Software security detection method and device based on deep learning model

Abstract

The present invention discloses a software security detection method and device based on a deep learning model. The method relates to the technical field of electrical digital data processing and includes the following steps: collecting detection feature validity data, quantitatively judging the detection feature validity, collecting detection time limitation data, and quantitatively judging the detection time limitation. The present invention quantifies the acquired detection feature validity data to obtain a software security detection feature validity value, and determines whether to perform detection feature validity optimization. If so, the detection time limitation data is obtained after optimization. Otherwise, the detection time limitation data is directly obtained and quantified to obtain a software security detection time limitation value, and determines whether to perform detection time limitation optimization and secondary software security detection. This improves the effectiveness of software security long-term behavior detection and solves the problem of low effectiveness of software security long-term behavior detection due to differences in the detection process in the prior art.

Description

Technical Field

[0001] The present invention relates to the technical field of electronic digital data processing, and in particular to a software security detection method and device based on a deep learning model. Background Art

[0002] Existing technologies can automatically extract features of input data through convolutional layers, pooling layers, and fully connected layers, which can automatically extract features and reduce reliance on manual feature engineering; process sequence data through cyclic structures, which can capture dependencies in time series and process long sequence data to capture time dependencies; solve the gradient vanishing problem through gating mechanisms, and can remember important information for a long time.

[0003] For example, the invention patent announcement with announcement number: CN116361748B discloses a software supply chain security detection method and device, including: entering a monitoring mode in response to a development security detection instruction, and promptly obtaining the source URL of the target content when an operation of copying / downloading target content carrying open source code is detected. If the source URL is unsafe, the corresponding target content is promptly deleted to prevent the target content from being applied to the development interface.

[0004] For example, the software security detection system and software security detection method disclosed in the invention patent announcement with announcement number CN111382444B include: a software detection device for receiving software, classifying the software, and detecting the source code of the software with a first program corresponding to the type of software, or a software detection device for detecting the relationship of at least one parameter transfer of the software with a second program corresponding to the type of software. If the source code of the software is abnormal or the relationship of at least one parameter transfer of the software is abnormal, the software detection device outputs an abnormal signal.

[0005] However, in the process of implementing the technical solutions of the invention in the embodiments of the present application, the present application found that the above technology has at least the following technical problems:

[0006] In existing technologies for monitoring mobile application behavior (such as system calls, network communications, etc.), malware uses slow data transmission to evade detection, transmitting only a small amount of data in total over a long period of time, thereby avoiding generating obvious traffic characteristics. This makes the amount of data transmitted each time far lower than the burst traffic that normal applications may generate, thus appearing "normal" in threshold detection based on traffic size. In addition, some malicious applications exhibit normal behavior for a period of time after installation, but the cumulative effect of their behavior, that is, the sum of their behavior over a long period of time, poses a security threat. There is a problem of low effectiveness of long-term software security behavior detection due to differences in the detection process. Summary of the Invention

[0007] The embodiments of the present application solve the problem in the prior art of low effectiveness of long-term software security behavior detection due to differences in the detection process by providing a software security detection method and device based on a deep learning model, thereby improving the effectiveness of long-term software security behavior detection.

[0008] An embodiment of the present application provides a software security detection method based on a deep learning model, comprising the following steps: performing software security detection through a constructed long short-term memory network model to obtain detection feature validity data; quantifying the validity of the software security detection through the detection feature validity data to obtain a software security detection-feature validity value, and judging whether to perform detection feature validity optimization, where the detection feature validity optimization includes feature discrimination optimization and flow threshold optimization; if detection feature validity optimization is performed, then obtaining detection time limitation data after the detection feature validity optimization, otherwise directly obtaining detection time limitation data; quantifying the time limitation of the software security detection through the detection time limitation data to obtain a software security detection-time limitation value, and judging whether to perform detection time limitation optimization and secondary software security detection, where the detection time limitation optimization includes dynamic window width adjustment and adjustment of the weight of data points within the window.

[0009] An embodiment of the present application provides a software security detection device based on a deep learning model, including a detection feature validity data acquisition module, a detection feature validity quantification judgment module, a detection time limitation data acquisition module and a detection time limitation quantification judgment module: the detection feature validity data acquisition module is used to perform software security detection through a constructed long short-term memory network model to obtain detection feature validity data; the detection feature validity quantification judgment module is used to quantify the validity of software security detection through the detection feature validity data to obtain a software security detection-feature validity value, and to determine whether to perform detection feature validity optimization; the detection time limitation data acquisition module is used to obtain detection time limitation data after the detection feature validity optimization if detection feature validity optimization is performed, otherwise directly obtain detection time limitation data; the detection time limitation quantification judgment module is used to quantify the time limitation of software security detection through the detection time limitation data to obtain a software security detection-time limitation value, and to determine whether to perform detection time limitation optimization and secondary software safety detection.

[0010] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0011] 1. The software security detection-feature effectiveness value is quantified by the obtained detection feature effectiveness data to determine whether to optimize the detection feature effectiveness. If so, the detection time limitation data is obtained after optimization. Otherwise, the detection time limitation data is directly obtained and quantified to obtain the software security detection-time limitation value. It is determined whether to optimize the detection time limitation and conduct secondary software safety detection, thereby improving the effectiveness of software security long-term behavior detection and solving the problem of low effectiveness of software security long-term behavior detection due to differences in the detection process in the existing technology.

[0012] 2. By detecting feature validity data, the software security detection-feature validity value is obtained, thereby achieving accurate quantification of the effectiveness of software security detection. The software security detection-feature validity value is then used to determine whether to optimize the detection feature validity, thereby improving the accuracy of software security detection and further achieving an improvement in the effectiveness of software security detection features.

[0013] 3. The software safety detection-time limitation value is obtained by detecting the time limitation data, thereby realizing the accurate quantification of the time limitation of the software safety detection. Then, the software safety detection-time limitation value is used to determine whether to optimize the detection time limitation and conduct secondary software safety detection, thereby improving the effectiveness of the detection time and realizing the time reliability of the software safety detection, thereby reducing unnecessary waiting time and improving the efficiency of the software safety detection process. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 Flowchart of the software security detection method based on deep learning model provided in the embodiment of the present application;

[0015] Figure 2 A flowchart of feature discrimination optimization for a software security detection method based on a deep learning model provided in an embodiment of the present application;

[0016] Figure 3 A flow chart of dynamic window width adjustment for a software security detection method based on a deep learning model provided in an embodiment of the present application;

[0017] Figure 4 Structural diagram of a software security detection device based on a deep learning model provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] The embodiments of the present application solve the problem of low effectiveness of long-term software security behavior detection due to differences in the detection process in the prior art by providing a software security detection method and device based on a deep learning model. The software security detection-feature effectiveness value is obtained by quantifying the obtained detection feature effectiveness data, and it is determined whether to perform detection feature effectiveness optimization. If so, the detection time limitation data is obtained after optimization. Otherwise, the detection time limitation data is directly obtained and quantified to obtain the software security detection-time limitation value, and it is determined whether to perform detection time limitation optimization and secondary software safety detection, thereby improving the effectiveness of long-term software security behavior detection.

[0019] The technical solution in the embodiments of the present application is to solve the above-mentioned problem of low effectiveness of long-term software security behavior detection due to differences in the detection process. The overall idea is as follows:

[0020] Software security testing is performed through the constructed long short-term memory network model to obtain detection feature validity data. The software security detection-feature validity value is quantified based on the detection feature validity data and it is determined whether to perform detection feature validity optimization. If so, the detection time limitation data is obtained after optimization. Otherwise, the detection time limitation data is directly obtained. The software security detection-time limitation value is quantified by the detection time limitation data, and it is determined whether to perform detection time limitation optimization and secondary software safety testing, thereby improving the effectiveness of software security long-term behavior detection.

[0021] In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0022] like Figure 1 FIG. 1 is a flow chart of a software security detection method based on a deep learning model provided in an embodiment of the present application. The method is applied to a software security detection device based on a deep learning model. The method includes the following steps:

[0023] Collect detection feature validity data: Perform software security testing through the constructed long short-term memory network model to obtain detection feature validity data.

[0024] Quantitative judgment of detection feature effectiveness: The effectiveness of software security detection is quantified by detecting feature effectiveness data to obtain the software security detection-feature effectiveness value, and to determine whether to optimize the detection feature effectiveness. The detection feature effectiveness optimization includes feature discrimination optimization and traffic threshold optimization.

[0025] Collecting detection time limitation data: If the detection feature effectiveness optimization is performed, the detection time limitation data is obtained after the detection feature effectiveness optimization; otherwise, the detection time limitation data is directly obtained.

[0026] Quantitative judgment of detection time limitations: Quantify the time limitations of software security detection through detection time limitation data to obtain the software security detection-time limitation value, and determine whether to optimize the detection time limitations and conduct secondary software security detection. The optimization of detection time limitations includes dynamic window width adjustment and weight adjustment of data points within the window.

[0027] In this embodiment, the software security detection task is performed by using a long short-term memory network model that has been constructed. The validity of the current timing feature is determined based on the software security detection-feature validity value, and then a decision is made whether to optimize the detection feature validity. The detection time limitation optimization and secondary software security detection are determined based on the software security detection-time limitation value. In this application, the feature validity in the software security detection process is improved by feature discrimination optimization and flow threshold optimization, and the accuracy of time efficiency in the software security detection process is improved by dynamic window width adjustment and data point weight adjustment within the window.

[0028] It should be added that in the process of software security testing, the main function of the long short-term memory network model is to process time series data related to software behavior. Specifically, the long short-term memory network model takes time series data representing software behavior such as system call sequences, network communication patterns, etc. as input, and outputs software security testing results to reflect whether there is malicious communication or abnormal behavior in the current traffic. The form of the software security testing results is pre-set by preset personnel, including but not limited to risk level, risk type and risk quantity.

[0029] Specifically, the detection feature validity data includes the temporal feature discrimination, the behavior drift tolerance window, the behavior sequence entropy weight and the cumulative feature decay rate per unit time; the software security detection-feature validity value is obtained, which also includes obtaining the detection feature validity threshold and the detection feature validity influencing factor from the constructed software security detection database; the detection feature validity threshold includes the temporal feature discrimination threshold, the behavior drift tolerance window standard value, the behavior sequence entropy weight standard value and the cumulative feature decay rate standard value per unit time; the detection feature validity influencing factors include the temporal feature discrimination influencing factor, the behavior drift tolerance window influencing factor, the behavior sequence entropy weight influencing factor and the cumulative feature decay rate influencing factor per unit time.

[0030] Specifically, the detection time limitation data includes the software security detection time interval, the effective value of the software security detection feature to be detected, the software security detection response time and the software security detection time window; obtaining the software security detection-time limitation value also includes obtaining the detection time limitation threshold and the detection time limitation influencing factor from the constructed software security detection database; the detection time limitation threshold includes the software security detection time interval threshold, the software security detection-feature effectiveness threshold, the software security detection response time threshold and the software security detection time window standard value; the detection time limitation influencing factors include the software security detection time interval influencing factor, the software security detection-feature effective value influencing factor, the software security detection response time influencing factor and the software security detection time window influencing factor.

[0031] It should be noted that the aforementioned software security testing database was established to support the design and implementation of software security testing methods based on deep learning models. This database is essentially a storage center for preset parameters and data, providing key settings required for the operation of long-short-term memory network models. The database contains information including, but not limited to, time series feature discrimination thresholds, standard values ​​for behavioral drift tolerance windows, standard values ​​for behavioral sequence entropy weights, and standard values ​​for cumulative feature decay rates per unit time. It may also contain other necessary settings. It is particularly noteworthy that specific values, such as the software security testing interval threshold, are not generated out of thin air but are directly set by technical personnel based on actual needs. For example, the determination of this detection interval threshold is based on the actual application scenario of software security testing and is adjusted accordingly based on application characteristics.

[0032] Furthermore, the specific steps for obtaining the effective value of software security detection-features are as follows: using the time series feature discrimination influence factor to compensate for the analysis result of the proportion of the time series feature discrimination and the time series feature discrimination threshold, recorded as the time series feature discrimination influence value; using the behavior drift tolerance window influence factor to compensate for the analysis result of the proportion of the behavior drift tolerance window standard value and the behavior drift tolerance window deviation degree, recorded as the behavior drift tolerance window influence value; using the behavior sequence entropy weight influence factor to compensate for the analysis result of the proportion of the behavior sequence entropy weight standard value and the behavior sequence entropy weight deviation degree, recorded as the behavior sequence entropy weight influence value; through the unit time The cumulative feature decay rate impact factor compensates for the analysis result of the ratio of the deviation between the standard value of the cumulative feature decay rate per unit time and the degree of deviation between the cumulative feature decay rate per unit time, and is recorded as the cumulative feature decay rate per unit time impact value. The temporal feature discrimination impact value, the behavior drift tolerance window impact value, the behavior sequence entropy weight impact value, and the cumulative feature decay rate per unit time impact value are coupled to obtain the software security detection-feature effectiveness value. The software security detection-feature effectiveness value represents the quantitative data of the combined effects of the temporal feature discrimination, the behavior drift tolerance window, the behavior sequence entropy weight, and the cumulative feature decay rate per unit time on the effectiveness of the software security detection feature.

[0033] It should be added that the degree of deviation of the behavior drift tolerance window represents the absolute value of the difference between the behavior drift tolerance window and the standard value of the behavior drift tolerance window; the degree of deviation of the behavior sequence entropy weight represents the absolute value of the difference between the behavior sequence entropy weight and the standard value of the behavior sequence entropy weight; the degree of deviation of the cumulative feature decay rate per unit time represents the absolute value of the difference between the cumulative feature decay rate per unit time and the standard value of the cumulative feature decay rate per unit time.

[0034] In this embodiment, the specific formula for obtaining the effective value of the software security detection-feature is:

[0035] ;

[0036] ;

[0037] Indicates the valid value of software security detection feature.

[0038] It represents the discrimination of time series features, which means the Euclidean distance between the mean vector of normal behavior time series features and the mean vector of abnormal behavior time series features in the time series data of the constructed long short-term memory network. The discrimination of time series features is obtained using statistics such as inter-class divergence. Normal behavior time series features represent features that are less than or equal to the alarm threshold that triggers an alarm obtained from the software security detection database, and abnormal behavior time series features represent features that are greater than the alarm threshold that triggers an alarm obtained from the software security detection database.

[0039] Indicates the discrimination threshold of the timing features obtained from the software security detection database.

[0040] Indicates the standard value of the behavior drift tolerance window obtained from the software security detection database.

[0041] It represents the behavior drift tolerance window, which indicates the time interval within which the concept drift of the normal behavior pattern occurs. The behavior drift tolerance window is obtained according to the concept drift detection algorithm. The normal behavior pattern refers to the set of predictable behavior sequence characteristics exhibited by the software during normal operation (i.e., no malicious behavior such as IP address leakage and malicious advertisement injection is detected) in software security detection.

[0042] It represents the standard value of the entropy weight of the behavior sequence obtained from the software security detection database.

[0043] It represents the entropy weight of the behavior sequence, which represents the weight assigned to the behavior time series features in the behavior sequence. It is obtained by discretizing the behavior sequence such as binning.

[0044] Represents the standard value of the cumulative characteristic decay rate per unit time obtained from the software safety detection database.

[0045] It represents the cumulative feature decay rate per unit time, which refers to the decay rate of normal behavior timing features in time series analysis of the long short-term memory network model. The cumulative feature decay rate per unit time is obtained through the corresponding training process of the long short-term memory network.

[0046] Represents a constant term, a number set to avoid meaningless points in the data.

[0047] Represents a constant term, a number set to avoid meaningless points in the data.

[0048] Represents a constant term, a number set to avoid meaningless points in the data.

[0049] is the temporal feature discrimination influencing factor obtained from the software security detection database.

[0050] is the behavior drift tolerance window impact factor obtained from the software security detection database.

[0051] is the entropy weight impact factor of the behavior sequence obtained from the software security detection database.

[0052] is the impact factor of the cumulative feature decay rate per unit time obtained from the software security detection database.

[0053] The detection feature validity impact factor in this example represents the degree to which the detection feature validity data pre-set in the software security detection database affects the software security detection feature validity. Specifically, the software security detection database stores pre-set impact factors corresponding to the detection feature validity data. These impact factors are mapped to the detection feature validity data in a pre-set manner. This mapping relationship can be one-to-one or many-to-one. For example, in practical applications, real-time detection feature validity data can be input into this mapping relationship to quickly obtain the corresponding impact factor.

[0054] In this example, the values ​​of the time series feature discrimination influencing factor, the behavior drift tolerance window influencing factor, the behavior sequence entropy weight influencing factor, and the unit time cumulative feature decay rate influencing factor usually range from 0 to 1, and the sum of the four is 1.

[0055] In this embodiment, the parameters involved in software security detection-acquisition of effective feature values ​​are not independent of each other, but influence each other.

[0056] Specifically, the higher the discriminability of the time series feature, the more the feature itself can clearly distinguish between normal and malicious behaviors, and even if the behavior pattern drifts slightly, it can be effectively captured, and the smaller the behavior drift tolerance window; the higher the discriminability of the time series feature, the better it can reveal the low entropy or high entropy in the behavior pattern, making the judgment of the behavior sequence entropy weight more reliable; the closer the cumulative feature decay rate per unit time is to the standard value of the cumulative feature decay rate per unit time, the higher the sensitivity to recent changes, and the smaller the behavior drift tolerance window; the higher the behavior sequence entropy weight, the more it can effectively distinguish between normal and malicious features, and the higher the discriminability of the time series feature.

[0057] There is a positive correlation between the discrimination of time series features and the effective value of software security detection features. The higher the discrimination of time series features, the more clearly the features can distinguish between normal and malicious behaviors, and the higher the effective value of software security detection features. There is a negative correlation between the degree of deviation of the behavior drift tolerance window and the effective value of software security detection features. The higher the degree of deviation of the behavior drift tolerance window, the delayed response to malicious behavior will be because it takes longer to confirm the drift, and the smaller the effective value of software security detection features. There is a negative correlation between the degree of deviation of the behavior sequence entropy weight and the effective value of software security detection features. The higher the degree of deviation of the behavior sequence entropy weight, the greater the uncertainty of the behavior pattern, and the smaller the effective value of software security detection features. There is a negative correlation between the degree of deviation of the cumulative feature decay rate per unit time and the effective value of software security detection features. The faster the degree of deviation of the cumulative feature decay rate per unit time, the inability to effectively identify malicious behavior, and the smaller the effective value of software security detection features.

[0058] By analyzing the correlation between the temporal feature discrimination, behavior drift tolerance window, behavior sequence entropy weight, cumulative feature decay rate per unit time and software security detection-feature effective value, the effectiveness of the software security detection process can be quantified more accurately. Then, based on the quantified results, the effectiveness of the detection features can be optimized more timely and accurately, thereby improving the accuracy of software security detection and further improving the reliability of software security detection.

[0059] Furthermore, it is determined whether to optimize the effectiveness of the detection feature. The specific steps are as follows: if the software security detection-feature effectiveness value is greater than or equal to the preset software security detection-feature effectiveness threshold, then the detection feature effectiveness optimization adjustment is not performed. Otherwise, it is determined whether to optimize the feature discrimination based on the feature discrimination. If so, it is determined whether to optimize the flow threshold after optimizing the feature discrimination. Otherwise, it is determined whether to optimize the flow threshold directly. Otherwise, it means that the feature discrimination optimization is not performed. In other words, under the premise that the software security detection-feature effectiveness value does not meet the standard, after judgment, if the feature discrimination optimization is not performed, the process of determining whether to optimize the flow threshold is directly entered.

[0060] As a further solution, the specific steps for determining whether to perform feature discrimination optimization based on feature discrimination are as follows: if the feature discrimination is lower than or equal to the preset feature discrimination threshold, it means that the discrimination ability of the current feature set is insufficient and feature discrimination optimization is required. The initial data sample quantity is compensated by the obtained data sample quantity compensation amount, and the data sample quantity compensation amount is obtained by inputting the software security detection-feature effective value into the software security detection database for mapping; if the feature discrimination is higher than the preset feature discrimination threshold, feature discrimination optimization is not performed; if feature discrimination optimization is performed, the software security detection-feature effective value obtained after feature discrimination optimization is recorded as the software security detection-feature effective value to be evaluated, otherwise the current software security detection-feature effective value is recorded as the software security detection-feature effective value to be evaluated; the feature discrimination is obtained by judging the value of the feature through the chi-square test.

[0061] In this embodiment, if Figure 2 As shown, this is a feature discrimination optimization flow chart of the software security detection method based on the deep learning model provided in an embodiment of the present application. During the software security detection process, it is determined whether the feature discrimination is lower than or equal to the preset feature discrimination threshold. If so, the data sample quantity compensation amount is obtained to compensate the initial data sample quantity, and the software security detection-feature effective value after feature discrimination optimization is obtained and recorded as the software security detection-feature effective value to be evaluated. If feature discrimination optimization is not performed, the current software security detection-feature effective value is used and recorded as the software security detection-feature effective value to be evaluated.

[0062] By comparing the feature discrimination with a preset feature discrimination threshold, feature discrimination is optimized, the initial data sample quantity is compensated by the obtained data sample quantity compensation amount to improve the feature discrimination, and the obtained data sample quantity compensation amount is added to the initial data sample quantity to compensate for the data sample quantity.

[0063] As a further solution, the specific steps for determining whether to perform traffic threshold optimization are as follows: A1, if the software security detection-feature effective value to be evaluated is greater than or equal to the average software security detection-feature effective value within the preset software security detection times, traffic threshold optimization is not performed; A2, if the software security detection-feature effective value to be evaluated is less than the average software security detection-feature effective value within the preset software security detection times, the preset traffic minimum value is adjusted by the obtained traffic minimum adjustment amount, that is, the obtained traffic minimum adjustment amount is added to the preset traffic minimum value as the new preset traffic minimum value, so that the slow transmission behavior that was originally ignored due to too little transmission volume can also be detected, and the preset traffic maximum value is adjusted by the obtained traffic maximum adjustment amount, and the obtained traffic maximum adjustment amount is added to the preset traffic maximum value. Adding them together as a new preset traffic maximum value helps to improve detection in low-traffic areas and avoid being disturbed by normal, high-traffic behaviors, so as to focus more on analyzing existing slow malicious transmissions to detect malware that evades detection through slow data transmission. The minimum traffic adjustment amount is obtained by inputting the effective value of the software security detection-feature to be evaluated into the software security detection database for mapping. The maximum traffic adjustment amount is obtained by inputting the effective value of the software security detection-feature to be evaluated into the software security detection database for mapping. The average software security detection-feature effective value is represented by summing and averaging the software security detection-feature effective values ​​corresponding to the preset number of software security detections before the current security detection, where the preset number of software security detections is set by the preset personnel and stored in the software security detection database.

[0064] In this embodiment, the ultimate goal of adjusting the traffic threshold is to improve the ability to identify malware that uses slow data transmission strategies to evade detection. For example, malware evades detection by slowing down data transmission, generating a network data transmission volume lower than the preset network data transmission volume obtained from the software security detection database within the standard software security detection time window. By optimizing the traffic threshold, the software security detection system can more effectively identify and intercept malware that uses slow data transmission to conceal its behavior, thereby enhancing the adaptability of software security detection.

[0065] Furthermore, the specific steps for obtaining the software security detection-time limit value are as follows: compensating the analysis result of the ratio of the software security detection time interval to the software security detection time interval threshold by the software security detection time interval influencing factor, which is recorded as the software security detection time interval influencing value; compensating the analysis result of the ratio of the software security detection-feature validity threshold to the software security detection-feature validity value to be detected by the software security detection-feature validity influencing factor, which is recorded as the software security detection-feature validity influencing value to be detected; correcting the analysis result of the ratio of the software security detection response time to the software security detection response time threshold by the software security detection response time influencing factor, which is recorded as the software security detection response time influencing value; The software security detection time window impact factor is used to compensate for the analysis results of the proportion of the software security detection time window deviation degree and the software security detection time window standard value, which is recorded as the software security detection time window impact value; the software security detection time interval impact value, the software security detection-feature validity impact value to be detected, the software security detection response time impact value and the software security detection time window impact value are coupled to obtain the software security detection-time limitation value; the software security detection-time limitation value represents the quantitative data of the influence degree of the software security detection time interval, the software security detection-feature validity value to be detected, the software security detection response time and the software security detection time window on the time limitation of the software security detection process.

[0066] It should be added that the degree of deviation of the software safety detection time window represents the absolute value of the difference between the software safety detection time window and the standard value of the software safety detection time window.

[0067] In this embodiment, the specific formula for obtaining the software security detection-time limit value is:

[0068] ;

[0069] ;

[0070] Indicates the software safety detection-time limit value.

[0071] Indicates the software security check interval, which refers to the time interval between two consecutive software security checks and is represented by the timestamp recorded in the log when the software security check is performed.

[0072] Indicates the software security detection time interval threshold obtained from the software security detection database.

[0073] Indicates the preset software security detection-feature validity threshold obtained from the software security detection database.

[0074] It represents the effective value of the software security detection feature to be detected. Specifically, if the detection feature effectiveness optimization is performed, the effective value of the software security detection feature to be detected represents the effective value of the software security detection feature after the detection feature effectiveness optimization. It should be noted that if the detection feature effectiveness optimization is not performed, the effective value of the software security detection feature is the effective value of the software security detection feature to be detected.

[0075] Indicates the software security detection response time, which is expressed as the duration from the time a security incident is detected (e.g., the time the alarm is sent) to the time the response measures are executed and the administrator is notified, as recorded in the alarm log.

[0076] Indicates the software security detection response time threshold obtained from the software security detection database.

[0077] The software security detection time window refers to the time used to determine whether a software security detection is abnormal. It is obtained through data analysis windows such as SIEM (Security Information and Event Management).

[0078] Indicates the standard value of the software safety detection time window obtained from the software safety detection database.

[0079] Represents a constant term, a number set to avoid meaningless points in the data.

[0080] is the software safety detection time interval influencing factor from the software safety detection database.

[0081] It is the software security detection-feature effective value influencing factor from the software security detection database.

[0082] is the software security detection response time influencing factor from the software security detection database.

[0083] is the software security detection time window impact factor from the software security detection database.

[0084] In this example, the detection time limitation impact factor represents the degree to which the detection time limitation data pre-set in the software security detection database affects the software security detection time limitation. Specifically, the software security detection database stores pre-set impact factors corresponding to the detection time limitation data. These impact factors are mapped to the detection time limitation data in a pre-set manner. This mapping relationship can be one-to-one or many-to-one. For example, in practical applications, real-time detection time limitation data can be input into this mapping relationship to quickly obtain the corresponding impact factor.

[0085] In this example, the software security detection time interval impact factor, software security detection-feature effective value impact factor, software security detection response time impact factor, and software security detection time window impact factor typically range from 0 to 1, and the sum of the four is 1.

[0086] In this embodiment, the parameters involved in obtaining the software security detection time limit value are not independent of each other, but influence each other.

[0087] Specifically, the longer the software security detection time interval, the easier it is to miss rapidly occurring attacks, and the smaller the effective value of the software security detection-feature to be detected; the higher the effective value of the software security detection-feature to be detected, the faster the response time is needed to make up for the detection deficiencies, and the shorter the software security detection response time; the longer the software security detection response time, the longer the time from detecting a security incident or reaching a certain threat threshold to taking predetermined response measures such as isolation and alerting, and the longer the software security detection time interval; the larger the software security detection time window, the longer the data needs to be accumulated over a longer period of time before making a security judgment or triggering an alarm, resulting in a longer software security detection response time.

[0088] There is a positive correlation between the software security detection time interval and the software security detection time limit value. The longer the software security detection time interval, the larger the time blind spot between the two detections and the higher the software security detection time limit value. There is a negative correlation between the effective value of the software security detection-feature to be detected and the software security detection-time limit value. The higher the effective value of the software security detection-feature to be detected, the higher the effectiveness of the software security detection process and the smaller the software security detection-time limit value. There is a positive correlation between the software security detection response time and the software security detection-time limit value. The longer the software security detection response time, the larger the window from threat discovery to containment and the higher the software security detection-time limit value. There is a positive correlation between the degree of deviation of the software security detection time window and the software security detection-time limit value. The higher the degree of deviation of the software security detection time window, the inability to capture abnormal patterns that require a certain amount of time to accumulate and appear, and the higher the software security detection-time limit value.

[0089] By analyzing the correlation between the software security detection time interval, the effective value of the software security detection-feature to be detected, the software security detection response time, the software security detection time window and the software security detection-time limitation value, the time limitation of the software security detection process can be quantified more accurately. Then, based on the quantified results, the detection time limitation can be optimized more timely and accurately, thereby improving the security of software security detection and further improving the accuracy of software security detection.

[0090] Furthermore, the specific determination steps for optimizing the detection time limitation are as follows:

[0091] In step 1, if the software safety detection-time limitation value is lower than or equal to the preset software safety detection-time limitation threshold, the detection time limitation optimization is not performed.

[0092] Step 2: If the software security detection-time limitation value is higher than the preset software security detection-time limitation threshold, determine whether to execute step 3 based on the software security detection-time limitation deviation value. If so, determine whether to adjust the weight of the data points in the window after executing step 3. Otherwise, directly determine whether to adjust the weight of the data points in the window. Otherwise, do not execute step 3 and directly determine whether to adjust the weight of the data points in the window.

[0093] Step three: If the software security detection-time limitation deviation value is lower than or equal to the preset threat threshold, it means that the threat level is low. The window width is expanded to identify slowly changing anomalies. The initial window width is adjusted by the obtained window width increase, that is, the obtained window width increase is added to the initial window width as the new window width to identify slowly changing anomalies. Expanding the window width means that the software security detection system will observe data patterns over a longer period of time, and can better identify malware that evades detection through extremely slow data transmission, or gradually increasing abnormal access patterns, thereby improving the sensitivity of software security detection to slow threats. The window width increase is obtained by inputting the software security detection-time limitation deviation value into the software security detection database for mapping. The software security detection-time limitation deviation value represents the difference between the software security detection-time limitation value and the preset software security detection-time limitation threshold.

[0094] Step 4. If the software security detection-time limitation deviation value is higher than the preset threat threshold, it means that the threat level is high. The window width is narrowed to quickly respond to sudden anomalies. The initial window width is corrected by the obtained window width correction value, that is, the initial window width is subtracted from the window width correction value as the new window width to quickly respond to sudden anomalies. Narrowing the window width means that the software security detection system will observe the data pattern in a shorter period of time, so that it can capture the sharp fluctuations or abnormal peaks of the data more quickly, identify sudden security incidents in time, and trigger alarms or defense measures more quickly, thereby improving the response speed and accuracy of software security detection to fast threats. The window width correction value is obtained by inputting the software security detection-time limitation deviation value into the software security detection database for mapping.

[0095] It should be added that the specific judgment of the secondary software safety test is: if the detection feature effectiveness optimization and detection time limitation optimization are not performed, the software safety test results are directly output; otherwise, a secondary software safety test is performed.

[0096] In this embodiment, if Figure 3 As shown, the dynamic window width adjustment flow chart of the software security detection method based on the deep learning model provided in the embodiment of the present application determines whether the software security detection-time limitation deviation value is less than or equal to the preset threat threshold. If so, the software security detection-time limitation deviation value is input into the software security detection database to obtain the window width increase to adjust the window width; otherwise, the software security detection-time limitation deviation value is input into the software security detection database to obtain the window width correction amount to correct the window width.

[0097] The software security detection-time limitation deviation value is represented by the difference between the software security detection-time limitation value and the preset software security detection-time limitation threshold, and the software security detection-time limitation deviation value is compared with the preset threat threshold. Its ultimate goal is to enable software security detection to more flexibly and accurately identify abnormal behaviors in different time windows. Through dynamic window width adjustment, the adaptability of software security detection to security threats with different window widths is enhanced.

[0098] As a further solution, the specific steps for determining whether to adjust the weight of the data points within the window are as follows: B1. If the week-on-week change rate is greater than or equal to the preset week-on-week change rate threshold, the weight of the initial window proximal data point is compensated by the obtained window proximal data point weight compensation, that is, the obtained window proximal data point weight compensation is added to the initial window proximal data point weight as the new window proximal data point weight, so as to increase the weight of the window proximal data point and highlight the change trend. Increasing the weight of the window proximal data point means that the latest change trend in the data can be captured more keenly during software security testing, such as abnormal login failure peaks or sudden acceleration of data leakage activities, thereby improving the response speed and detection sensitivity of software security testing to dynamic security threats. The window proximal data point weight compensation is obtained by inputting the software security detection-time limit value and the week-on-week maximum deviation change rate into the software security testing database for mapping. The week-on-week maximum deviation change rate represents the difference between the week-on-week change rate and the preset week-on-week change rate threshold, and the window proximal data point represents a value lower than or equal to the week-on-week maximum deviation change rate. The data point corresponding to the entropy value of the data point in the preset window; B2, if the week-on-week change rate is less than the preset week-on-week change rate threshold, the weight of the remote data point in the initial window is compensated by the obtained weight compensation amount of the remote data point in the window, that is, the obtained weight compensation amount of the remote data point in the window is added to the weight of the remote data point in the initial window as the new weight of the remote data point in the window, so as to increase the weight of the remote data point in the window and highlight the change trend. Increasing the weight of the remote data point in the window means that long-term trends or patterns can be better identified during software security testing. For example, the trend of application performance slowly declining over a period of time improves the stability of software security testing. The weight compensation amount of the remote data point in the window is obtained by inputting the software security testing-time limit value and the week-on-week minimum deviation change rate into the software security testing database for mapping. The week-on-week minimum deviation change rate represents the difference between the preset week-on-week change rate threshold and the week-on-week change rate. The remote data point in the window represents a data point corresponding to the entropy value of the data point in the preset window; the week-on-week change rate is obtained by data analysis tools such as Python.

[0099] In this embodiment, by comparing the week-over-week rate of change with a preset week-over-week rate threshold and dynamically adjusting the weights of data points within the window based on the deviation between the week-over-week rate of change and the preset week-over-week rate threshold, the ultimate goal is to more accurately identify and respond to changing trends in the data. By adjusting the weights of data points within the window, the accuracy and responsiveness of software security testing are improved.

[0100] like Figure 4 As shown, it is a structural diagram of a software security detection device based on a deep learning model provided in an embodiment of the present application. The software security detection device based on a deep learning model provided in an embodiment of the present application includes: a detection feature validity data acquisition module, a detection feature validity quantification judgment module, a detection time limitation data acquisition module and a detection time limitation quantification judgment module: Detection feature validity data acquisition module: used to perform software security detection through the constructed long short-term memory network model and obtain detection feature validity data; Detection feature validity quantification judgment module: used to quantify the validity of software security detection through the detection feature validity data to obtain the software security detection-feature validity value, and judge whether to perform detection feature validity optimization; Detection time limitation data acquisition module: used to obtain detection time limitation data after the detection feature validity optimization if detection feature validity optimization is performed, otherwise directly obtain detection time limitation data; Detection time limitation quantification judgment module: used to quantify the time limitation of software security detection through the detection time limitation data to obtain the software security detection-time limitation value, and judge whether to perform detection time limitation optimization and secondary software safety detection.

[0101] In this embodiment, the software security detection device includes but is not limited to a vulnerability scanner, a hybrid / interactive application security testing platform, and a dynamic application security testing platform. For example, a web server is running an application for an e-commerce website and needs to continuously monitor its network traffic to detect potential malicious activities, such as data leakage, malware, etc. By deploying probes in the network and mirroring server traffic, the security team can fully understand the network communication status of the application. On this basis, the dynamic application security testing platform performs passive monitoring to capture all network data generated by the application during normal operation or user operation, including user interactions and background process communications that are ignored by active scanning. This comprehensive monitoring enables the platform to promptly detect abnormal traffic patterns, such as sudden traffic surges, and abnormal data content, such as data packets containing malicious signatures or communications with known malicious servers, thereby achieving early detection of security threats and advancing risk identification before the attack causes actual damage, thereby improving the effectiveness of software security detection.

[0102] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0103] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0104] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0105] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0106] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0107] Obviously, those skilled in the art may make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, if such modifications and variations fall within the scope of the claims and their equivalents, the present invention is intended to include such modifications and variations.

Claims

1. A software security detection method based on a deep learning model, characterized in that: The following steps are involved: Conduct software security testing using the established long-short-term memory network model to obtain detection feature validity data; Quantifying the effectiveness of software security testing by detecting feature effectiveness data to obtain a software security testing-feature effectiveness value, and determining whether to optimize the effectiveness of the detection feature, wherein the optimization of the effectiveness of the detection feature includes feature discrimination optimization and flow threshold optimization; If the detection feature validity optimization is performed, the detection time limitation data is obtained after the detection feature validity optimization, otherwise the detection time limitation data is directly obtained; Quantifying the time limitation of software security testing by detecting time limitation data to obtain a software security testing-time limitation value, and determining whether to perform detection time limitation optimization and secondary software security testing. The detection time limitation optimization includes dynamic window width adjustment and weight adjustment of data points within the window; The specific determination steps for optimizing the detection time limitation are as follows: Step 1: If the software security detection-time limit value is lower than or equal to the preset software security detection-time limit threshold, then the detection time limit optimization is not performed; Step 2: If the software safety detection-time limitation value is higher than the preset software safety detection-time limitation threshold, determine whether to execute step 3 based on the software safety detection-time limitation deviation value. If so, determine whether to adjust the weight of the data points in the window after executing step 3. Otherwise, directly determine whether to adjust the weight of the data points in the window. The specific steps of determining whether to adjust the weights of data points within the window are: B1. If the week-over-week change rate is greater than or equal to the preset week-over-week change rate threshold, the weight of the proximal data point in the initial window is compensated by the obtained weight compensation amount of the proximal data point in the window. The weight compensation amount of the proximal data point in the window is obtained by inputting the software safety detection-time limit value and the week-over-week maximum deviation change rate into the software safety detection database for mapping; B2: If the week-over-week change rate is less than a preset week-over-week change rate threshold, the weight of the remote data points in the initial window is compensated by the obtained weight compensation amount of the remote data points in the window. The weight compensation amount of the remote data points in the window is obtained by inputting the software safety detection-time limit value and the week-over-week minimum deviation change rate into the software safety detection database for mapping; Step 3: If the software security detection-time limitation deviation value is less than or equal to the preset threat threshold, the initial window width is adjusted by the obtained window width increase, where the window width increase is obtained by inputting the software security detection-time limitation deviation value into a software security detection database for mapping; Step 4: If the software security detection-time limitation deviation value is higher than the preset threat threshold, the initial window width is corrected using the obtained window width correction value, where the window width correction value is obtained by inputting the software security detection-time limitation deviation value into a software security detection database for mapping; The specific determination of the secondary software security detection is: if the detection feature effectiveness optimization and the detection time limitation optimization are not performed, the software security detection result is directly output; otherwise, a secondary software security detection is performed.

2. The software security detection method based on the deep learning model according to claim 1, characterized in that: The detection feature validity data includes time series feature discrimination, behavior drift tolerance window, behavior sequence entropy weight and unit time cumulative feature decay rate; The obtaining of the software security detection-feature validity value also includes obtaining the detection feature validity threshold and the detection feature validity influencing factor from the established software security detection database; The detection feature validity threshold includes a time series feature discrimination threshold, a behavior drift tolerance window standard value, a behavior sequence entropy weight standard value, and a unit time cumulative feature decay rate standard value; The detection feature validity influencing factors include the temporal feature discrimination influencing factor, the behavior drift tolerance window influencing factor, the behavior sequence entropy weight influencing factor and the unit time cumulative feature attenuation rate influencing factor; The detection time limitation data includes software security detection time interval, software security detection-feature validity value to be detected, software security detection response time, and software security detection time window; The obtaining of the software safety detection-time limitation value also includes obtaining a detection time limitation threshold and a detection time limitation influencing factor from a constructed software safety detection database; The detection time limitation thresholds include a software security detection time interval threshold, a software security detection-feature validity threshold, a software security detection response time threshold, and a software security detection time window standard value; The detection time limitation influencing factors include software security detection time interval influencing factors, software security detection-feature effective value influencing factors, software security detection response time influencing factors and software security detection time window influencing factors.

3. The software security detection method based on the deep learning model according to claim 2, characterized in that: The specific steps for obtaining the software security detection-feature effective value are: The analysis results of the proportion of temporal feature discrimination and temporal feature discrimination threshold are compensated by the temporal feature discrimination impact factor, which is recorded as the temporal feature discrimination impact value; The behavior drift tolerance window impact factor is used to compensate for the analysis result of the proportion of the behavior drift tolerance window standard value and the degree of deviation of the behavior drift tolerance window, which is recorded as the behavior drift tolerance window impact value; The behavior sequence entropy weight impact factor is used to compensate for the analysis result of the proportion of the behavior sequence entropy weight standard value and the degree of deviation of the behavior sequence entropy weight, which is recorded as the behavior sequence entropy weight impact value; The unit time cumulative characteristic decay rate influence factor is used to compensate the analysis result of the proportion of the deviation between the unit time cumulative characteristic decay rate standard value and the unit time cumulative characteristic decay rate, which is recorded as the unit time cumulative characteristic decay rate influence value; The software security detection-feature effective value is obtained by coupling the influence value of the time series feature discrimination, the influence value of the behavior drift tolerance window, the influence value of the behavior sequence entropy weight, and the influence value of the cumulative feature decay rate per unit time. The software security detection-feature effective value represents the quantitative data of the effectiveness of the software security detection feature, which is the result of the combined effects of the temporal feature discrimination, the behavior drift tolerance window, the behavior sequence entropy weight, and the cumulative feature decay rate per unit time.

4. The software security detection method based on the deep learning model according to claim 1, characterized in that: The specific steps of determining whether to optimize the effectiveness of the detection feature are as follows: If the software security detection-feature validity value is greater than or equal to the preset software security detection-feature validity threshold, no optimization adjustment of the detection feature validity will be performed. Otherwise, it will be determined whether to perform feature discrimination optimization based on the feature discrimination. If so, it will be determined whether to perform flow threshold optimization after performing feature discrimination optimization. Otherwise, it will be directly determined whether to perform flow threshold optimization.

5. The software security detection method based on the deep learning model according to claim 4 is characterized in that: The specific steps of determining whether to optimize the feature discrimination according to the feature discrimination are as follows: If the feature discrimination is lower than or equal to the preset feature discrimination threshold, the initial data sample quantity is compensated by the obtained data sample quantity compensation amount, wherein the data sample quantity compensation amount is obtained by inputting the software security detection-feature effective value into the software security detection database for mapping; If the feature discrimination is higher than the preset feature discrimination threshold, no feature discrimination optimization is performed; If feature discrimination optimization is performed, the software security detection-feature effective value obtained after feature discrimination optimization is recorded as the software security detection-feature effective value to be evaluated; otherwise, the current software security detection-feature effective value is recorded as the software security detection-feature effective value to be evaluated.

6. The software security detection method based on the deep learning model according to claim 5, characterized in that: The specific steps of determining whether to optimize the flow threshold are as follows: A1: If the effective value of the software security detection feature to be evaluated is greater than or equal to the average effective value of the software security detection feature within the preset number of software security detection times, the traffic threshold optimization is not performed; A2. If the effective value of the software security detection-feature to be evaluated is less than the average effective value of the software security detection-feature within the preset number of software security detections, the preset minimum flow value is adjusted by the obtained minimum flow value adjustment amount, and the preset maximum flow value is adjusted by the obtained maximum flow value adjustment amount. The minimum flow value adjustment amount is obtained by inputting the effective value of the software security detection-feature to be evaluated into the software security detection database for mapping, and the maximum flow value adjustment amount is obtained by inputting the effective value of the software security detection-feature to be evaluated into the software security detection database for mapping.

7. The software security detection method based on the deep learning model according to claim 2, characterized in that: The specific steps for obtaining the software safety detection-time limit value are: Compensate the analysis result of the ratio of the software safety detection time interval to the software safety detection time interval threshold using the software safety detection time interval impact factor, and record it as the software safety detection time interval impact value; The software security detection-feature effectiveness impact factor is used to compensate the analysis result of the ratio of the software security detection-feature effectiveness threshold and the software security detection-feature effectiveness value to be detected, and the result is recorded as the software security detection-feature effectiveness impact value to be detected; The analysis result of the ratio of software security detection response time to software security detection response time threshold is modified by the software security detection response time impact factor, and recorded as the software security detection response time impact value; The software safety detection time window impact factor is used to compensate for the analysis result of the ratio of the software safety detection time window deviation to the software safety detection time window standard value, which is recorded as the software safety detection time window impact value; The software security detection time interval impact value, the to-be-detected software security detection-feature validity impact value, the software security detection response time impact value, and the software security detection time window impact value are coupled to obtain the software security detection-time limit value; The software security detection-time limitation value represents quantitative data on the degree of influence of the time limitation of the software security detection process on the software security detection time interval, the effective value of the software security detection-feature to be detected, the software security detection response time and the software security detection time window.

8. A software security detection device based on a deep learning model, applying the software security detection method based on a deep learning model as described in any one of claims 1 to 7, characterized in that: It includes detection feature validity data collection module, detection feature validity quantitative judgment module, detection time limitation data collection module and detection time limitation quantitative judgment module: The detection feature validity data acquisition module is used to perform software security detection through the constructed long short-term memory network model to obtain detection feature validity data; The detection feature effectiveness quantification judgment module is used to quantify the effectiveness of software security detection through detection feature effectiveness data to obtain a software security detection-feature effectiveness value, and determine whether to perform detection feature effectiveness optimization; The detection time limitation data acquisition module is used to obtain the detection time limitation data after the detection feature effectiveness optimization is performed if the detection feature effectiveness optimization is performed, and directly obtain the detection time limitation data otherwise; The detection time limitation quantification judgment module is used to quantify the time limitation of software security detection through detection time limitation data to obtain a software safety detection-time limitation value, and determine whether to perform detection time limitation optimization and secondary software safety detection.

Images