Virus library detection verification and continuous updating method

Abstract

The invention discloses a method for detecting, verifying and continuously updating a virus library, which comprises the following steps of: downloading latest virus library data of ClamAV, deploying the latest virus library data into a target system, and verifying whether the updating is successful or not; the method comprises the following steps of: dividing latest virus database data into known viruses and unknown viruses through a classifier, marking the unknown viruses as potential novel malicious software and injecting the potential novel malicious software into a Monkey Agent of an Insection Monkey, configuring the Monkey Agent to simulate behaviors of the malicious software, collecting analysis data, modifying configuration of the Insection Monkey according to an analysis result to obtain the Monkey Agent after configuration optimization, injecting the Monkey Agent into a target network, and establishing the target network. And simulating the attack of malicious software, and verifying whether the target network security control measure can detect, prevent or relieve infection by monitoring the response of the network security equipment. According to the method, threats of novel malicious software can be found and dealt with in time, the timeliness of a virus library and the effectiveness of defense measures are ensured through continuous updating and verification circulation, and the overall performance and stability of network security protection are improved.

Description

Technical Field

[0001] The present invention relates to a method for updating and verifying a virus database by utilizing ClamAV and Infection Monkey, and belongs to the technical field of power information system network security. Background Art

[0002] Timely virus database updates and validation are crucial for the security of power information systems. While timely virus database updates ensure the system's ability to defend against known threats, validation is a key step in verifying the system's ability to cope with emerging attacks. Especially in core scenarios like power dispatch automation and substation monitoring, delayed virus database updates can lead to infection of critical equipment, potentially causing large-scale power outages. Ineffective validation mechanisms can render defense systems ineffective, preventing them from detecting new attack vectors like zero-day exploits.

[0003] Traditional virus database update methods often rely on centralized processing of virus database version updates, requiring manual updates from operations and maintenance personnel. This not only consumes significant computing resources but can also impact overall system performance due to update delays. Furthermore, there's a lack of mechanisms to verify the actual detection capabilities of updated virus databases, creating the risk of "update failure."

[0004] Existing technologies primarily employ methods such as static signature matching verification, sandbox dynamic behavior analysis, penetration testing verification, and threat intelligence-driven verification. These methods replay historical attack samples in a sandbox environment to test the responsiveness of the protection system; and simulate hacker attacks (such as vulnerability exploitation and social engineering) to verify the effectiveness of the protection system. However, these methods suffer from incomplete scenario coverage, low automation, and a lack of closed-loop mechanisms when verifying the virus library's ability to detect new malware.

[0005] Therefore, the present invention proposes a virus library detection, verification, and continuous update method that can be used in power information systems. This method combines the ClamAV+CNN classifier and Infection Monkey. By integrating the virus detection capabilities of ClamAV with the adversarial simulation advantages of Infection Monkey, it solves the problems of delayed updates and single verification scenarios in traditional methods, and constructs a dynamic closed-loop system of "update-verification-optimization". Summary of the Invention

[0006] The existing virus library update and verification scheme for power information systems has technical defects such as delayed updates, single verification scenarios, and lack of closed-loop optimization mechanisms. It cannot meet the real-time defense needs of core scenarios such as power dispatching automation and substation monitoring against new malware.

[0007] To address the above issues, the present invention proposes a method for detecting, verifying, and continuously updating a virus library that can be used in power information systems. This method combines the ClamAV+CNN classifier and Infection Monkey, utilizing classification verification and updates. The classifier collects unknown virus or malware attacks, then renders them harmless and injects them into the host for testing. The extracted virus features are then synchronously updated to the virus library, forming a globally coordinated virus protection system. This method can form a continuous, automated cycle, ensuring the timeliness of the virus library and the effectiveness of defense measures, thereby optimizing the ability to handle new viruses, improving the robustness of the system, and providing strong support for network security operations and maintenance.

[0008] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0009] A virus database detection, verification and continuous updating method comprises the following steps:

[0010] Step 1: Use ClamAV's automatic update tool, freshclam, to update the virus database to the latest version. This will ensure the database's timeliness and integrity. Download the latest database data and deploy it to the target system (such as a power information system). Verify the success of the update. This can be determined by parsing keywords (such as "Databaseupdated" or "ERROR") in the log file or by running the command clamscan --version to check the database version number. If the update fails, the system automatically rolls back to the previous version and triggers an alarm for maintenance personnel. If the update is successful, proceed to the next step.

[0011] Step 2: Use a classifier to classify the latest virus database data into two categories: known viruses and unknown viruses, and mark unknown viruses as potential new malware;

[0012] Step 3: Inject samples marked as potential new malware into Infection Monkey's MonkeyAgent. Configure the MonkeyAgent to simulate the behavior of these malware without causing actual damage to the target system. Run the MonkeyAgent in a controlled environment to collect data on the simulated malware's behavior, including propagation methods, system calls, and network activity.

[0013] Step 4: Analyze the data collected in Step 3 to understand the characteristics and potential threats of the malware. Based on the analysis results, modify the configuration of Infection Monkey to enable it to more accurately simulate the behavior of the malware. Adjust simulation parameters such as propagation speed and infection range to adapt to different types of malware.

[0014] Step 5: Inject the optimized Monkey Agent into the target network to simulate a malware attack. By monitoring the responses of network security devices (such as firewalls and intrusion detection systems), verify whether the target network security control measures can detect, prevent, or mitigate the infection. If the infection is not successfully prevented, analyze the reasons for the failure and take necessary measures to improve it. Through continuous improvement and optimization, strengthen the system's "immune response" and enhance overall defense capabilities.

[0015] The above-mentioned virus database detection, verification and continuous updating method also includes step 6: after completing a complete update and verification cycle, the newly discovered malware features are updated to the ClamAV virus database, and steps 1-5 are repeated to form a continuous and automated virus database update and verification process.

[0016] In step 6 above, the malware analysis tool Ghidra is used to reverse engineer the newly discovered malware and extract its signature. The YARA rule generator is used to generate a malware signature. The clamav-milter script of ClamAV is used to integrate the new signature into the ClamAV virus database and ensure that it takes effect.

[0017] In step 2 above, the CNN algorithm is used to distinguish common viruses from unknown viruses.

[0018] In step 2 above, when an anomaly is detected, the situation is T = A*W{sv}. Here, T is the similarity score between the feature vector A and the total set of anomalies W{sv}, A is the feature vector of the new virus extracted from the infected system, W is the total set of anomalies at this time, s is the virus sample stored in the virus library (known virus), and v is the virus that cannot be identified (unknown virus);

[0019] During the classification process, the classifier evaluates the degree of match between the sample and the known virus s and the unknown virus v by calculating the interaction result T between A and the total set of anomalies W{sv}, where W{sv} contains a set of anomaly features related to known viruses and unknown viruses, and A is a new virus feature vector extracted from the runtime behavior of the infected system.

[0020] Calculate the weighted cosine similarity T between A and the total set of anomalies W{sv}, and regard T as the similarity score between the feature vector A and the total set of anomalies W{sv}:

[0021]

[0022] T=Softmax(W sim ·[A;W {s,v} ])

[0023] Among them, Wsim is a learnable similarity weight matrix, and the score is normalized by Softmax.

[0024] If T ≥ θ (θ is a dynamic threshold for judgment, affected by virus database updates), indicating a closer match with known virus signatures, the sample is classified as a known virus s. Otherwise, it is labeled as an unknown virus v and flagged as potential new malware, triggering the subsequent verification process. In this version of the virus database, the value of θ is 0.71. That is, T ≥ 0.71 indicates a known virus, while T < 0.71 indicates an unknown virus, requiring further processing before being sent to the updated virus database for labeling and updating. This classification process effectively divides the updated virus database samples into two categories: identified viruses and unknown viruses.

[0025] In step 3 above, after injecting the sample marked as a potential new malware into the Infection Monkey's Monkey Agent, hashdeep is used to verify the integrity of the sample to ensure its integrity and executableness so that its behavior can be accurately simulated.

[0026] In step 5 above, necessary measures include updating the virus database, updating the rule base of security tools, adjusting security policies and / or optimizing network architecture.

[0027] This paper proposes a method for detecting, verifying, and continuously updating virus libraries in power information systems. This method combines the ClamAV+CNN classifier with Infection Monkey to provide an efficient and accurate virus library update and verification method. Using classification verification and update, the classifier collects unknown virus or malware attacks, then decontaminates them and injects them into a host for testing. The extracted virus signatures are then synchronously updated to the virus library, forming a global virus protection topology.

[0028] ClamAV, an open-source antivirus software, provides powerful virus detection capabilities and a regularly updated virus database. Infection Monkey, an open-source adversarial simulation platform, simulates malware behavior to help users test and improve network security defenses.

[0029] The classifier is based on the CNN algorithm, an integral part of the field of deep learning. CNNs are feed-forward artificial neural networks whose hidden layers consist of three distinct functional components: convolutional layers, pooling layers, and fully connected layers. Convolutional layers play a crucial role in the network, namely, feature extraction. A specified number of filters of a specific size are convolved with the input image. The learnable parameters of this architecture are the filter matrix elements, which are updated during backpropagation. Pooling layers are optional in CNN architectures. However, in many architectures, they are applied after convolutional layers to reduce the dimensionality of features mapped from the input without losing important information. This reduces the computational burden of the network and improves its overall performance by reducing the number of parameters to learn and reducing the risk of overfitting. The final output tensor is flattened and followed by multiple fully connected layers. The final fully connected layer performs the target task, classification, while the convolutional and pooling layers perform feature extraction in the architecture. The CNN architecture is used to classify traffic payloads. The stride parameter is set to 1 in all convolution operations. However, it is set to 2 in all max pooling operations. 2D global average pooling is applied before the fully connected layers to reduce dimensionality and the risk of overfitting. In binary payload traffic classification, the final Softmax layer has two units to classify stored recognized payloads and unrecognized payloads.

[0030] The present invention uses a CNN-based classifier to classify samples in the virus library and screen out potential new malware samples. These samples are then injected into the Monkey Agent of Infection Monkey to simulate the behavior of new malware. By analyzing the behavioral data during the simulation process, the configuration of Infection Monkey is optimized so that it can more accurately simulate the attack mode of malware. Finally, the optimized Monkey Agent is injected into the network to verify the effectiveness of security control measures. If it is found that the security measures fail to successfully prevent infection, necessary improvement measures are taken, such as updating security tools, adjusting security policies, etc., to enhance the system's defense capabilities. The entire process forms a continuous, automated cycle to ensure the timeliness of the virus library and the effectiveness of defense measures.

[0031] This collaborative strategy not only leverages the virus detection capabilities of ClamAV and the adversarial simulation strengths of Infection Monkey, but also achieves timely detection and effective response to new malware through a combination of automated and manual analysis. In practical applications, this approach significantly improves system efficiency, while also enhancing the accuracy of virus database updates and the reliability of defense verification, providing a more solid foundation for network security protection.

[0032] The technologies not mentioned in this invention are all referred to the prior art.

[0033] The present invention proposes a method for detecting, verifying, and continuously updating a virus library that can be used in power information systems. By combining the ClamAV+CNN classifier and Infection Monkey, this method provides an efficient and accurate method for updating and verifying the virus library. ClamAV is responsible for updating the virus library and detecting common viruses, while Infection Monkey is used to simulate and verify the defense capabilities against new malware. The two work together to make up for the shortcomings of a single tool, enabling timely detection and response to the threats of new malware, resulting in a 1+1 effect that is far greater than 2. Through a continuous update and verification cycle, the timeliness of the virus library and the effectiveness of defense measures are ensured, thereby improving the overall performance and stability of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the continuous automated update and verification cycle according to the present invention;

[0035] Figure 2 A flowchart of the continuous automated update and verification cycle according to the present invention; DETAILED DESCRIPTION

[0036] In order to better understand the present invention, the content of the present invention is further illustrated below in conjunction with the examples, but the content of the present invention is not limited to the following examples.

[0037] The present invention provides a virus library detection, verification and continuous updating method that can be used in power information systems, which mainly includes the following steps:

[0038] Step 1: Use ClamAV's automatic update tool, freshclam, to update the virus database to the latest version to ensure its timeliness and integrity. Download the latest virus database file, obtain the latest virus database data from the official ClamAV website, deploy it to the target system (such as the power information system), and verify whether the update was successful. The success of the update can be determined by parsing keywords in the log file (such as "Database updated" or "ERROR") or by checking the virus database version number using the command clamscan --version. If the update fails, the system automatically rolls back to the previous version of the virus database, triggering an alarm for the operation and maintenance personnel. If the update is successful, proceed to the next step.

[0039] In step 2, the updated virus library samples are injected into the classifier for pre-training. This classifier passes through convolutional, pooling, and fully connected layers. Convolutional and pooling layers perform feature extraction in the architecture. The stride parameter is set to 1 in all convolution operations. However, this parameter is set to 2 in all max pooling operations. 2D global average pooling is applied before the fully connected layers to reduce dimensionality and the risk of overfitting. For binary payload traffic classification, the trained CNN neural network, W{sv}, is obtained.

[0040] Step 3: Optimize the Infection Monkey configuration to improve the accuracy and effectiveness of malware simulation. Adjust the Monkey Agent's propagation strategy so that it can exploit common vulnerabilities (such as SMB and WMI) and tools (such as Mimikatz) to simulate real-world attacks. Also, clearly specify the attack target range, such as a specific IP address range or service port, to prevent unnecessary spread. Furthermore, use the --depth parameter in the configuration file to appropriately adjust the detection depth to strike a balance between comprehensiveness of the simulated attack and system resource utilization. Inject the optimized Monkey Agent into the target network to simulate the attack, while monitoring the responses of network security devices to verify the effectiveness of security controls.

[0041] In step 4, after completing the optimizations described above, the optimized Monkey Agent is injected into the target network to simulate an attack. During this process, it is necessary to monitor the responses of network security devices in real time, such as whether the firewall intercepts malicious connections and whether the intrusion detection system issues alerts, to verify the effectiveness of security control measures. This not only identifies potential security vulnerabilities but also provides data support for subsequent security policy adjustments, thereby enhancing the system's overall defense capabilities.

[0042] Step 5: Analyze the reasons for the failure of security control measures discovered during the verification process, take corresponding improvement measures (such as updating the virus database, adjusting security policies, etc.) to enhance defense capabilities, and update the newly discovered malware features to the virus database, forming a continuous and automated update and verification cycle to ensure that the system defense capabilities are always up to date.

[0043] Figure 1 An overview diagram of the continuous automated update and verification cycle of the present invention is presented.

[0044] The automated update and verification cycle diagram begins with the attacked host collecting information and calling the classifier for processing. The Infection Monkey then responds, neutralizes and records the information, and finally returns to update the ClamAV virus database, forming a complete, continuous, automated update and verification cycle view.

[0045] Figure 2 The flow chart of the continuous automated update and verification cycle of the present invention is shown. The process of constructing the continuous automated update and verification cycle specifically includes the following steps:

[0046] Step 1: Configure the ClamAV virus database and Infection Monkey as needed. If manual updates are required, download the latest virus database file from the ClamAV official website, deploy it to the target system, and verify that the update was successful.

[0047] Step 2: Inject the updated virus library samples into the classifier for pre-training. This classifier passes through convolutional, pooling, and fully connected layers. Convolutional and pooling layers perform feature extraction in the architecture. The stride parameter is set to 1 in all convolution operations. However, this parameter is set to 2 in all max pooling operations. 2D global average pooling is applied before the fully connected layers to reduce dimensionality and the risk of overfitting. The trained CNN neural network, W{sv}, is used to classify binary payload traffic.

[0048] When an anomaly is detected, the situation is T = A * W{sv}. Here, T is the similarity score between feature vector A and the total set of anomalies W{sv}. A is the feature vector of a new virus extracted from the infected system, W is the total set of anomalies at that time, s is a virus sample stored in the virus database, and v is an unidentified virus. During the virus sample classification process, the classifier evaluates the sample's match with known virus s and unknown virus v by calculating the interaction result T between A and the total set of anomalies W{sv}. W{sv} contains a set of anomaly features associated with known and unknown viruses, while A is the new virus feature vector extracted from the runtime behavior of the infected system.

[0049] Calculate the weighted cosine similarity T between A and the total set of anomalies W{sv}, and regard T as the similarity score between the feature vector A and the total set of anomalies W{sv}:

[0050]

[0051] T=Softmax(W sim ·[A;W {s,v} ])

[0052] Among them, W sim is a learnable similarity weight matrix, and the score is normalized by Softmax.

[0053] If T ≥ θ (θ is a dynamic threshold for judgment, affected by virus database updates), indicating a closer match with known virus signatures, the sample is classified as a known virus s. Otherwise, it is labeled as an unknown virus v and flagged as potential new malware, triggering the subsequent verification process. In this version of the virus database, the value of θ is 0.71. That is, T ≥ 0.71 indicates a known virus, while T < 0.71 indicates an unknown virus, requiring further processing before being sent to the updated virus database for labeling and updating. This classification process effectively divides the updated virus database samples into two categories: identified viruses and unknown viruses.

[0054] Step 3: Inject a sample of an unknown virus (v) confirmed to be new malware into the Infection Monkey's Monkey Agent. Configure the Monkey Agent to simulate the behavior of this malware without causing actual damage to the target system. Run the Monkey Agent in a controlled environment to collect data on the simulated malware's behavior, including propagation methods, system calls, and network activity. During the injection process, ensure the integrity and executable nature of the sample to accurately simulate its behavior. Use tools such as hashdeep to verify the integrity of the sample. Configure the Monkey Agent's propagation method, such as through a network share, USB drive, or vulnerability exploit. Choose an appropriate propagation method based on the environment's network topology and security configuration. Specify a specific IP address range or service port for the Monkey Agent. Configure the Monkey Agent's behavior, such as simulating the malware's file operations, registry modifications, and network connections.

[0055] Step 4.1: Use data analysis tools to conduct in-depth analysis of the collected data and limit the Monkey Agent's reach to avoid unnecessary impact. Configure a whitelist to control the targets of the spread. Extract key behavioral characteristics of the malware and, based on the analysis results, adjust the Infection Monkey configuration file to increase monitoring of specific system calls. For example, monitor for abnormal file system operations or network connection behavior.

[0056] Step 4.2: Update firewall rules based on newly discovered malware behaviors to block its commonly used network ports and communication paths. Optimize the firewall's access control list (ACL) to ensure that only legitimate traffic can pass through. Update the IDS signature library to add the characteristic signatures of newly discovered malware. Adjust the IDS detection rules to improve the detection capabilities of complex attacks. Check system and application vulnerabilities and apply security patches in a timely manner. Use vulnerability scanning tools (such as Nessus or OpenVAS) to scan the system regularly to discover and fix potential vulnerabilities. Evaluate the performance of existing security devices and upgrade or expand them when necessary. Optimize the configuration of security devices to improve their ability to handle high traffic and complex attacks.

[0057] Step 5.1: New malware signatures need to be extracted and updated to the ClamAV virus database. Use the malware analysis tool Ghidra to reverse engineer the newly discovered malware and extract its signature code. Generate malware signatures using the automated YARA rule generator. Use ClamAV's clamav-milter automated script to integrate the new signatures into the virus database and ensure they take effect.

[0058] Step 5.2: Implement a real-time monitoring system to promptly detect and respond to security incidents. Establish a feedback mechanism to promptly report issues discovered during verification to the security team so that corrective measures can be taken quickly. This also allows for fault tracing when information system anomalies occur.

[0059] In summary, the present invention proposes a method for detection, verification and continuous updating based on the existing virus database. The method aims to use the combination of ClamAV+CNN classifier and Infection Monkey injection host experiment to synchronously update the extracted virus features to the virus database to form a global collaborative virus protection system. This method can form a continuous and automated cycle to ensure the timeliness of the virus database and the effectiveness of defense measures, thereby optimizing the ability to handle new viruses, improving the robustness of the system, and providing strong support for subsequent operation and maintenance work. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made, and these improvements and modifications should also be regarded as the scope of protection of the present invention. All components not specified in this embodiment can be implemented using existing technologies.

Claims

1. A method for detecting, verifying and continuously updating a virus database, characterized by: The steps include: Step 1: Use ClamAV's automatic update tool, freshclam, to update the virus database to the latest version. Download the latest virus database data, deploy it to the target system, and verify whether the update is successful. This is determined by parsing keywords in the log file or checking the virus database version number using the command clamscan --version. If the update fails, the system automatically rolls back to the previous version of the virus database and triggers an alarm for the operation and maintenance personnel. If the update is successful, proceed to the next step. Step 2: Use a classifier to classify the latest virus database data into two categories: known viruses and unknown viruses, and mark unknown viruses as potential new malware; Step 3: Inject samples flagged as potential new malware into Infection Monkey's Monkey Agent. Configure the Monkey Agent to simulate the behavior of these malware without causing actual damage to the target system. Run the Monkey Agent in a controlled environment to collect data on the simulated malware behavior. Step 4: Analyze the data collected in Step 3 to understand the characteristics and potential threats of the malware. Based on the analysis results, modify the configuration of Infection Monkey to enable it to more accurately simulate the behavior of the malware. Adjust the simulation parameters to adapt to different types of malware, and obtain an optimized Monkey Agent. Step 5: Inject the optimized Monkey Agent into the target network to simulate a malware attack. By monitoring the response of network security devices, verify whether the target network security control measures can detect, prevent, or mitigate the infection. If the infection is not successfully prevented, analyze the cause of the failure and take necessary measures to improve it, completing a complete update and verification cycle.

2. The virus database detection, verification, and continuous updating method according to claim 1, characterized in that: It also includes step 6: After completing a complete update and verification cycle, the newly discovered malware features are updated to the ClamAV virus database, and steps 1-5 are repeated to form a continuous, automated virus database update and verification process.

3. The virus database detection, verification, and continuous updating method according to claim 2, characterized in that: In step 6, the malware analysis tool Ghidra is used to reverse engineer the newly discovered malware and extract its signature. The YARA rule generator is used to generate a malware signature. The clamav-milter script of ClamAV is used to integrate the new signature into the ClamAV virus database and ensure that it takes effect.

4. The virus library detection, verification, and continuous updating method according to any one of claims 1 to 3, characterized in that: In step 2, the CNN algorithm is used to distinguish known viruses from unknown viruses.

5. The virus database detection, verification, and continuous updating method according to claim 4, characterized in that: In step 2, when an anomaly is detected, the situation is T = A*W{sv}, where T is the similarity score between the feature vector A and the total set of anomalies W{sv}, A is the new virus feature vector extracted from the infected system, W is the total set of anomalies at this time, s is the virus sample saved in the virus library, and v is the virus that cannot be identified; During the classification process, the classifier evaluates the degree of match between the sample and the known virus s and the unknown virus v by calculating the interaction result T between A and the total set of anomalies W{sv}, where W{sv} contains a set of anomaly features related to known viruses and unknown viruses, and A is a new virus feature vector extracted from the runtime behavior of the infected system.

6. The virus database detection, verification, and continuous updating method according to claim 5, characterized in that: By calculating the weighted cosine similarity between A and the total set of anomalies W{sv}, we can get the similarity score T between the feature vector A and the total set of anomalies W{sv}: T=Softmax(W sim ·[A;W {s,v} ]) Among them, W sim is a learnable similarity weight matrix, and the score is normalized by Softmax; If T ≥ θ, θ is the dynamic threshold for judgment affected by the virus database update, indicating that it is more consistent with the known virus characteristics, it is classified as a known virus s; otherwise, it is marked as an unknown virus v and is labeled as a potential new malware, thus triggering the subsequent verification process.

7. The virus library detection, verification, and continuous updating method according to any one of claims 1 to 3, characterized in that: In step 3, after injecting the sample marked as potential new malware into the Monkey Agent of Infection Monkey, hashdeep is used to verify the integrity of the sample.

8. The virus library detection, verification, and continuous updating method according to any one of claims 1 to 3, characterized in that: In step 5, necessary measures include updating the virus database, updating the rule base of security tools, adjusting security policies and / or optimizing the network architecture.

Images