File operation traceability analysis method, system and device based on flexible gray measurement and calculation

Abstract

The invention discloses a file operation traceability analysis method, system and device based on flexible gray measurement and calculation, and relates to the technical field of data security, the method comprises the following steps: obtaining a file operation event, combining information entropy with index moving average and long and short-term memory network prediction, and constructing a dynamic security baseline; comparing the dynamic security baseline with an entropy value, dynamically judging a behavior risk level, and switching an optimal traceability path according to the behavior risk level; and calculating evidence storage density according to the gray level, and designing an elastic evidence storage strategy according to the evidence storage density. According to the main technical scheme and effects, through high-quality time sequence characteristics obtained through quantitative operation on a file operation event and LSTM prediction, early warning is given out before a malicious encryption behavior breaks out, overall detection is more accurate, and the dynamic detection precision is greatly improved through a dynamic security baseline; and the traceability results of the process chain traceability and the socket chain traceability are fused and compared, so that the penetrating traceability realizes a substantial breakthrough.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a file operation tracing analysis method, system and device based on flexible grayscale measurement. Background Art

[0002] As digital transformation accelerates, file operation traceability has become a key technology for ensuring data security. Current mainstream industry solutions generally adopt a static rule-based traceability architecture. Its core implementation mechanism includes a triple-layer protection system consisting of file hash value comparison, process ID binding analysis, and network-layer IP access control.

[0003] However, this technical approach has significant limitations when dealing with new attack methods, as reflected in the following four aspects:

[0004] 1. Static threshold mechanisms have inherent flaws. Traditional systems rely on preset, fixed operation frequency thresholds to identify anomalies. This mechanism is severely inadequate in scenarios with dynamically fluctuating business loads. When system resource utilization fluctuates by more than ±30%, the inability to establish a dynamic baseline model causes the false alarm rate to climb above 15%, resulting in a 38.2% underreporting of slow penetration attacks.

[0005] 2. Systematic failure of process chain tracing. In containerized environments and advanced process injection attack scenarios, existing technologies struggle to maintain a complete process tree traceability chain. Due to a breakdown in namespace isolation mechanisms and the active evasion of malicious processes, traditional parent-child process association methods have a failure rate of up to 62% in fileless attack scenarios, disrupting critical traceability paths.

[0006] 3. The inherent lack of penetration capability in tracing attacks. Existing technologies are limited in their ability to trace attack sources to network-layer surface information. On the one hand, IP address-based tracing cannot penetrate proxy jumps above Layer 7. On the other hand, due to the lack of hardware-level trusted authentication mechanisms, attackers can conceal their identities by forging basic identifiers such as MAC addresses, thus undermining the credibility of tracing results.

[0007] 4. The lack of a dynamic behavior recognition mechanism. Faced with the continuously evolving advanced persistent threats, existing technologies lack the ability to effectively detect long-term, latent attacks. This is particularly true for slow file infiltration behaviors that occur over a 72-hour period. Without a temporal behavior entropy model, the system is unable to identify anomalous micro-operation sequences that disguise legitimate operations, creating a serious security blind spot. Summary of the Invention

[0008] In view of the deficiencies in the prior art, the present invention discloses a file operation traceability analysis method, system and device based on flexible grayscale measurement.

[0009] A file operation traceability analysis method based on flexible grayscale measurement includes the following steps:

[0010] Obtain file operation events and perform quantification operations on the file operation events to obtain information entropy;

[0011] Combining the information entropy with exponential moving average and long short-term memory network predictions to construct a dynamic security baseline;

[0012] Comparing the dynamic security baseline with the entropy value, dynamically determining the behavior risk level, switching the optimal tracing path according to the behavior risk level, and obtaining key link information;

[0013] Calculate the evidence density based on the grayscale level and design a flexible evidence strategy based on the evidence density.

[0014] As an implementable method, the method of obtaining the file operation event and performing a quantization operation on the file operation event to obtain information entropy includes the following steps:

[0015] Obtain file operation events at the kernel layer of the operating system, count file operations within a certain time period, and calculate the probability distribution of each file operation event;

[0016] Constructing features for the file operation event to obtain a "file operation - execution process - underlying hardware" feature data set;

[0017] Performing real-time streaming processing on the feature data set to obtain high-dimensional feature data;

[0018] Performing a quantization operation on the high-dimensional feature data based on an information entropy calculation formula to obtain information entropy;

[0019] The information entropy calculation formula is:

[0020]

[0021] Where Hf(t) represents the information entropy of the current sampling window, and P(opk) represents the probability distribution of operation type opk in the current window, where k ranges from 1 to 4.

[0022] As an implementable method, the information entropy is combined with the exponential moving average and the long short-term memory network prediction to construct a dynamic security baseline, which specifically includes the following steps:

[0023] The information entropy sequence within a certain period of time is calculated by the exponential moving average algorithm to generate the historical entropy value component;

[0024] Input the information entropy sequence into the long short-term memory network to generate the future entropy value prediction component;

[0025] A dynamic security baseline is constructed based on the weighted fusion of historical entropy value component and future entropy value prediction component;

[0026] The calculation formula of the dynamic security baseline is:

[0027]

[0028] Where μ(t) represents the dynamic security baseline of the current sampling window; α represents the weight coefficient of the historical component, β represents the weight coefficient of the prediction component, and α+β=1, Eh(t) represents the information entropy, and Pf(t) represents the future entropy value prediction component;

[0029] The calculation formula of the historical entropy value component is:

[0030]

[0031] Among them, E h (t) represents the historical entropy value component of the current sampling window, information entropy λ represents the exponential decay coefficient, E h (t-1) represents the historical entropy value component of the previous sampling window, and H f (t) represents the information entropy of the current window.

[0032] As an implementable method, the dynamic security baseline is compared with the entropy value, the behavior risk level is dynamically determined, the optimal traceability path is switched according to the behavior risk level, and key link information is obtained, including the following steps:

[0033] Based on the ratio of information entropy to dynamic security baseline, the behavior risk level is dynamically judged;

[0034] When the specified behavior risk level is reached, the system prioritizes process chain tracing;

[0035] In containerized or process injection scenarios, if the process chain is interrupted due to namespace inconsistency, it will automatically switch to socket chain tracing;

[0036] The tracing results of process chain tracing and socket chain tracing are integrated and compared to obtain key link information.

[0037] As an implementable method, when the specified behavior risk level is reached, the system prioritizes process chain tracing, specifically including the following steps:

[0038] Deploy an extended Berkeley packet filter hook in the operating system kernel to capture process runtime information in real time;

[0039] Reconstruct the call chain of parent and child processes through process runtime information.

[0040] As an implementation method, when it is found that the process chain is interrupted due to namespace inconsistency in the containerization or process injection scenario, it automatically switches to socket chain tracing, which specifically includes the following steps:

[0041] In containerized or process injection scenarios, real-time detection of consistency between the control group and the process identifier namespace;

[0042] If the control group and the process identifier namespace are inconsistent, the process chain is determined to be interrupted;

[0043] Extract the TCP five-tuple based on the Transmission Control Protocol socket information, perform a reverse comparison with the kernel socket event log, and restore the network communication link from the remote control terminal to the local terminal;

[0044] Through the dynamic fingerprint and behavior risk level binding mechanism, the accuracy of socket chain tracing is further improved.

[0045] As an implementable method, the method of calculating the evidence density according to the grayscale level and designing a flexible evidence storage strategy according to the evidence density specifically includes the following steps:

[0046] Calculate the evidence density based on the grayscale level;

[0047] Adopting a layered evidence storage architecture, we design flexible evidence storage strategies for evidence data with different storage densities.

[0048] Conduct judicial verification of evidence data at the corresponding level;

[0049] The formula for calculating the evidence density is:

[0050]

[0051] Among them, ρ represents the evidence density, and GrayLevel represents the grayscale level.

[0052] A file operation traceability analysis system based on flexible grayscale measurement, including: information entropy acquisition module, dynamic security baseline construction module, key chain traceability module, and flexible evidence storage strategy design module;

[0053] The information entropy acquisition module is used to acquire file operation events and perform quantization operations on the file operation events to obtain information entropy;

[0054] The dynamic security baseline construction module is used to combine the information entropy with the exponential moving average and long short-term memory network prediction to construct a dynamic security baseline;

[0055] The critical chain tracing module is used to compare the dynamic security baseline with the entropy value, dynamically determine the behavior risk level, switch the optimal tracing path according to the behavior risk level, and obtain critical link information;

[0056] The elastic evidence storage strategy design module is used to calculate the evidence storage density according to the grayscale level and design an elastic evidence storage strategy according to the evidence storage density.

[0057] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the following method:

[0058] Obtain file operation events and perform quantification operations on the file operation events to obtain information entropy;

[0059] Combining the information entropy with exponential moving average and long short-term memory network predictions to construct a dynamic security baseline;

[0060] Comparing the dynamic security baseline with the entropy value, dynamically determining the behavior risk level, switching the optimal tracing path according to the behavior risk level, and obtaining key link information;

[0061] Calculate the evidence density based on the grayscale level and design a flexible evidence strategy based on the evidence density.

[0062] A file operation tracing and analysis device based on flexible grayscale measurement includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the following method is implemented:

[0063] Obtain file operation events and perform quantification operations on the file operation events to obtain information entropy;

[0064] Combining the information entropy with exponential moving average and long short-term memory network predictions to construct a dynamic security baseline;

[0065] Comparing the dynamic security baseline with the entropy value, dynamically determining the behavior risk level, switching the optimal tracing path according to the behavior risk level, and obtaining key link information;

[0066] Calculate the evidence density based on the grayscale level and design a flexible evidence strategy based on the evidence density.

[0067] The present invention has significant technical effects due to the adoption of the above technical solutions:

[0068] 1. The present invention obtains high-quality time series features by quantifying file operation events, so that information entropy can truly reflect the randomness of file operations. The LSTM prediction component P f (t) It can issue an early warning about 30 seconds before malicious encryption behavior actually breaks out, capturing "sudden" behavior in advance and making overall detection more accurate. The dynamic security baseline constructed by combining the advantages of both greatly improves the accuracy of dynamic detection;

[0069] 2. This invention integrates and compares the traceability results of process chain tracing and socket chain tracing according to the security level, achieving a substantial breakthrough in penetrating traceability capabilities;

[0070] 3. The dynamic security baseline described in this invention automatically adjusts thresholds based on business load fluctuations and provides practical socket chain tracing in case of process chain interruptions in containerized or process injection scenarios. This design enables the invention to maintain excellent detection accuracy and real-time protection capabilities in cloud-native architectures, containerized scenarios, and high-concurrency stress testing.

[0071] 4. The present invention significantly enhances the credibility of stored evidence data through gradient blockchain evidence storage and verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 Schematic diagram of the process of the file operation traceability analysis method based on flexible grayscale measurement according to the present invention;

[0073] Figure 2 It is an overall schematic diagram of the file operation traceability analysis system based on flexible grayscale measurement according to the present invention. DETAILED DESCRIPTION

[0074] The present invention will be further described below with reference to the accompanying drawings and embodiments. The following embodiments are intended to explain the present invention but the present invention is not limited to the following embodiments.

[0075] Example 1:

[0076] A file operation traceability analysis method based on flexible grayscale measurement, such as Figure 1 As shown, the following steps are included:

[0077] S100, obtaining a file operation event, and performing a quantization operation on the file operation event to obtain information entropy;

[0078] S200, combining the information entropy with the exponential moving average and long short-term memory network prediction to construct a dynamic security baseline;

[0079] S300: Compare the dynamic security baseline with the entropy value, dynamically determine the behavior risk level, switch the optimal tracing path according to the behavior risk level, and obtain key link information;

[0080] S400. Calculate the evidence density based on the grayscale level and design a flexible evidence strategy based on the evidence density.

[0081] In this embodiment, step S100 acquires a file operation event and performs a quantization operation on the file operation event to obtain information entropy, specifically including the following steps:

[0082] S110: Obtain file operation events at the kernel layer of the operating system, count file operations within a certain time period, and calculate the probability score of each file operation event.

[0083] For Linux environments, the audit subsystem is used to intercept key file calls such as open, read, write, and close in real time to fully record all file operation events such as file creation, reading, modification, and deletion;

[0084] For Windows environments, Event Tracing for Windows (ETW) is used to track system call interfaces such as NtCreateFile and NtReadFile to ensure comprehensive coverage of file operation events.

[0085] To balance business peaks and system performance, the monitoring module adopts an intelligent dynamic sampling strategy - a 60-second sampling window is used when the central processing unit (CPU) load is less than 50%, switching to a 30-second sampling period when the CPU load is in the range of 50% to 70%, and shortening to a 15-second high-frequency sampling when the CPU load exceeds 70%. This ensures that key file operation events are continuously and reliably captured during peak business loads.

[0086] S120: Construct features for the file operation event to obtain a “file operation - execution process - underlying hardware” feature data set to support dynamic file traceability analysis.

[0087] In the file operation dimension, the four types of operations (create, read, modify, and delete) are counted separately within a continuous 30-second sampling window, and the complete file path, operation timestamp, and operation type corresponding to each operation are recorded to form the "operation type-path-time" triplet information.

[0088] In the execution process dimension, the process identifier (PID) of the process that triggers the file operation is correlated with its parent process identifier (PPID), CPU usage, memory usage, thread call stack depth, and other key information in real time. This data can be obtained by reading the / proc file system (Linux) or accessing Windows kernel data structures.

[0089] At the underlying hardware level, hardware-level metrics such as memory page error rate, CPU temperature fluctuation, and disk I / O latency are collected simultaneously. These metrics can be obtained in real time through the Linux perf_event (performance event) interface or the Windows Performance Monitor interface. These three levels of features together constitute a high-dimensional feature dataset covering the "file operation - execution process - underlying hardware" model.

[0090] S130: Perform real-time streaming processing on the high-dimensional feature data set to obtain high-dimensional feature data, ensuring accurate and traceable time series.

[0091] The implementation of data cleaning is to filter out the regular file operation records (noise) generated by the core processes of the system, such as systemd and svchost; use the monotonic clock (CLOCK_MONOTONIC) to stamp all operation events with nanosecond timestamps, and strictly sort the events to ensure absolute timing consistency; thirdly, through the mapping of PID, file handle, and complete file path, each file operation event is accurately associated with the initiating process, and finally form a "traceable file operation event stream", which is standardized in structure and accurate in timing, providing high-quality input for the subsequent information entropy calculation module.

[0092] S140: After performing real-time streaming processing on the high-dimensional feature dataset, quantification operations are performed to obtain information entropy, which is used to measure the randomness of file operation behavior. Specifically, the four types of operations (create, read, modify, and delete) within the current 30-second sampling window are counted and the probability distribution P(opk) is calculated. The information entropy is then calculated using the following formula:

[0093] The information entropy calculation formula is:

[0094]

[0095] Among them, H f (t) represents the information entropy of the current sampling window, and P(opk) represents the probability distribution of the operation type opk in the current window, where k ranges from 1 to 4. In this embodiment, H f The value of (t) ranges from 0 to 2. Values ​​closer to 0 indicate a more orderly operation (such as batch data processing), while values ​​closer to 2 indicate a highly random operation (such as malicious scanning or encryption). This entropy value can reflect both normal business fluctuations and identify latent and covert attacks, serving as a core quantitative indicator for subsequent dynamic baseline assessments.

[0096] To further identify "burst" attacks, the system identifies any file operation with a time interval of 10 milliseconds or less as a "pulse operation" and calculates the percentage of pulse operations within the current window, V(t). If V(t) exceeds the 15% threshold, the system immediately issues an "orange alert" rather than blocking the operation, ensuring business continuity. Field tests have shown that this pulse impact detection mechanism can detect potential threats up to 72 hours in advance in slow-moving infiltration scenarios like ransomware scanning, providing valuable early warning capabilities for subsequent "flexible grayscale measurement."

[0097] In this embodiment, step S200 combines information entropy with exponential moving average and long short-term memory network prediction to construct a dynamic security baseline. A two-component dynamic baseline method of "historical trend + future prediction" is proposed. By combining information entropy (IE) with exponential moving average (EMA) and long short-term memory network (LSTM) prediction, a baseline μ(t) that can change in real time is constructed, which is used to compare with the real-time entropy value H. f (t) Perform comparison to dynamically determine the risk level of the behavior. This specifically includes the following steps:

[0098] S210: Calculate the information entropy sequence within a certain period of time using an exponential moving average algorithm to generate a historical entropy value component. The calculation formula for the historical entropy value component is:

[0099]

[0100] Among them, E h (t) represents the historical entropy value component of the current sampling window, λ represents the exponential decay coefficient, E h (t-1) represents the historical entropy value component of the previous sampling window, and H f (t) represents the information entropy of the current window. In this embodiment, the information entropy λ is set to 0.2, which means that the current window entropy value accounts for 20% of the historical average, and the remaining 80% comes from E h (t-1). This calculation method makes it possible for the system to detect a continuous high H f (t), E h (t) will gradually increase, thereby raising the baseline μ(t) to avoid misjudgment of large-scale normal business operations; and when the business falls back, E h (t) will also gradually decrease, restoring the baseline's sensitivity. Actual measurements show that EMA's adaptability to cyclical business fluctuations has improved by 85%.

[0101] S220: Input the information entropy sequence into the long short-term memory network to generate a future entropy value prediction component. The future entropy value prediction component is generated online by the LSTM network. The structure of the LSTM network includes: the input layer receives the entropy value sequence of the last 10 sampling windows (about 5 minutes) {H f (t-9), ..., H f (t)}; the first layer is an LSTM with 128 hidden units, which is used to extract short-term time series features; the second layer is an LSTM with 128 hidden units to capture longer dependencies; the output layer is a fully connected (Dense) layer, which directly outputs the entropy value prediction P of the next window f During offline training, the model was trained by minimizing mean squared error (MSE) using nearly 30 days of measured entropy data, achieving good performance on the validation set. During deployment, the model was fine-tuned every 12 hours using the latest 24 hours of data to keep the prediction components synchronized with business changes. Field tests have shown that this LSTM model can improve the system's warning time for sudden malicious behavior by six times.

[0102] S230: A dynamic security baseline is constructed by weightedly fusing the historical entropy component and the predicted future entropy component. This dynamic baseline, μ(t), can adapt to various business scenarios. During stable periods, the baseline is primarily based on Eh(t) to avoid misjudgments caused by short-term fluctuations. During abnormal periods, Pf(t) proactively reflects sudden trends, allowing μ(t) to adjust rapidly and capture hidden attacks in a timely manner. Throughout the calculation process, the ratio of the real-time entropy value Hf(t) to μ(t) serves as the basis for subsequent grayscale classification.

[0103] The calculation formula of the dynamic security baseline is:

[0104]

[0105] Where μ(t) represents the dynamic security baseline of the current sampling window; α represents the weight coefficient of the historical component, β represents the weight coefficient of the prediction component, and α+β=1, E h (t) represents information entropy, P f (t) represents the future entropy value prediction component.

[0106] In this embodiment, step S300 compares the dynamic security baseline with the entropy value, dynamically determines the behavior risk level, switches the optimal tracing path according to the behavior risk level, and obtains key link information, specifically including the following steps:

[0107] S310: Dynamically determine the behavior risk level based on the ratio of information entropy to the dynamic security baseline.

[0108] According to the dynamic security baseline μ(t) and real-time information entropy Hf Based on the comparison results of (t), the current behavior is divided into light gray, medium gray or dark gray levels, and the optimal tracing path is dynamically switched according to different levels to achieve accurate and reliable file operation source positioning.

[0109] Grayscale level judgment is performed based on the ratio of real-time entropy value to dynamic baseline. The judgment rules are as follows:

[0110] If Hf(t)≤1.25×μ(t), the system determines it as light gray level, records the operation log, and does not block the service;

[0111] If Hf(t)>1.25×μ(t) and lasts for more than two sampling windows (about 60 seconds), it is judged as medium gray level, the system starts the real-time traceability engine and issues a yellow warning;

[0112] If Hf(t) ≥ 1.4 × μ(t), it is judged as a dark gray level, and the system starts the real-time traceability engine system to immediately trigger the blocking process and perform emergency operations such as memory snapshots.

[0113] This three-level grayscale strategy can ensure business continuity while responding quickly to potential high-risk behaviors. Actual tests show that blocking can be completed within 200 milliseconds at the deep gray level, with a blocking success rate of 99.7%.

[0114] S320: When the specified behavior risk level is reached, the system prioritizes process chain tracing, which specifically includes the following steps:

[0115] S321: Deploy an extended Berkeley packet filter hook in the operating system kernel to capture process runtime information in real time;

[0116] S322: Reconstruct the call chain of the parent and child processes through the process runtime information.

[0117] In this embodiment, when the risk level is medium gray or dark gray, an extended Berkeley packet filter hook is deployed in the operating system kernel to capture process runtime information in real time, including process identifiers, parent process identifiers, namespaces, control groups, and more. Using this data, the system can reconstruct the call chain between parent and child processes, tracing back to the source process that initiated the suspicious file operation. This method is applicable to physical hosts, virtual machines, and some container scenarios.

[0118] S330: In a containerized or process injection scenario, if the process chain is interrupted due to namespace inconsistency, it automatically switches to socket chain tracing.

[0119] S331: In containerized or process injection scenarios, real-time detection of consistency between the control group and the process identifier namespace;

[0120] S332: If the control group and the process identifier namespace are inconsistent, for example, if an attacker uses process injection techniques or container escape to bypass the normal parent-child call relationship, the process chain is determined to be interrupted and the socket chain tracing is switched to.

[0121] S333: Extracts the source IP, source port, destination IP, destination port, and protocol type, i.e., the TCP five-tuple, from the Transmission Control Protocol socket information. This is then compared against the kernel socket event log to restore the network communication link from the remote control terminal to the local. This method is more effective against multi-layer proxy scenarios such as jump servers, SSH tunnels, or TOR (The Onion Router) networks.

[0122] S334: Through the dynamic fingerprint and behavior risk level binding mechanism, the accuracy of socket chain tracing is further improved.

[0123] To further improve the accuracy of socket chain traceability, this solution incorporates a "device fingerprint and grayscale binding" mechanism. During client deployment, the system extracts unique hardware information such as the motherboard serial number, CPU identifier, and hard drive serial number, and uses the national commercial cryptographic hash algorithm SM3 (SM3 Hash Algorithm) to generate the original device fingerprint. This fingerprint is then bitwise XORed with the current grayscale level to generate a "dynamic fingerprint." If the current grayscale level is medium, only a loose fuzzy comparison is required; if the grayscale level is dark, a strict full fingerprint comparison is performed to prevent device camouflage or replay attacks. The dynamic fingerprint, combined with the TCP five-tuple information, can accurately identify the real terminal in a multi-proxy environment.

[0124] S340: The tracing results of the process chain tracing and the socket chain tracing are integrated and compared to obtain key link information.

[0125] During actual operation, the system performs process chain tracing and socket chain tracing in parallel, integrating and comparing the traceability results of the two paths. If both paths point to the same endpoint, the credibility of the traceability conclusion is significantly improved. If there is a significant discrepancy, the system marks the event for manual review and retains the complete traceability log for subsequent audits and manual analysis.

[0126] For high-risk events at the deep gray level, the system will also package all key nodes such as process chain information, socket chain information, dynamic fingerprint information, timestamps, information entropy data, etc. into structured evidence records, and hand them over to the blockchain evidence module to write them onto the chain, ensuring that the evidence data is tamper-proof and traceable at the judicial and audit levels.

[0127] In this embodiment, in step S400, if the process chain is found to be interrupted due to namespace inconsistency in the containerization or process injection scenario, the process automatically switches to socket chain tracing, which specifically includes the following steps:

[0128] S410: Calculate the evidence density according to the grayscale level;

[0129] The formula for calculating the evidence density is:

[0130]

[0131] Wherein, ρ represents the evidence density, and GrayLevel represents the grayscale level. In this embodiment, the grayscale level (GrayLevel) has three values: light gray level 1, medium gray level 2, and dark gray level 3, and the corresponding evidence densities ρ are 100%, 50%, and 25%, respectively. When it is at the dark gray level, that is, ρ=1 / (2 3-1 )=1 / 4=25%, the system will write the most comprehensive traceability link information, entropy value sequence, etc. into the evidence; when it is in the medium gray level, that is, ρ=1 / (2 2-1 )=1 / 2=50%, only the key node information is recorded; when it is in the light gray level, that is, ρ=1 / (2 1-1 )=1, only the dynamic baseline check value and the most concise traceability summary are saved for quick retrieval during subsequent audits.

[0132] S420: A layered evidence storage architecture is employed, with flexible evidence storage strategies designed for data with varying densities. At the data layer, file operation time chains, information entropy values, process call chains, socket chains, and dynamic fingerprints are used as Merkle tree leaf nodes to ensure that the underlying data cannot be tampered with. At the protocol layer, each evidence block is signed using the SM2 Digital Signature Algorithm, a national commercial cryptographic algorithm, to ensure data integrity and traceability. At the consensus layer, the PBFT (Practical Byzantine Fault Tolerance) algorithm is used to ensure multi-node consensus on evidence information within the permissioned blockchain network. This layered architecture ensures the security of evidence data while also balancing efficiency and scalability.

[0133] S430: Conduct forensic verification of the corresponding level of evidence data. The system provides a "five-element search interface" that can flexibly search for the corresponding level of evidence data based on conditions such as "grayscale level," "timestamp," "device fingerprint," "process identifier (PID)," and "file path," allowing for rapid location and evidence collection.

[0134] The present invention obtains high-quality time series features by quantifying file operation events, so that the information entropy can truly reflect the randomness of file operations. The LSTM prediction component P f(t) It can issue an early warning about 30 seconds before malicious encryption behavior actually breaks out, capture "sudden" behavior in advance, and make the overall detection more accurate. The dynamic security baseline constructed by combining the advantages of the two greatly improves the accuracy of dynamic detection; the traceability results of process chain tracing and socket chain tracing are integrated and compared according to the security level, so that the penetrating traceability capability can achieve a substantial breakthrough; the dynamic security baseline automatically adjusts the threshold according to business load fluctuations, and uses socket chain tracing to interrupt the process chain in containerization or process injection scenarios. This design enables the present invention to maintain excellent detection accuracy and real-time protection capabilities in cloud-native architecture, containerization scenarios, and high-concurrency stress testing; the credibility of the stored evidence data is significantly enhanced through gradient blockchain evidence storage and verification.

[0135] Example 2:

[0136] A file operation traceability analysis system based on flexible grayscale measurement, such as Figure 2 As shown, it includes: information entropy acquisition module 100, dynamic security baseline construction module 200, key chain traceability module 300, and elastic evidence strategy design module 400;

[0137] The information entropy acquisition module 100 is used to acquire file operation events and perform quantization operations on the file operation events to obtain information entropy;

[0138] The dynamic security baseline construction module 200 is used to combine the information entropy with the exponential moving average and long short-term memory network prediction to construct a dynamic security baseline;

[0139] The critical chain tracing module 300 is used to compare the dynamic security baseline with the entropy value, dynamically determine the behavior risk level, switch the optimal tracing path according to the behavior risk level, and obtain critical link information;

[0140] The flexible evidence storage strategy design module 400 is used to calculate the evidence storage density according to the grayscale level and design a flexible evidence storage strategy according to the evidence storage density.

[0141] Various changes and modifications can be made without departing from the spirit and scope of the present invention, and all equivalent technical solutions also fall within the scope of the present invention.

[0142] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0143] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0145] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0147] It should be noted that:

[0148] References in this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Therefore, appearances of the phrases "one embodiment" or "an embodiment" in various places throughout this specification do not necessarily refer to the same embodiment.

[0149] In addition, it should be noted that the shapes and names of the components of the specific embodiments described in this specification may vary. Any equivalent or simple variation based on the structure, features, and principles described in the patent concept of the present invention is included within the scope of protection of the patent. Those skilled in the art of the present invention may make various modifications, additions, or substitutions to the described specific embodiments, and these modifications, as long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, shall fall within the scope of protection of the present invention.

Claims

1. A file operation traceability analysis method based on flexible grayscale measurement, characterized in that: The following steps are involved: Obtain file operation events and perform quantification operations on the file operation events to obtain information entropy; Combining the information entropy with exponential moving average and long short-term memory network predictions to construct a dynamic security baseline; Comparing the dynamic security baseline with the entropy value, dynamically determining the behavior risk level, switching the optimal tracing path according to the behavior risk level, and obtaining key link information; Calculate the evidence density based on the grayscale level and design a flexible evidence strategy based on the evidence density.

2. The file operation tracing analysis method based on flexible grayscale measurement according to claim 1 is characterized in that: The method of obtaining a file operation event and performing a quantization operation on the file operation event to obtain information entropy includes the following steps: Obtain file operation events at the kernel layer of the operating system, count file operations within a certain time period, and calculate the probability distribution of each file operation event; Constructing features for the file operation event to obtain a "file operation - execution process - underlying hardware" feature data set; Performing real-time streaming processing on the feature data set to obtain high-dimensional feature data; Performing a quantization operation on the high-dimensional feature data based on an information entropy calculation formula to obtain information entropy; The information entropy calculation formula is: ； Where Hf(t) represents the information entropy of the current sampling window, and P(opk) represents the probability distribution of operation type opk in the current window, where k ranges from 1 to 4.

3. The file operation tracing analysis method based on flexible grayscale measurement according to claim 1 is characterized in that: The method combines information entropy with exponential moving average and long short-term memory network prediction to construct a dynamic security baseline, which specifically includes the following steps: The information entropy sequence within a certain period of time is calculated by the exponential moving average algorithm to generate the historical entropy value component; Input the information entropy sequence into the long short-term memory network to generate the future entropy value prediction component; A dynamic security baseline is constructed based on the weighted fusion of historical entropy value component and future entropy value prediction component; The calculation formula of the dynamic security baseline is: ； Where μ(t) represents the dynamic security baseline of the current sampling window; α represents the weight coefficient of the historical component, β represents the weight coefficient of the prediction component, and α+β=1, Eh(t) represents the information entropy, and Pf(t) represents the future entropy value prediction component; The calculation formula of the historical entropy value component is: ； Among them, E h (t) represents the historical entropy value component of the current sampling window, information entropy λ represents the exponential decay coefficient, E h (t-1) represents the historical entropy value component of the previous sampling window, and H f (t) represents the information entropy of the current window.

4. The file operation tracing analysis method based on flexible grayscale measurement according to claim 1 is characterized in that: The step of comparing the dynamic security baseline with the entropy value, dynamically determining the behavior risk level, switching the optimal tracing path according to the behavior risk level, and obtaining key link information includes the following steps: Based on the ratio of information entropy to dynamic security baseline, the behavior risk level is dynamically judged; When the specified behavior risk level is reached, the system prioritizes process chain tracing; In containerized or process injection scenarios, if the process chain is interrupted due to namespace inconsistency, it will automatically switch to socket chain tracing; The tracing results of process chain tracing and socket chain tracing are integrated and compared to obtain key link information.

5. The file operation tracing analysis method based on flexible grayscale measurement according to claim 4 is characterized in that: When the specified behavior risk level is reached, the system will prioritize process chain tracing, which specifically includes the following steps: Deploy an extended Berkeley packet filter hook in the operating system kernel to capture process runtime information in real time; Reconstruct the call chain of parent and child processes through process runtime information.

6. The file operation traceability analysis method based on flexible grayscale measurement according to claim 4 is characterized in that: In the containerization or process injection scenario, if the process chain is interrupted due to namespace inconsistency, the system automatically switches to socket chain tracing, which specifically includes the following steps: In containerized or process injection scenarios, real-time detection of consistency between the control group and the process identifier namespace; If the control group and the process identifier namespace are inconsistent, the process chain is determined to be interrupted; Extract the TCP five-tuple based on the Transmission Control Protocol socket information, perform a reverse comparison with the kernel socket event log, and restore the network communication link from the remote control terminal to the local terminal; Through the dynamic fingerprint and behavior risk level binding mechanism, the accuracy of socket chain tracing is further improved.

7. The file operation tracing analysis method based on flexible grayscale measurement according to claim 1 is characterized in that: The method of calculating the evidence density according to the grayscale level and designing a flexible evidence storage strategy according to the evidence density specifically includes the following steps: Calculate the evidence density based on the grayscale level; Adopting a layered evidence storage architecture, we design flexible evidence storage strategies for evidence data with different storage densities. Conduct judicial verification of evidence data at the corresponding level; The formula for calculating the evidence density is: ； Among them, ρ represents the evidence density, and GrayLevel represents the grayscale level.

8. A file operation traceability analysis system based on flexible grayscale measurement, characterized by: include: Information entropy acquisition module, dynamic security baseline construction module, critical chain traceability module, and elastic evidence storage strategy design module; The information entropy acquisition module is used to acquire file operation events and perform quantization operations on the file operation events to obtain information entropy; The dynamic security baseline construction module is used to combine the information entropy with the exponential moving average and long short-term memory network prediction to construct a dynamic security baseline; The critical chain tracing module is used to compare the dynamic security baseline with the entropy value, dynamically determine the behavior risk level, switch the optimal tracing path according to the behavior risk level, and obtain critical link information; The elastic evidence storage strategy design module is used to calculate the evidence storage density according to the grayscale level and design an elastic evidence storage strategy according to the evidence storage density.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A file operation tracing and analysis device based on flexible grayscale measurement, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images