System call sequence exception detection method and system

Abstract

The application belongs to the technical field of information security, and provides a system call sequence anomaly detection method and system, wherein the system call sequence anomaly detection method comprises the following steps: calling a prediction model to perform sequence prediction based on a target sequence in a system full sequence to obtain a target prediction sequence, wherein the system full sequence comprises at least one encoding value of a system call application program name; calling an anomaly detection model to perform judgment based on the target prediction sequence and a to-be-detected sequence in the target sequence to obtain a detection result, which can not only detect unknown abnormal sequences, but also improve the accuracy of detection and reduce the false positive rate.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for detecting anomalies in a system call sequence. Background Art

[0002] In recent years, due to the increasing number of incidents threatening kernel security, such as vulnerabilities and malware, the demand for Linux operating system kernel reliability has continued to increase. By detecting anomalies in system call sequences, operating system kernel anomalies can be diagnosed, providing a deep understanding of the kernel's internal state.

[0003] Currently, system call sequence anomaly detection methods generally perform anomaly detection by modeling known anomaly sequences, which lacks the ability to detect unknown anomalies. Furthermore, existing system call sequence anomaly detection methods often have poor accuracy and high false positive rates.

[0004] Therefore, how to perform anomaly detection on system call sequences is a problem that those skilled in the art need to solve urgently. Summary of the Invention

[0005] In view of this, an embodiment of the present invention provides a system call sequence anomaly detection method and system to solve the problem of how to detect anomalies in system call sequences in the prior art; that is, the embodiment of the present invention can improve the detection accuracy and reduce the false alarm rate.

[0006] According to one aspect of the present invention, a method for detecting anomalies in a system call sequence is provided. The method comprises: calling a prediction model to perform sequence prediction based on a target sequence in a full system sequence to obtain a target prediction sequence, wherein the full system sequence includes an encoded value of at least one system call application name; and calling an anomaly detection model to perform judgment based on the target prediction sequence and a sequence to be tested in the target sequence to obtain a detection result.

[0007] In one embodiment, the calling prediction model performs sequence prediction based on the target sequence in the full sequence of the system to obtain the target prediction sequence, including: processing based on the target sequence to obtain target sequence data features; performing feature processing based on the target sequence data features to obtain intermediate target sequence data features, and obtaining prediction sequence features based on the intermediate target sequence data features; processing based on the prediction sequence features to obtain the target prediction sequence.

[0008] In one embodiment, the calling of the anomaly detection model and the judgment based on the target prediction sequence and the sequence to be tested in the target sequence to obtain the detection result include: performing calculation based on the target prediction sequence and the sequence to be tested to obtain a residual sequence; performing calculation based on the residual sequence to obtain a decision value, and performing judgment based on the decision value to obtain the detection result.

[0009] In one embodiment, the target prediction sequence is obtained by processing based on the prediction sequence features, and the target prediction sequence is:

[0010]

[0011] Wherein, σ is the gelu activation function, W is the weight matrix, τ is the predicted sequence feature, and b is the bias vector.

[0012] In one embodiment, the calculation is performed based on the target prediction sequence and the sequence to be measured to obtain a residual sequence, and the residual sequence is:

[0013]

[0014] Wherein, yt is the sequence to be tested, A sequence is predicted for the target.

[0015] In one embodiment, the decision value is obtained by calculating based on the residual sequence, and the decision value is:

[0016]

[0017] Among them, sgn is the sign function, α i is the first Lagrange multiplier, is the kernel function, x i is the data whose first Lagrange multiplier in the residual sequence is greater than zero, y is the residual data in the residual sequence, ρ is the bias, and n is the number of residual data in the residual sequence.

[0018] In one embodiment, the detection result is obtained by judging based on the decision value, including: when f(y)=1, the target sequence is normal data; when f(y)=-1, the target sequence is abnormal data.

[0019] According to another aspect of the present invention, a system call sequence anomaly detection system is provided, comprising: a sequence prediction module and an anomaly detection module, wherein the sequence prediction module is configured to call a prediction model, perform sequence prediction based on a target sequence in a full system sequence, and obtain a target prediction sequence, wherein the full system sequence includes an encoded value of at least one system call application name; and the anomaly detection module is configured to call the anomaly detection model, perform judgment based on the target prediction sequence and a sequence to be tested in the target sequence, and obtain a detection result.

[0020] In one embodiment, the sequence prediction module includes a feature extraction module, a feature processing module and an output module, wherein the feature extraction module is used to process based on the target sequence to obtain target sequence data features; the feature processing module is used to perform feature processing based on the target sequence data features to obtain intermediate target sequence data features, and obtain prediction sequence features based on the intermediate target sequence data features; the output module is used to process based on the prediction sequence features to obtain the target prediction sequence.

[0021] In one embodiment, the anomaly detection module includes a calculation module and a detection module, wherein the calculation module is used to perform calculations based on the target prediction sequence and the sequence to be tested to obtain a residual sequence; the detection module is used to perform calculations based on the residual sequence to obtain a decision value, and to make judgments based on the decision value to obtain the detection result.

[0022] In summary, in an embodiment of the present invention, a prediction model is called to perform sequence prediction based on a target sequence in a full system sequence to obtain a target prediction sequence, wherein the full system sequence includes at least one encoded value of a system call application name, and an anomaly detection model is called to perform judgment based on the target prediction sequence and the sequence to be tested in the target sequence to obtain a detection result. This not only enables detection of unknown anomaly sequences, but also improves the detection accuracy and reduces the false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Further details, features and advantages of the present invention are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0024] Figure 1 A schematic diagram of a process for detecting anomalies in a system call sequence disclosed in an embodiment of the present application is shown;

[0025] Figure 2 Shown Figure 1 The schematic diagram of the step flow of step S110 is shown;

[0026] Figure 3shows a schematic structural diagram of a gated recurrent unit;

[0027] Figure 4 Schematic diagram of the structure of the residual connection module is shown;

[0028] Figure 5 Shown Figure 1 The schematic diagram of the step flow of step S120 is shown;

[0029] Figure 6 A schematic diagram of a single-class support vector machine model is shown;

[0030] Figure 7 A structural diagram of a system call sequence anomaly detection system disclosed in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] Embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0032] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0033] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0034] It should be noted that the modifications of "one" and "multiple" mentioned in the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0035] The names of the messages or information exchanged between the plurality of devices in the embodiments of the present application are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0036] It should be noted that the execution subject of the system call sequence anomaly detection method provided in the embodiments of the present application can be one or more electronic devices, which are not limited by the present application. The electronic device can be a terminal (i.e., a client) or a server. When the execution subject includes multiple electronic devices, and the multiple electronic devices include at least one terminal and at least one server, the system call sequence anomaly detection method provided in the embodiments of the present application can be executed by the terminal and the server together. Correspondingly, the terminal mentioned here can include but is not limited to a smartphone, a tablet computer, a notebook computer, a desktop computer, a smart watch, a smart voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, and the like. The server mentioned here can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDNs (Content Delivery Networks), and basic cloud computing services such as big data and artificial intelligence platforms, and the like.

[0037] Based on the above description, the embodiments of the present application provide a system call sequence anomaly detection method, which can be executed by the electronic device (terminal or server) mentioned above. Alternatively, the system call sequence anomaly detection method can be executed by the terminal and the server together. For ease of description, the system call sequence anomaly detection method executed by the electronic device is taken as an example for description in the following.

[0038] Please refer to Figure 1 which is a flowchart of a system call sequence anomaly detection method disclosed in the embodiments of the present application. The system call sequence anomaly detection method solves the problem of how to detect the anomaly of the system call sequence, thereby improving the accuracy of detection and reducing the false positive rate. It should be noted that the system call sequence anomaly detection method of the embodiments of the present application is not limited to Figure 1 the steps and order shown in the flowchart. According to different needs, the steps in the flowchart can be added, removed, or the order changed. In the embodiments of the present application, as Figure 1 shown in the flowchart, the flow of the system call sequence anomaly detection method includes at least the following steps.

[0039] S110 , calling a prediction model, performing sequence prediction based on a target sequence in a full system sequence, and obtaining a target prediction sequence, wherein the full system sequence includes an encoding value of at least one system call application name.

[0040] like Figure 2 As shown, in an embodiment of the present invention, Figure 2 The step S110 includes at least the following steps:

[0041] S111 . Process the target sequence to obtain target sequence data features.

[0042] In the embodiment of the present invention, the system full sequence with a preset length of N Among them, xi is the encoded value of the system call application name. The target sequence in the system full sequence Q is transmitted to the embedding layer. The target sequence may include the historical sequence and the sequence to be tested. The embedding layer processes the target sequence to obtain the first sequence data feature. The first sequence data feature is sequentially transmitted to the first gated recurrent unit (GRU) and the second gated recurrent unit for feature extraction to obtain the second sequence data feature. The second sequence data feature is transmitted to the linear layer for processing to obtain the target sequence data feature.

[0043] like Figure 3 As shown, z t represents the operation of updating the gate at time t, r t represents the operation of resetting the gate at time t, x t Represents the input sequence, update gate z t Used to determine how much new information to update to the sequence prediction model, reset gate r t Used to determine how much historical information should be discarded, Indicates the use of reset gate r t After processing the input information, the candidate hidden state information is obtained and finally passes through the update gate z t After filtering the previous hidden state information and the candidate hidden state information, the current hidden state information h is obtained. t The calculation process is as follows:

[0044] z t =σ(W z ·[h t-1 ,x t ]) Formula (1)

[0045] r t =σ(W r ·[h t-1 ,x t ]) Formula (2)

[0046]

[0047] S112. Perform feature processing based on the target sequence data features to obtain intermediate target sequence data features, and obtain predicted sequence features based on the intermediate target sequence data features.

[0048] In an embodiment of the present invention, the target sequence data features are transmitted to the encoder and decoder respectively. The encoder may include a multi-head sparse self-attention module and a distillation module. In order to prevent the gradient from disappearing or exploding, a residual connection module is introduced into the encoder. Figure 4 As shown, the residual connection module can include at least a residual part and a jump connection part. The jump connection part directly transmits the input of the first self-attention block in the residual part to the output of the last self-attention block. The output of the residual connection module is as follows:

[0049] h(x)=W' l x Formula (5)

[0050] y=F(x,W l )+h(x) Formula (6)

[0051] Where y is the output, x is the input, and W' l is a 1x1 nonlinear convolution operation, W l is the convolution operation, F(x,W l ) is the residual part.

[0052] The encoder includes a main stack and a sub-stack. The jump connection part of the sub-stack is similar to the main stack, but the residual part of the main stack can include 3 self-attention modules and 2 dilated causal convolution pooling modules, and the residual part of the sub-stack can include 2 self-attention modules and 1 dilated causal convolution pooling module.

[0053] The dilated causal convolution is as follows:

[0054]

[0055] Among them, F is the convolution kernel of size K, x t is the data at time t, f k is the filter in the convolution operation, and d is the expansion factor.

[0056] Dilated causal convolution can include causal convolution and dilated convolution. Causal convolution uses only past input data to predict future outputs, preventing the leakage of future information. Dilated convolution is implemented by sampling input data at intervals, maintaining the simplicity of the network architecture while enhancing capture capabilities. Combining dilated convolution with causal convolution can improve network performance without increasing model complexity, maintaining temporal causality while enhancing the ability to extract features from long sequences.

[0057] The convolution kernel size of the dilated convolution is as follows:

[0058] K c =d*(K o -1)+1 formula (8)

[0059] Among them, K c is the size of the ordinary convolution kernel after expansion, K o is the size of the ordinary convolution kernel, and d is the expansion factor.

[0060] The decoder can include a masked multi-head sparse self-attention module and a standard multi-head attention module. The mask mechanism in the masked multi-head sparse self-attention module ensures that each position can only access information from the current position and the previous position, preventing future information leakage. The prediction step size is W, and the target sequence data features When W=1, it is a single-step prediction, and when W>1, it is a multi-step prediction. As shown in the following formula:

[0061]

[0062] Wherein, L is an integer, 1≤L≤N, and B is the amount of data to be processed.

[0063] The encoding values ​​of the target sequence data features that are longer than NW (that is, the sequence data features to be tested) are set to 0 to obtain the historical sequence data features. The historical sequence data features and the target sequence placeholder are used as the input of the decoder. The input of the decoder is as follows:

[0064]

[0065] in, is the t-th input sequence of the decoder, is the start mark of the tth sequence, is the target sequence placeholder for the t-th sequence.

[0066] Specifically, the encoder performs feature processing on the target sequence data features to obtain intermediate target sequence data features, and transmits the intermediate target sequence data features to the decoder. The decoder performs calculations based on the intermediate target sequence data features and the historical sequence data features to obtain predicted sequence features.

[0067] S113: Process the predicted sequence features to obtain a target predicted sequence.

[0068] In the embodiment of the present invention, the fully connected layer processes the prediction sequence features to obtain a processed prediction sequence, and the output layer calculates the processed prediction sequence to obtain a target prediction sequence. The target prediction sequence is as follows:

[0069]

[0070] in, is the target prediction sequence, σ is the gelu activation function, W is the weight matrix, and b is the bias vector.

[0071] S120 , calling an anomaly detection model, performing judgment based on the target prediction sequence and the sequence to be tested in the target sequence, and obtaining a detection result.

[0072] like Figure 5 As shown, in an embodiment of the present invention, Figure 5 The step S120 at least includes the following steps:

[0073] S121. Perform calculation based on the target prediction sequence and the sequence to be measured to obtain a residual sequence.

[0074] In an embodiment of the present invention, the target prediction sequence and the sequence to be measured are calculated to obtain a residual sequence. The calculation process of the residual sequence is as follows:

[0075]

[0076] Among them, yt is the sequence to be tested, Predict a sequence for the target.

[0077] S122. Calculate a decision value based on the residual sequence, and make a judgment based on the decision value to obtain a detection result.

[0078] In the embodiment of the present invention, Figure 6 As shown in Figure 2, the One-Class Support Vector Machine (One-Class SVM) projects the residual sequence into a high-dimensional space through a kernel function and establishes a hyperplane for classification to separate the residual sequence from the origin. The loss function is as follows:

[0079]

[0080] Among them, ω is the normal vector of the hyperplane in the feature space, ρ is the bias, represents the parameter trade-off between maximum distance and origin, is the slack variable, and n is the number of residual data in the residual sequence. The constraints are Based on the Lagrange multiplier method, the loss function is as follows:

[0081]

[0082] Among them, α i is the first Lagrange multiplier, α j is the second Lagrange multiplier, is the kernel function, x i is the data whose first Lagrange multiplier in the residual sequence is greater than zero, i is an integer, and j is an integer.

[0083] When satisfied The input space is implicitly mapped to the feature space by calculating the dot product. The decision value is as follows:

[0084]

[0085] Among them, ω is the normal vector of the hyperplane in the feature space, α i is the first Lagrange multiplier, y is the residual data in the residual sequence, ρ is the bias, n is the number of residual data in the residual sequence, and sgn is the sign function.

[0086] When f(y)=1, it means that the target sequence is normal data, and when f(y)=-1, it means that the target sequence is abnormal data.

[0087] In summary, in a system call sequence anomaly detection method of the present application, a prediction model is called, and sequence prediction is performed based on a target sequence in a full system sequence to obtain a target prediction sequence, wherein the full system sequence includes at least one encoding value of a system call application name, and an anomaly detection model is called, and judgment is performed based on the target prediction sequence and the sequence to be tested in the target sequence to obtain a detection result. This method can not only detect unknown anomaly sequences, but also improve the detection accuracy and reduce the false alarm rate.

[0088] See also Figure 7 , which is a structural diagram of a system call sequence anomaly detection system disclosed in an embodiment of the present application. In one embodiment, Figure 7As shown, the present application provides a system call sequence anomaly detection system 100, which can at least include a sequence prediction module 110 and an anomaly detection module 130. There is information interaction between the sequence prediction module 110 and the anomaly detection module 130.

[0089] The sequence prediction module 110 is used to call a prediction model to perform sequence prediction based on a target sequence in a system full sequence to obtain a target prediction sequence, wherein the system full sequence includes at least one encoding value of a system call application program name. The sequence prediction module 110 can at least include a feature extraction module 111, a feature processing module 113, and an output module 115.

[0090] The feature extraction module 111 is used to process based on the target sequence to obtain target sequence data features. The feature extraction module 111 can at least include an embedding layer 1111, a first gated recurrent unit 1113, a second gated recurrent unit 1115, and a linear layer 1117. Specifically, the target sequence is processed by the embedding layer 1111 to obtain first sequence data features, the first sequence data features are sequentially transmitted to the first gated recurrent unit (GRU) 1113 and the second gated recurrent unit 1115 for feature extraction to obtain second sequence data features, and the second sequence data features are transmitted to the linear layer 1117 for processing to obtain target sequence data features.

[0091] As shown, Figure 3 z t represents the operation of the update gate at time t, r t represents the operation of the reset gate at time t, x t represents the input sequence data, the update gate z t is used to determine how much new information to update into the sequence prediction model, the reset gate r t is used to determine how much historical information should be discarded, represents the candidate hidden state information obtained after processing the input information using the reset gate r t , the final candidate hidden state information is filtered through the update gate z t , and the current time hidden state information h t is obtained after filtering the previous time hidden state information and the candidate hidden state information. The calculation process is as follows:

[0092] z t = σ(W z · [h t-1 , x t ]) Formula (1)

[0093] r t = σ(Wr ·[h t-1 ,x t ]) Formula (2)

[0094]

[0095]

[0096] The feature processing module 113 is used to perform feature processing based on the target sequence data features to obtain intermediate target sequence data features, and to obtain prediction sequence features based on the intermediate target sequence data features. The feature processing module 113 may include at least an encoder 1131 and a decoder 1133 .

[0097] The encoder 1131 is used to process the target sequence data features to obtain intermediate target sequence data features, and transmit the intermediate target sequence data features to the decoder 1133. Specifically, the encoder 1131 may include a multi-head sparse self-attention module 1131a, a distillation module 1131b and a residual connection module 1131c. Figure 4 As shown, the residual connection module 1131c may include at least a residual part (not shown) and a skip connection part (not shown). The skip connection part directly transmits the input of the first self-attention block to the output of the last self-attention block. The output of the residual connection module 1131c is as follows:

[0098] h(x)=W' l x Formula (5)

[0099] y=F(x,W l )+h(x) Formula (6)

[0100] Where y is the output, x is the input, and W' l is a 1x1 nonlinear convolution operation, W l is the convolution operation, F(x,W l ) is the residual part.

[0101] The encoder 1131 includes a main stack (Main Stack) (not shown) and a sub-stack (Sub-Stack) (not shown). The jump connection part of the sub-stack is similar to the main stack, but the residual part of the main stack can include 3 self-attention modules and 2 dilated causal convolution pooling modules, and the residual part of the sub-stack can include 2 self-attention modules and 1 dilated causal convolution pooling module.

[0102] The dilated causal convolution is as follows:

[0103]

[0104] Among them, F is the convolution kernel of size K, x t is the data at time t, f k is the filter in the convolution operation, and d is the expansion factor.

[0105] Dilated causal convolution can include causal convolution and dilated convolution. Causal convolution uses only past input data to predict future outputs, preventing the leakage of future information. Dilated convolution is implemented by sampling input data at intervals, maintaining the simplicity of the network architecture while enhancing capture capabilities. Combining dilated convolution with causal convolution can improve network performance without increasing model complexity, maintaining temporal causality while enhancing the ability to extract features from long sequences.

[0106] The convolution kernel size of the dilated convolution is as follows:

[0107] K c =d*(K o -1)+1 formula (8)

[0108] Among them, K c is the size of the ordinary convolution kernel after expansion, K o is the size of the ordinary convolution kernel, and d is the expansion factor.

[0109] The decoder 1133 may include a masked multi-head sparse self-attention module 1133a and a standard multi-head attention module 1133c. The masking mechanism in the masked multi-head sparse self-attention module 1133a ensures that each position can only access information from the current position and the previous position, preventing future information leakage. The prediction step size is W, and the target sequence data features When W=1, it is a single-step prediction, and when W>1, it is a multi-step prediction. As shown in the following formula:

[0110]

[0111] Wherein, L is an integer, 1≤L≤N, and B is the amount of data to be processed.

[0112] The encoding values ​​of the target sequence data features that are longer than NW (i.e., the sequence data features to be tested) are set to 0 to obtain the historical sequence data features. The historical sequence data features and the target sequence placeholder are used as inputs to the decoder 1133. The input of the decoder 1133 is as follows:

[0113]

[0114] in, is the t-th input sequence of decoder 1133, is the start mark of the tth sequence, is the target sequence placeholder for the t-th sequence.

[0115] The output module 115 is used to process the predicted sequence features to obtain a target predicted sequence. The output module 115 may include at least a fully connected layer 1151 and an output layer 1153.

[0116] The fully connected layer 1151 is used to process the prediction sequence features to obtain a processed prediction sequence.

[0117] The output layer 1153 is used to calculate the processed prediction sequence to obtain the target prediction sequence. The target prediction sequence is as follows:

[0118]

[0119] in, is the target prediction sequence, σ is the gelu activation function, W is the weight matrix, τ is the prediction sequence feature, and b is the bias vector.

[0120] The anomaly detection module 130 is used to call the anomaly detection model, perform judgment based on the target prediction sequence and the test sequence in the target sequence, and obtain a detection result. The anomaly detection module 130 may include at least a calculation module 131 and a detection module 133.

[0121] The calculation module 131 is used to perform calculations based on the target prediction sequence and the sequence to be tested to obtain a residual sequence. Specifically, the calculation module 131 calculates the target prediction sequence and the sequence to be tested to obtain a residual sequence. The calculation process of the residual sequence is as follows:

[0122]

[0123] Among them, yt is the sequence to be tested, Predict a sequence for the target.

[0124] The detection module 133 is used to calculate the decision value based on the residual sequence, and to make a judgment based on the decision value to obtain a detection result. Specifically, Figure 6 As shown in Figure 2, the One-Class Support Vector Machine (One-Class SVM) projects the residual sequence into a high-dimensional space through a kernel function and establishes a hyperplane for classification to separate the residual sequence from the origin. The loss function is as follows:

[0125]

[0126] Among them, ω is the normal vector of the hyperplane in the feature space, ρ is the bias, represents the parameter trade-off between maximum distance and origin, is the number of residual data in the residual sequence. The constraint condition is Based on the Lagrange multiplier method, the loss function is as follows:

[0127]

[0128] wherein, a i is the first Lagrange multiplier, a j is the second Lagrange multiplier, is the kernel function, x i is the first Lagrange multiplier greater than zero in the residual sequence, i is an integer, and j is an integer.

[0129] When the following condition is met The input space is implicitly mapped to the feature space through the calculation of the dot product. The decision value is as follows:

[0130]

[0131] wherein, ω is the normal vector of the hyperplane in the feature space, a i is the first Lagrange multiplier, y is the residual data in the residual sequence, ρ is the bias, and n is the number of residual data in the residual sequence.

[0132] When f(y) = 1, it indicates that the target sequence is normal data, and when f(y) = -1, it indicates that the target sequence is abnormal data.

[0133] As can be seen from the above, in the system call sequence anomaly detection method, the prediction model is called by the sequence prediction module 110, the sequence prediction is performed based on the target sequence in the system full sequence, and the target prediction sequence is obtained, wherein the system full sequence includes at least one encoding value of a system call application program name, the anomaly detection model is called by the anomaly detection module 130, the judgment is performed based on the target prediction sequence and the to-be-detected sequence in the target sequence, and the detection result is obtained. Not only can unknown abnormal sequences be detected, but also the detection accuracy can be improved and the false positive rate can be reduced.

[0134] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example", "one implementation", "one preferred implementation" or "some examples" and the like means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0135] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

Claims

1. A method for detecting anomalies in a system call sequence, characterized in that: The system call sequence anomaly detection method comprises: Calling a prediction model, performing sequence prediction based on a target sequence in a full system sequence, and obtaining a target prediction sequence, wherein the full system sequence includes at least one encoded value of a system call application name, wherein calling the prediction model, performing sequence prediction based on the target sequence in the full system sequence, and obtaining a target prediction sequence, includes: processing based on the target sequence to obtain target sequence data features; performing feature processing based on the target sequence data features to obtain intermediate target sequence data features, and obtaining prediction sequence features based on the intermediate target sequence data features; processing based on the prediction sequence features to obtain the target prediction sequence, wherein the target prediction sequence is: Wherein, σ is the gelu activation function, W is the weight matrix, τ is the predicted sequence feature, and b is the bias vector; Calling an anomaly detection model, performing judgment based on the target prediction sequence and the sequence to be tested in the target sequence, and obtaining a detection result, wherein the calling anomaly detection model, performing judgment based on the target prediction sequence and the sequence to be tested in the target sequence, and obtaining a detection result, includes: performing calculation based on the target prediction sequence and the sequence to be tested to obtain a residual sequence; calculating based on the residual sequence to obtain a decision value, and performing judgment based on the decision value to obtain the detection result, wherein the decision value obtained by calculating based on the residual sequence is: Among them, sgn is the sign function, α i is the first Lagrange multiplier, is the kernel function, x i is the data whose first Lagrange multiplier in the residual sequence is greater than zero, y is the residual data in the residual sequence, ρ is the bias, and n is the number of residual data in the residual sequence.

2. A method for detecting anomalies in a system call sequence according to claim 1, characterized in that: The calculation is performed based on the target prediction sequence and the sequence to be measured to obtain a residual sequence, and the residual sequence is: Among them, y t is the sequence to be tested, A sequence is predicted for the target.

3. A method for detecting anomalies in a system call sequence according to claim 1, characterized in that: The determining based on the decision value to obtain a detection result includes: When f(y)=1, the target sequence is normal data; When f(y)=-1, the target sequence is abnormal data.

4. A system call sequence anomaly detection system, characterized in that: The system call sequence anomaly detection system includes: a sequence prediction module and an anomaly detection module, wherein: The sequence prediction module is used to call the prediction model, perform sequence prediction based on the target sequence in the full system sequence, and obtain the target prediction sequence, wherein the full system sequence includes at least one encoded value of the system call application name, wherein the calling prediction model, based on the target sequence in the full system sequence, performs sequence prediction to obtain the target prediction sequence, including: processing based on the target sequence to obtain target sequence data features; performing feature processing based on the target sequence data features to obtain intermediate target sequence data features, and obtaining prediction sequence features based on the intermediate target sequence data features; processing based on the prediction sequence features to obtain the target prediction sequence, wherein the target prediction sequence is: Wherein, σ is the gelu activation function, W is the weight matrix, τ is the predicted sequence feature, and b is the bias vector; The anomaly detection module is configured to call an anomaly detection model, perform judgment based on the target prediction sequence and the sequence to be tested in the target sequence, and obtain a detection result. The calling of the anomaly detection model, performing judgment based on the target prediction sequence and the sequence to be tested in the target sequence, and obtaining a detection result includes: performing calculation based on the target prediction sequence and the sequence to be tested to obtain a residual sequence; performing calculation based on the residual sequence to obtain a decision value, and performing judgment based on the decision value to obtain the detection result. The decision value obtained by calculating based on the residual sequence is: Among them, sgn is the sign function, α i is the first Lagrange multiplier, is the kernel function, x i is the data whose first Lagrange multiplier in the residual sequence is greater than zero, y is the residual data in the residual sequence, ρ is the bias, and n is the number of residual data in the residual sequence.

Images