Ransomware behavior simulation-based disinfection protection capability verification method and system

Abstract

The application provides a harmless protection capability verification method and system based on ransomware behavior simulation, and relates to the technical field of network security. The method comprises the following steps: first, generating reference behavior information based on the attack behavior characteristics of ransomware; then, simulating the operation defined by the reference behavior information in the target server environment and obtaining actual physical layer behavior information; then, comparing the actual physical layer behavior information with the expected physical layer behavior information corresponding to the reference behavior information for spatiotemporal consistency, so as to identify abnormal behavior patterns; then, reconstructing the abnormal behavior patterns to establish a target behavior field model, and calculating the topology characteristic data and entropy change gradient through the model; finally, combining the topology characteristic data and the entropy change gradient to evaluate the harmless protection capability of the protection system in the target server environment against ransomware. The application improves the active protection verification capability against advanced ransomware evasion behavior.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method and system for verifying harmless protection capabilities based on ransomware behavior simulation. Background Technology

[0002] In the field of cybersecurity, verifying ransomware protection capabilities is a crucial step in ensuring information system security. Among these methods, the harmless protection capability verification method, by evaluating responses to simulated attacks, can test the effectiveness of the defense system without affecting real business operations, and thus has significant application value.

[0003] Existing technical solutions typically involve injecting simulated malicious code into the target environment and monitoring the system response. These solutions often rely on the direct reproduction of known virus behavior patterns and assess the effectiveness of protection by analyzing network traffic, file changes, or system call logs.

[0004] These methods primarily focus on logical-level behavior matching and alarm analysis, resulting in a relatively singular evaluation dimension. For subtle discrepancies between the actual physical layer behavior of storage devices and the expected behavior of simulated attacks, especially anomalies caused by advanced evasion techniques that are difficult to directly reflect in logical logs, existing verification processes may introduce evaluation biases, leading to an incomplete assessment of the true capabilities of the protection system. Therefore, existing technologies suffer from insufficient accuracy in verifying protection capabilities against advanced evasion behaviors. Summary of the Invention

[0005] This application provides a method and system for verifying harmless protection capabilities based on ransomware behavior simulation, in order to solve the problem of poor proactive protection verification capabilities against advanced ransomware evasion behaviors in the prior art.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a method for verifying harmless protection capabilities based on ransomware behavior simulation, comprising:

[0007] Based on the attack behavior characteristics of ransomware, baseline behavioral information is generated to simulate ransomware behavior;

[0008] In the target server environment, the operations defined by the baseline behavior information are simulated and executed, and the actual physical layer behavior information of the storage device is monitored during the simulation.

[0009] By using a comparison mechanism, the actual physical layer behavior information is spatiotemporally compared with the expected physical layer behavior information corresponding to the baseline behavior information in order to identify abnormal behavior patterns triggered by simulated attacks.

[0010] The abnormal behavior pattern is dynamically behavior mapping reconstructed to establish a target behavior field model, through which topological feature data and entropy change gradient are calculated;

[0011] The topological feature data and the entropy change gradient are combined, and an adaptive evaluation algorithm is used to evaluate the harmless protection ability of the protection system in the target server environment against ransomware.

[0012] Optionally, the combination of the topological feature data and the entropy change gradient, and the use of an adaptive evaluation algorithm to evaluate the harmless protection ability of the protection system in the target server environment against ransomware, comprises:

[0013] Obtain the security alarm events and interception records generated by the protection system during the simulation execution;

[0014] Based on the topological feature data and the entropy change gradient, the behavior feature vector of this simulation attack is constructed;

[0015] Through the adaptive evaluation algorithm, the behavior feature vector is analyzed, and the abnormal score of this simulation attack is calculated;

[0016] According to the security alarm events and interception records, it is judged whether the protection system responds to this simulation attack, and the response information is extracted;

[0017] Combined with the abnormal score and the response information of the protection system, according to the preset evaluation matrix, the harmless protection level of the protection system is determined.

[0018] Optionally, the adaptive evaluation algorithm is used to analyze the behavior feature vector and calculate the abnormal score of this simulation attack, comprising:

[0019] From the behavior feature vector, a first sub-vector representing network connection state and a second sub-vector representing change rate of chaos degree are parsed out;

[0020] According to the node connection density and path complexity of the first sub-vector, a first dynamic weight coefficient is calculated, and according to the change trend and fluctuation intensity of the second sub-vector, a second dynamic weight coefficient is calculated;

[0021] The first dynamic weight coefficient is used to weight and aggregate the first sub-vector to obtain a first abnormal index, and the second dynamic weight coefficient is used to weight and aggregate the second sub-vector to obtain a second abnormal index;

[0022] The first abnormal index and the second abnormal index are fused to obtain an abnormal score.

[0023] Optionally, the abnormal behavior pattern is dynamically reconstructed into a dynamic behavior graph to establish a target behavior field model, and through the target behavior field model, topological feature data and an entropy change gradient are calculated, including:

[0024] Based on the abnormal behavior pattern, a behavior subject, an operated object, and an operation type are extracted as behavior nodes, and based on the causal correlation between behaviors, an associated edge between the behavior nodes is established to generate a dynamic behavior graph;

[0025] Based on the dynamic behavior graph, a target behavior field model is constructed in combination with a coupling mechanism;

[0026] Based on the network structure of the target behavior field model, topological feature data is calculated;

[0027] Based on the evolution sequence of the field intensity distribution of the target behavior field model within a preset time window, the rate of change of information entropy is calculated to obtain an entropy change gradient.

[0028] Optionally, the target behavior field model is constructed based on the dynamic behavior graph in combination with a coupling mechanism, including:

[0029] Based on the dynamic behavior graph, the dynamic behavior graph is expanded into an initial multi-dimensional behavior field model through a coupling mechanism;

[0030] The initial multi-dimensional behavior field model is optimized through a parameter optimization algorithm to obtain a target behavior field model.

[0031] Optionally, based on the attack behavior characteristics of the ransomware, reference behavior information for simulating ransomware behavior is generated, including:

[0032] Seed features are extracted from a preset ransomware behavior feature library;

[0033] Based on the seed features, in combination with environment configuration information of a simulation execution target, a standardized behavior sequence is generated through a sequence generator;

[0034] Random disturbance factors and mutation operators are introduced to transform the standardized behavior sequence to generate an attack instruction sequence as reference behavior information.

[0035] Optionally, the actual physical layer behavior information and the expected physical layer behavior information corresponding to the reference behavior information are compared for spatiotemporal consistency through a comparison mechanism to identify an abnormal behavior pattern triggered by a simulated attack, including:

[0036] Based on the reference behavior information and a hardware performance model of the storage device, corresponding expected physical layer behavior information is generated;

[0037] transform the expected physical layer behavior information and the actual physical layer behavior information into first and second spatiotemporal trajectory sequences with the same time reference and physical coordinate reference, respectively;

[0038] calculate a difference degree of physical feature parameters of the first and second spatiotemporal trajectory sequences within the same time window;

[0039] when the difference degree exceeds a preset abnormality determination threshold, determine that there is an abnormal behavior pattern triggered by the simulation attack within the corresponding time window.

[0040] In a second aspect, the present application provides a harmless protection capability verification system based on ransomware behavior simulation, comprising:

[0041] a generation module configured to generate benchmark behavior information for simulating ransomware behavior based on attack behavior characteristics of ransomware;

[0042] a simulation module configured to simulate execution of operations defined by the benchmark behavior information in a target server environment and monitor actual physical layer behavior information of a storage device during the simulation;

[0043] a comparison module configured to perform spatiotemporal consistency comparison between the actual physical layer behavior information and expected physical layer behavior information corresponding to the benchmark behavior information by using a comparison mechanism, to identify an abnormal behavior pattern triggered by the simulation attack;

[0044] a reconstruction module configured to reconstruct a dynamic behavior graph of the abnormal behavior pattern to establish a target behavior field model, and calculate topology feature data and entropy change gradient by using the target behavior field model;

[0045] an evaluation module configured to combine the topology feature data and the entropy change gradient, and evaluate the harmless protection capability of a protection system against ransomware in the target server environment by using an adaptive evaluation algorithm.

[0046] In a third aspect, the present application provides an electronic device, comprising:

[0047] a memory configured to store a computer program;

[0048] a processor configured to execute the computer program to implement the steps of the harmless protection capability verification method based on ransomware behavior simulation according to the first aspect.

[0049] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executable by a processor to implement the steps of the harmless protection capability verification method based on ransomware behavior simulation according to the first aspect.

[0050] In the present application, a harmless protection capability verification method based on ransomware behavior simulation is provided, which comprises: generating benchmark behavior information for simulating ransomware behavior based on the attack behavior characteristics of ransomware; simulating the operation defined by the benchmark behavior information in the target server environment, and monitoring the actual physical layer behavior information of the storage device during the simulation process; using a comparison mechanism, the actual physical layer behavior information is compared with the expected physical layer behavior information corresponding to the benchmark behavior information for spatiotemporal consistency, to identify abnormal behavior patterns triggered by the simulated attack; the abnormal behavior patterns are dynamically reconstructed to establish a target behavior field model, and the topology feature data and entropy gradient are calculated through the target behavior field model; combining the topology feature data and the entropy gradient, an adaptive evaluation algorithm is used to evaluate the harmless protection capability of the protection system against ransomware in the target server environment.

[0051] The technical scheme provided by the present application has the following beneficial effects:

[0052] Firstly, by generating benchmark behavior information based on virus characteristics, a simulated attack sequence that fits real threats can be constructed, providing a reliable test benchmark for the verification process; then, by executing simulation in the target environment and monitoring the physical layer behavior, the actual hardware response of the storage device during execution can be captured, thereby obtaining more bottom-level observation data; next, by comparing the actual physical behavior with the expected behavior for spatiotemporal comparison, subtle abnormal patterns caused by advanced evasion techniques that are difficult to detect at the traditional logic level can be effectively identified; then, by dynamically reconstructing the abnormal patterns and establishing a behavior field model, discrete abnormal points can be converted into systematic network structure features and state change trends; finally, by combining the calculated topology features and entropy gradient and using an adaptive evaluation algorithm for analysis, multi-dimensional quantitative evaluation of the detection and response capability of the protection system can be achieved, improving the accuracy and comprehensiveness of the verification results.

[0053] Further, when evaluating the protection capability, the method first collects the alarm and interception records generated by the protection system during the simulated attack, and simultaneously constructs the behavior feature vector of this attack using the topology features and entropy gradient obtained in the foregoing steps; then, the vector is analyzed by an adaptive algorithm to calculate an abnormal score; next, the response information of the protection system is combined, and a comprehensive analysis is performed according to the preset evaluation rules, to finally determine the specific protection level of the protection system.

[0054] And, the process combines the internal abnormality degree of the simulated attack with the external response performance of the protection system, so that the evaluation not only focuses on whether the attack is blocked, but also measures the perception and judgment ability of the system to complex and hidden attack behaviors; this internal and external combined evaluation method makes the determination of the protection system ability more detailed and objective.

[0055] These aspects or other aspects of the present application will be more apparent in the following description of the embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0057] Figure 1 A flow chart of a harmless protection capability verification method based on ransomware behavior simulation provided by the embodiments of the present application;

[0058] Figure 2 A specific implementation schematic diagram of a harmless protection capability verification method based on ransomware behavior simulation provided by the embodiments of the present application;

[0059] Figure 3 A structure schematic diagram of a harmless protection capability verification system based on ransomware behavior simulation provided by the embodiments of the present application. DETAILED DESCRIPTION

[0060] In the existing verification method for ransomware protection capability, the evaluation process mainly depends on the reproduction of the simulated attack logic behavior and the analysis of the system layer log. When facing ransomware using slow encryption, random access and other advanced evasion techniques, the limitations of this method gradually appear: due to the lack of fine monitoring and comparison of the actual response of the storage device hardware physical layer, the verification process is difficult to capture the subtle abnormalities exposed in the physical track trajectory, timing and other underlying behaviors which are deliberately hidden at the logical access level, thus leading to the evaluation of the real detection ability of the protection system may be biased.

[0061] In view of the verification deviation problem caused by the single evaluation dimension, the application provides a harmless protection capability verification method based on ransomware behavior simulation. The method first generates benchmark behavior for simulating attacks based on known virus characteristics, and executes the simulation operation in the target environment, while capturing the underlying physical behavior information such as storage device execution arm displacement through special monitoring means. Then, through the construction of a comparison mechanism, the actual physical track monitored is analyzed in detail for space-time consistency with the expected physical behavior of the simulation attack, so as to effectively identify abnormal behavior patterns caused by advanced evasion techniques that cannot be found by traditional methods. Then, the abnormal patterns are further reconstructed into dynamic behavior graphs, a target behavior field model that can quantify system behavior correlation and state changes is established, and key evaluation parameters such as topological structure and entropy gradient are extracted from the model. Finally, combined with these deep feature parameters, an adaptive evaluation algorithm is used to comprehensively judge the detection and response capability of the protection system. The scheme introduces physical layer behavior comparison and deep behavior field modeling, expands the observation dimension of verification from a single logical layer to the "logical-physical" coordination and system behavior evolution level, so that the evaluation can more accurately reflect the real perception and disposal capability of the protection system to complex and hidden attacks, thereby solving the problem of inaccurate protection capability verification of advanced evasion behavior in the prior art.

[0062] In order for those skilled in the art to better understand the application scheme, the application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only part of the embodiments of the application, not all embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0063] The core of the application is to provide a harmless protection capability verification method based on ransomware behavior simulation, and a specific implementation process of the method is shown in the flowchart of Figure 1 The method comprises the following steps:

[0064] Step 101: Based on the attack behavior characteristics of ransomware, generate benchmark behavior information for simulating ransomware behavior.

[0065] In this embodiment, the step 101 comprises the following process:

[0066] Step 1011: Extract seed features from a pre-set ransomware behavior feature library.

[0067] In step 1011, the ransomware behavior feature library is a pre-constructed data set containing typical behavior pattern data exhibited by multiple known ransomware samples during real infection processes; the seed features refer to the original behavior pattern fragments selected from the feature library as the basis for sequence generation, which typically include key behavior attributes such as file operation type, access interval regularity, data encryption rate range, etc.

[0068] In the embodiments of the present application, the process of generating baseline behavior information starts with extracting seed features; the specific implementation is to retrieve the historical behavior data fragments most relevant to the behavior from the ransomware behavior feature library according to the target of the current simulation verification, for example, to test the protection capability against "slow encryption" behavior, these fragments contain parameters such as low-frequency write operations and random sleep intervals commonly seen in slow encryption behavior, which are used as the initial template for subsequent sequence generation.

[0069] In actual application, assuming that a ransomware with intermittent write characteristics needs to be simulated, a seed feature is extracted from the feature library, which specifically contains the following behavior parameters: operation type is "file write", single write data volume range is 8KB to 16KB, and time interval between two write operations is 5 seconds to 15 seconds.

[0070] Step 1012: based on the seed features, combined with the environment configuration information of the simulation execution target, generate a standardized behavior sequence through a sequence generator.

[0071] In step 1012, the environment configuration information refers to the specific hardware and software parameters of the target server environment, which includes but is not limited to the model of the storage device, the type of the file system, and the version of the operating system; the standardized behavior sequence refers to a list of behavior instructions that are logically complete, continuous in time, and have their behavior parameters adapted and standardized according to the environment configuration, including operation type, target file path, data size, and timestamp.

[0072] In the embodiments of the present application, the seed features obtained in the previous step are further processed by a sequence generator; the sequence generator receives the seed features and environment configuration information as input, and its internal processing logic includes: first, analyze the behavior parameters in the seed features, then adapt the parameters according to the environment configuration information, for example, map the abstract file path in the seed features to the actual existing decoy file path according to the file system path specification of the target server, and calibrate the rate parameters of data read / write operations according to the performance model of the storage device; after the adjustment is completed, the sequence generator organizes these behavior instructions into an ordered standardized behavior sequence that can be directly parsed by the simulation execution engine.

[0073] In practical application, in combination with the aforementioned seed features and the target environment which is the configuration of a certain brand file server, the sequence generator will concretize the abstract "file writing" operation into writing to the "D:\share\bait.docx" file on the server, determine the writing data volume as 10 KB, determine the writing interval as 10 seconds, and generate a standardized behavior sequence containing 20 writing operations, each operation in the sequence being accompanied by an accurate timestamp.

[0074] Step 1013: Introduce a random disturbance factor and a mutation operator to transform the standardized behavior sequence to generate an attack instruction sequence as the benchmark behavior information.

[0075] In step 1013, the random disturbance factor is a numerical parameter used to introduce a random time offset conforming to a specific probability distribution on the given time parameter of the standardized behavior sequence to simulate the time uncertainty that the attack behavior may encounter in real execution; the mutation operator is a set of rules used to probabilistically and non-fixedly modify the behavior type, target object or operation parameter in the sequence, for example, to replace a "write" operation with a "read" operation with a certain probability, or to randomly change the file object to be accessed, so as to simulate the variation behavior taken by the virus to evade detection; the attack instruction sequence is the benchmark behavior information after randomization and variation processing, which is closer to the complexity of real attack.

[0076] In the embodiments of the present application, the standardized behavior sequence is finally transformed to enhance the authenticity of simulation; the processing process is, first, a random disturbance factor is applied to add a random value sampled from a normal distribution with a mean of 0 and a standard deviation of 2 seconds to the predetermined execution timestamp of each operation instruction in the sequence, thereby disrupting the originally strict periodic time rhythm; then, a mutation operator is applied to randomly select part of the operation instructions in the sequence with a probability of 15%, change the operation target from a fixed file to one of the pre-defined multiple decoy files, thereby simulating the random access behavior in the attack process; after the two transformations, the originally regular standardized behavior sequence is converted into an attack instruction sequence with a certain randomness in time and space, which is output as the final benchmark behavior information.

[0077] In practical applications, the aforementioned standardized behavior sequence containing 20 operations is transformed; in the time disturbance link, 1.5 seconds of offset is added to the timestamp of the first operation, 0.8 seconds of offset is reduced from the second operation, and so on; in the behavior variation link, the third, eighth and fifteenth operations in the sequence are randomly selected, and the target files of the three operations are changed from "D:\share\bait.docx" to "D:\share\bait2.pdf", "D:\share\log.txt" and "D:\share\bait3.xlsx", respectively; finally, an attack instruction sequence containing 20 instructions is generated, which is the benchmark behavior information used for subsequent simulation execution.

[0078] Through the above steps, the application can generate a highly realistic simulation attack instruction containing evasive behavior characteristics from known threat intelligence combined with specific environment, and provide reliable test input for subsequent precise verification of protection capability.

[0079] Step 102: In the target server environment, the operations defined by the benchmark behavior information are simulated, and the actual physical layer behavior information of the storage device is monitored during the simulation.

[0080] In step 102, the target server environment refers to the enterprise file server running scene in which the protection system to be verified is deployed; the actual physical layer behavior information specifically refers to the original signal data directly related to the hardware physical movement generated by the storage device in response to these simulation operations, which includes hard disk actuator displacement trajectory data and seek sound wave vibration data captured by special sensors; wherein the hard disk actuator displacement trajectory data records the micron-level accurate path point sequence of the head assembly moving on the disk during reading and writing data, and the seek sound wave vibration data captures the vibration waveform of a specific frequency generated by the motor and bearing during mechanical seek.

[0081] In the embodiment of the application, the benchmark behavior information generated in step 101 is first loaded into the simulation execution engine deployed on the target server; the engine initiates reading or writing requests for the specified bait file in the background of the operating system according to the definition in the instruction sequence in the form of system calls or driver-level instructions, thereby simulating the file operation behavior of the virus. At the same time, the optical displacement monitoring device and high-sensitivity vibration sensor pre-installed inside the server chassis close to the hard disk position synchronously and uninterruptedly collect the physical movement signals of the storage device actuator; these sensors convert mechanical movement into high-fidelity electrical signals, and after analog-to-digital conversion, a set of actual physical layer behavior information strictly aligned in time with the simulation operation is obtained, reflecting the real response state of the hardware, for subsequent comparison and analysis.

[0082] Step 103: using a comparison mechanism, performing spatio-temporal consistency comparison between the actual physical layer behavior information and the expected physical layer behavior information corresponding to the reference behavior information, to identify abnormal behavior patterns triggered by the simulation attack.

[0083] In this embodiment, the step 103 includes the following process:

[0084] Step 1031: based on the reference behavior information and a hardware performance model of the storage device, generating corresponding expected physical layer behavior information.

[0085] In step 1031, the hardware performance model is a data model containing physical response parameters of a specific model of storage device in an ideal working state, including but not limited to standard seek time for hard disk actuator to move from one physical location to another, theoretical minimum displacement distance when continuously reading and writing adjacent data blocks, and typical vibration spectrum characteristics under different loads; the expected physical layer behavior information refers to the complete data of physical motion trajectory and vibration signal that the storage device should theoretically exhibit under the operation logic defined by the reference behavior information, combined with the hardware performance model.

[0086] In the embodiments of the present application, first, the expected physical layer behavior information needs to be generated for comparison; the specific implementation process is to take the reference behavior information generated in step 101 as input, and process it by an independent analysis device; the analysis device calculates the optimal mechanical seek path, theoretical execution time and accompanying vibration signal characteristics required to complete the access according to the logical block address of the target file on the disk involved in each file operation in the instruction sequence, combined with the preloaded hardware performance model for the hard disk model used by the target server; finally, all the theoretical physical responses corresponding to the operations are concatenated in time sequence to generate a complete expected physical layer behavior information representing "what should happen".

[0087] In actual application, for the first "write D:\share\bait.docx file at position 10KB" operation contained in the reference behavior information, according to the hardware performance model, the physical track corresponding to the file at this position is track 150, the standard seek time for moving from the current position of the actuator (assuming track 0) to track 150 is 4 milliseconds, and the moving trajectory is a straight line; the analysis device generates the expected physical layer behavior information segment for this operation according to this, including a straight line displacement trajectory data with a starting point of 0 and an ending point of 150, an expected time marker lasting 4 milliseconds, and a group of expected low-frequency vibration waveform data corresponding to straight line acceleration and deceleration motion.

[0088] Step 1032: transforming the expected physical layer behavior information and the actual physical layer behavior information into a first space-time trajectory sequence and a second space-time trajectory sequence respectively, which have the same time reference and physical coordinate reference.

[0089] In step 1032, the first space-time trajectory sequence refers to a sequence obtained by performing format unification on the expected physical layer behavior information, each data point in the sequence containing a unified timestamp and a coordinate value in the standardized physical coordinate system; the second space-time trajectory sequence refers to a sequence obtained by performing the same format unification on the actual physical layer behavior information.

[0090] In the embodiments of the present application, secondly, in order to perform accurate comparison, the information from the two sources needs to be placed under the same measurement standard; the specific process is to input the expected physical layer behavior information generated in step 1031 and the actual physical layer behavior information monitored in step 102 into a data normalization module respectively; the module first aligns the time information of the two to the same high-precision system clock reference, for example, converts the expected time with the instruction issuing time as the reference into the absolute timestamp which is the same as the sensor collection time; then, the module converts the position information recorded by the two to the same two-dimensional coordinate system with the geometric center of the hard disk as the origin, and the coordinate value is expressed in millimeters; after the conversion, the expected information is normalized into the first space-time trajectory sequence, and the actual information is normalized into the second space-time trajectory sequence, and the two sequences have direct comparability in the time and space dimensions.

[0091] In actual application, assuming that the simulation is performed starting at 10:00:00 am, then the expected start time of the first operation in the reference behavior information is normalized to the absolute timestamp 10:00:00.000; at the same time, the expected track position 150 of the operation is converted to the coordinate point 38.5 mm away from the center of the disk; the same processing is performed on the sensor raw data in the corresponding time window of the actual monitoring information, and finally two sequences with the same number of data points, aligned time axis and same coordinate unit are generated: the first space-time trajectory sequence is [(10:00:00.000, 0 mm), (10:00:00.004, 38.5 mm)], and the second space-time trajectory sequence is [(10:00:00.000, 0.1 mm), (10:00:00.006, 38.3 mm)].

[0092] Step 1033: calculating the difference degree of the physical feature parameters of the first space-time trajectory sequence and the second space-time trajectory sequence in the same time window.

[0093] In step 1033, the physical characteristic parameters are key indicators for quantitatively describing the physical motion trajectory or vibration state; in this application, the physical characteristic parameters of interest include the spatial position deviation of the trajectory points, the instantaneous motion speed difference between adjacent points, and the energy distribution difference of the vibration signal; the difference degree is a comprehensive numerical calculation result, which is used to measure the overall deviation of the second spatio-temporal trajectory sequence and the first spatio-temporal trajectory sequence in these physical characteristic parameters within the same time window.

[0094] In the embodiments of the present application, then, the specific quantitative comparison is started; the processing process is to set a fixed analysis time window length, for example, 5 milliseconds, to perform sliding window segmentation on the aligned first spatio-temporal trajectory sequence and the second spatio-temporal trajectory sequence; in each time window, the corresponding trajectory segment data is extracted from the two sequences respectively; then, the differences of multiple physical characteristic parameters in the window are calculated, for example, the Euclidean distance average value of all corresponding points between the actual trajectory points and the expected trajectory points is calculated as the position deviation Dp, and the root mean square error between the actual instantaneous speed sequence and the expected instantaneous speed sequence is calculated as the speed difference Dv; finally, the difference degree Score of the time window is calculated by a difference degree function f which synthesizes these deviation values, wherein the difference degree function can adopt a weighted summation manner, i.e. Score = w1 x Dp + w2 x Dv, wherein Score is the difference degree function, w1 and w2 are preset weight coefficients, and w1 + w2 = 1.

[0095] In actual application, for the first 5 millisecond window of the above-mentioned first and second spatio-temporal trajectory sequences, the average position deviation Dp of the actual trajectory points and the expected trajectory points is calculated to be 0.15 millimeters, and the root mean square error Dv of the actual and expected speeds is calculated to be 2.1 millimeters / millisecond; setting the weight w1 to be 0.7 and w2 to be 0.3, then according to the difference degree function Score = 0.7 x 0.15 + 0.3 x 2.1, the difference degree of the time window is calculated to be 0.735.

[0096] Step 1034: when the difference degree exceeds the preset abnormality judgment threshold, it is determined that there is an abnormal behavior pattern triggered by the simulation attack in the corresponding time window.

[0097] In step 1034, the preset abnormality judgment threshold is an empirical value pre-calculated according to a large amount of normal file operation data or a critical value calibrated through experiments, which represents the boundary of "normal fluctuation" between the actual physical response and the expected theoretical response.

[0098] In the embodiment of the present application, finally, the difference degree is calculated and judged. The process is to compare the difference degree Score of each time window calculated in step 1033 with a pre-set abnormality judgment threshold T. If the Score of a certain time window is greater than the threshold T, it is determined that the actual physical movement of the storage device deviates from the reasonable expectation calculated based on the reference behavior information and the hardware model in this specific time window. This deviation is triggered by the simulated attack behavior being executed, so the behavior characteristics captured in this time window are marked as an abnormal behavior pattern. These identified abnormal behavior patterns will be used as key inputs to pass to the subsequent step for in-depth analysis.

[0099] In actual application, assuming that the pre-set abnormality judgment threshold T is 0.5 in the above example. The calculated difference degree Score of the first time window is 0.735, which is greater than the threshold 0.5. Therefore, it is determined that there is an abnormal behavior pattern triggered by the simulated attack in the first 5 ms time window after the simulation starts. The characteristic of this pattern is that there is a quantifiable deviation between the actual moving track and speed of the magnetic arm and the theoretical optimal path.

[0100] Through the above steps, the present application realizes fine physical layer comparison from theoretical expectation to actual monitoring, can effectively detect subtle abnormalities that may be hidden at the logic level but exposed in hardware physical movement, and accurately identifies the hidden behavior pattern triggered by advanced simulation attacks.

[0101] Step 104: dynamically reconstructing the behavior graph of the abnormal behavior pattern to establish a target behavior field model, and calculating the topological feature data and entropy change gradient through the target behavior field model.

[0102] In this embodiment, step 104 includes the following processes:

[0103] Step 1041: based on the abnormal behavior pattern, extracting the behavior subject, the operated object and the operation type as the behavior node, and based on the causal correlation between behaviors, establishing the correlation edge between the behavior nodes to generate a dynamic behavior graph.

[0104] In step 1041, the behavior subject refers to the process or thread identification that initiates the abnormal file operation; the operated object refers to the identification of the specific file or data block targeted by the abnormal operation; and the operation type refers to the specific action category of the abnormal operation, such as writing, reading or deleting; the three elements of behavior subject, operated object and operation type together constitute a behavior node.

[0105] The causal correlation refers to the relationship between different abnormal behaviors in terms of time sequence and logical dependence, for example, one behavior creates conditions for another behavior.

[0106] The dynamic behavior graph is a network structure graph composed of multiple behavior nodes and associated edges connecting the nodes, which can dynamically reflect the evolution process of abnormal behavior patterns.

[0107] In the embodiments of the present application, first, in order to systematically analyze discrete abnormal behavior patterns, dynamic behavior graph reconstruction needs to be performed; the specific implementation process is that from all the abnormal behavior patterns identified in step 103, the corresponding initiator, target and action when each pattern occurs are extracted; the three are combined to create a unique behavior node for each abnormal pattern; then, the timestamp sequence and logical relationship of the occurrence of these abnormal patterns are analyzed, and if it is found that the operation object of behavior node A is the premise of the operation object of behavior node B, or node B occurs immediately after node A and is directed at the same object, an associated edge from A to B is established between node A and node B, indicating potential causal effect; all nodes and edges are organized according to the time axis, thus generating a dynamic behavior graph that can visually display abnormal behavior propagation links.

[0108] In actual application, it is assumed that step 103 identifies two continuous abnormal behavior patterns: pattern one is "abnormal write of process 1234 to file F1" occurring at time T1, and pattern two is "abnormal read of process 1234 to file F1" occurring at time T2, and T2 is later than T1; the behavior subject "process 1234" and the operation object "file F1" are extracted, and the operation types are "abnormal write" and "abnormal read" respectively, thus generating two behavior nodes; since the object of pattern two is the same file that has just been operated on by pattern one, and the time is continuous, an associated edge from the "write" node to the "read" node is established between the two nodes, indicating the causal relationship of "write first and read later"; finally, a dynamic behavior graph containing two nodes and one edge is generated.

[0109] Step 1042: constructing a target behavior field model based on the dynamic behavior graph and in combination with a coupling mechanism.

[0110] Step 1042 can specifically include the following steps:

[0111] A1: based on the dynamic behavior graph, the dynamic behavior graph is expanded into an initial multi-dimensional behavior field model through a coupling mechanism.

[0112] In step A1, the coupling mechanism is a data processing method that fuses and calculates the local information of nodes and edges in the network structure graph with global network structure features and time evolution information.

[0113] The initial multi-dimensional behavior field model is a preliminary form of the target behavior field model, and the model adds new data dimensions on the basis of the dynamic behavior graph.

[0114] In the embodiments of the present application, the first step of constructing the target behavior field model through the coupling mechanism is to generate an initial multi-dimensional behavior field model. The specific processing process is to input the dynamic behavior graph generated in step 1041 into a field model construction module. The module first calculates an initial "field strength" value for each behavior node in the graph. The calculation of the value will comprehensively consider the degree centrality of the node and the inherent risk weight of the operation type represented by the node. At the same time, an initial "coupling strength" value is calculated for each associated edge. The calculation of the value will refer to the time interval of the two nodes connected by the edge and the correlation of the operation types. Then, the calculated node field strength value and edge coupling strength value are combined with the original attributes of the nodes and the time stamp information to form a data table containing multiple dimensions. This data table is the initial multi-dimensional behavior field model.

[0115] In actual application, for the aforementioned dynamic behavior graph containing two nodes, the degree centrality of the first node (abnormal write) is calculated as 1 (one out-edge), the risk weight of the "write" operation type is assigned as 0.9, and then the initial field strength of the node is calculated as 1 x 0.9 = 0.9. The degree centrality of the second node (abnormal read) is calculated as 1 (one in-edge), the risk weight of the "read" operation type is assigned as 0.6, and then the initial field strength of the node is calculated as 1 x 0.6 = 0.6. The coupling strength of the edge connecting the two nodes is calculated. Since the operation time interval T2-T1 is 10 milliseconds and the operation types are related (both are for file F1), the coupling strength is obtained as 0.8 through a preset mapping table. The final initial multi-dimensional behavior field model contains two data records. The first record is [node ID: 1, behavior subject: process 1234, object: F1, operation type: abnormal write, time stamp: T1, node field strength: 0.9, coupling edge: (1 to 2, strength 0.8)], and the second record is [node ID: 2, behavior subject: process 1234, object: F1, operation type: abnormal read, time stamp: T2, node field strength: 0.6, coupling edge: (1 to 2, strength 0.8)].

[0116] A2: optimizing the initial multi-dimensional behavior field model through a parameter optimization algorithm to obtain a target behavior field model.

[0117] In step A2, the target behavior field model is a multi-dimensional data model that not only contains the original node and edge information of the dynamic behavior graph, but also integrates the state intensity of each node, the propagation intensity of the influence between nodes, and the trend characteristics of the overall network structure over time through coupling calculation, thereby forming a multi-dimensional "field" that can more comprehensively describe the abnormal behavior state of the system.

[0118] In the embodiments of the present application, after obtaining the initial model, the initial model is optimized by a parameter optimization algorithm to obtain the final target behavior field model. The specific implementation manner is that the initial multi-dimensional behavior field model is input into an optimization iteration process. The process sets a target function, for example, requiring the total "energy" change of all nodes in the entire behavior field to remain smooth, or requiring the influence propagation between nodes to satisfy the distance attenuation principle. Then, an optimization method such as gradient descent is used to fine-tune the field strength value of each node and the coupling strength value of each edge in an iterative manner, so that the state of the entire field model satisfies or approximates the preset target function. After multiple iterations, when the change of the field model parameters is less than a minimum threshold, the optimization is stopped, and the stable and parameter-optimized model obtained at this time is the target behavior field model.

[0119] In actual application, taking the above example, the optimization target is set as "the field strength influence between nodes should decay with the increase of 'time distance'", where "time distance" is defined as the absolute value of the timestamp difference of two nodes. Using the gradient descent method for 5 rounds of iteration, the field strength of the first node is adjusted from 0.9 to 0.85, the field strength of the second node is adjusted from 0.6 to 0.65, and the coupling strength of the connecting edge is adjusted from 0.8 to 0.75. The final target behavior field model contains the optimized parameters: the field strength of node 1 is 0.85, the field strength of node 2 is 0.65, and the coupling strength of edge (1 to 2) is 0.75.

[0120] Step 1043: Calculate topological feature data based on the network structure of the target behavior field model.

[0121] In step 1043, the topological feature data is index data for quantitatively describing the network connection characteristics implied by the target behavior field model. These data do not focus on the specific attributes of the nodes, but focus on how the nodes are connected and the overall morphology formed by the connection, such as the connectivity density of the network, whether there are key hub nodes, etc.

[0122] In the embodiment of the present application, then, the topological feature data is calculated based on the optimized target behavior field model; the specific calculation process is that the node set and the edge set are extracted from the target behavior field model, and the attribute values such as field strength and coupling strength are ignored, and the node set and the edge set are abstracted into a pure network structure; then, a plurality of indexes in graph theory are applied to calculate and analyze the network structure; for example, the average path length of the entire graph is calculated, the length reflecting the average number of edges that need to be passed between any two nodes in the graph; the clustering coefficient of the graph is calculated, the coefficient reflecting the degree to which the nodes in the graph tend to gather together to form small groups; the betweenness centrality of each node is calculated, the centrality reflecting the importance of the node as a “bridge” in the network; the values of the calculated average path length, clustering coefficient, and betweenness centrality of each node are summarized to form a set of topological feature data.

[0123] In actual application, for the target behavior field model optimized to contain two nodes and one edge, the abstracted network structure contains two nodes and one directed edge; the average path length of the network is calculated, and since there is only one edge, the distance between any two points is 1, so the average path length is 1; the clustering coefficient of the network is calculated, and since no triangular closed structure is formed, the clustering coefficient is 0; the betweenness centrality of the two nodes is calculated respectively, and the betweenness centrality of node 1 and node 2 is 0 (because no other path needs to pass through them); finally, the topological feature data obtained is: the average path length is 1, the clustering coefficient is 0, the betweenness centrality of node 1 is 0, and the betweenness centrality of node 2 is 0.

[0124] Step 1044: based on the evolution sequence of the field strength distribution of the target behavior field model in a preset time window, the change rate of information entropy is calculated to obtain an entropy change gradient.

[0125] In step 1044, the preset time window is a fixed time length set for analyzing the dynamic change of the behavior field, for example, 1 second; the evolution sequence of the field strength distribution refers to the sequence of the distribution of the field strength values of all nodes in the target behavior field model changing over time in a plurality of consecutive preset time windows.

[0126] Information entropy is an information theory concept for measuring the uncertainty or degree of disorder of a probability distribution; in the present application, the field strength values of all nodes in each time window are normalized to be regarded as a probability distribution, and the information entropy is calculated; the entropy change gradient refers to the rate of change of the information entropy value over time windows.

[0127] In the embodiment of the present application, finally, the entropy change gradient is calculated to quantify the dynamic change of the behavior field state; the specific implementation process is that a time window length W is set, for example, 1 second; all node data in the time period with a length of W is sequentially intercepted from the target behavior field model according to the time stamp order; for each time window, the field strength values of all nodes in the window are normalized so that the sum is 1, thereby forming a field strength probability distribution; then, the information entropy value H of the distribution is calculated according to the information entropy formula; after the entropy values of all continuous time windows are calculated, an information entropy sequence H(t) varying with time is obtained; finally, the difference value between adjacent time windows of the entropy value sequence is calculated, that is, ΔH = H(t+1)-H(t), and the difference value sequence represents the rate of change of the behavior field chaos degree, that is, the entropy change gradient.

[0128] In actual application, it is assumed that the target behavior field model has data of three time windows within 3 seconds, and the normalized field strength distribution of nodes in each window is as follows: window 1 is [0.6, 0.4], window 2 is [0.5, 0.5], and window 3 is [0.9, 0.1]. According to the information entropy formula H = -∑(pi x log2(pi)), where pi is the probability of each element in the distribution, the information entropy is calculated. The information entropy H1 of window 1 is H1 = -(0.6 x log2(0.6) + 0.4 x log2(0.4)) ≈ 0.971; the information entropy H2 of window 2 is H2 = -(0.5 x log2(0.5) + 0.5 x log2(0.5)) = 1.000; and the information entropy H3 of window 3 is H3 = -(0.9 x log2(0.9) + 0.1 x log2(0.1)) ≈ 0.469. The entropy change gradient is calculated, and the entropy change from window 1 to window 2 is ΔH12 = H2-H1 ≈ 0.029, the entropy change from window 2 to window 3 is ΔH23 = H3-H2 ≈ -0.531, and thus the entropy change gradient sequence is [0.029, -0.531].

[0129] Through the above steps, the discrete abnormal behavior pattern is reconstructed into a behavior field model that can reflect the internal correlation and dynamic evolution thereof, and the topological feature describing the stability of the network structure and the entropy change gradient describing the degree of state change are extracted therefrom, thereby providing a deep and quantitative analysis basis for subsequent accurate evaluation of the protection capability of the system.

[0130] Step 105: combining the topological feature data and the entropy change gradient, an adaptive evaluation algorithm is used to evaluate the harmless protection capability of the protection system against ransomware in the target server environment.

[0131] In this embodiment, this step 105 includes the following flow as shown in Figure 2

[0132] ​Step 1051: Obtain the security alert events and interception records generated by the defense system during the simulation execution.

[0133] In step 1051, the security alert event refers to the log record automatically generated by the security software or hardware device deployed in the target server environment when detecting suspicious or malicious behavior, which includes information such as alert time, alert type, triggering process, and threat level.

[0134] The interception record refers to the confirmation information generated after the defense system successfully prevents a suspected malicious operation, which includes information such as the type of intercepted operation, target object, interception time, and action taken.

[0135] In the embodiments of the present application, first, in order to evaluate the actual response effect of the defense system, its operation log needs to be obtained; the specific implementation process is that, during the entire time period of simulating the execution of the benchmark behavior information, all security alert events and operation interception records related to the simulated attack process are collected in real time or periodically by calling the application program interface provided by the defense system or directly reading its security log database; these data will serve as direct evidence for subsequent judgment of whether the defense system responds effectively.

[0136] In actual application, assuming that the simulated attack is initiated by a process with process ID 1234, during the 10-second simulation execution, two related records are obtained by querying the security log of the defense system: one is a security alert event generated at time T1, with the content "Process 1234 performs suspicious encryption write on file F1, threat level: high"; the other is an interception record generated at time T2, with the content "Successfully blocked process 1234's delete operation on file F2".

[0137] Step 1052: Based on the topology feature data and the entropy change gradient, construct the behavior feature vector of this simulated attack.

[0138] In step 1052, the behavior feature vector is a data structure that combines multi-dimensional feature data into a one-dimensional array, which is used to comprehensively represent the overall characteristics of this simulated attack in the system behavior layer.

[0139] In the embodiments of the present application, secondly, in order to quantify the abnormality degree of the simulated attack, a comprehensive feature representation needs to be constructed; the specific method is to splice and combine the topology feature data calculated in step 1043 and the entropy change gradient sequence calculated in step 1044; for example, the average path length L and the clustering coefficient C are taken as the first two elements, and all elements of the entropy change gradient sequence [g1, g2, …] are arranged in sequence, to form a one-dimensional array, which is the behavior feature vector V of this simulated attack.

[0140] In practical applications, the embodiment results of the receiving step 104, the topology feature data includes an average path length 1, a clustering coefficient 0, a node 1 betweenness centrality 0, a node 2 betweenness centrality 0, and an entropy gradient sequence [0.029, -0.531]; these data are spliced in order to construct a behavior feature vector V as [1, 0, 0, 0, 0.029, -0.531].

[0141] Step 1053: analyzing the behavior feature vector by an adaptive evaluation algorithm to calculate an anomaly score of the current simulation attack.

[0142] In step 1053, the adaptive evaluation algorithm can specifically include the following steps:

[0143] B1: parsing a first sub-vector representing a network connection state and a second sub-vector representing a change rate of a chaos degree from the behavior feature vector.

[0144] In step B1, the first sub-vector is a subset composed of feature elements related to the network topology structure in the behavior feature vector, and the second sub-vector is a subset composed of feature elements related to the entropy gradient in the behavior feature vector.

[0145] In the embodiments of the present application, first, the first step of analyzing the behavior feature vector by the adaptive evaluation algorithm is feature parsing; the specific processing process is that the behavior feature vector V constructed in step 1052 is segmented according to a preset mapping rule; for example, the rule stipulates that the first N elements of the vector constitute the first sub-vector , which is used to represent the network connection state; and the remaining elements constitute the second sub-vector , which is used to represent the change rate of the system chaos degree.

[0146] In practical applications, according to the preset rule, the first four elements of the feature vector V are parsed as the first sub-vector =[1, 0, 0, 0], and the last two elements are parsed as the second sub-vector =[0.029, -0.531].

[0147] B2: calculating a first dynamic weight coefficient according to the node connection density and the path complexity of the first sub-vector, and calculating a second dynamic weight coefficient according to the change trend and the fluctuation intensity of the second sub-vector.

[0148] In step B2, the node connection density and the path complexity are specific feature values parsed from the first sub-vector, for example, the node connection density can be represented by the clustering coefficient, and the path complexity can be represented by the average path length.

[0149] The change trend and the fluctuation intensity are statistical quantities calculated from the second sub-vector, for example, the change trend can be the mean of the entropy gradient sequence, and the fluctuation intensity can be the variance of the sequence.

[0150] The first dynamic weight coefficient and the second dynamic weight coefficient are two weight values dynamically calculated according to the above-mentioned eigenvalues, and are used to reflect the relative importance of different types of features in the subsequent aggregation step.

[0151] In the embodiments of the present application, secondly, the weight coefficients are calculated by an adaptive evaluation algorithm; the specific calculation process is that, for the first sub-vector , the element representing the path complexity (such as the average path length L) and the element representing the connection density (such as the clustering coefficient C) are extracted; then, the two values are input into a preset first weight function (L, C), which outputs a first dynamic weight coefficient w1 between 0 and 1; for the second sub-vector , the mean μ of all elements is calculated to represent the change trend, and the variance of all elements is calculated to represent the fluctuation intensity; then, the mean and the variance are input into a preset second weight function , which outputs a second dynamic weight coefficient w2 between 0 and 1.

[0152] In actual application, for =[1, 0, 0, 0], the average path length L = 1 is taken as the path complexity, and the clustering coefficient C = 0 is taken as the connection density; the first weight function is set to w1 = 0.3 × L + 0.7 × (1-C), and the numerical calculation gives w1 = 0.3 × 1 + 0.7 × (1-0) = 1.0. For =[0.029, -0.531], the mean μ = (0.029 + (-0.531)) / 2 = -0.251 is calculated, and the variance The second weight function is set to , and the numerical calculation gives w2 = 0.5 × 0.251 + 0.5 × 0.0784 ≈ 0.1255 + 0.0392 = 0.1647.

[0153] B3: The first dynamic weight coefficient is used to perform weighted aggregation on the first sub-vector to obtain a first anomaly index, and the second dynamic weight coefficient is used to perform weighted aggregation on the second sub-vector to obtain a second anomaly index.

[0154] In step B3, the first abnormality index and the second abnormality index are two scalar values obtained by weighted aggregation of the first sub-vector and the second sub-vector respectively, which quantify the strength of network structure abnormality and state change abnormality respectively.

[0155] In the embodiment of the present application, then, the abnormality index is calculated by the adaptive evaluation algorithm; the specific implementation is that the first sub-vector is weighted aggregated; the common aggregation method is to perform weighted summation on the absolute values of all elements in the vector, and the weight is the first dynamic weight coefficient w1 of the vector, and the calculation formula is =w1×Σ|Vtopo_i|, wherein Vtopo_i is the i-th element of the first sub-vector, and the summation obtains the first abnormality index ; the second sub-vector is weighted aggregated, and the similar formula is used =w2×Σ|Ventropy_i|, and the summation obtains the second abnormality index .

[0156] In actual application, for =[1, 0, 0, 0], the sum of the absolute values of the elements is 1+0+0+0=1, the first dynamic weight coefficient w1=1.0, and thus the first abnormality index =1.0×1=1.0. For =[0.029, -0.531], the sum of the absolute values of the elements is 0.029+0.531=0.56, the second dynamic weight coefficient w2≈0.1647, and thus the second abnormality index =0.1647×0.56≈0.0922.

[0157] B4: The first abnormality index and the second abnormality index are fused to obtain an abnormality score.

[0158] In the embodiment of the present application, finally, the final abnormality score is calculated by the adaptive evaluation algorithm; the specific processing process is that the first abnormality index and the second abnormality index calculated are input into a fusion function ; the function can be a simple weighted summation, for example, Score=α× +β× , wherein α and β are preset fusion coefficients, and α+β=1 generally; the Score value calculated by the function is the abnormality score of the current simulation attack.

[0159] In actual application, the fusion coefficients are set as α=0.6 and β=0.4, the first abnormality index =1.0, and the second abnormality index ≈0.0922; according to the fusion formula Score=0.6x1.0+0.4x0.0922, the abnormal score Score of this simulation attack is calculated as ≈0.6+0.03688=0.63688.

[0160] Step 1054: According to the security alarm event and the interception record, it is judged whether the protection system responds to this simulation attack, and the response information is extracted.

[0161] In step 1054, the response information is several key indicators for quantitatively evaluating the response effect of the protection system, which are extracted from the security alarm event and the interception record, such as whether the response occurs, the delay time of the response, and the accuracy of the response.

[0162] In the embodiments of the present application, then, the actual response of the protection system needs to be analyzed; the specific implementation process is to associate and compare all the security alarm events and the interception records obtained in step 1051 with the occurrence time and the operation object of the abnormal behavior pattern identified in step 103; if it is found that after the occurrence of a certain abnormal behavior pattern, within the preset time tolerance, there is an alarm or interception record for the same process or the same operation object, it is determined that the protection system responds to the abnormal behavior pattern; the information of all successful responses is extracted, including the number of responses, the delay time of the first response, and the accuracy of the alarm or interception.

[0163] In actual application, two abnormal behavior patterns are identified in step 103, which occur at T1 and T2 respectively; one "suspicious encryption write" alarm at T1 and one "block deletion operation" interception record at T2 are obtained in step 1051; after comparison, the alarm at T1 and the first abnormal pattern match in time and object, and the interception record at T2 matches the second abnormal pattern; therefore, it is determined that the protection system responds to both abnormalities; the response information extracted includes: the number of responses is 2 times, the delay of the first response is 0, and the response accuracy is high.

[0164] Step 1055: According to the abnormal score and the response information of the protection system, the harmless protection level of the protection system is determined according to the preset evaluation matrix.

[0165] In step 1055, the preset evaluation matrix is a two-dimensional or multi-dimensional lookup table, the horizontal dimension of the table can be the segmented interval of the abnormal score (such as low, medium and high), the vertical dimension can be the response effect rating (such as no response, partial response and complete response), and the corresponding protection level (such as level one, level two and level three) is predefined in each cell.

[0166] In the embodiment of the present application, finally, the abnormality degree of the comprehensive attack and the response effect of the protection are combined to determine the final protection level; the specific evaluation process is that the abnormal score Score calculated in step 1053 is mapped to the horizontal axis dimension of the evaluation matrix, for example, if Score is greater than 0.7, it is "high threat", between 0.3 and 0.7, it is "medium threat", and less than 0.3, it is "low threat"; at the same time, the response information extracted in step 1054 is comprehensively evaluated as a response effect rating, for example, "complete response" or "partial response"; then, according to the two coordinates of the abnormal score and the response effect rating, the preset evaluation matrix is searched, and the corresponding cell is found, and the level indicated in the cell is the harmless protection level of the protection system obtained by this evaluation.

[0167] In actual application, the abnormal score Score calculated is about 0.637, which is mapped to "medium threat" according to the rule; it is known from the response information that both of the two abnormalities are responded, and the delay is low, so the response effect rating is "complete response"; the preset evaluation matrix is queried, and the protection level defined in the cell intersected by the "medium threat" row and the "complete response" column is "level two"; therefore, it is determined that the harmless protection level of the protection system under the current simulated attack is level two.

[0168] The present application combines the technical concealment of the simulated attack itself with the real-time response effect of the protection system through the above steps, obtains a comprehensive protection ability level through matrix evaluation, so that the verification result is more objective and comprehensive, and the actual ability of the protection system to cope with advanced ransomware can be accurately reflected.

[0169] Figure 3 The structure diagram of a harmless protection ability verification system based on ransomware behavior simulation provided in the embodiment of the present application is shown in Figure 3 The specific implementation part describes:

[0170] The generating module 31 is configured to generate reference behavior information for simulating the behavior of ransomware based on the attack behavior characteristics of ransomware.

[0171] The simulation module 32 is configured to simulate the operation defined by the reference behavior information in the target server environment, and monitor the actual physical layer behavior information of the storage device during the simulation process.

[0172] The comparison module 33 is configured to use a comparison mechanism to perform spatiotemporal consistency comparison between the actual physical layer behavior information and the expected physical layer behavior information corresponding to the reference behavior information, so as to identify the abnormal behavior pattern triggered by the simulated attack.

[0173] The reconstruction module 34 is configured to perform dynamic behavior graph reconstruction on the abnormal behavior pattern to establish a target behavior field model, and to calculate topology feature data and entropy change gradient based on the target behavior field model.

[0174] The evaluation module 35 is configured to combine the topology feature data and the entropy change gradient, and to evaluate the harmless protection capability of the protection system in the target server environment against the ransomware by using an adaptive evaluation algorithm.

[0175] The ransomware behavior simulation-based harmless protection capability verification system according to the embodiments of the present application is used to implement the aforementioned ransomware behavior simulation-based harmless protection capability verification method, and therefore the specific embodiments of the ransomware behavior simulation-based harmless protection capability verification system can refer to the aforementioned embodiments of the ransomware behavior simulation-based harmless protection capability verification method, and the specific embodiments can refer to the descriptions of the respective embodiments, which will not be repeated here.

[0176] The present application further provides an electronic device, which comprises a memory configured to store a computer program, and a processor configured to execute the computer program to implement the steps of the ransomware behavior simulation-based harmless protection capability verification method.

[0177] The present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the ransomware behavior simulation-based harmless protection capability verification method.

[0178] In an exemplary embodiment, the aforementioned computer readable storage medium can include, but is not limited to, a U disk, a read-only memory, a random access memory, a mobile hard disk, a magnetic disk or an optical disk, and various media that can store computer programs.

[0179] The embodiments of the present application further provide a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement the steps of the aforementioned ransomware behavior simulation-based harmless protection capability verification method.

[0180] Those skilled in the art will further realize that the mere concepts, teachings, and embodiments described herein are merely meant to provide an enabling description of the claimed application. Accordingly, modifications and / or additions, other than those explicitly described herein, can be obvious to those skilled in the art in the light of this disclosure. The claimed application is intended to embrace all such modifications and / or additions.

[0181] The above provides a ransomware behavior simulation-based harmless protection capability verification method and system. The principles and implementation modes of the present application are described by applying specific examples in this paper. The above description of the embodiments is only used to help understand the method of the present application and its core idea. It should be pointed out that for those skilled in the art, some improvements and modifications can be made without departing from the principles of the present application, and these improvements and modifications also fall within the protection scope of the present application.

Claims

1. A method for verifying harmless protection capabilities based on ransomware behavior simulation, characterized in that, include: Based on the attack behavior characteristics of ransomware, baseline behavioral information is generated to simulate ransomware behavior; In the target server environment, the operations defined by the baseline behavior information are simulated and executed. During the simulation, the actual physical layer behavior information of the storage device is monitored. The actual physical layer behavior information refers to the raw signal data directly related to the physical motion of the hardware generated by the storage device when responding to these simulated operations. The actual physical layer behavior information includes hard disk execution arm displacement trajectory data and seek acoustic vibration data captured by dedicated sensors. The hard disk execution arm displacement trajectory data records the micron-level precise path point sequence of the read / write head assembly on the disk platter when reading and writing data, while the seek acoustic vibration data captures the vibration waveform of a specific frequency generated by the motor and bearing during the mechanical seek process. By using a comparison mechanism, the actual physical layer behavior information is spatiotemporally compared with the expected physical layer behavior information corresponding to the baseline behavior information in order to identify abnormal behavior patterns triggered by simulated attacks. The abnormal behavior pattern is dynamically reconstructed to establish a target behavior field model. The topological feature data and entropy gradient are calculated through the target behavior field model. Combining the topological feature data and the entropy gradient, an adaptive evaluation algorithm is used to assess the ability of the protection system in the target server environment to protect against ransomware.

2. The method according to claim 1, characterized in that, The process of combining the topological feature data and the entropy gradient, and employing an adaptive evaluation algorithm to assess the harmless protection capability of the protection system in the target server environment against ransomware, includes: Acquire security alert events and interception records generated by the protection system during simulation execution; Based on the topological feature data and the entropy gradient, construct the behavioral feature vector of this simulated attack; An adaptive evaluation algorithm is used to analyze the behavioral feature vector and calculate the anomaly score for this simulated attack. Based on the security alert events and interception records, determine whether the protection system responded to this simulated attack and extract the response information; By combining the anomaly score with the response information of the protection system, and according to a preset evaluation matrix, the harmlessness protection level of the protection system is determined.

3. The method according to claim 2, characterized in that, The step of analyzing the behavioral feature vector using an adaptive evaluation algorithm and calculating the anomaly score for this simulated attack includes: From the behavioral feature vector, a first sub-vector representing the network connection state and a second sub-vector representing the rate of change of disorder are extracted; The first dynamic weight coefficient is calculated based on the node connection density and path complexity of the first sub-vector, and the second dynamic weight coefficient is calculated based on the changing trend and fluctuation intensity of the second sub-vector. The first sub-vector is weighted and aggregated using the first dynamic weight coefficient to obtain the first anomaly index, and the second sub-vector is weighted and aggregated using the second dynamic weight coefficient to obtain the second anomaly index. The first anomaly index and the second anomaly index are combined to obtain an anomaly score.

4. The method according to claim 1, characterized in that, The step of dynamically reconstructing the abnormal behavior pattern to establish a target behavior field model, and calculating topological feature data and entropy gradient through the target behavior field model, includes: Based on the abnormal behavior pattern, the behavior subject, the manipulated object, and the operation type are extracted as behavior nodes, and based on the causal relationship between behaviors, the association edges between behavior nodes are established to generate a dynamic behavior graph. Based on the dynamic behavior graph, a target behavior field model is constructed using a coupling mechanism; Based on the network structure of the target behavior field model, calculate the topological feature data; Based on the evolution sequence of the field strength distribution of the target behavior field model within a preset time window, the rate of change of information entropy is calculated to obtain the entropy gradient.

5. The method according to claim 4, characterized in that, The construction of the target behavior field model based on the dynamic behavior graph and combined with the coupling mechanism includes: Based on the dynamic behavior graph, the dynamic behavior graph is extended into an initial multidimensional behavior field model through a coupling mechanism; The initial multidimensional behavior field model is optimized using a parameter optimization algorithm to obtain the target behavior field model.

6. The method according to claim 1, characterized in that, The benchmark behavioral information generated based on the attack behavior characteristics of ransomware to simulate ransomware behavior includes: Extract seed features from a pre-defined database of ransomware behavior characteristics; Based on the seed features and combined with the environmental configuration information of the simulated execution target, a standardized behavior sequence is generated by a sequence generator; A random perturbation factor and a mutation operator are introduced to transform the standardized behavior sequence to generate an attack instruction sequence as baseline behavior information.

7. The method according to claim 1, characterized in that, The method of using a comparison mechanism to perform a spatiotemporal consistency comparison between the actual physical layer behavior information and the expected physical layer behavior information corresponding to the baseline behavior information, in order to identify abnormal behavior patterns triggered by simulated attacks, includes: Based on the baseline behavior information and the hardware performance model of the storage device, corresponding expected physical layer behavior information is generated. The expected physical layer behavior information and the actual physical layer behavior information are respectively converted into a first spatiotemporal trajectory sequence and a second spatiotemporal trajectory sequence with the same time reference and physical coordinate reference. Calculate the difference in physical characteristic parameters between the first spatiotemporal trajectory sequence and the second spatiotemporal trajectory sequence within the same time window; When the difference exceeds the preset anomaly determination threshold, it is determined that there is an abnormal behavior pattern triggered by a simulated attack within the corresponding time window.

8. A system for verifying harmless protection capabilities based on ransomware behavior simulation, characterized in that, include: The generation module is used to generate baseline behavioral information to simulate ransomware behavior based on the attack behavior characteristics of ransomware. The simulation module is used to simulate the operation defined by the baseline behavior information in the target server environment, and to monitor the actual physical layer behavior information of the storage device during the simulation. The actual physical layer behavior information refers to the raw signal data directly related to the physical movement of the hardware generated by the storage device when responding to these simulated operations. The actual physical layer behavior information includes hard disk execution arm displacement trajectory data and seek acoustic vibration data captured by dedicated sensors. The hard disk execution arm displacement trajectory data records the micron-level precise path point sequence of the read / write head assembly moving on the disk platter when reading and writing data, while the seek acoustic vibration data captures the vibration waveform of a specific frequency generated by the motor and bearing during the mechanical seek process. The comparison module is used to perform a spatiotemporal consistency comparison between the actual physical layer behavior information and the expected physical layer behavior information corresponding to the baseline behavior information, so as to identify abnormal behavior patterns triggered by simulated attacks. The reconstruction module is used to dynamically reconstruct the abnormal behavior pattern to establish a target behavior field model, and to calculate the topological feature data and entropy gradient through the target behavior field model. The evaluation module is used to combine the topological feature data and the entropy gradient, and employ an adaptive evaluation algorithm to evaluate the ability of the protection system in the target server environment to protect against ransomware.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the method for verifying harmless protection capabilities based on ransomware behavior simulation as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the implementation of the method for verifying harmless protection capabilities based on ransomware behavior simulation as described in any one of claims 1 to 7.

Images