IPD13-based execution abnormity monitoring system and method

Abstract

The invention relates to the technical field of behavior monitoring during operation, in particular to an execution exception monitoring system and method based on IPD13. According to the execution exception monitoring system and method based on IPD13, through accurate mapping of instruction blocks of execution logs and execution records and jump control flows, an execution path diagram can be effectively constructed, and each detail in program operation can be accurately captured; the method comprises the following steps of: identifying a potential jump path and an abnormal behavior, comparing execution paths segment by segment through a graph neural network, and calculating the similarity, so that not only can the paths which are not matched with a standard graph structure be accurately identified, but also the abnormal paths can be marked in time, thereby preventing the influence of potential system abnormality on stability and performance, and improving the reliability of the system. Through acquisition of the execution frequency and calculation of the node frequency deviation, the nodes showing abnormal behaviors in the system can be identified in time, the nodes are clustered into the abnormal behavior segments, and the abnormal nodes are further generated, so that early warning of the abnormal behaviors is ensured, and the probability of serious faults is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of runtime behavior monitoring, and in particular to an execution anomaly monitoring system and method based on IPD13. Background Art

[0002] The field of runtime behavior monitoring technology aims to dynamically obtain the actual execution behavior data of programs and systems during their operation, identify and analyze abnormal conditions that may occur in the behavior path, and achieve continuous protection and optimization of system stability, security and performance.

[0003] The purpose of the IPD13-based execution anomaly monitoring system is to provide structured perception of system and module-level behaviors during the actual program operation, promptly detect abnormal phenomena such as instruction jumps, state rollbacks, and undefined paths, and achieve instant identification, visual tracing, and quantifiable evaluation of abnormal events, ensuring stable system operation, improving operation and maintenance efficiency, and supporting structured archiving and model optimization of abnormal events.

[0004] Existing technologies have difficulty capturing dynamic changes in system operation. Anomaly detection methods have significant limitations and cannot accurately reflect the real-time execution path of the program. Especially when faced with complex or nonlinear jumps, it is difficult to efficiently identify and locate anomalies. Existing path recognition usually relies on preset rules, which makes the response speed slow when faced with new and unknown abnormal situations, and potential abnormal events cannot be discovered in time. In addition, due to the lack of structured perception of the execution path, it may not be possible to effectively distinguish between normal and abnormal paths, resulting in an increased risk of misjudgment and missed judgment. Summary of the Invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose an execution anomaly monitoring system and method based on IPD13.

[0006] In order to achieve the above objectives, the present invention adopts the following technical solutions: The execution abnormality monitoring system based on IPD13 includes:

[0007] Execution path construction module: Based on the execution log and execution record, it maps instruction blocks to jump control flows, with instruction blocks as nodes and jump control flows as edges. It records edge weights and delays, sorts paths according to timing, and generates an execution path graph.

[0008] Path matching identification module: Based on the execution path graph, a graph neural network is used to compare the path with the standard graph structure, check the node and edge matching, and compare the similarity between the path and the standard graph segment by segment. If the match fails and the similarity is low, it is marked as a jump path and a jump path identifier is generated;

[0009] Abnormal behavior determination module: Based on the execution path graph, collects the execution information of each node, calculates the jump frequency in combination with the historical path data, determines whether it is an abnormal node based on the node frequency deviation, clusters it into abnormal behavior segments, and generates abnormal behavior nodes;

[0010] Abnormal path identification module: Based on the jump path identifier, it screens the jump segments in the path and checks the number of consecutive jump points. If the number exceeds the threshold, it is marked as an abnormal path. Combined with the jump strength value analysis, the abnormality degree is determined and an abnormal path identifier is generated;

[0011] Abnormal path compression module: Based on abnormal path identification and abnormal behavior nodes, it compresses low-frequency jump paths, calculates jump intensity and abnormal density, and marks as a potential abnormal path if the intensity exceeds the set threshold, generating a potential abnormal path.

[0012] As a further solution of the present invention, the execution path construction module includes:

[0013] Instruction block mapping submodule: Based on execution logs and execution records, each instruction is identified and mapped into a node in sequence, and relevant execution information of each node, such as execution time, input and output data, is extracted. The relationship between instructions and status is recorded, and an instruction node set is generated.

[0014] Jump control flow mapping submodule: Based on the execution log and execution record, it identifies the jump control flow of each instruction, captures the conditional and unconditional flags of each jump, records the jump condition and target address, generates the edge weight and delay tag of each jump, and obtains the jump control flow graph;

[0015] Path timing sorting submodule: Based on the instruction node set and jump control flow graph, the paths are sorted according to the timestamps in the execution log to ensure that the execution order of the path nodes is consistent with the actual execution, and the order of each node and the jump path relationship are updated to generate an execution path graph.

[0016] As a further solution of the present invention, the path matching identification module includes:

[0017] Path structure comparison submodule: Based on the execution path graph, compare the path structure, check whether the node and jump control flow are consistent with the standard path, compare the structure of the path graph and the standard graph section by section, output the result of structure matching, and generate the path structure comparison result;

[0018] Node and edge matching submodule: Based on the path structure comparison results, each node and edge is matched, and the nodes and edges in the execution path and the standard path are compared one by one to confirm whether they match, and the nodes and edges that fail to match are marked, and the node and edge matching results are generated;

[0019] Path similarity calculation submodule: Based on the node and edge matching results, a graph neural network is used to calculate the similarity between each path segment and the standard path. If the similarity is lower than the set threshold, the path is marked as a jump path and a jump path identifier is generated.

[0020] As a further solution of the present invention, the graph neural network is according to the formula:

[0021]

[0022] Where: A represents the execution path diagram built based on the IPD13 standard process model, B represents the standard path diagram preset based on the IPD13 standard execution specification, A·B represents the vector dot product between the execution path embedding vector A and the standard path embedding vector B, ||A|| represents the Euclidean norm of the execution path embedding vector A, ||B|| represents the Euclidean norm of the standard path embedding vector B, w d The weight coefficient representing the density of the jump nodes in the execution path graph, w s represents the similarity weight coefficient between the execution path graph and the standard path graph in terms of topological connectivity, w a Represents the local abnormal density correction coefficient of the execution path graph, w b represents the local anomaly density correction coefficient of the standard path graph, and Sim′(A,B) represents the improved path similarity value.

[0023] As a further solution of the present invention, the abnormal behavior determination module includes:

[0024] Node information extraction submodule: Based on the execution path graph, extract the execution time, status, input and output data of each node, traverse the path graph nodes, record the execution order and execution results of each node, mark the instruction type and data dependency, and generate a node execution information set;

[0025] Frequency deviation identification submodule: Based on the node execution information set, the jump frequency of each node is counted and compared with the corresponding node in the historical path data, the difference in jump frequency is calculated, and it is determined whether the deviation exceeds the set threshold. The nodes with large deviations are marked and a set of frequency abnormal nodes is generated;

[0026] Behavior clustering and annotation submodule: Based on the frequency abnormal node set, cluster the deviation nodes according to the execution order and jump mode, determine whether the consecutive jump nodes belong to the same abnormal behavior segment, annotate the clustering results, and generate abnormal behavior nodes.

[0027] As a further solution of the present invention, the abnormal path identification module includes:

[0028] Transition segment extraction submodule: Based on the transition path identifier, traverse the path graph, extract all transition segments, and screen out continuous transition segments based on the order of transitions and the correlation between nodes, eliminating segments with transition intervals less than a set threshold, and generating continuous transition segments;

[0029] Transition accumulation judgment submodule: Based on the continuous transition segments, the transition points in each transition segment are counted. If the number of continuous transition points exceeds the set threshold, it is identified as an abnormal path, and the transition features are recorded to generate a path abnormal segment set;

[0030] Path strength assessment submodule: Based on the path abnormality segment set, the jump strength of each path segment is accumulated, and the distribution density of the jump points in the path is calculated. The severity of the abnormal path is determined through strength assessment, and an abnormal path identifier is generated.

[0031] As a further solution of the present invention, the number of continuous jump points adopts linear scanning of jump continuous segments node by node, the count is increased by one when a jump node is encountered, and the count is reset when a non-jump node is encountered. When the counter reaches the set jump point threshold, abnormal path confirmation is triggered.

[0032] As a further solution of the present invention, the abnormal path compression module includes:

[0033] Low-frequency path identification submodule: Based on the abnormal path identifier and abnormal behavior node, the hopping node and hopping frequency of each path are obtained. By counting the hopping frequencies of the paths, low-frequency hopping paths are screened out, and paths with frequencies below a set threshold are eliminated to generate a low-frequency hopping path set.

[0034] The jump strength calculation submodule extracts the node information of each jump path based on the low-frequency jump path set, calculates the jump strength between nodes, and performs weighted calculation on the strength value of each path according to the jump node interval, frequency and time density to generate the jump strength result;

[0035] Abnormal path marking submodule: Based on the jump strength results, the jump strength of each path is evaluated. If the strength exceeds the set threshold, combined with the abnormal density of the path, it is determined whether it is a potential abnormal path, and the path with abnormal jump strength is marked to generate a potential abnormal path.

[0036] As a further solution of the present invention, the abnormal density is the ratio of the number of abnormal nodes, which is counted by the total number of nodes in the path graph, and the path execution time is obtained by calculating the timestamp in the actual callback sequence.

[0037] The execution anomaly monitoring method based on IPD13 is performed based on the above-mentioned execution anomaly monitoring system based on IPD13, and includes the following steps:

[0038] S1: Based on the execution log information and instruction record data, extract the instruction block sequence and jump control flow sequence, define the instruction block sequence as a node, and the jump control flow sequence as an edge. Calculate the weight value and jump delay value corresponding to each edge, sort all nodes and edges according to the timestamp sequence, establish the timing association between nodes and edges, and generate the execution path graph structure;

[0039] S2: Based on the execution path graph structure, extract all node feature values and edge weight values, compare the corresponding node feature values and edge weight values in the standard path graph features node by node and edge by edge, calculate the similarity score of each node and edge, define the node-edge combination with consecutive scores below the threshold as an abnormal jump segment, mark and generate an abnormal jump path set;

[0040] S3: Based on the abnormal jump path set, the actual jump frequency values of all nodes are collected and compared with the historical standard jump frequency, and the frequency deviation value of each node is calculated. The nodes are classified according to the frequency deviation amplitude, and the nodes whose deviation exceeds the set deviation limit are screened out. The continuously deviated nodes are aggregated to form an abnormal segment area, and the abnormal behavior node set is generated;

[0041] S4: Based on the abnormal behavior node set, retrieve abnormal jump segments in all jump paths, count the number of consecutive abnormal jump segments in each path, determine whether the number of consecutive jump segments exceeds a set abnormal threshold, perform a comprehensive analysis based on the jump strength score of each path, classify the abnormality degree, and establish and generate an abnormal path feature set;

[0042] S5: Based on the abnormal path feature set, screen the path segments with low jump frequencies in all abnormal paths, calculate the jump strength value and abnormal node density value of each path segment, perform weighted calculation on the jump strength value and abnormal node density value, compare the weighted result with the set threshold, screen out potential abnormal path segments, and generate a potential abnormal path list.

[0043] Compared with the prior art, the advantages and positive effects of the present invention are:

[0044] 1. In this invention, by accurately mapping the instruction blocks and jump control flows in execution logs and execution records, an execution path graph can be effectively constructed, providing a structured data foundation for subsequent behavioral analysis. The temporal ordering of paths and the generation of path graphs can accurately capture every detail of program execution, thereby identifying potential jump paths and abnormal behaviors.

[0045] 2. In this invention, a graph neural network is used to compare execution paths segment by segment and calculate similarity. This not only accurately identifies paths that do not match the standard graph structure, but also promptly marks these abnormal paths, thereby preventing potential system anomalies from affecting stability and performance.

[0046] 3. In this invention, by collecting execution frequencies and calculating node frequency deviations, nodes in the system that exhibit abnormal behavior can be promptly identified and clustered into abnormal behavior segments, further generating abnormal nodes, ensuring early warning of abnormal behavior and reducing the probability of serious failures;

[0047] 4. In the present invention, by combining jump intensity and anomaly density analysis, low-frequency jump paths can be compressed, thereby reducing the amount of redundant data, improving anomaly identification efficiency, and significantly improving operation and maintenance efficiency. At the same time, it can provide structured data support to facilitate subsequent model optimization and troubleshooting. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The above and other objects, features and advantages of the present application will become more apparent through a more detailed description of exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0049] Figure 1 is a system flow chart of the present invention;

[0050] Figure 2 Schematic diagram of the system framework of the present invention;

[0051] Figure 3 Schematic diagram of the method steps of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application; the technical solutions in the embodiments of this application will be described in detail below in conjunction with the drawings.

[0053] See also Figure 1 The present invention provides a technical solution: an execution anomaly monitoring system based on IPD13 includes:

[0054] Execution path construction module: Based on the execution log and execution record, it maps instruction blocks to jump control flows, with instruction blocks as nodes and jump control flows as edges. It records edge weights and delays, sorts paths according to timing, and generates an execution path graph.

[0055] Path matching identification module: Based on the execution path graph, a graph neural network is used to compare the path with the standard graph structure, check the node and edge matching, and compare the similarity between the path and the standard graph segment by segment. If the match fails and the similarity is low, it is marked as a jump path and a jump path identifier is generated;

[0056] Abnormal behavior determination module: Based on the execution path graph, it collects the execution information of each node, calculates the jump frequency based on the historical path data, and determines whether it is an abnormal node based on the node frequency deviation. It clusters it into abnormal behavior segments and generates abnormal behavior nodes;

[0057] Abnormal path identification module: Based on the jump path identifier, it screens the jump segments in the path and checks the number of consecutive jump points. If the number exceeds the threshold, it is marked as an abnormal path. Combined with the jump strength value analysis, the degree of abnormality is determined and an abnormal path identifier is generated;

[0058] Abnormal path compression module: Based on abnormal path identification and abnormal behavior nodes, it compresses low-frequency jump paths, calculates jump intensity and abnormal density, and marks as a potential abnormal path if the intensity exceeds the set threshold, generating a potential abnormal path.

[0059] See also Figure 2 , the execution path building blocks include:

[0060] Instruction block mapping submodule: Based on execution logs and execution records, each instruction is identified and mapped into a node in sequence, and relevant execution information of each node, such as execution time, input and output data, is extracted. The relationship between instructions and status is recorded, and an instruction node set is generated.

[0061] Jump control flow mapping submodule: Based on the execution log and execution record, it identifies the jump control flow of each instruction, captures the conditional and unconditional flags of each jump, records the jump condition and target address, generates the edge weight and delay tag of each jump, and obtains the jump control flow graph;

[0062] Path timing sorting submodule: Based on the instruction node set and jump control flow graph, it sorts the paths according to the timestamps in the execution log to ensure that the execution order of the path nodes is consistent with the actual execution. It updates the order of each node and the jump path relationship to generate the execution path graph.

[0063] Instruction block mapping submodule: Based on the execution log data and execution record data, the longest common subsequence matching algorithm is adopted, and the matching parameters are set as strict matching of sequence element consistency, the maximum matching length is limited to 128, the starting index position starts from the 0th bit, and the end index is determined by the total length of the sequence minus 1. Each instruction sequence is identified and processed, and the instruction sequence is extracted and compared in sequence. The instruction block node mapping operation is performed. By traversing the instruction sequence, the execution start timestamp, end timestamp, input data set number, and output data set number corresponding to each instruction are extracted. The instruction sequence index is used as the node ID, and a node table structure is established to record the correspondence between each instruction and the system state variable set, and generate an instruction node set;

[0064] Jump control flow mapping submodule: Based on the execution log data and execution record data, the finite state automaton modeling method is used to set the state transfer table. The input condition type is the instruction jump flag. The condition flag set value range is 0 to 7. The state set range is set to all instruction block nodes in the program. The target state is defined as the jump target node index. Each instruction jump control flow is identified and processed, and the jump condition extraction and transfer path analysis are performed. The jump edge weight marking operation is performed. By analyzing the jump trigger condition parameters, condition establishment flag value, and jump target address index in the instruction jump instruction set, each valid jump path is extracted, and the corresponding jump condition type value and the time difference before and after the jump are recorded. The edge weight of each jump path is set to the jump frequency between instruction blocks, and the delay mark is the time difference to obtain the jump control flow graph;

[0065] Path timing sorting submodule: Based on the instruction node set and jump control flow graph, a stable sorting method is adopted, and the comparison function is set to timestamp ascending sorting. The element stability requirement is that the nodes with the same timestamp are arranged in the original index order. The nodes and jump edges are sorted in time series, and the nodes and edges are serialized and adjusted. Sequential update operations are performed. By comparing the start timestamp field and the jump trigger timestamp field in all node structures one by one, the nodes and jump edges are stably merged in ascending timestamp order, and the sequential update of the nodes and jump relationships in the execution path is completed to generate an execution path graph.

[0066] See also Figure 2 , the path matching recognition module includes:

[0067] Path structure comparison submodule: Based on the execution path graph, it compares the path structure, checks whether the node and jump control flow are consistent with the standard path, compares the structure of the path graph and the standard graph section by section, outputs the structure matching results, and generates the path structure comparison results;

[0068] Node and edge matching submodule: Based on the path structure comparison results, it matches each node and edge, compares the nodes and edges in the execution path with those in the standard path one by one, confirms whether they match, marks the nodes and edges that fail to match, and generates the node and edge matching results;

[0069] Path similarity calculation submodule: Based on the node and edge matching results, a graph neural network is used to calculate the similarity between each path segment and the standard path. If the similarity is lower than the set threshold, the path is marked as a jump path and a jump path identifier is generated;

[0070] Path structure comparison submodule: Based on the execution path graph, a subgraph isomorphism detection algorithm is adopted. The node attribute set is set as the node number and the node status value, the edge attribute set is set as the jump control identifier and the jump direction identifier. The node matching constraint is that the node number is consistent, and the edge matching constraint is that the jump direction is consistent with the identifier value. The path structure is compared and processed, and a structural mapping detection of the node set and the edge set is performed. Each path segment is compared step by step. The execution path node and the standard path node are matched through the node number mapping function. The edge set is compared to see if the jump control identifiers correspond one to one. The comparison status and matching flag of each segment are output to generate the path structure comparison result.

[0071] Node and edge matching submodule: Based on the path structure comparison results, the node-edge attribute comparison method is used. The node comparison items are set as the execution index number, input data hash value, and output data hash value. The edge comparison items are set as the starting node index, end node index, and jump trigger type value. The node comparison method is that the hash values are consistent and the index order has no offset. The edge comparison method is that the starting and end indexes correspond exactly and the jump types are consistent. Each node and edge is matched, and the field verification of the node field content and the edge attribute content is performed. The matching failure identification record is performed. By traversing each node, the execution input and output data hash values are compared, and the jump edge start and end indexes and jump type values are compared with the standard path edge set. All nodes and edges that fail the comparison are marked, and the node and edge matching results are generated.

[0072] Path similarity calculation submodule: Based on the node and edge matching results, the graph neural network modeling method is adopted, the input node feature dimension is set to 64, the number of attention heads is 8, the output dimension of each head is 8, the total number of layers is 3, the activation function is ELU, the learning rate is set to 0.0005, the training batch size is 32, the maximum number of iterations is 500, and the path segment similarity calculation is performed. Node feature encoding is performed to generate node embedding representation and path graph embedding is generated. Node aggregation features are formed by weighted averaging of neighbor node features. Path segment embedding vectors are jointly constructed using node features and jump edge features. The cosine similarity function is used to calculate the similarity score between the path segment embedding vector and the standard path segment embedding vector. If the similarity score is lower than the set threshold of 0.75, the corresponding path segment is marked as a jump path, and a jump path identifier is generated.

[0073] See also Figure 2 , graph neural network, according to the formula:

[0074]

[0075] Where: A represents the execution path diagram built based on the IPD13 standard process model, B represents the standard path diagram preset based on the IPD13 standard execution specification, A·B represents the vector dot product between the execution path embedding vector A and the standard path embedding vector B, ||A|| represents the Euclidean norm of the execution path embedding vector A, ||B|| represents the Euclidean norm of the standard path embedding vector B, w d The weight coefficient representing the density of the jump nodes in the execution path graph, w s represents the similarity weight coefficient between the execution path graph and the standard path graph in terms of topological connectivity, w a Represents the local abnormal density correction coefficient of the execution path graph, w b represents the local anomaly density correction coefficient of the standard path map, Sim′(A,B) represents the improved path similarity value;

[0076] Execution process: First, the collected execution path graph is input into the graph neural network model to extract the embedding vector. At the same time, the pre-defined standard path graph is input into the same graph neural network to extract the embedding vector. Then, the inner product similarity of the two paths in the embedding space is obtained by calculating the dot product. The ratio of the number of jump nodes to the total number of nodes in the execution path graph is further statistically calculated to obtain the jump node density weight coefficient. The path topology structure similarity weight coefficient is determined based on the node connectivity consistency score of the execution path graph and the standard path graph. At the same time, the local abnormal node density of the execution path graph and the standard path graph are integrated respectively to generate the execution path local anomaly correction coefficient and the standard path local anomaly correction coefficient respectively. Local anomaly adjustment and standard characteristic adjustment are performed at the same time. Finally, the enhanced dot product result is used as the numerator and the product of the two corrected norms is used as the denominator to complete the calculation of the improved path similarity and obtain an accurate similarity index for identifying execution anomalies or jump anomalies.

[0077] See also Figure 2 ,The abnormal behavior determination module includes:

[0078] Node information extraction submodule: Based on the execution path graph, it extracts the execution time, status, input and output data of each node. By traversing the path graph nodes, it records the execution order and execution results of each node, marks the instruction type and data dependency, and generates a node execution information set.

[0079] Frequency deviation identification submodule: Based on the node execution information set, it counts the jump frequency of each node and compares it with the corresponding node in the historical path data. It calculates the difference in jump frequency, determines whether the deviation exceeds the set threshold, marks the node with large deviation, and generates a frequency abnormal node set;

[0080] Behavior clustering and annotation submodule: Based on the frequency abnormal node set, cluster the deviation nodes according to the execution order and jump pattern, determine whether the consecutive jump nodes belong to the same abnormal behavior segment, annotate the clustering results, and generate abnormal behavior nodes;

[0081] Node information extraction submodule: Based on the execution path graph, a node traversal extraction method is adopted, the traversal mode is set to depth-first traversal, the initial node is set to the first node with the smallest timestamp in the execution path graph, and the traversal order is sorted in ascending order of timestamps. The node extraction content fields include the execution start time, execution end time, node current state flag, input data hash number, and output data hash number. Node information extraction processing is performed, and node time and data fields are captured and associated with execution results. By recording the node index, execution time interval, input and output data number relationship each time a node is visited, and extracting the instruction operation type field and upstream and downstream data dependency, after the traversal is completed, the node records are sorted and stored in the execution order to generate a node execution information set;

[0082] Frequency deviation identification submodule: Based on the node execution information set, the node frequency difference calculation method is used. The statistical period is set to every 100 node batches. The jump record statistics method is the sum of the number of jumps per node. The historical path node frequency benchmark takes the average of the most recent 50 execution records. The deviation calculation method uses the current frequency minus the benchmark frequency to perform jump frequency statistics and difference calculation processing. The node jump record aggregation and historical data comparison are performed, and the frequency deviation threshold is judged. By reading the number of jumps of each node in the execution path, the node jump frequency value is accumulated and then subtracted from the historical frequency mean to calculate the frequency difference. The deviation threshold is set to plus or minus 10%. Nodes whose frequency difference exceeds the positive and negative threshold range are marked to generate a frequency abnormal node set.

[0083] Behavior clustering and labeling submodule: Based on the frequency abnormal node set, a density-based spatial clustering algorithm is adopted, the minimum number of neighbors parameter min_samples is set to 5, the neighborhood distance threshold eps is set to 0.3, and the clustering basis is the node execution time sequence difference and the jump target node similarity. The node time sequence difference is set to be a neighbor within 20 time units, and the jump target node similarity is set to the target node hash number being consistent. Abnormal behavior segment clustering processing is performed, abnormal node neighborhood search and cluster formation are performed, and abnormal cluster behavior is labeled. By selecting any node as the initial point in the frequency abnormal node, querying its neighbor nodes within the eps range, and judging whether the number of neighbor nodes meets the min_samples condition, if it does, a cluster set is formed. During the clustering process, the node set index range and jump pattern characteristics of each cluster are recorded, and abnormal segments are labeled according to the continuity of the node sequence within the cluster to generate abnormal behavior nodes.

[0084] See also Figure 2 ,The abnormal path identification module includes:

[0085] Transition segment extraction submodule: Based on the transition path identifier, it traverses the path graph, extracts all transition segments, and filters out continuous transition segments based on the order of transitions and the correlation between nodes. It removes segments with transition intervals less than the set threshold and generates continuous transition segments.

[0086] Transition accumulation judgment submodule: Based on the continuous transition segments, the transition points in each transition segment are counted. If the number of continuous transition points exceeds the set threshold, it is identified as an abnormal path, and the transition features are recorded to generate a path abnormal segment set;

[0087] Path strength assessment submodule: Based on the path anomaly segment set, the jump strength of each path segment is accumulated and the distribution density of the jump points in the path is calculated. The severity of the abnormal path is determined through strength assessment and an abnormal path identifier is generated.

[0088] Jump segment extraction submodule: Based on the jump path identification, the jump sequence screening method is adopted. The screening condition is set as the jump node appearance timestamps are arranged in ascending order. The jump segment division threshold is that the time interval does not exceed 10 unit time. The correlation judgment standard is that the node jump target address numbers are continuous and the adjacent difference is less than 3. Jump segment extraction processing is performed, and the jump node time is compared with the jump target number. Jump segment continuity screening is performed. By traversing the node list marked as jump nodes in the execution path graph, continuous jump occurrence nodes are extracted, and the sections where the time interval between any two jump nodes is less than the set threshold are screened out. The node segments that meet the continuous jump requirements are aggregated to generate jump continuous sections.

[0089] Jump accumulation judgment submodule: Based on the continuous jump segment, the jump point number accumulation judgment method is used. The continuous jump point counting parameter is set to the continuous jump point number of a single segment, the judgment threshold is set to 6 points, and the counting method is the continuous accumulation of the jump node index within the segment. The jump point accumulation counting process is performed, the number of continuous jump nodes in a single segment is judged, and abnormal sections are screened. By counting the number of jump nodes within each continuous jump segment, when the number of nodes is greater than the set threshold, the corresponding jump segment feature information is recorded, including the jump start node index, end node index, total jump point number and jump time span, and the path abnormal section index set is formed.

[0090] Path strength assessment submodule: Based on the path abnormal section set, the jump strength accumulation and density assessment method is adopted. The jump strength calculation formula is set as the number of jump points in the section divided by the time span, and the abnormal density calculation formula is set as the number of jump points divided by the total number of nodes. The abnormal classification standard sets the jump strength higher than 0.3 and the density higher than 0.4 as a serious abnormality. The path jump strength and density calculation processing are performed, the jump section strength quantification and distribution density measurement are performed, and the abnormal level is determined. The abnormality classification standard is used to determine the accumulated jump strength value of each path abnormal section and the proportion of jump nodes in the total number of section nodes, and generate an abnormal path identifier.

[0091] The number of continuous jump points is determined by linearly scanning the jump continuous segment node by node. The count is increased by one when a jump node is encountered, and the count is reset when a non-jump node is encountered. When the counter reaches the set jump point threshold, abnormal path confirmation is triggered.

[0092] See also Figure 2 , the abnormal path compression module includes:

[0093] Low-frequency path identification submodule: Based on abnormal path identifiers and abnormal behavior nodes, it obtains the hopping nodes and hopping frequencies of each path. By counting the hopping frequencies of the paths, it screens out low-frequency hopping paths, eliminates paths with frequencies below a set threshold, and generates a low-frequency hopping path set.

[0094] The jump strength calculation submodule extracts the node information of each jump path based on the low-frequency jump path set, calculates the jump strength between nodes, and performs weighted calculation on the strength value of each path according to the jump node interval, frequency, and time density to generate the jump strength result.

[0095] Abnormal path marking submodule: Based on the jump strength results, the jump strength of each path is evaluated. If the strength exceeds the set threshold, combined with the abnormal density of the path, it is determined whether it is a potential abnormal path. The path with abnormal jump strength is marked and generated as a potential abnormal path;

[0096] Low-frequency path identification submodule: Based on abnormal path identification and abnormal behavior nodes, a hopping frequency statistical screening method is adopted. The frequency calculation window is set to the total number of hopping nodes in the entire path, and the hopping frequency threshold is set to 0.05 times / node. The screening rule is that when the hopping node frequency is lower than the set threshold, the path is classified as a low-frequency hopping path. Hopping frequency statistical processing is performed, node hopping frequency extraction and low-frequency screening are performed, and path set classification is performed. By extracting the hopping frequency data of all hopping nodes in each abnormal path, the ratio of the number of hopping occurrences of each node to the total number of nodes is calculated, and the paths with hopping frequencies lower than the set threshold are screened out to generate a low-frequency hopping path set;

[0097] Jump strength calculation submodule: Based on the low-frequency jump path set, the jump node weighted calculation method is adopted. The jump interval parameter is set as the node index difference, the jump frequency parameter is the ratio of the number of node jumps, and the time density parameter is the inverse of the time interval between node jumps. The strength weighting coefficients are interval weight 0.4, frequency weight 0.3, and density weight 0.3 respectively. The node jump strength calculation process is performed, and node pair interval measurement, frequency statistics and time density estimation are performed. The jump strength of the nodes in the path is accumulated. By traversing the continuous jump nodes in each path, the node index position difference, jump frequency value and occurrence time interval value are extracted. The overall jump strength value of the path is formed according to the weighted accumulation of each weight to generate the jump strength result.

[0098] Abnormal path marking submodule: Based on the jump strength results, the path anomaly judgment method is adopted, and the jump strength threshold is set to 0.6 and the anomaly density threshold is set to 0.4. The jump strength calculation is based on the weighted jump value, and the anomaly density calculation is based on the proportion of abnormal nodes in the path. Path anomaly detection and processing are performed, and the jump strength and anomaly density are jointly judged. Potential abnormal paths are screened. By independently judging the jump strength and abnormal node density value of each path, when both indicators exceed the set threshold, the path is marked as a potential anomaly and a potential abnormal path is generated.

[0099] Anomaly density is the ratio of the number of nodes with abnormalities, which is counted by the total number of nodes in the path graph. The path execution time is obtained by calculating the timestamp in the actual callback sequence.

[0100] See also Figure 3 The execution anomaly monitoring method based on IPD13 is executed based on the above-mentioned execution anomaly monitoring system based on IPD13, and includes the following steps:

[0101] S1: Based on the execution log information and instruction record data, extract the instruction block sequence and jump control flow sequence, define the instruction block sequence as a node, and the jump control flow sequence as an edge. Calculate the weight value and jump delay value corresponding to each edge, sort all nodes and edges according to the timestamp sequence, establish the timing association between nodes and edges, and generate the execution path graph structure;

[0102] S2: Based on the execution path graph structure, all node feature values and edge weights are extracted. The corresponding node feature values and edge weights in the standard path graph features are compared node by node and edge by edge. The similarity score of each node and edge is calculated. The node-edge combination with consecutive scores below the threshold is defined as an abnormal jump segment. The abnormal jump path set is marked and generated.

[0103] S3: Based on the abnormal jump path set, the actual jump frequency values of all nodes are collected and compared with the historical standard jump frequency. The frequency deviation value of each node is calculated. The nodes are classified according to the frequency deviation amplitude, and the nodes with deviations exceeding the set deviation limit are screened out. The continuously deviated nodes are aggregated to form an abnormal segment area, and the abnormal behavior node set is generated.

[0104] S4: Based on the abnormal behavior node set, retrieve the abnormal jump segments in all jump paths, count the number of consecutive abnormal jump segments in each path, determine whether the number of consecutive jump segments exceeds the set abnormal threshold, perform a comprehensive analysis based on the jump strength score of each path, classify the abnormality level, and establish and generate an abnormal path feature set;

[0105] S5: Based on the abnormal path feature set, screen all abnormal paths for path segments with low hopping frequencies, calculate the hopping strength value and abnormal node density value of each path segment, perform weighted calculation on the hopping strength value and abnormal node density value, compare the weighted result with the set threshold, screen out potential abnormal path segments, and generate a potential abnormal path list.

[0106] The above are merely preferred embodiments of the present invention and do not limit the present invention in any other form. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. The execution anomaly monitoring system based on IPD13 is characterized by: The system comprises: Execution path construction module: Based on the execution log and execution record, it maps instruction blocks to jump control flows, with instruction blocks as nodes and jump control flows as edges. It records edge weights and delays, sorts paths according to timing, and generates an execution path graph. Path matching identification module: Based on the execution path graph, a graph neural network is used to compare the path with the standard graph structure, check the node and edge matching, and compare the similarity between the path and the standard graph segment by segment. If the match fails and the similarity is low, it is marked as a jump path and a jump path identifier is generated; Abnormal behavior determination module: Based on the execution path graph, collects the execution information of each node, calculates the jump frequency in combination with the historical path data, determines whether it is an abnormal node based on the node frequency deviation, clusters it into abnormal behavior segments, and generates abnormal behavior nodes; Abnormal path identification module: Based on the jump path identifier, it screens the jump segments in the path and checks the number of consecutive jump points. If the number exceeds the threshold, it is marked as an abnormal path. Combined with the jump strength value analysis, the abnormality degree is determined and an abnormal path identifier is generated; Abnormal path compression module: Based on abnormal path identification and abnormal behavior nodes, it compresses low-frequency jump paths, calculates jump intensity and abnormal density, and marks as a potential abnormal path if the intensity exceeds the set threshold, generating a potential abnormal path.

2. The execution anomaly monitoring system based on IPD13 according to claim 1, characterized in that: The execution path construction module includes: Instruction block mapping submodule: Based on execution logs and execution records, each instruction is identified and mapped into a node in sequence, and relevant execution information of each node, such as execution time, input and output data, is extracted. The relationship between instructions and status is recorded, and an instruction node set is generated. Jump control flow mapping submodule: Based on the execution log and execution record, it identifies the jump control flow of each instruction, captures the conditional and unconditional flags of each jump, records the jump condition and target address, generates the edge weight and delay tag of each jump, and obtains the jump control flow graph; Path timing sorting submodule: Based on the instruction node set and jump control flow graph, the paths are sorted according to the timestamps in the execution log to ensure that the execution order of the path nodes is consistent with the actual execution, and the order of each node and the jump path relationship are updated to generate an execution path graph.

3. The execution anomaly monitoring system based on IPD13 according to claim 1, characterized in that: The path matching identification module includes: Path structure comparison submodule: Based on the execution path graph, compare the path structure, check whether the node and jump control flow are consistent with the standard path, compare the structure of the path graph and the standard graph section by section, output the result of structure matching, and generate the path structure comparison result; Node and edge matching submodule: Based on the path structure comparison results, each node and edge is matched, and the nodes and edges in the execution path and the standard path are compared one by one to confirm whether they match, and the nodes and edges that fail to match are marked, and the node and edge matching results are generated; Path similarity calculation submodule: Based on the node and edge matching results, a graph neural network is used to calculate the similarity between each path segment and the standard path. If the similarity is lower than the set threshold, the path is marked as a jump path and a jump path identifier is generated.

4. The execution anomaly monitoring system based on IPD13 according to claim 3, characterized in that: The graph neural network is based on the formula: Where: A represents the execution path diagram built based on the IPD13 standard process model, B represents the standard path diagram preset based on the IPD13 standard execution specification, A·B represents the vector dot product between the execution path embedding vector A and the standard path embedding vector B, ||A|| represents the Euclidean norm of the execution path embedding vector A, ||B|| represents the Euclidean norm of the standard path embedding vector B, w d The weight coefficient representing the density of the jump nodes in the execution path graph, w s represents the similarity weight coefficient between the execution path graph and the standard path graph in terms of topological connectivity, w a Represents the local abnormal density correction coefficient of the execution path graph, w b Indicates the local anomaly density correction coefficient of the standard path map, Sim ′ (A, B) represents the improved path similarity value.

5. The execution anomaly monitoring system based on IPD13 according to claim 1, characterized in that: The abnormal behavior determination module includes: Node information extraction submodule: Based on the execution path graph, extract the execution time, status, input and output data of each node, traverse the path graph nodes, record the execution order and execution results of each node, mark the instruction type and data dependency, and generate a node execution information set; Frequency deviation identification submodule: Based on the node execution information set, the jump frequency of each node is counted and compared with the corresponding node in the historical path data, the difference in jump frequency is calculated, and it is determined whether the deviation exceeds the set threshold. The nodes with large deviations are marked and a set of frequency abnormal nodes is generated; Behavior clustering and annotation submodule: Based on the frequency abnormal node set, cluster the deviation nodes according to the execution order and jump mode, determine whether the consecutive jump nodes belong to the same abnormal behavior segment, annotate the clustering results, and generate abnormal behavior nodes.

6. The execution anomaly monitoring system based on IPD13 according to claim 1, characterized in that: The abnormal path identification module includes: Transition segment extraction submodule: Based on the transition path identifier, traverse the path graph, extract all transition segments, and screen out continuous transition segments based on the order of transitions and the correlation between nodes, eliminating segments with transition intervals less than a set threshold, and generating continuous transition segments; Transition accumulation judgment submodule: Based on the continuous transition segments, the transition points in each transition segment are counted. If the number of continuous transition points exceeds the set threshold, it is identified as an abnormal path, and the transition features are recorded to generate a path abnormal segment set; Path strength assessment submodule: Based on the path abnormality segment set, the jump strength of each path segment is accumulated, and the distribution density of the jump points in the path is calculated. The severity of the abnormal path is determined through strength assessment, and an abnormal path identifier is generated.

7. The execution anomaly monitoring system based on IPD13 according to claim 6, characterized in that: The number of continuous jump points is determined by linearly scanning the jump continuous segment node by node. When a jump node is encountered, the count is increased by one. When a non-jump node is encountered, the count is reset. When the counter reaches the set jump point threshold, abnormal path confirmation is triggered.

8. The execution anomaly monitoring system based on IPD13 according to claim 1, characterized in that: The abnormal path compression module includes: Low-frequency path identification submodule: Based on the abnormal path identifier and abnormal behavior node, the hopping node and hopping frequency of each path are obtained. By counting the hopping frequencies of the paths, low-frequency hopping paths are screened out, and paths with frequencies below a set threshold are eliminated to generate a low-frequency hopping path set. The jump strength calculation submodule extracts the node information of each jump path based on the low-frequency jump path set, calculates the jump strength between nodes, and performs weighted calculation on the strength value of each path according to the jump node interval, frequency and time density to generate the jump strength result; Abnormal path marking submodule: Based on the jump strength results, the jump strength of each path is evaluated. If the strength exceeds the set threshold, combined with the abnormal density of the path, it is determined whether it is a potential abnormal path, and the path with abnormal jump strength is marked to generate a potential abnormal path.

9. The execution anomaly monitoring system based on IPD13 according to claim 8, characterized in that: The abnormal density is the ratio of the number of abnormal nodes, which is calculated based on the total number of nodes in the path graph. The path execution time is obtained by calculating the timestamp in the actual callback sequence.

10. The execution anomaly monitoring method based on IPD13 is characterized in that: The execution anomaly monitoring system based on IPD13 according to any one of claims 1 to 9 comprises the following steps: S1: Based on the execution log information and instruction record data, extract the instruction block sequence and jump control flow sequence, define the instruction block sequence as a node, and the jump control flow sequence as an edge. Calculate the weight value and jump delay value corresponding to each edge, sort all nodes and edges according to the timestamp sequence, establish the timing association between nodes and edges, and generate the execution path graph structure; S2: Based on the execution path graph structure, extract all node feature values and edge weight values, compare the corresponding node feature values and edge weight values in the standard path graph features node by node and edge by edge, calculate the similarity score of each node and edge, define the node-edge combination with consecutive scores below the threshold as an abnormal jump segment, mark and generate an abnormal jump path set; S3: Based on the abnormal jump path set, the actual jump frequency values of all nodes are collected and compared with the historical standard jump frequency, and the frequency deviation value of each node is calculated. The nodes are classified according to the frequency deviation amplitude, and the nodes whose deviation exceeds the set deviation limit are screened out. The continuously deviated nodes are aggregated to form an abnormal segment area, and the abnormal behavior node set is generated; S4: Based on the abnormal behavior node set, retrieve abnormal jump segments in all jump paths, count the number of consecutive abnormal jump segments in each path, determine whether the number of consecutive jump segments exceeds a set abnormal threshold, perform a comprehensive analysis based on the jump strength score of each path, classify the abnormality degree, and establish and generate an abnormal path feature set; S5: Based on the abnormal path feature set, screen the path segments with low jump frequencies in all abnormal paths, calculate the jump strength value and abnormal node density value of each path segment, perform weighted calculation on the jump strength value and abnormal node density value, compare the weighted result with the set threshold, screen out potential abnormal path segments, and generate a potential abnormal path list.

Images