A method and system for encrypted scene detection based on double model adaptive switching

Abstract

The application relates to the technical field of network security, in particular to an encryption scene detection method and system based on double-model adaptive switching, which comprises the following steps: loading an unsupervised detection model and an unsupervised data collection module; the unsupervised data collection module collects data for the unsupervised detection model to perform unsupervised preliminary screening and obtain a real-time anomaly score; an adaptive switching controller compares the real-time anomaly score with a switching threshold to determine whether the system is abnormal; if the system is normal, the unsupervised preliminary screening is continued; if the system is abnormal, supervised fine screening is performed; a supervised data collection module collects behavior data and inputs the behavior data into the supervised detection model to determine whether the attack is an encryption virus attack; if the attack is an encryption virus attack, corresponding strategies are executed; if the attack is not an encryption virus attack, the unsupervised preliminary screening is continued. The application performs coarse-grained threat preliminary screening in a normal state, and adaptively switches the model to perform fine screening when potential abnormalities are detected, thereby guaranteeing a high detection rate and reducing the influence on system performance.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to an encryption scene detection method and system based on double-model adaptive switching. BACKGROUND

[0002] With the rapid development of information technology, Linux operating system has been widely used in key fields such as servers, cloud computing and Internet of Things due to its open source, stable and efficient characteristics. However, this also makes it gradually become an important target of network attacks, especially malicious encryption software attacks. Malicious encryption software encrypts core assets such as key files and databases on the server, and demands high ransom from users, which brings huge economic losses and data security risks to enterprises and individuals.

[0003] Traditional encryption scene detection methods mainly include:

[0004] 1. Feature code-based detection: by maintaining a feature code library of malicious software, the file is scanned and compared. The advantages of this method are fast detection speed and high accuracy, but the disadvantages are that it cannot detect unknown and variant malicious encryption software, and the feature library will be invalid if it is not updated in time.

[0005] 2. Sandbox-based dynamic behavior analysis: suspicious programs are run in an isolated virtual environment (sandbox) to observe their behavior for maliciousness. This method can effectively identify unknown viruses, but it consumes a lot of resources and has a lag in detection, which cannot be applied to production environments that require real-time protection.

[0006] 3. Behavior pattern-based detection: by monitoring system behavior such as API calls, file operations, network connections, etc., a normal behavior baseline or malicious behavior model is established to identify abnormalities. This method is the mainstream direction for dealing with unknown threats.

[0007] In the field of behavior pattern-based detection technology, existing technical solutions usually use a single model to continuously monitor and analyze system behavior. Although the existing technical solution can detect encryption scenes to some extent, the "single fine-grained model continuous monitoring" architecture has the following inherent disadvantages:

[0008] 1. System resource consumption is huge, and performance overhead is high: in order to ensure the accuracy of detection, the existing technology needs to monitor all processes in the system in a fine-grained and continuous manner. Every time the auditd captures the file system call and performs in-depth analysis, a large amount of performance overhead will be generated, especially on servers with high I / O load. This overhead will significantly affect the running efficiency of normal business and reduce the overall performance of the server.

[0009] 2. Detection scheme universality and cost are difficult to balance: the prior art scheme is in a dilemma. If high accuracy is pursued, complex models and full data monitoring must be used, resulting in high resource costs; if resource consumption is to be reduced, the model must be simplified or the monitoring frequency / granularity must be reduced, but this will sacrifice detection accuracy and real-time performance, and may result in false negatives. This inherent contradiction makes it difficult for the prior art to provide high-precision security protection while ensuring business performance.

[0010] 3. Lack of dynamic adaptability: the prior art uses a "static" protection strategy, i.e. monitoring in the same, high-intensity mode regardless of whether the system is currently facing threats. The system spends a high performance cost on attack behavior that may only account for 0.1% of the time, which is a great waste of resources.

[0011] Therefore, how to design a malicious encryption software detection scheme that can guarantee high detection accuracy and significantly reduce resource consumption during daily operation, achieving dynamic balance between performance and security, is a problem to be solved in the current technical field. SUMMARY

[0012] To solve the problems of high persistent resource consumption, difficulty in balancing performance and accuracy, and lack of dynamic adaptability in the prior art, the purpose of the present application is to provide a dual-model adaptive switching-based encryption scenario detection method and system, which performs coarse-grained threat preliminary screening with very low resource overhead during normal system operation, and only when potential anomalies are detected, switches to a high-precision detection model for accurate identification, thereby ensuring high detection rate while minimizing the impact on system performance.

[0013] The present application provides a dual-model adaptive switching-based encryption scenario detection method, comprising the following steps:

[0014] Step S1: load the unsupervised detection model and the unsupervised data collection module;

[0015] Step S2: the unsupervised data collection module monitors the directory in real time and sends the collected event statistical information to the unsupervised detection model in real time for unsupervised preliminary screening;

[0016] Step S3: the unsupervised detection model calculates a real-time anomaly score based on the event statistical information;

[0017] Step S4: the adaptive switching controller compares the real-time anomaly score with a preset switching threshold to determine whether the real-time anomaly score is abnormal;

[0018] Step S5: If the real-time anomaly score is normal, the adaptive switching controller does not trigger supervised fine-grained detection, and directly returns to step S2; if the real-time anomaly score is abnormal, the adaptive switching controller activates the supervised data collection module and the supervised detection model to perform supervised fine-grained detection;

[0019] Step S6: The supervised data collection module targets the processes in the list of real-time anomaly scores and inputs the fine-grained behavior data of the processes into the supervised detection model;

[0020] Step S7: The supervised detection model determines whether the behavior corresponding to the process is an attack of the encryption virus based on the fine-grained behavior data; if the behavior corresponding to the process is an attack of the encryption virus, the response handling layer is triggered to execute a corresponding strategy to handle the process; if the behavior corresponding to the process is not an attack of the encryption virus, no further handling is performed, and the process returns to step S2.

[0021] Further, the event statistical information includes a first feature, a second feature, and a third feature; the first feature is the number of file renaming events in a unit time window; the second feature is the number of file modification events in a unit time window; and the third feature is the number of file creation events in a unit time window.

[0022] Further, the real-time anomaly score is a weighted sum or a maximum value of the anomaly score of the first feature, the anomaly score of the second feature, and the anomaly score of the third feature.

[0023] Further, the calculation formula of the anomaly score of the first feature, the anomaly score of the second feature, or the anomaly score of the third feature is:

[0024]

[0025] wherein, is the anomaly score of the first feature, the second feature, or the third feature in a unit time window t; is the observed value of the first feature, the second feature, or the third feature in a unit time window t; is the mean value of the first feature, the second feature, or the third feature in a behavior baseline; is the standard deviation of the first feature, the second feature, or the third feature in a behavior baseline; the behavior baseline is the statistical value of the event statistical information when the real-time anomaly score is normal; and the subscript i represents the first feature, the second feature, or the third feature.

[0026] Further, in step S4, if the real-time anomaly score is greater than a preset switching threshold, the real-time anomaly score is abnormal, and the adaptive switching controller triggers the supervised fine-grained detection; if the real-time anomaly score is less than or equal to the preset switching threshold, the real-time anomaly score is normal.

[0027] ​Further, in step S7, the supervised detection model is a trained DeepFM model; the trained DeepFM model outputs a probability that the behavior corresponding to the process is an attack of the encryption virus based on the input refined behavior data, and then compares the probability that the attack of the encryption virus with a preset decision threshold value;

[0028] If the probability that the attack of the encryption virus is greater than the decision threshold value, the behavior corresponding to the process is an attack of the encryption virus, and if the probability that the attack of the encryption virus is less than or equal to the decision threshold value, the behavior corresponding to the process is not an attack of the encryption virus.

[0029] Further, the DeepFM model includes a first part and a second part.

[0030] The probability that the attack of the encryption virus is calculated by the following formula:

[0031]

[0032] is the probability that the attack of the encryption virus, is the probability output by the first part, is the probability output by the second part.

[0033] Further, the unsupervised data collection module collects event statistical information based on the inotify mechanism; and the supervised data collection module collects refined behavior data based on the eBPF technology.

[0034] The application also provides a system for detecting an encryption scene based on adaptive switching of double models, which comprises a data collection layer, an analysis engine layer and a response disposal layer connected in sequence.

[0035] The data collection layer comprises an unsupervised data collection module and a supervised data collection module; the analysis engine layer comprises an unsupervised detection model, an adaptive switching controller and a supervised detection model connected in sequence.

[0036] The unsupervised data collection module is used for monitoring a directory and sending collected event statistical information to the unsupervised detection model in real time.

[0037] The unsupervised detection model is connected in information with the unsupervised data collection module and the adaptive switching controller, and is used for receiving the event statistical information sent by the unsupervised data collection module, calculating a real-time anomaly score and outputting the real-time anomaly score to the adaptive switching controller.

[0038] The adaptive switching controller is connected in information with the unsupervised data collection module, the supervised data collection module and the supervised detection model, and is used for judging whether the supervised data collection module and the supervised detection model need to be activated based on the real-time anomaly score. ​

[0039] The supervised data collection module is used for targeted monitoring of processes in the directory of real-time exceptions, and sends the collected refined behavior data to the supervised detection model;

[0040] The supervised detection model is connected with the supervised data collection module and the adaptive switching controller, and is used for receiving refined behavior data from the supervised data collection module and performing feature extraction and judgment analysis of the attack of the encryption virus after being activated by the adaptive switching controller;

[0041] The response treatment layer is connected with the supervised detection model, and performs corresponding operations to treat the process after the supervised detection model determines that the behavior of the process is the attack of the encryption virus.

[0042] Further, the model training and baseline management module is further included; the model training and baseline management module includes a supervised detection model training module;

[0043] The supervised model training module is connected with the supervised detection model, and is used for training the supervised detection model using the labeled behavior data corresponding to the attack of the encryption virus and the behavior data corresponding to the attack of the non-encryption virus.

[0044] The beneficial effects of the present application are:

[0045] 1. Extremely low normal operation resource consumption: the core advantage of the present application is the "asymmetric" monitoring mode. During most of the normal operation time of the system, only the lightweight, inotify-based unsupervised detection model is working, and the CPU and memory occupation is almost negligible. Compared with the existing technology, the present application greatly reduces the daily impact on business performance, improves the overall availability and operation efficiency of the system. This effect is realized by the "unsupervised detection model" and the "adaptive switching mechanism".

[0046] 2. High accuracy and low false positive rate: the present application realizes the complementary advantages through a two-stage detection process. The unsupervised preliminary screening stage ensures the breadth and real-time performance of the detection, although there may be some false positives (normal batch operations are identified as abnormal), but these false positives will be filtered out by the second-stage precise identification model. The supervised detection model uses advanced DeepFM algorithm and refined behavior data from eBPF, and has a high accuracy in judging the attack of the real encryption virus. This effect is guaranteed by the "supervised detection model", especially the application of "DeepFM algorithm", and the design of "two-stage filtering".

[0047] 3. Dynamic adaptability and intelligence: the application changes the security protection system from a "static" observer to a "dynamic" responder. This intelligent and adaptive feature enables it to flexibly respond to different business loads and attack scenarios. This effect is a direct result of the core innovation of the "adaptive switching method".

[0048] The application successfully solves the fundamental contradiction between "performance" and "security" in the detection of malicious encryption software behavior in the prior art, and provides a new protection paradigm that is efficient, accurate and intelligent. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the specific embodiments of the application or the technical solutions in the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0050] Figure 1 The flow architecture diagram of the application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the application will be described clearly and completely below. In the following description, many specific details are set forth in order to provide a thorough understanding of the application, but the application can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without departing from the scope of the application. Therefore, the application is not limited to the specific embodiments disclosed below.

[0052] The purpose of the application is to provide a dual-model adaptive switching based encryption scenario detection method and system. When the system is running normally, it performs coarse-grained threat preliminary screening with very low resource overhead. Only when potential anomalies are detected, the system adaptively switches to a high-precision detection model for accurate identification, thereby ensuring high detection rate while minimizing the impact on system performance.

[0053] The general idea of the application is to build a dual-layer detection architecture composed of an "unsupervised detection model" and a "supervised detection model", and to combine the two through an adaptive switching mechanism.

[0054] 1. Unsupervised detection model (low resource consumption layer): This model serves as the normal monitoring module of the system. It does not focus on specific process behavior, but rather monitors file access events based on the directory hierarchy using the Linux inotifywait tool. The inotifywait tool is directly driven by kernel events, with extremely low resource consumption. This model establishes a "behavior baseline" of normal file access patterns by statistically analyzing the frequency and type distribution of file creation, modification, deletion, and movement events in a specific directory within a unit of time. When the current behavior pattern (event statistics) significantly deviates from the behavior baseline (for example, a large number of files are modified and renamed within a short period of time), it is considered abnormal. This model is responsible for rapid and low-cost "preliminary screening".

[0055] 2. Supervised detection model (high-precision analysis layer): This model serves as the on-demand start module of the system. It uses eBPF technology to conduct fine-grained file access behavior monitoring on specific suspicious processes. By collecting system call sequences, file operation types, data read-write patterns, and other information of the process, a rich feature set is constructed. This invention uses the DeepFM model (Deep Factorization Machine model), which can organically combine factorization machines (FM) and deep neural networks (DNN) to automatically learn low-order (second-order) and high-order combination relationships between features, thereby more deeply understanding the complex behavior patterns of malicious encryption software and achieving high-precision judgment. This model is trained on a large number of malicious virus samples and normal samples, and can accurately distinguish between real encryption virus attacks and benign high-I / O operations. The supervised detection model performs supervised analysis.

[0056] 3. Adaptive switching mechanism: This is the core that connects the above two models. The system defaults to running the unsupervised detection model. The unsupervised detection model continuously calculates the deviation (or "real-time anomaly score") of the current file access behavior (event statistics) from the behavior baseline. When the real-time anomaly score exceeds the preset switching threshold, the system determines that there may be a threat and immediately triggers the switching mechanism. The switching mechanism activates the supervised detection model and the supervised data collection module, and instructs them to conduct targeted and refined monitoring and analysis on the directory or related user / process that caused the anomaly. After the supervised detection model completes the analysis, the results are output, and based on the results, it is decided whether to alarm and handle or to disarm the alarm. Subsequently, the system can return to the low-power unsupervised preliminary screening mode.

[0057] Through this "coarse screening + refined analysis" combination and dynamic adaptive switching strategy, the invention limits the high performance overhead to a very short time window where it is truly needed, thereby perfectly solving the pain points of existing technologies.

[0058] Embodiment one:

[0059] As Figure 1As shown, the embodiment discloses an encryption scene detection system based on double-model adaptive switching, mainly including the following modules:

[0060] 1. Data acquisition layer

[0061] a) Unsupervised data acquisition module: realized based on inotify mechanism, which monitors the preset key directories (such as / home, / var / www, / data, etc.) through the inotifywait tool. It only collects event types (creation, modification, deletion, etc.) and event counts, with small data volume and low overhead. These collected data are collectively referred to as event statistics (corresponding to "file event statistics" in Figure 1 ).

[0062] b) Supervised data acquisition module: realized based on eBPF technology. When the supervised data acquisition module is activated, it dynamically mounts eBPF probes to file access system calls related to suspicious activities to capture detailed behavior data.

[0063] 2. Analysis engine layer

[0064] The analysis engine layer includes an unsupervised detection model, an adaptive switching controller, and a supervised detection model connected in sequence.

[0065] a) Unsupervised detection model: connected with the unsupervised data acquisition module and the adaptive switching controller, used to receive event statistics from the unsupervised data acquisition module, calculate the deviation of behavior patterns from the preset behavior baseline (corresponding to "calculate abnormal deviation" in Figure 1 ), and output a real-time anomaly score to the adaptive switching controller.

[0066] b) Supervised detection model: connected with the supervised data acquisition module and the adaptive switching controller, used to receive behavior data from the supervised data acquisition module (corresponding to "detailed behavior data" in Figure 1 ) after being activated by the adaptive switching controller, perform feature extraction, and analyze using a pre-trained DeepFM model to output a judgment result of "attack by encryption virus" or "normal".

[0067] c) Adaptive switching controller: the core control unit of the system, connected with the unsupervised data acquisition module, the unsupervised detection model, the supervised data acquisition module, and the supervised detection model, used to continuously monitor the real-time anomaly score output by the unsupervised detection model. When the real-time anomaly score exceeds the switching threshold, it is responsible for activating the supervised data acquisition module and the supervised detection model, and assigning analysis tasks to the supervised data acquisition module and the supervised detection model. After the analysis is completed, it is responsible for restoring the system to normal.

[0068] 3. Model training and baseline management module

[0069] The model training and baseline management module includes a baseline generation and update module connected with the unsupervised detection model information, and a supervised model training module connected with the supervised detection model information.

[0070] a) Baseline generation and update module (corresponding to "baseline generation and update" in Figure 1 ): responsible for learning normal file access patterns during system initialization or specified time period, generating and updating behavior baseline for unsupervised detection model.

[0071] b) Supervised model training module (corresponding to "supervised model training" in Figure 1 ): in offline environment, using labeled malicious encryption software behavior data and normal behavior data, training DeepFM model, providing and updating supervised detection model loaded model file.

[0072] 4. Response handling layer

[0073] The response handling layer is connected with the supervised detection model information. When the supervised detection model confirms the attack of encryption virus, the response handling layer is responsible for executing the preset response strategy, such as sending alarm notification to administrator, automatically isolating infected process, backing up critical data, etc.

[0074] Embodiment two:

[0075] The embodiment discloses an encryption scene detection method based on double model adaptive switching, comprising the following steps:

[0076] Step S1: system initialization. When the system starts, load the unsupervised detection model and the preset behavior baseline. At the same time, the supervised detection model and its required supervised data acquisition module are in standby state.

[0077] Step S2: start unsupervised preliminary screening. The unsupervised data acquisition module starts to monitor the specified directory by using inotifywait tool, and sends the collected event statistical information to the unsupervised detection model in real time. The system resource consumption of this step is extremely low.

[0078] Step S3: calculate the abnormal deviation degree. The unsupervised detection model calculates the deviation degree (real-time anomaly score) of the current file access behavior pattern and the behavior baseline according to the received data (event statistical information). For example, by calculating the Z-score score of the proportion of file renaming and modification events in a short time, the rate of file creation and deletion, etc.

[0079] Step S4: Determine whether to trigger switching. The adaptive switching controller compares the real-time anomaly score with the preset switching threshold to determine whether the real-time anomaly score is abnormal. The switching threshold can be adjusted according to the business scenario and security level.

[0080] Step S5: If the adaptive switching controller does not need to trigger supervised fine-grained analysis, it will continue to monitor. If the adaptive switching controller needs to trigger supervised fine-grained analysis, it will trigger the corresponding operation of supervised fine-grained analysis.

[0081] Specifically, if the real-time anomaly score is less than or equal to the preset switching threshold, it means that the real-time anomaly score is normal and the system behavior is normal, and the adaptive switching controller does not need to trigger supervised fine-grained analysis. The process returns to step S2 and continues to monitor unsupervised low-power consumption.

[0082] If the real-time anomaly score is greater than the switching threshold, the adaptive switching controller determines that there is suspicious activity and immediately performs the following operations:

[0083] a) Activate the supervised data collection module to target monitor the active processes in the directory that triggered the anomaly or the processes associated with the suspicious user through eBPF.

[0084] b) Activate the supervised detection model.

[0085] Step S6: Collect fine-grained behavior data and input it into the supervised detection model. The supervised data collection module starts to capture the detailed file access behavior of the target process, including but not limited to: system call sequence (such as open->read->write->rename), byte size and frequency of read / write data, file entropy value change (through small fragment read / write analysis), operation tendency on different types of files, etc.

[0086] Step S7: Feature extraction and analysis, and determine whether it is an attack of encrypted virus.

[0087] Specifically, first, the supervised detection model performs feature engineering on the collected fine-grained behavior data to construct a high-dimensional feature vector. Then, the high-dimensional feature vector is input into the pre-trained DeepFM model. The FM part of the DeepFM model captures the second-order cross relationship between features (such as the combination of "high-frequency rename" and "target file is.doc"), and the DNN part captures higher-order and more abstract nonlinear relationships, thereby performing deep analysis.

[0088] Second, determine whether it is an attack of encrypted virus. The DeepFM model outputs a probability value representing the possibility of the current behavior being an attack of encrypted virus. The probability value is compared with a decision threshold to obtain the final conclusion.

[0089] If the current behavior is confirmed as an attack of encryption virus, a response is performed. Specifically, when the supervised detection model confirms an attack of encryption virus, the response handling layer is triggered to perform operations such as alarm and isolation.

[0090] If the current behavior is confirmed as not an attack of encryption virus, the alarm is removed. Specifically, when the supervised detection model judges that the current behavior is normal and not an attack of encryption virus (for example, it is a legal batch file processing or database operation), it is considered as a “false positive in preliminary screening”, and no subsequent handling is performed.

[0091] It should be noted that regardless of the result of the fine cut, after the analysis is completed, the adaptive switching controller will return the supervised detection model to standby state, and the system will return to the low-power monitoring mode dominated by the unsupervised model, and the flow returns to step S2.

[0092] Embodiment Three:

[0093] This embodiment focuses on the calculation of real-time anomaly score of the unsupervised detection model.

[0094] The unsupervised detection model discovers anomalies by calculating the deviation of the current file access behavior pattern (event statistical information) from the behavior baseline. The event statistical information includes multiple behavior characteristics.

[0095] The behavior baseline is composed of the statistical values (mean μ and standard deviation σ) of a group of behavior characteristics in the normal period. In this embodiment, there are several key behavior characteristics:

[0096] The first characteristic ( ): The number of file rename events in a unit time window (for example, 10 seconds).

[0097] The second characteristic ( ): The number of file modification events in a unit time window (for example, 10 seconds).

[0098] The third characteristic ( ): The number of file creation events in a unit time window (for example, 10 seconds).

[0099] For any behavior characteristic , its Z-score (anomaly score) at time point is calculated as follows: Equation (1):

[0100] , ,

[0101] Where: is the observed value of feature in the current time window . is the mean value of feature Mean at the behavioral baseline. is the feature Standard deviation at the behavioral baseline.

[0102] Anomaly score (Z-score) reflects the degree of deviation of the current observation from the mean. A higher Z-score (e.g., greater than 3) implies the occurrence of a rare event.

[0103] Real-time anomaly score may be the weighted sum or maximum of the Z-scores of all behavioral features to comprehensively evaluate the overall degree of anomaly. For example, when the maximum strategy is adopted:

[0104] Equation (2): ,

[0105] The adaptive switching controller continuously monitors when the preset switching threshold is exceeded , that is, the switching to the supervised detection model is triggered.

[0106] Embodiment Four:

[0107] This embodiment focuses on the calculation of the supervised detection model.

[0108] The supervised model uses a pre-trained DeepFM model (Deep Factorization Machine) to analyze the refined features (behavioral data) collected by eBPF. The advantage of the DeepFM model is that it can simultaneously learn low-order feature combinations and high-order feature combinations. In this embodiment, the high-dimensional feature vector is a d-dimensional feature vector.

[0109] The prediction output is composed of the first part (FM part) and the second part (DNN part):

[0110] Equation (3): ,

[0111] The prediction output is mapped to the interval (0, 1), representing the probability of a crypto virus attack.

[0112] FM part is responsible for capturing first-order features and second-order feature cross:

[0113] Equation (4): ,

[0114] where: is a d-dimensional feature vector used to represent the input multi-dimensional features, such as = [process name_hash, operation type_onehot, file entropy,...].

[0115] is the weight vector corresponding to the first-order feature (multi-dimensional feature).

[0116] is the linear part, and are the k-dimensional hidden vectors of the j1th and j2th features, respectively, , k is a hyper-parameter.

[0117] and are the values of the d-dimensional feature vector at the j1th and j2nd dimensions, respectively.

[0118] is the dot product of the two feature hidden vectors, used to calculate the weight of the second-order feature cross. The FM part efficiently learns all the interactions between feature pairs in this way.

[0119] DNN part : responsible for capturing high-order, nonlinear feature cross. The input of the DNN part is to connect the hidden vectors of all features to form a dense vector .

[0120] Equation (5): ,

[0121] where is the hidden vector of feature , shared with the FM part, i.e. .

[0122] Then, the input vector goes through a standard feedforward neural network (with multiple hidden layers):

[0123] Equation (6): ,

[0124] where: is the output (activation value) of the lth hidden layer. and are the weight matrix and bias vector of the lth hidden layer, respectively. is the activation function, for example . After passing through multiple layers of the network, the final output of the DNN part is calculated as follows:

[0125] Equation (7): ,

[0126] where H is the number of hidden layers. is the output (activation) of the Hth hidden layer.

[0127] H+1 is the output layer after the Hth hidden layer, and are the weight matrix and bias vector of the output layer H+1, respectively.

[0128] In this embodiment, the DeepFM model is able to simultaneously utilize low-order and high-order feature information by adding and together, and accurately model and identify the complex and implicit behavior patterns (attacks of encryption viruses) of malicious encryption software, thereby obtaining extremely high accuracy.

[0129] The above merely describes the preferred embodiments of the present application, and the protection scope of the present application is not limited to the above-described embodiments. Any technical solutions falling within the concept of the present application shall fall within the protection scope of the present application. It should be noted that, for ordinary skilled persons in the art, some improvements and refinements without departing from the principles of the present application shall also be considered as falling within the protection scope of the present application.

Claims

1. A method for detecting encrypted scenes based on dual-model adaptive switching, characterized in that, Includes the following steps: Step S1: Load the unsupervised detection model and the unsupervised data acquisition module; Step S2: The unsupervised data acquisition module monitors the directory in real time and sends the collected event statistics to the unsupervised detection model in real time for unsupervised initial screening; Step S3: The unsupervised detection model calculates real-time anomaly scores based on event statistics; Step S4: The adaptive switching controller compares the real-time abnormal score with the preset switching threshold to determine whether the real-time abnormal score is abnormal; Step S5: If the real-time anomaly score is normal, the adaptive switching controller does not need to trigger supervised fine-tuning and returns directly to step S2; if the real-time anomaly score is abnormal, the adaptive switching controller activates the supervised data acquisition module and the supervised detection model to perform supervised fine-tuning. Step S6: The supervised data acquisition module performs targeted monitoring of processes in the real-time anomaly sub-list and inputs the refined behavioral data of the acquired processes into the supervised detection model. Step S7: The supervised detection model determines whether the behavior of a process is an attack by an encryption virus based on refined behavioral data; If the behavior of the process is an attack by a cryptovirus, the response and handling layer will be triggered to execute the corresponding strategy to handle the process. If the behavior of the process is not an attack by an encryption virus, no further action will be taken, and the process will return to step S2.

2. The encryption scene detection method based on dual-model adaptive switching according to claim 1, characterized in that, The event statistics include a first feature, a second feature, and a third feature; the first feature is the number of file renaming events within a unit time window; the second feature is the number of file modification events within a unit time window; and the third feature is the number of file creation events within a unit time window.

3. The encryption scene detection method based on dual-model adaptive switching according to claim 2, characterized in that, Real-time anomalies are classified into anomaly scores based on the first feature, the second feature, and the third feature, which are weighted sums or the maximum value.

4. The encryption scene detection method based on dual-model adaptive switching according to claim 3, characterized in that, The formulas for calculating the anomaly score of the first feature, the second feature, or the third feature are as follows: ， in, For the first feature, second feature, or third feature, anomalies are identified within a unit time window t. It is the observation value of the first feature, the second feature, or the third feature within a unit time window t; It is the mean of the first, second, or third characteristic at the behavioral baseline; It is the standard deviation of the first, second, or third feature in the behavioral baseline; the behavioral baseline is the statistical value of the event statistics when the event is abnormal in real time and normal; the subscript i indicates the first, second, or third feature.

5. The encryption scene detection method based on dual-model adaptive switching according to claim 2, characterized in that, In step S4, if the real-time anomaly score is greater than the preset switching threshold, the real-time anomaly score is considered abnormal, and the adaptive switching controller triggers supervised error correction; if the real-time anomaly score is less than or equal to the preset switching threshold, the real-time anomaly score is considered normal.

6. The encryption scene detection method based on dual-model adaptive switching according to claim 2, characterized in that, In step S7, the supervised detection model is the trained DeepFM model; the trained DeepFM model outputs the probability of an attack by a cryptographic virus based on the refined behavioral data of the input process, and then compares the probability of the attack by the cryptographic virus with a preset decision threshold. If the probability of an attack by a cryptovirus is greater than the decision threshold, then the behavior of the process is an attack by a cryptovirus; if the probability of an attack by a cryptovirus is less than or equal to the decision threshold, then the behavior of the process is not an attack by a cryptovirus.

7. The encryption scene detection method based on dual-model adaptive switching according to claim 2, characterized in that, The DeepFM model consists of a first part and a second part; The probability of an attack by a cryptovirus is calculated using the following formula: ， The probability of an attack by a cryptovirus. This represents the probability of the first part of the output. This represents the probability of the second part of the output.

8. The encryption scene detection method based on dual-model adaptive switching according to claim 1, characterized in that, The unsupervised data acquisition module uses the inotify mechanism to collect event statistics; the supervised data acquisition module uses eBPF technology to collect refined behavioral data.

9. An encrypted scene detection system based on dual-model adaptive switching, characterized in that, The system comprises a data acquisition layer, an analysis engine layer, and a response processing layer that are sequentially connected. The data acquisition layer includes an unsupervised data acquisition module and a supervised data acquisition module; the analysis engine layer includes an unsupervised detection model, an adaptive switching controller, and a supervised detection model that are connected in sequence. The unsupervised data acquisition module is used to monitor the directory and send the collected event statistics to the unsupervised detection model in real time. The unsupervised detection model is connected to the unsupervised data acquisition module and the adaptive switching controller. It is used to receive event statistics sent by the unsupervised data acquisition module, calculate the real-time anomaly score, and output it to the adaptive switching controller. The adaptive switching controller is connected to the unsupervised data acquisition module, the supervised data acquisition module, and the supervised detection model to determine whether the supervised data acquisition module and the supervised detection model need to be activated based on real-time anomaly analysis. The supervised data acquisition module is used to perform targeted monitoring of processes in the directory of real-time anomalies and send the collected refined behavioral data to the supervised detection model. The supervised detection model is connected to the supervised data acquisition module and the adaptive switching controller. After being activated by the adaptive switching controller, it receives refined behavioral data from the supervised data acquisition module and performs feature extraction and analysis to determine and analyze the attack of encrypted viruses. The response and handling layer is connected to the supervised detection model. After the supervised detection model determines that the behavior of the process is an attack by an encryption virus, it performs corresponding operations to handle the process.

10. The encrypted scene detection system based on dual-model adaptive switching according to claim 9, characterized in that, It also includes a model training and baseline management module; the model training and baseline management module includes a supervised detection model training module; The supervised model training module is connected to the supervised detection model information and is used to train the supervised detection model using labeled behavioral data corresponding to attacks by encrypted viruses and behavioral data corresponding to attacks by unencrypted viruses.

Images