generalization ability for unknown threats, and the autoencoder is used to extract features and reduce the dimension of the data to improve model training efficiency and detection accuracy.
[0014] Preferably, the security data covers diverse virus samples, malicious behavior patterns, and various types of normal communication data, and through a semi-supervised learning algorithm, makes full use of unlabeled data to further improve model performance, and updates and optimizations are based on emerging security threat features. Federated learning technology is used to aggregate local model updates of multiple terminals without leaking terminal device privacy data, thereby achieving rapid iteration of the global model.
[0015] Preferably, in the symmetric encryption stage, the hybrid encryption algorithm uses an initial key generated based on quantum key distribution technology in combination with the AES-256 algorithm to encrypt data at high speed, and in the asymmetric encryption stage, uses an encryption algorithm based on the lattice cryptography system for key exchange and digital signature.
[0016] Preferably, the key exchange protocol is based on a multi-party key agreement extension protocol of an elliptic curve cryptography system, allowing secure negotiation of shared keys between multiple communication nodes, and is suitable for complex network communication scenarios.
[0017] Preferably, the data verification mechanism uses blockchain-based distributed ledger technology to record the hash value and digital signature of the data to ensure the integrity and non-tamperability of the data during transmission, and at the same time uses smart contracts to realize an automated verification process to improve verification efficiency and reliability.
[0018] Preferably, the security policy management center and the monitoring center both adopt a policy optimization algorithm based on reinforcement learning to dynamically adjust security policies according to the real-time security status of terminal devices, historical security event records, and changes in the network environment to maximize the overall network security benefits.
[0019] Preferably, the visual security situation report uses three-dimensional visualization technology to display the security risk distribution, security event trends and security policy execution effects of each terminal device in the network, providing administrators with intuitive and comprehensive decision support information.
[0020] Compared with the prior art, the present invention has the following beneficial effects:
[0021] 1. The present invention adopts a lightweight neural network architecture based on the attention mechanism, which can quickly focus on key data features, preliminarily judge abnormal behaviors, and reduce the consumption of computing resources on terminal devices. The cloud-based deep learning security engine integrates generative adversarial networks and autoencoder technology, and enhances the generalization ability of unknown threats by generating simulated malicious samples. The autoencoder is used to improve training efficiency and detection accuracy. In addition, the semi-supervised learning algorithm and federated learning technology can make full use of diversified data, realize rapid iteration of the global model, accurately identify various known and unknown viruses and malware, and effectively solve the problem that traditional antivirus software is unable to detect and kill new complex virus variants, providing powerful security protection for terminal devices.
[0022] 2. The present invention adopts a hybrid encryption algorithm. The symmetric encryption stage combines quantum key distribution technology and AES-256 algorithm, and the asymmetric encryption stage uses an encryption algorithm based on the lattice cryptography system, which greatly improves the encryption strength and effectively resists advanced threats such as quantum computing attacks. It ensures the confidentiality of communication data, and its key exchange protocol is based on the multi-party key negotiation extension protocol of the elliptic curve cryptography system, which is suitable for complex network communication scenarios. The data verification mechanism adopts blockchain and smart contract technology to ensure the integrity and non-tamperability of data during transmission, prevent information from being stolen or tampered with during the communication process, and effectively ensure communication security. It meets the strict confidentiality requirements of scenarios such as personal privacy data, corporate trade secrets and government sensitive information interaction.
[0023] 3. The present invention uses a policy optimization algorithm based on reinforcement learning to dynamically adjust security policies according to the real-time security status of terminal devices, historical security events and changes in the network environment. It can maximize the overall network security benefits, avoid the limitations of traditional fixed security policies, and flexibly respond to ever-changing network security threats, so that security protection measures always meet actual needs, effectively improving the intelligence level and adaptability of network security management.
[0024] 4. The present invention uses three-dimensional visualization technology to display the security risk distribution, security event trends and security policy execution effects of each terminal device in the network, providing administrators with intuitive and comprehensive decision-making support information, enabling administrators to quickly understand the security status of the entire network, promptly discover potential security issues, and accurately locate risk areas and problem terminals, greatly improving the efficiency and accuracy of security management decisions, reducing security management costs and complexity, and contributing to the maintenance and optimization of overall network security. BRIEF DESCRIPTION OF THE DRAWINGS
[0025] Figure 1 Schematic diagram of the system architecture of the present invention. DETAILED DESCRIPTION
[0026] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.
[0027] like Figure 1 As shown, the present invention relates to a terminal antivirus management system based on Internet deep learning, which includes an intelligent data acquisition module, an analysis module, a cloud-based deep learning security engine, a confidential communication module, a monitoring center, and a security policy management center;
[0028] The intelligent data collection module is deployed on the terminal device to collect device operation and communication data. The collected data includes system kernel call sequence, process memory access mode, five-tuple information of network data packets, and application API call frequency and sequence;
[0029] The analysis module is deployed on the terminal device. Based on the local deep learning model, the collected device operation and communication data are initially analyzed by the local deep learning model and then encrypted and transmitted to the cloud.
[0030] The cloud-based deep learning security engine is based on a deep neural network architecture and uses security data training to identify various security threats and send detection and killing instructions and strategies to the terminal. It can also update and optimize itself.
[0031] The confidential communication module is integrated into the terminal communication device, adopts a hybrid encryption algorithm to ensure the confidentiality and integrity of communication data, and has a key exchange and data verification mechanism;
[0032] The monitoring center is located in the cloud and performs fine-grained monitoring of terminal devices, including in-depth analysis of network traffic of specific applications, real-time verification of the integrity of key system files, and assessment of the physical location of the device and the security of the access network;
[0033] The security policy management center is located in the cloud, formulates and issues security policies to terminals, monitors the security status of devices and provides feedback and adjustments, and provides visual security situation reports.
[0034] Specifically, by integrating intelligent data collection modules, analysis modules, cloud-based deep learning security engines, confidential communication modules, monitoring centers, and security policy management centers, they work closely together to form an organic whole. The intelligent data collection module is precisely deployed on terminal devices to comprehensively and meticulously collect device operation and communication data, including system kernel call sequences, accurately reflecting the underlying system operation mechanism, process memory access patterns, and effectively presenting program operation status and potential risks; five-tuple information of network data packets, accurately tracking the source and destination of network connections; and the frequency and sequence of API calls of application programs, to lay a solid data foundation for subsequent analysis and protection work, capture all kinds of security risks that terminal devices may face, ensure the accuracy and effectiveness of security protection from the source, greatly reduce the possibility of terminal devices being attacked by network attacks, and effectively protect users' information security and normal operation of equipment.
[0035] Furthermore, the local deep learning model adopts a lightweight neural network architecture based on the attention mechanism, which can quickly focus on key data features to make preliminary judgments on abnormal behavior with low computing resource consumption. It also has incremental learning capabilities and can update its own parameters in real time based on newly collected data to adapt to dynamic changes in the operating status of terminal devices.
[0036] Specifically, it adopts a lightweight neural network architecture based on the attention mechanism, which can quickly and accurately focus on key data features under low computing resource consumption scenarios, efficiently make preliminary judgments on abnormal behaviors, and effectively improve the early identification capabilities of potential security threats. At the same time, its incremental learning capability enables the model to update its own parameters in real time based on newly collected data, closely following the dynamic changes in the operating status of terminal devices. Whether it is a change in data patterns caused by the installation of new applications or a change in operating status caused by system updates, it can adjust the judgment criteria in a timely manner, always maintain a keen perception of potential security issues, and significantly enhance the early warning and prevention effectiveness of unknown threats. It effectively fills the gap in traditional antivirus software in responding to new and complex security risks, and provides a more solid guarantee for the security of terminal devices.
[0037] Furthermore, the deep neural network architecture integrates generative adversarial networks and autoencoder technology. The generative adversarial network is used to generate simulated malicious samples to enhance the model's generalization ability for unknown threats, and the autoencoder is used to extract features and reduce the dimension of the data to improve model training efficiency and detection accuracy.
[0038] Specifically, the deep neural network architecture of the deep learning security engine integrates generative adversarial networks and autoencoder technology. The generative adversarial network greatly enriches the types of threat samples that the model is exposed to by generating simulated malicious samples, effectively enhancing the generalization ability of unknown threats and effectively responding to the endless stream of new viruses and malware attacks. The autoencoder performs efficient feature extraction and dimensionality reduction operations on massive complex data, converting high-dimensional complex data into concise and representative feature vectors, improving model training efficiency, reducing training resource consumption, and improving detection accuracy. It can accurately identify subtle security threats hidden behind complex data, build a more powerful and reliable security protection barrier for terminal devices, effectively resist various complex and changeable network attacks, and ensure the stability and security of terminal devices in complex network environments.
[0039] Furthermore, security data covers diverse virus samples, malicious behavior patterns, and various types of normal communication data. Through semi-supervised learning algorithms, we fully utilize unlabeled data to further improve model performance. Updates and optimizations are based on emerging security threat features. Federated learning technology is used to aggregate local model updates of multiple terminals without leaking the privacy data of terminal devices, thereby achieving rapid iteration of the global model.
[0040] Specifically, the security data comprehensively covers a variety of virus samples, involving known viruses and their variants from different regions, industries and equipment types, as well as malicious behavior patterns, ranging from simple file tampering to complex network penetration attacks, as well as various normal communication data, to provide a comprehensive comparative reference for the model. With the help of semi-supervised learning algorithms, it deeply mines potential security information in unlabeled data to further improve model performance, so that it can accurately learn normal and abnormal behavior feature patterns based on limited labeled data. It uses federated learning technology to efficiently aggregate local model updates of multiple terminals while strictly protecting the privacy data of terminal devices, to achieve rapid iteration of the global model, and to ensure that the system can quickly adapt to emerging security threat characteristics and adjust protection strategies in a timely manner. This effectively ensures the security of terminal devices in the face of new virus outbreaks and new malicious attack methods, and is always at the forefront of security protection.
[0041] Furthermore, in the symmetric encryption stage, the hybrid encryption algorithm uses the initial key generated based on quantum key distribution technology combined with the AES-256 algorithm to encrypt data at high speed. In the asymmetric encryption stage, an encryption algorithm based on the lattice cryptography system is used for key exchange and digital signature.
[0042] Specifically, the hybrid encryption algorithm used in the confidential communication module is highly secure and efficient, providing solid protection for the confidentiality and integrity of communication data. In the symmetric encryption stage, the initial key generated based on quantum key distribution technology is used in combination with the AES-256 algorithm to encrypt data at high speed. While ensuring the encryption speed, the high security and randomness of quantum key distribution technology greatly improve data confidentiality and effectively prevent theft during data transmission. In the asymmetric encryption stage, an encryption algorithm based on the lattice cryptography system is used for key exchange and digital signature. Compared with traditional encryption algorithms, it significantly enhances the ability to resist attacks, effectively guarantees the security of key exchange and the authenticity and unforgeability of digital signatures, ensures the identity authentication and data integrity of both communicating parties, enables the communication data to be transmitted safely and completely in a complex network environment, provides reliable protection for sensitive information communication, effectively maintains the confidentiality and integrity of communication data, and reduces the risk of information leakage.
[0043] Furthermore, the key exchange protocol is based on the multi-party key agreement extension protocol of the elliptic curve cryptography system, which allows the secure negotiation of shared keys between multiple communication nodes and is suitable for complex network communication scenarios.
[0044] Specifically, the key exchange protocol is based on the multi-party key agreement extension protocol of the elliptic curve cryptography system, providing a flexible and reliable solution for secure communications in complex network communication scenarios. The protocol supports secure negotiation of shared keys by multiple communication nodes, and is suitable for multi-department data interaction in large-scale network environments within enterprises and secure communication connections between numerous devices in Internet of Things scenarios. It ensures the security of the key negotiation process, effectively prevents third parties from stealing or tampering with keys, and improves the security and reliability of network communications.
[0045] Furthermore, the data verification mechanism uses blockchain-based distributed ledger technology to record the hash value and digital signature of the data to ensure the integrity and non-tamperability of the data during transmission, while using smart contracts to automate the verification process to improve verification efficiency and reliability.
[0046] Specifically, the data verification mechanism adopts blockchain-based distributed ledger technology and combines smart contracts to achieve a highly automated and reliable data verification process, providing strong protection for the integrity and non-tamperability of communication data. The hash value and digital signature of the data are recorded through the distributed ledger technology of the blockchain to ensure the integrity and authenticity of the data during transmission. Any tampering will be quickly detected by other nodes. At the same time, smart contracts are used to realize an automated verification process without human intervention. After the data transmission is completed, the smart contract verifies the data hash value and digital signature according to preset rules, greatly improving the verification efficiency and reliability, reducing the possibility of human errors and fraud, and enhancing the data credibility and security of the entire system.
[0047] Furthermore, the security policy management center and the monitoring center adopt a policy optimization algorithm based on reinforcement learning to dynamically adjust security policies according to the real-time security status of terminal devices, historical security event records, and changes in the network environment to maximize the overall network security benefits.
[0048] Specifically, based on the real-time security status of the terminal equipment, the security status of each terminal equipment can be accurately perceived, including situations of attack or potential security risks. Combined with historical security event records, lessons learned can be summarized to optimize strategies. With reference to changes in the network environment, such as network bandwidth fluctuations, new equipment access and other factors, security strategies can be dynamically adjusted to maximize the overall network security benefits. This dynamic adjustment capability overcomes the rigidity and lag of traditional fixed security strategies, effectively improves the flexibility and adaptability of network security management, and can quickly respond and adjust protection measures in the face of sudden large-scale network attacks or long-term potential security risks, ensuring the stable and secure operation of the network, providing users with continuous and reliable security protection, and reducing the probability of network security incidents and the degree of loss.
[0049] Furthermore, the visual security situation report uses three-dimensional visualization technology to display the security risk distribution, security event trends and security policy execution effects of each terminal device in the network, providing administrators with intuitive and comprehensive decision-making support information.
[0050] Specifically, the visual security situation report uses three-dimensional visualization technology to create an intuitive, comprehensive and efficient decision-making support platform for administrators.
[0051] The embodiments of the present invention disclose preferred embodiments, but are not limited thereto. A person skilled in the art can easily understand the spirit of the present invention based on the above embodiments and make different extensions and changes. However, as long as they do not deviate from the spirit of the present invention, they are all within the protection scope of the present invention.
Claims
1. A terminal antivirus management system based on Internet deep learning, characterized in that: The system includes an intelligent data acquisition module, an analysis module, a cloud-based deep learning security engine, a confidential communication module, a monitoring center, and a security policy management center; The intelligent data collection module is deployed on the terminal device to collect device operation and communication data, and the collected data includes system kernel call sequence, process memory access mode, five-tuple information of network data packets, and application API call frequency and sequence; The analysis module is deployed on the terminal device, and based on the local deep learning model, the collected device operation and communication data are initially analyzed by the local deep learning model and then encrypted and transmitted to the cloud; The cloud-based deep learning security engine is based on a deep neural network architecture and uses security data training to identify various security threats and send detection and killing instructions and strategies to the terminal, and can self-update and optimize; The confidential communication module is integrated on the terminal communication device, adopts a hybrid encryption algorithm to ensure the confidentiality and integrity of communication data, and has a key exchange and data verification mechanism; The monitoring center is located in the cloud and performs fine-grained monitoring of terminal devices, including in-depth analysis of network traffic of specific applications, real-time verification of the integrity of key system files, and assessment of the physical location of the device and the security of the access network; The security policy management center is located in the cloud, formulates and issues security policies to terminals, monitors the security status of devices and provides feedback and adjustments, and provides visual security situation reports.
2. According to the terminal antivirus management system based on Internet deep learning according to claim 1, it is characterized in that: The local deep learning model adopts a lightweight neural network architecture based on the attention mechanism, which can quickly focus on key data features to make preliminary judgments on abnormal behaviors with low computing resource consumption. It also has incremental learning capabilities and can update its own parameters in real time based on newly collected data to adapt to dynamic changes in the operating status of terminal devices.
3. According to the terminal antivirus management system based on Internet deep learning in claim 1, it is characterized in that: The deep neural network architecture integrates generative adversarial networks and autoencoder technology. The generative adversarial network is used to generate simulated malicious samples to enhance the model's generalization ability for unknown threats. The autoencoder is used to extract features and reduce the dimension of the data to improve model training efficiency and detection accuracy.
4. According to the terminal antivirus management system based on Internet deep learning according to claim 1, it is characterized in that: The security data covers a variety of virus samples, malicious behavior patterns and various normal communication data. Through a semi-supervised learning algorithm, it makes full use of unlabeled data to further improve model performance. The update optimization is based on the characteristics of newly emerging security threats. It uses federated learning technology to aggregate local model updates of multiple terminals without leaking the privacy data of terminal devices, thereby achieving rapid iteration of the global model.
5. According to the terminal antivirus management system based on Internet deep learning in claim 1, it is characterized in that: In the symmetric encryption stage, the hybrid encryption algorithm uses the initial key generated based on quantum key distribution technology in combination with the AES-256 algorithm to encrypt data at high speed. In the asymmetric encryption stage, an encryption algorithm based on the lattice cryptography system is used for key exchange and digital signature.
6. The terminal antivirus management system based on Internet deep learning according to claim 1 is characterized in that: The key exchange protocol is based on a multi-party key negotiation extension protocol of an elliptic curve cryptography system, allowing secure negotiation of shared keys between multiple communication nodes, and is suitable for complex network communication scenarios.
7. The terminal antivirus management system based on Internet deep learning according to claim 1 is characterized in that: The data verification mechanism uses blockchain-based distributed ledger technology to record the hash value and digital signature of the data to ensure the integrity and non-tamperability of the data during transmission. At the same time, it uses smart contracts to realize an automated verification process to improve verification efficiency and reliability.
8. The terminal antivirus management system based on Internet deep learning according to claim 1 is characterized in that: The security policy management center and the monitoring center both adopt a policy optimization algorithm based on reinforcement learning to dynamically adjust security policies according to the real-time security status of terminal devices, historical security event records, and changes in the network environment to maximize the overall network security benefits.
9. The terminal antivirus management system based on Internet deep learning according to claim 1 is characterized in that: The visual security situation report uses three-dimensional visualization technology to display the security risk distribution, security event trends and security policy execution effects of each terminal device in the network, providing administrators with intuitive and comprehensive decision-making support information.