A virus detection method and system for distributed energy security data

Abstract

The application discloses a virus searching and killing method and system for distributed energy safety data, relates to the field of virus processing, and comprises the following steps: acquiring a virus original characteristic code, splitting the original characteristic code into N discontinuous but sequentially fixed segments F i , calculating the starting offset S i of each segment F i relative to the first segment F1, and constructing a virus characteristic database; then, the data stream is divided into multiple data blocks B i of fixed size, a fixed-size sliding window is adopted to perform scanning and matching association, and finally, threshold judgment is performed; the original virus characteristic code is subjected to fragmentation processing, the storage requirement of the virus characteristic database is reduced; the sliding window scanning can ensure that any characteristic combination is covered, and a matching event FP i is recorded instead of full data, so that the memory occupation is reduced; through comparison of the absolute offset SB i with an expected position, the correct sequence of the segment in the virus is ensured, a state machine can track the matching progress in real time, and the weight of only the segment with correct sequence is accumulated, so that the detection reliability is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of virus data processing, in particular to a virus detection method and system for distributed energy security data. BACKGROUND

[0002] Distributed energy systems usually include solar panels, wind turbines, energy storage devices, etc. These devices are connected through a network for monitoring and control. With the increasing digitalization of DERs, network security threats are also increasing, especially malicious software or virus attacks on these systems, which can easily cause the entire system to malfunction.

[0003] The existing patent 202411162169.7 discloses a method and calculation for automatically detecting viruses in Maya software, which calls a callback function and opens a scene file in the callback function. The scene file format is determined. If the scene file is a text scene file, the instructions and their attribute setting instructions in the text scene file are read line by line, and whether they match the virus record in the virus feature library is detected according to the features in the virus feature library. If they match, the instructions are deleted. If the scene file is a binary scene file, the data blocks in the binary scene file are read block by block according to the binary data structure, and the attribute data is parsed. The attribute data is matched with the features in the virus feature library. If they match, the attribute data is emptied. This method can effectively prevent the spread and outbreak of viruses in Maya software and ensure the safety of Maya systems and user data. However, this method uses continuous and complete data streams for matching, which may delay the response when the match is not determined, allowing the virus to spread, and cannot ensure the correct sequence in the virus, greatly increasing the false positives of unrelated sequences. SUMMARY

[0004] To solve the above problems, the present application adopts the following technical solutions.

[0005] A virus detection method for distributed energy security data, comprising the following steps:

[0006] S1: Obtain the original virus feature code and split the original virus feature code into N non-continuous but sequentially fixed segments F i , count the frequency of each segment F i in the normal file library and assign different weights W i ;

[0007] S2: Calculate the starting offset S i of each segment F i relative to the first segment F1, then output and store the feature mark, which contains (F i , W i , S ia set of virus signatures, a virus contains multiple signatures, and the stored multiple signatures constitute a virus signature database;

[0008] S3: obtaining data streams of each device through the input end, and dividing the obtained data streams into multiple data blocks B of fixed size i , the engine scans each data block B i using a fixed-size sliding window, obtains all sliding window features within the current data block B i , and then matches them one by one with virus fragments F i and records matching events FP i ;

[0009] S4: calculating the absolute offset SB i of each matching event FP i , and then calculating the expected position of the virus fragment F i , which is the sum of the reference offset and the start offset S i . If the absolute offset SB i is equal to the expected position, the matching is successful, and the weight is accumulated, and the state machine of each virus matching event FP i is updated;

[0010] S5: comparing the weight of the state machine of each matching event FP i with the size of the threshold value one by one, when the cumulative weight of a certain state machine exceeds the threshold value, it is determined that the corresponding virus is detected, the response is triggered, and the data stream transmission is interrupted, otherwise normal data stream transmission is performed.

[0011] Preferably, before obtaining the virus original signature, the virus original signature needs to be extracted, and the extraction step of the virus original signature includes: obtaining a virus sample, capturing through a honeypot, a sandbox, user reporting, and actively crawling a malicious software library; preprocessing, using a static unpacking tool or a dynamic sandbox to extract real malicious code; format analysis, parsing executable code segments or script macro codes; and original signature generation, extracting according to different extraction methods according to different characteristic categories.

[0012] Preferably, when scanning each data block B i inside through a sliding window, it is ensured that the step length of each sliding window is much smaller than the size of the sliding window, so that any cross-border feature code fragment combination can be completely contained in at least one sliding window.

[0013] Preferably, the threshold value is the sum of the weights W i of all virus fragments F i multiplied by a proportionality coefficient µ, and the value range of the proportionality coefficient µ is: 0.75≤µ<1.

[0014] Preferably, before calculating the absolute offset SB i for each matching event FP i , an initial state machine is also created for each matching event FP i , which contains a set of (matched fragment, accumulated weight, baseline offset).

[0015] Preferably, the present application also provides a virus detection system for distributed energy security data, comprising a unit for executing the method as described above.

[0016] Preferably, the unit comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the method as described above when executing the computer program.

[0017] Preferably, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the method as described above.

[0018] Preferably, the present application also provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the method as described above.

[0019] The beneficial effects of the present application are:

[0020] In the data stream of a distributed energy system, normal files (such as device firmware) may contain code fragments similar to viruses. If the commonality of fragments is not distinguished, high-frequency fragments are easy to trigger false positives. The present application fragments the original virus signature code, allows partial matching of virus features, can detect key fragments even if the virus is mutated (such as shell), only stores and processes fragments instead of complete signature codes, reduces the storage requirements of the virus feature database, and is suitable for the memory limitations of distributed devices; secondly, sliding window scanning ensures that any feature combination (including cross-border fragments) is covered, records matching events FP i instead of full data, reduces memory usage, adapts to resource-limited energy devices, achieves high detection rate and low false positive rate; finally, by comparing the absolute offset SB i with the expected position, it ensures the correct sequence of fragments in the virus, greatly reduces position-independent false positives, and creates a state machine that can track the matching progress in real time, only accumulates weights for fragments in the correct order, and improves detection reliability. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 The flowchart of the method of the present application is shown;

[0022] Figure 2This is a flowchart illustrating the process of extracting the original signature of a virus.

[0023] Figure 3 This is a schematic diagram of the data flow operation process of the present invention;

[0024] Figure 4 This is a flowchart illustrating the dynamic sandbox extraction process.

[0025] Figure 5 This is a schematic diagram of the logical structure of the virus detection and removal system of the present invention;

[0026] Figure 6 This is a schematic diagram of the physical structure of the virus detection and removal system of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0028] In the description of this invention, it should be understood that, when used in this application specification and appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0029] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0030] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0031] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0032] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0033] Example 1:

[0034] Please see Figures 1-4 A method for detecting and removing viruses from distributed energy security data, comprising the following steps:

[0035] S1: Obtain the original virus signature, which is obtained through feature extraction and then split into N non-contiguous but sequentially ordered segments F. i Statistical analysis of each segment F i The frequency of occurrence in the normal file library, and assigned different weights W i ;

[0036] For example, the original virus signature is 8 bits, such as "2A 9B C4 D7 E8 F1 03 5C". It is then split into three non-contiguous but sequentially ordered segments, such as "F1:2A 9B; F2:D7 E8; F3:03 5C". During this splitting, non-contiguous segments are detected much faster than continuous segments. Traditional continuous scanning requires matching the entire signature byte-by-byte, which is computationally too intensive. Non-contiguous matching, on the other hand, is equivalent to setting multiple anchor points and performing fine-grained matching only near those anchor points. Non-contiguous detection is 4-6 times faster than continuous detection. Then, the F values ​​for each segment are statistically analyzed. i The frequency of occurrence in the normal file library (based on statistics from a large data file library) and assigned different weights W i For example, F1: 2A 9B, weight W1 is assigned 0.9; F2: D7 E8, weight W2 is assigned 0.8; F3: 03 5C, weight W3 is assigned 0.95. In virus detection, traditional full-signature matching is inefficient because viruses frequently mutate or are packed, causing signature changes. Furthermore, certain code segments may be common in normal files, leading to false positives. The above technical solution splits the signature into multiple segments F... i And assign F to each fragment i Different weights can handle partial matching and mutated viruses. Statistics on the frequency of occurrence in normal files help reduce false positives: if a segment F...i If a virus fragment is common in normal files, it is assigned a lower weight because it is unlikely to be malicious; if it is rare, it is assigned a higher weight. This weighting system assigns a weight to common virus fragments F. i It will not trigger an alarm.

[0037] S2: Calculate F for each segment i The starting offset S relative to the first segment F1 i Then, feature tags are output and stored, the feature tags being those containing (F) i W i S i A virus is a collection of multiple feature tags, and the stored feature tags together constitute a virus feature database.

[0038] Calculate F for each segment i The starting offset S relative to the first segment F1 i When the data is in bytes, for example, assuming each data unit is 1 byte, F1 starts at position 0, that is, the starting offset S1 is 0; F2 starts at position 3 relative to F1, that is, the starting offset S2 is 3; F3 starts at position 6 relative to F1, that is, the starting offset S3 is 6; then the output virus feature markers are: {(F1, W1, S1), (F2, W2, S2), (F3, W3, S3)}. This is only for one virus, but in reality there will be multiple viruses. The virus feature database contains multiple virus feature marker sets.

[0039] For example, the virus described above has the following characteristic marker set: {(2A 9B, 0.9, 0), (D7 E8, 0.8, 3), (03 5C, 0.95, 6)}. Using this technical solution, the offset S... i Fragment F was recorded i The location information is crucial for subsequent sequence matching, and the feature labels are compact, storing only key information (segment, weight, offset). During scanning, the segment sequence can be quickly verified by the offset.

[0040] S3: As Figure 3 As shown, the data streams from each device are obtained through the input terminal, which is equivalent to acquiring the input data stream. Then, the data streams are divided into blocks, that is, the acquired data streams are divided into multiple data blocks B of fixed size. i The engine uses a fixed-size sliding window for each data block B. i Perform a scan to obtain the current data block B. i All sliding window features were then compared one by one with virus fragment F. i A matching process is performed; if a virus fragment is matched, a matching event FP is generated. iOtherwise, a sliding window scan is performed again. This step primarily addresses the issue that when detecting viruses in a data stream, virus signatures may be fragmented across multiple data packets or blocks, leading to missed detections. A sliding window scan ensures coverage of all possible starting points, guaranteeing that any combination of signatures is checked, thus reducing missed detections.

[0041] For example, a 16-bit data stream containing the aforementioned viral characteristic fragments:

[0042]

[0043] Dividing the data stream into fixed-size blocks, assuming each block is 4 bits, the data stream is divided into 4 blocks.

[0044] B0: Position 0-3 [01, A0, 2A, 9B];

[0045] B1: Position 4-7 [55, D7, E8, F0];

[0046] B2: Location 8-11 [03, 5C, B4, 22];

[0047] B3: Positions 12-16 [FF, 77, 39, AA];

[0048] Then, the current data block is scanned one by one, with the sliding window size being 2 bytes. Taking data block B0 as an example, the features of all sliding windows in data block B0 are as follows: sliding window 00 is: [01, A0]; sliding window 01 is: [A0, 2A]; sliding window 02 is: [2A, 9B]. Then, each sliding window is matched with virus fragments F1-F31. It can be seen that only sliding window 02: [2A, 9B] matches, so a matching event FP1 (2A 9B, 0.9, 0) is generated. For windows that do not match, the scan continues and the matching event FP1 (2A 9B, 0.9, 0) is recorded.

[0049] Based on the above steps, all sliding window features in data block B1 are divided into: sliding window 03: [55, D7]; sliding window 04: [D7, E8]; sliding window 05: [E8, FO]. Then, they are matched one by one with virus fragments F1-F31, generating a matching event FP2 (D7 E8, 0.8, 3), and the matching event FP2 is recorded.

[0050] Continuing the reasoning, all sliding window features within data block B2 are divided as follows: sliding window 06: [03, 5C]; sliding window 07: [5C, B4]; sliding window 08: [B4, 22]; then a matching event FP3 (03 5C, 0.95, 6) is generated and recorded; through the above scheme, the data stream is divided into blocks and scanned using sliding windows, allowing for efficient data stream processing and adapting to high-speed networks. i It can be processed independently, making it suitable for distributed systems and improving throughput.

[0051] S4: As Figure 3 Calculate FP for each matching event i absolute offset SB i Then calculate the viral fragment F. i Expected position, where the expected position is the current reference offset and the initial offset S. i The sum, if the absolute offset is SB i If the match equals the expected position, the match is successful, the weight is accumulated, and the FP of each virus matching event is updated. i A state machine with an absolute offset of SB i If the position is not equal to the expected position, the match is unsuccessful, the association is discarded, and the scan is repeated.

[0052] Wherein: the absolute offset SB i The absolute value of the number of slides relative to the starting sliding window is SB0, which is 0. Therefore, the absolute offset SB2 of the sliding window 02: [2A, 9B] is 2. The current reference offset refers to the absolute starting position of the first fragment F1 of the virus signature in the data stream, and its value is always equal to 2. The reference offset is not preset but dynamically captured during the scanning process. For example, if the sliding window is 02: [2A, 9B], which is the virus fragment F1, its absolute starting position in the normal data stream is 0. Therefore, the expected position of the sliding window 02: [2A, 9B] is = reference offset + starting offset S1 = 0 + 2 = 2, and its expected position is = absolute offset SB2. Thus, the match is successful, and the state machine is updated to {F1, 0.9, 2} = {2A 9B, 0.9, 2}.

[0053] By analogy, for sliding window 04: [D7, E8], the absolute offset SB5 is equivalent to the initial sliding window having a sliding number of 5, so SB5 = 5. Its expected position is: base offset + initial offset S2 = 2 + 3 = 5, expected position = absolute offset SB5, then the match is successful, update the state machine = {2A 9B ,D7 E8,0.9+0.8,2};

[0054] Its absolute offset SB5 is equivalent to the number of slides of the initial sliding window being 8, so SB5=8. Its expected position is the base offset + the initial offset S3=2+6=8. The expected position = absolute offset SB5, so the match is successful. Update the state machine = {F1, F2, F3, 0.9+0.8+0.95, 2} = {2A 9B, D7 E8, 03 5C, 0.9+0.8+0.95, 2};

[0055] S5: Compare each matching event FP one by one. i The weights of the state machines are determined by the threshold. When the cumulative weight of a certain state machine exceeds the threshold, it is determined that the corresponding virus has been detected, triggering a response and interrupting the data stream transmission; otherwise, normal data stream transmission is carried out.

[0056] For example, W 总 =0.9+0.8+0.95=2.65, and FP1 updates the state machine ={F1, 0.9, 2}={2A 9B, 0.9, 2}, 0.9<µ2.65, so no response is triggered. Similarly, FP2 updates the state machine ={2A 9B, D7 E8, 0.9+0.8, 2}, 1.7<µ2.65, so no response is triggered. FP3 updates the state machine ={F1, F2, F3, 0.9+0.8+0.95, 2}={2A 9B D7 E8 03 5C, 0.9+0.8+0.95, 2}, 2.65>µ2.65, so it is determined that a virus has been detected, a response is triggered, and data stream transmission is interrupted.

[0057] In some other embodiments, see Figure 2 Before obtaining the original virus signature, it is necessary to extract the original virus signature. The steps for extracting the original virus signature include: obtaining a virus sample by capturing it through a honeypot system, sandbox, user reporting, and actively crawling a malware database; preprocessing by using a static unpacking tool or a dynamic sandbox to extract the real malicious code; format parsing by parsing the executable code segment or script macro code; and feature generation by using different extraction methods according to different feature categories.

[0058] The sources of virus samples include honeypot systems, sandbox capture, user reports, and proactive crawling of malware libraries. The implementation methods are as follows: honeypot systems deploy highly interactive honeypots (such as Cowrie and Dionaea), employing IP rotation and fingerprint obfuscation to avoid attacker identification; sandbox capture utilizes cloud-based sandbox clusters (such as CAPE and Cuckoo) to trigger the execution of macro / script document samples; user reports are integrated with the VirusTotal API, with blockchain evidence ensuring the credibility of the sample source; proactive crawling of malware libraries uses distributed crawlers monitoring DarkWeb to automatically download viruses. Preprocessing includes static unpacking or dynamic sandboxing, with static unpacking using the following algorithm:

[0059] def unpack_executable(file):

[0060] if detect_upx(file): # UPX detection

[0061] return upx_unpack(file)

[0062] elif detect_vmp(file):# VMProtect detection

[0063] return dynamic_unpack(vm=azure_windows_sandbox)

[0064] else:

[0065] Return file.

[0066] The extraction steps of the dynamic sandbox are as follows: Figure 4 As shown, in Figure 4 In the process, virus samples are input into an anti-sandbox. It is then determined whether the sample triggers the anti-sandbox. If triggered, the virus enters a customized sandbox; otherwise, it enters a standard sandbox. Memory dumps are then extracted, and finally, code is injected into the process to reconstruct the virus. The parsing tools used for format parsing include, but are not limited to, LIEF, PE Tree, oletools, OfficeDissector, and AST tree analysis.

[0067] In other embodiments, the generated feature types include, but are not limited to, API call sequences, encrypted constants, abnormal jumps, and string fingerprints. The API call sequence extraction method mainly uses IAT Hook monitoring and dynamic call graphs. Encrypted constants use continuous data of 4 bytes or more with an entropy value > 7.5. Abnormal jumps use JMP / CALL instructions with unaligned addresses. String fingerprints use hash digests of concatenated URLs / registry paths to obtain the original signature of the virus.

[0068] In some other embodiments, for each data block B i When scanning internally using sliding windows, it's crucial to ensure that the step size of each sliding window is significantly smaller than the window's size. This guarantees that any combination of signature fragments crossing the scan boundary can be completely contained within at least one sliding window. This technical approach ensures that no virus signature is missed.

[0069] The threshold value is taken as the total viral fragment F. i Weight W i The sum is multiplied by the proportionality coefficient µ, where the value of the proportionality coefficient µ is in the range of 0.75 ≤ µ < 1.

[0070] In other embodiments, when calculating each matching event FP... i absolute offset SB i Previously, it was also necessary to perform FP for each matching event. i Create an initial state machine, which is a set containing (matched segments, cumulative weights, and baseline offsets).

[0071] According to the above scheme, the initial state machines created for each matching event FP1 (2A 9B, 0.9, 0), FP2 (D7E8, 0.8, 3) and FP3 (03 5C, 0.95, 6) are (2A 9B, 0.9, 2), (D7 E8, 0.8, 2) and (03 5C, 0.95, 2), respectively.

[0072] This application also provides a virus detection system for distributed energy security data, including a unit for performing the method described in any of the preceding claims.

[0073] Figure 5 A schematic diagram of the logical structure of a virus detection system for distributed energy security data provided in an embodiment of this application is shown below. Figure 5As shown, the system 1 of this embodiment includes a processing unit 11, a storage unit 12, and a transceiver unit 13. The processing unit 11 is used to process data, the storage unit 12 is used to store data, and the transceiver unit 13 is used to send and receive data. The processing unit 11, the storage unit 12, and the transceiver unit 13 cooperate with each other to implement the above-described method. The beneficial effects brought by the embodiments of this application have been described in the above-described method and will not be repeated here.

[0074] This application also provides a virus detection and removal system for distributed energy security data, wherein the processor executes a computer program to implement the method described in any of the preceding claims.

[0075] Figure 6 A schematic diagram of the physical structure of a virus detection system for distributed energy security data provided in an embodiment of this application is shown below. Figure 6 As shown, the system 2 of this embodiment includes: at least one processor 20 ( Figure 6 Only one processor 20, a memory 21, and a computer program 22 stored in the memory 21 and executable on the at least one processor 20 are shown. When the processor 20 executes the computer program 22, it implements the steps in any of the above method embodiments. The beneficial effects of the embodiments of this application have been described in the above methods and will not be repeated here.

[0076] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0077] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0078] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0079] This application provides a computer program product that, when run on a mobile terminal, enables the mobile terminal to implement the steps described in the above-described method embodiments.

[0080] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0081] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0082] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0083] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0084] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0085] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for detecting and removing viruses from distributed energy security data, characterized in that, Includes the following steps: S1: Obtain the original virus signature and split it into N discontinuous but sequentially ordered segments F. i Statistical analysis of each segment F i The frequency of occurrence in the normal file library, and assigned different weights W i ; S2: Calculate F for each segment i The starting offset S relative to the first segment F1 i Then, feature tags are output and stored, the feature tags being those containing (F) i W i S i A virus is a collection of multiple feature tags, and the stored feature tags constitute a virus feature database. S3: Acquire data streams from various devices via the input terminal, and divide the acquired data streams into multiple data blocks B of fixed size. i The engine uses a fixed-size sliding window for each data block B. i Perform a scan to obtain the current data block B. i All sliding window features were then compared one by one with virus fragment F. i Perform matching to form a matching event FP. i ; S4: Calculate FP for each matching event i absolute offset SB i In calculating each matching event FP i absolute offset SB i Previously, it was also necessary to perform FP for each matching event. i Create an initial state machine, which is a set containing (matched fragments, cumulative weights, and baseline offsets), and then calculate the viral fragment F. i Expected position, where the expected position is the base offset and the starting offset S i The sum, if the absolute offset is SB i If the match equals the expected position, the match is successful, the weight is accumulated, and the FP of each virus matching event is updated. i A state machine; S5: Compare each matching event FP one by one. i The weights of the state machines are determined by the threshold. When the cumulative weight of a certain state machine exceeds the threshold, it is determined that the corresponding virus has been detected, triggering a response and interrupting the data stream transmission; otherwise, normal data stream transmission is carried out.

2. The method for detecting and eliminating viruses in distributed energy security data according to claim 1, characterized in that, Before obtaining the original virus signature, it is necessary to extract the original virus signature. The steps for extracting the original virus signature include: obtaining virus samples through honeypots, sandboxes, user reports, and actively crawling malware databases; preprocessing by using static unpacking tools or dynamic sandboxes to extract real malicious code; format parsing by parsing executable code segments or script macros after preprocessing; and feature generation by using different extraction methods according to different feature categories.

3. The method for detecting and eliminating viruses in distributed energy security data according to claim 1, characterized in that, For each data block B i When scanning internally using sliding windows, it is essential to ensure that the step size of each sliding window is much smaller than the size of the sliding window, so that any combination of feature code segments that cross the scan boundary can be completely contained within at least one sliding window.

4. The method for detecting and eliminating viruses in distributed energy security data according to claim 1, characterized in that, The threshold value is taken as the total viral fragment F. i Weight W i The sum is multiplied by the proportionality coefficient µ, where the value of the proportionality coefficient µ is in the range of 0.75 ≤ µ < 1.

5. A virus detection and removal system for distributed energy security data, characterized in that, Includes a unit for performing the method according to any one of claims 1 to 4.

6. The virus detection and removal system for distributed energy security data according to claim 5, wherein the unit comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images