Terminal security detection method based on multi-modal features, electronic equipment and medium

Abstract

The invention discloses a terminal security detection method based on multi-mode characteristics, electronic equipment and a medium, the method comprises the following steps: collecting system state characteristics and real-time behavior state characteristics of a terminal, the real-time behavior state characteristics comprising user operation behaviors and application program behaviors; performing weighted fusion on the system state features and the real-time behavior state features to obtain fused features; the terminal type features and the fused features are input into an improved deep belief network for training, an intelligent detection model is obtained, the intelligent detection model outputs terminal safety data, and the terminal safety data comprise normal data and abnormal data. According to the method, the fused features are constructed based on the real-time behavior state features, the terminal type features are fused into the improved deep belief network to obtain the intelligent detection model, sample updating and model updating are performed on the intelligent detection model, the method can adapt to different terminals, and the security detection accuracy can be improved.

Description

Technical Field

[0001] This invention belongs to the field of terminal security detection technology, specifically relating to terminal security detection methods, electronic devices, and media based on multimodal features. Background Technology

[0002] Terminal security testing has become a key link in ensuring the security of information systems.

[0003] In related technologies, endpoint detection technology has several shortcomings: First, feature extraction is limited; most methods rely solely on single-modal data such as system configuration logs, making it difficult to comprehensively capture security vulnerabilities and resulting in a high false negative rate. It also struggles to identify some new attack methods. Second, detection adaptability is poor; endpoint characteristics vary significantly across different operating systems and hardware architectures (such as x86 and ARM), making it difficult for existing detection methods to accommodate all. This necessitates configuring detection rules separately for different endpoints, leading to cumbersome operations. Third, real-time performance is insufficient; traditional detection methods are mostly offline analysis or periodic scanning, unable to perceive changes in endpoint security status in real time, making it difficult to respond promptly when endpoints are under real-time attacks. Fourth, the false positive rate is high; the ability to distinguish between normal operations and malicious behavior is weak, often misjudging normal system configuration adjustments as security threats. Therefore, developing an intelligent detection method that integrates multimodal features, adapts to different endpoints, and is real-time and accurate has become an urgent need for endpoint security assurance. Summary of the Invention

[0004] The purpose of this invention is to obtain an intelligent detection model by constructing fused features based on real-time behavioral features, integrating terminal type features into an improved deep belief network, and updating the intelligent detection model with samples and the model itself. This achieves a terminal security detection method based on multimodal features that can adapt to different terminals and improve detection accuracy.

[0005] To achieve the above objectives, this invention proposes a terminal security detection method based on multimodal features, comprising: collecting system-state features and real-time behavioral features of the terminal, wherein the system-state features include system configuration information, system logs, and hardware information, and the real-time behavioral features include user operation behavior and application behavior; performing weighted fusion of the system-state features and the real-time behavioral features to obtain fused features; inputting terminal type features and the fused features into an improved deep belief network for training to obtain an intelligent detection model, and outputting terminal security data, wherein the terminal security data includes normal and abnormal, and the abnormal includes malicious program attacks, unauthorized access, configuration anomalies, virus infection, and unknown threats.

[0006] In one optional implementation, the system-state features and the real-time behavioral features are weighted and fused to obtain fused features. Specifically, this includes: aligning the system-state features and the real-time behavioral features through time alignment and granularity unification to obtain aligned features; encoding the aligned features to obtain system-state feature vectors and behavioral feature vectors; and weighting and fusing the system-state feature vectors and behavioral feature vectors according to attention weights to obtain the fused features.

[0007] In an optional implementation, the terminal security detection method based on multimodal features further includes: adding a multimodal feature consistency loss during the training of the intelligent detection model; and / or adding a product term of the system-state feature vector and the behavior-state feature vector when weighted and fused the system-state features and the real-time behavior-state features, to obtain the optimized fused feature F: F=α×S+(1-α)×B+γ×(S⊙B); where α is the system-state feature weight; S is the system-state feature vector; (1-α) is the real-time behavior-state feature weight; B is the behavior-state feature vector; ⊙ is the element-wise product; and γ is the interaction term weight.

[0008] In one optional implementation, the terminal type features and the fused features are input into an improved deep belief network for training to obtain an intelligent detection model, and terminal security data is output. Specifically, this includes: inputting the fused features into the improved deep belief network for training to obtain an initial model; inputting the terminal type features into the initial model to obtain the intelligent detection model; and outputting terminal security data based on the intelligent detection model.

[0009] In one optional implementation, the fused features are input into an improved deep belief network for training to obtain an initial model. Specifically, this includes: assigning higher weights to key dimensions in the fused features based on the improved deep belief network to obtain modified features; and extracting high-order threat features layer by layer from the modified features through multi-layer nonlinear transformations to obtain the initial model.

[0010] In one optional implementation, the terminal type features are input into the initial model to obtain the intelligent detection model, specifically including: the initial model generating a terminal type vector based on the terminal type features and hardware architecture encoding; concatenating the terminal type vector with the fused features to obtain a concatenated feature vector; dynamically constructing an anomaly judgment dynamic correction threshold according to the application scenario and the terminal type vector, the expression of the anomaly judgment dynamic correction threshold threshold is: threshold = base_threshold + α × f(T) + β × g(S); where base_threshold is the base threshold, base_threshold = 0.7; f(T) is the terminal type correction term; g(S) is the scenario correction term; α = 0.5; β = 0.5; the intelligent detection model is obtained based on the concatenated feature vector, the concatenated feature vector and the initial model.

[0011] In an optional implementation, the terminal security detection method based on multimodal features further includes: if the output terminal security data includes anomalies, then performing anomaly tracing analysis, specifically including: identifying the original features that have the greatest impact on anomaly determination through feature contribution analysis; reconstructing the threat path triggered by the anomaly by combining the time series of the original features; and generating targeted suggestions based on terminal characteristics and the threat path.

[0012] In one optional implementation, sample and model updates based on the intelligent detection model specifically include: automatically collecting features of scene data at fixed intervals as basic samples, the scene data including daily terminal operation data and detection anomaly data; if a triggering event occurs, targeted collection is initiated to obtain corrected samples, the triggering events including terminal environment change events, known threat events, and false alarm events; classifying and storing the basic samples and corrected samples according to terminal type, scene, and time order to obtain stored data; labeling the stored data to obtain labeled data, the labeled data including normal candidate sample data and abnormal candidate sample data; generating a sample library based on the labeled data to complete sample updates; updating the update rules of the intelligent detection model to obtain updated rules; adjusting the parameters of the intelligent detection model based on the updated rules to obtain a parameter-adjusted intelligent detection model; and verifying the parameter-adjusted intelligent detection model to complete model updates.

[0013] The present invention also proposes an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the multimodal feature-based terminal security detection methods described herein.

[0014] The present invention also proposes a medium storing a computer program, which, when executed by a processor, implements any of the terminal security detection methods based on multimodal features as described in the present invention.

[0015] The beneficial effects of this invention are as follows: by fusing dual-modal features, the system state and behavioral state features of the terminal are fully captured, which effectively improves the comprehensiveness of security threat detection and reduces missed detections; by leveraging the terminal adaptive mechanism, it adapts to the characteristics of different operating systems and hardware architectures, reduces the false alarm rate, improves the efficiency of security incident handling, and overall meets the security detection needs of the terminal in key areas. Attached Figure Description

[0016] Figure 1 A flowchart illustrating a terminal security detection method based on multimodal features provided in an embodiment of the present invention;

[0017] Figure 2 A flowchart of a terminal security detection method based on multimodal features provided in another embodiment of the present invention;

[0018] Figure 3 This is a diagram showing the composition of the program modules within an electronic device for the terminal security detection method based on multimodal features provided in an embodiment of the present invention. Detailed Implementation

[0019] This invention proposes a terminal intelligent detection method based on dual-modal feature fusion to solve the problems of high false negative rate, poor detection adaptability, insufficient real-time performance, and high false alarm rate caused by single feature extraction in the existing technology. It achieves the technical goal of "comprehensive perception, accurate identification, real-time response, and wide adaptability" for terminal security.

[0020] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0021] like Figure 1 As shown, according to an embodiment of the present invention, in one aspect, a terminal security detection method based on multimodal features is provided, comprising the following steps:

[0022] Step S101: Collect the system state characteristics and real-time behavioral characteristics of the terminal. The system state characteristics include system configuration information, system logs and hardware information. The real-time behavioral characteristics include user operation behavior and application behavior.

[0023] Step S103: Perform weighted fusion of system state features and real-time behavioral state features to obtain fused features.

[0024] Step S105: Input the terminal type features and the fused features into the improved deep belief network for training to obtain an intelligent detection model and output terminal security data. The terminal security data includes normal and abnormal data. Abnormal data includes malicious program attacks, unauthorized access, configuration anomalies, virus infection, and unknown threats.

[0025] In this embodiment, a connection can be established with the terminal operating system kernel interface to collect system configuration information, system logs, and hardware information according to a preset collection period and triggering conditions. The collected system state characteristic data is then stored in a local cache. For example, port open status is collected every 5 minutes, and relevant system logs are collected immediately when a user privilege escalation event is detected. A lightweight monitoring program deployed on the terminal can be launched to collect user operation behavior and application behavior in real time, which is also stored in a local cache. For example, the number of keystrokes per minute and the number of network connections per hour for applications can be recorded.

[0026] By collecting terminal system state characteristics (system configuration information, system logs, hardware information) and real-time behavioral characteristics (user operation behavior, application behavior), data is obtained from two dimensions: static system state and dynamic behavior. Compared with single feature detection methods, this method can more comprehensively and meticulously depict the terminal's operating status, effectively avoiding the problem of missed or misjudged security threats due to insufficient detection dimensions, and significantly improving the accuracy and comprehensiveness of detection.

[0027] By weighted fusion of system-state features and real-time behavioral features, the advantages of different feature types are fully integrated, resulting in fused features containing richer and more discriminative information. This provides high-quality input data for subsequent intelligent detection and enhances the model's ability to distinguish between normal and abnormal states, as well as different types of anomalies (malicious attacks, unauthorized access, etc.). Through the organic fusion of system-state features and real-time behavioral features, a more comprehensive and discriminative feature representation is formed, providing high-quality input for subsequent intelligent detection.

[0028] Considering the inherent differences in security characteristics among different terminals (such as Kylin / Tongxin operating systems and x86 / ARM architectures) (e.g., the low-power characteristics of ARM terminals may be misjudged as abnormal), terminal type features and fused features are input into an improved deep belief network for training, resulting in an intelligent detection model. Given these inherent differences in security characteristics among different terminals (such as different operating systems and hardware architectures), inputting both terminal type features and fused features into the improved deep belief network allows the intelligent detection model to learn the unique security feature patterns of different terminal types. This enables dynamic adaptive detection, effectively avoiding misjudgments caused by differences in terminal characteristics and improving the applicability and accuracy of the detection method in diverse terminal environments.

[0029] The terminal security detection method based on multimodal features also includes the following steps:

[0030] Step S107: Update samples and model based on the intelligent detection model.

[0031] Through a dynamic update mechanism involving sample and model updates, the system can quickly respond to changes in new threats and systems, enabling the detection method to continuously adapt to the evolving endpoint security environment. This avoids detection capability failure due to factors such as updates to security threat characteristics or the launch of new systems, ensuring the long-term effectiveness and practicality of the detection method and providing durable and reliable protection for endpoint security.

[0032] Further, step S103 involves weighted fusion of the system state features and real-time behavioral state features to obtain the fused features, specifically including the following steps:

[0033] Step S1031: Align system state features and real-time behavioral state features by time alignment and granularity unification to obtain aligned features.

[0034] Step S1033: Encode the alignment features to obtain the system-state feature vector and the behavioral-state feature vector. Step S1035: Weight and fuse the system-state feature vector and the behavioral-state feature vector according to attention weights to obtain the fused features.

[0035] In this embodiment, the process of obtaining the fused features is achieved through two key steps: feature alignment and bimodal fusion.

[0036] (1) Feature alignment: Solve the problem of inconsistent "time-granularity" of bimodal features.

[0037] There are inherent differences in the collection logic between system-level features (such as port status and permission configuration) and behavioral features (such as user operation trajectories and program call frequency): system-level features are mostly collected periodically (e.g., every 5 minutes) or event-triggered (e.g., when permissions change), with a coarser granularity; behavioral features are collected continuously in real time, with a finer granularity. Direct fusion would fail due to time asynchrony and data volume mismatch. Therefore, feature alignment must first be achieved through time alignment and granularity unification.

[0038] 1) Time alignment:

[0039] Based on the acquisition time of system state characteristics, behavioral state characteristics are mapped onto the same time axis.

[0040] Let the acquisition time points of the system state characteristics be T = {t1, t2, ..., t}. n (e.g., t1 = 09:00, t2 = 09:05, 5-minute interval);

[0041] The behavioral features are collected over a continuous time series t'∈[t k ,t k+1 (k = 1, 2, ..., n-1), it is necessary to [t] k ,t k+1 The time point t at which the behavioral characteristics within a system are correlated with the systemic characteristics. k+1 .

[0042] 2) Granularity unification: Aggregate the time-aligned behavioral features to make them consistent with the granularity of the system features.

[0043] The aggregation method is selected based on the feature type:

[0044] Numerical features (such as keystrokes per minute): aggregated using "mean / maximum value within the time window", as shown in the following formula:

[0045]

[0046] in, Let B be the aggregated value of the m-th behavioral feature within the k-th time window, where N is the number of times the behavioral feature was collected within that window. k,m,i This represents the original value from the i-th data collection.

[0047] Category-based features (such as accessed file paths): The "frequency statistics" aggregation is used to record the number of times each category appears in the window (such as "accessing the sensitive directory / usr / bin" appearing 3 times in 5 minutes).

[0048] Through the above steps, systemic features and behavioral features are unified into a "time point-feature value" aligned structure, effectively resolving the differences between the two types of features in terms of time dimension and data granularity. This ensures that feature data from different sources maintains consistency in timestamps and data granularity, avoiding feature information confusion caused by time misalignment or inconsistent granularity. It provides a standardized and structured data foundation for subsequent feature fusion and model training, significantly improving the standardization and accuracy of data processing.

[0049] (2) Bimodal fusion: weighted fusion based on attention mechanism.

[0050] Building upon feature alignment, an attention mechanism is employed to achieve bimodal fusion. The core of this mechanism is the dynamic calculation of the weights of systemic and behavioral features—the importance of the two modalities differs depending on the type of security threat being detected (e.g., systemic features are more important for detecting "unauthorized permission changes," while behavioral features are more important for detecting "abnormal file theft"), and the weights need to be adaptively adjusted. The specific steps are as follows:

[0051] 1) Feature encoding: Converting aligned features into vector representations. Feature encoding includes system-state feature encoding and behavioral-state feature encoding.

[0052] System-state features include numerical (e.g., memory usage), Boolean (e.g., port openness), and categorical (e.g., operating system type), which need to be uniformly encoded into system-state feature vectors. (d s (as a system state characteristic dimension):

[0053] Numerical features: directly standardized and used as vector elements;

[0054] Boolean characteristic: Convert to 0 / 1 value;

[0055] Category-type features: One-hot encoding is used (e.g., "Kylin Operating System" is encoded as [1,0], and "Tongxin Operating System" is encoded as [0,1]).

[0056] Behavioral features exist in the form of sequences or statistical values, and are encoded into behavioral feature vectors through a fully connected network. (d b (Behavioral feature dimension):

[0057] B = σ(W) b ·B agg +b b );

[0058] Among them, B agg W represents the behavioral characteristics after granularity unification. b Let b be the weight matrix. bσ is the bias term, and σ is the activation function (such as ReLU).

[0059] The aligned features are encoded to generate system-state feature vectors and behavioral-state feature vectors, transforming the original complex, multi-source heterogeneous data into a vector form that can be efficiently processed by computers. This data structure transformation not only facilitates subsequent deep belief network operations but also allows for the discovery of potential relationships within the feature data through the encoding process, enhancing the data's representational capabilities and improving the model's efficiency in extracting and utilizing feature information.

[0060] 2) Attention weight calculation: Dynamically allocate bimodal weights.

[0061] The weights α of the system state features (the weights of the behavioral state features are 1-α) are calculated using an attention mechanism, as shown in the following formula:

[0062] α = softmax(W) a ×[S;B]+b a );

[0063] Where [S; B] is the concatenated vector of system state and behavioral state features, W a and b a For the attention network parameters, the softmax function ensures that α∈[0,1].

[0064] Physical meaning: The larger α is, the greater the contribution of the system's state characteristics to the current detection task. For example:

[0065] When "abnormal port opening" is detected, the weight α of the system state feature (port state) approaches 1;

[0066] When detecting “abnormal user login (IP from a different location + high frequency of failures)”, the weight 1-α of the behavioral features (login IP, number of failures) approaches 1.

[0067] Attention weights are used to weight and fuse system-state feature vectors and behavioral-state feature vectors, simulating the human attention mechanism for key information. This allows for dynamic weight allocation based on the importance of different features to terminal security detection. During the fusion process, the model focuses on features that play a crucial role in security detection, weakening the interference of secondary information. This results in more representative and discriminative fused features, further improving the model's accuracy and sensitivity in identifying terminal security threats.

[0068] 3) Feature fusion: Weighted generation of the final feature vector

[0069] The system-state feature vector S and the behavioral-state feature vector B are weighted and fused according to attention weights to obtain the final fused features. (d=d s =d b(Through unified processing via feature dimensions):

[0070] F = α × S + (1 - α) × B;

[0071] The fused feature F retains both the static features of the system configuration and the dynamic features of the behavioral pattern, and the weights are adaptively adjusted according to the detection scenario, thus solving the problem of "information one-sidedness" of single-modal features.

[0072] A complete and rigorous feature fusion system was constructed, encompassing a multi-step fusion process from feature alignment and encoding to attention weighting. Each step works closely together and progresses progressively, systematically improving the quality of feature fusion. This enables the fused features to more accurately and comprehensively reflect the security status of the terminal, providing higher-quality input for intelligent detection models and ultimately enhancing the performance and reliability of the entire terminal security detection method.

[0073] To further enhance the discriminative power of fused features, it is necessary to strengthen the complementarity of bimodal features.

[0074] Furthermore, the terminal security detection method based on multimodal features also includes the following steps:

[0075] Step S201: Add multimodal feature consistency loss during the training of the intelligent detection model; and / or

[0076] Step S203: When weighting and fusing the system-state features and real-time behavioral features, add a product term of the system-state feature vector and the behavioral feature vector to obtain the optimized fused feature F:

[0077] F=α×S+(1-α)×B+γ×(S⊙B);

[0078] In the formula, α is the system state feature weight; S is the system state feature vector; (1-α) is the real-time behavioral state feature weight; B is the behavioral state feature vector; ⊙ is the element-wise product; and γ is the interaction term weight.

[0079] This involves enhancing the complementarity of features by introducing feature interaction terms: During fusion, a product term of S and B is added to capture the correlation between the two modalities (e.g., the risk association of "high-privilege user + frequent access to sensitive files"). When weighting and fusing system-state features and real-time behavioral features, a product term of the system-state feature vector and the behavioral feature vector is added, effectively capturing the interaction and complementary information between the two modalities. System-state features reflect more of the terminal's static configuration and other basic security attributes, while behavioral features focus on dynamic behavior. Their product term can uncover more discriminative fusion information that cannot be obtained through simple weighted summation, further enhancing the ability of the fused features to distinguish between normal and abnormal terminal states and different types of anomalies (e.g., malicious program attacks, unauthorized access), making the fused features more accurately depict the terminal's security posture.

[0080] Modality consistency constraint: Incorporating "bimodal feature consistency loss" during model training ensures that the fused features retain the core information of each modality while avoiding redundancy. For example, when the system-state feature indicates "Port 22 (SSH) is open," the behavioral-state feature should correspond to "SSH connection behavior exists." If the deviation is too large, the loss value is increased. Adding multimodal feature consistency loss during intelligent detection model training encourages the model to maintain consistency in the semantic information expressed by the system-state features and real-time behavioral-state features during the learning process. This ensures that the features of the two modalities corroborate and coordinate with each other in describing the terminal security status, reducing the decrease in the discriminative power of the fused features due to semantic deviations between modalities, thereby improving the accuracy and stability of the model's judgment of the terminal security status.

[0081] Further, in step S105, the terminal type features and the fused features are input into the improved deep belief network for training to obtain an intelligent detection model, which outputs terminal security data, specifically including:

[0082] Step S1051: Input the fused features into the improved deep belief network for training to obtain the initial model.

[0083] Step S1053: Input the terminal type features into the initial model to obtain the intelligent detection model.

[0084] Step S1055: Output terminal security data based on the intelligent detection model.

[0085] In this embodiment, the fused features are first input into the improved deep belief network to train an initial model. At this stage, the model focuses on learning the common patterns related to terminal security contained in the fused features. Then, terminal type features are input, which allows the model to further learn the unique security feature patterns of different terminal types (such as Kylin / Tongxin operating system, x86 / ARM architecture, etc.), making the model more targeted and better adapted to the security detection needs of different types of terminals.

[0086] By incorporating terminal type features, the improved deep belief network can fully consider the inherent differences in security characteristics among different terminals (for example, the low power consumption characteristics of ARM terminals may be misjudged as abnormal). This enables the intelligent detection model to dynamically adapt to different terminal environments, effectively avoiding misjudgment problems caused by differences in terminal characteristics, and significantly improving the applicability and detection accuracy of the detection method in diverse terminal scenarios.

[0087] The intelligent detection model, optimized based on terminal type characteristics, outputs terminal security data. Because the model fully integrates comprehensive information from the fused features and the differentiated characteristics of terminal types, it can more accurately distinguish between normal and abnormal states, as well as various anomalies (malicious program attacks, unauthorized access, configuration anomalies, virus infections, and unknown threats, etc.), thereby ensuring the accuracy and reliability of terminal security detection results and providing stronger support for terminal security protection.

[0088] Furthermore, step S1051: The fused features are input into the improved deep belief network for training to obtain the initial model, specifically including the following steps:

[0089] Step S10511: Based on the improved deep belief network, the key dimensions in the fused features are assigned higher weights to obtain the corrected features;

[0090] Step S10513: Extract higher-order threat features from the modified features layer by layer through multi-layer nonlinear transformation to obtain the initial model.

[0091] The improved deep belief network assigns higher weights to key dimensions in the fused features, highlighting features closely related to endpoint security threats. This allows the model to focus on information crucial for security detection in subsequent processing, effectively filtering out irrelevant or secondary features, enhancing the features' ability to represent threats, and laying a solid foundation for subsequent extraction of higher-order threat features. By extracting higher-order threat features layer by layer from the modified features through multi-layer nonlinear transformations, hidden and complex security threat patterns within the fused features can be deeply explored. Nonlinear transformations capture nonlinear relationships between features, while the multi-layer structure gradually constructs higher-level, more abstract higher-order threat features from lower-level features, enabling the initial model to identify more complex and covert endpoint security threats and enhancing its detection capabilities against unknown threats and new attacks.

[0092] Furthermore, step S1053: Input the terminal type features into the initial model to obtain the intelligent detection model, which specifically includes the following steps:

[0093] Step S10531: The initial model generates a terminal type vector based on terminal type features and hardware architecture encoding.

[0094] Step S10533: Concatenate the terminal type vector with the fused features to obtain the concatenated feature vector.

[0095] Step S10535: Dynamically construct the dynamic correction threshold for anomaly detection based on the application scenario and terminal type vector. The expression for the dynamic correction threshold for anomaly detection is:

[0096] threshold=base_threshold+α×f(T)+β×g(S);

[0097] In the formula, base_threshold is the base threshold, base_threshold=0.7; f(T) is the terminal type correction term; g(S) is the scene correction term; α=0.5; β=0.5.

[0098] Step S10537: Obtain the intelligent detection model based on the concatenated feature vector, the concatenated feature vector, and the initial model.

[0099] In this embodiment, the initial model is a basic detection model. Using fused features as input, it extracts high-order threat features through multi-layer nonlinear transformations, ultimately outputting the terminal's security status and confidence level. The model employs an improved Deep Belief Network (DBN), introducing a "feature attention mechanism" to enhance the discriminative ability of key threat features. The specific structure and inference process are as follows:

[0100] The model structure design includes an input layer, a feature attention layer, a hidden layer, and an output layer.

[0101] Input layer: Receives the fused feature vector (64-dimensional, generated by the fusion of system state and behavioral state features), containing comprehensive information on the terminal's static configuration (such as port status and permission settings) and dynamic behavior (such as network connection and file access).

[0102] Feature Attention Layer: This layer assigns higher weights to key dimensions in the fused features, highlighting the impact of threat-related features (such as "frequency of connections from unknown IPs" and "access records to sensitive directories"). The calculation method is as follows:

[0103] F att =softmax(W att ·F+b att )⊙F;

[0104] in, and The softmax function generates attention weight vectors (summing to 1) which are learnable parameters, and ⊙ represents element-wise multiplication.

[0105] Physical meaning: If a feature (such as "port 22 open") is highly correlated with historical threat samples, the attention weight will be automatically increased (e.g., from 0.01 to 0.1), enhancing its contribution to the final decision.

[0106] Hidden layer (3-layer Restricted Boltzmann Machine, RBM): Extracts higher-order features through multiple nonlinear transformations.

[0107] Layer 1 RBM: Maps 64-dimensional attention features to 128 dimensions to capture basic threat patterns (such as the association between "open ports + network connectivity");

[0108] Layer 2 RBM: Maps 128-dimensional features to 64 dimensions to extract mid-level threat features (such as the combination of "unauthorized port open + access from unknown IPs");

[0109] Layer 3 RBM: Maps 64-dimensional features to 32 dimensions to generate abstract threat features (such as "data theft behavior features" and "malicious program propagation features").

[0110] Output layer (multi-task classification): Outputs the probability distribution (summing up to 1) and confidence scores for 6 types of safe states.

[0111] Security status: Normal, Malicious program attack, Unauthorized access, Configuration error, Virus infection, Unknown threat;

[0112] Confidence level: Take the highest probability value (e.g., if the probability of "malicious program attack" is 0.92, then the confidence level is 0.92) for subsequent anomaly detection.

[0113] Among them, feature input: the fused feature F is input into the model, and the key dimensions are enhanced through the feature attention layer;

[0114] Feature transformation: High-order threat features are extracted layer by layer through a 3-layer RBM;

[0115] Classification output: Output the probability distribution and confidence level of 6 types of safety states.

[0116] For example: A terminal's integrated features show "Port 22 open + IP: 203.xxx (unknown) connection + sensitive file reading", and the model outputs "malicious program attack (probability 0.92)" with a confidence level of 0.92.

[0117] Terminal adaptive adjustment: adapting to the characteristics of different terminals.

[0118] Different terminals achieve adaptive detection through "terminal type embedding" and "dynamic threshold adjustment", as detailed below:

[0119] Terminal type embedding: The terminal's operating system type and hardware architecture are encoded into feature vectors, which, together with fused features, participate in inference, enabling the model to learn the characteristics of different terminals.

[0120] Type encoding:

[0121] Operating system: Kylin = [1,0], Tongxin = [1,0];

[0122] Hardware architecture: X86 = [1,0], ARM = [1,0];

[0123] Terminal type vector (Assembling operating system and architecture code).

[0124] Feature fusion:

[0125] During the model input phase, the terminal type vector T is concatenated with the fused feature F. Enable the model to perceive differences in terminal types (e.g., Kylin terminals have port 22 disabled by default, while Tongxin terminals require manual configuration).

[0126] Dynamic threshold adjustment: Based on the terminal type and application scenario, the anomaly judgment threshold is dynamically adjusted (the default threshold is 0.7) to obtain the dynamic adjustment threshold for anomaly judgment, which can avoid false alarms caused by "one-size-fits-all" approach: f(T): Terminal type adjustment item, such as ARM terminals are prone to triggering false alarms of "low resource consumption" due to their low power consumption characteristics, the adjustment item is -0.05; g(S): Scenario adjustment item, such as financial scenarios are sensitive to "data access", the adjustment item is -0.1, reducing the risk of missed alarms; α=0.5, β=0.5, are weight coefficients, determined through training.

[0127] For example:

[0128] Kylin + X86 terminal (general office scenario): threshold = 0.7 + 0.5 × 0 + 0.5 × 0 = 0.7;

[0129] Tongxin + ARM terminal (financial scenario): threshold = 0.7 + 0.5 × (-0.05) + 0.5 × (-0.1) = 0.625.

[0130] If the confidence level of the model output is greater than or equal to the adjusted threshold, it is judged as "abnormal"; otherwise, it is "normal".

[0131] Once an anomaly is detected, the threat triggering path needs to be traced and actionable remediation suggestions provided to address the problem of traditional detection methods that "only report anomalies without identifying the causes."

[0132] Furthermore, if the output terminal security data contains anomalies, anomaly tracing analysis is performed, specifically including the following steps:

[0133] Step S301: Identify the original features that have the greatest impact on anomaly determination through feature contribution analysis.

[0134] Step S303: Combine the time series of the original features to reconstruct the threat path triggered by the anomaly.

[0135] Step S305: Generate targeted recommendations based on endpoint characteristics and threat paths.

[0136] In this embodiment, feature contribution analysis is used to locate the original feature that has the greatest impact on anomaly detection:

[0137] Calculate the gradient of each dimension in the fusion feature with respect to the output probability (e.g., the gradient of the "Port 22 open" feature is 0.3, indicating that it makes a significant contribution to the "malicious program attack" determination);

[0138] The three fusion feature dimensions with the highest correlation gradient are mapped back to the original system state / behavioral state features (such as "port 22 open", "unknown IP connection", "sensitive file access").

[0139] Threat path reconstruction: By combining the time series of original features, the complete path of anomaly triggering is reconstructed.

[0140] Sort the key features in the order of their occurrence by time (e.g., "10:00 Port 22 was manually opened → 10:02 IP:203.xxx initiated a connection → 10:05 Sensitive file was read");

[0141] Verify the path's validity by checking the system logs (e.g., check / var / log / secure to confirm the user and time of the port opening operation).

[0142] Remediation suggestion generation: Based on threat paths and endpoint characteristics, generate targeted suggestions:

[0143] Regarding the issue of "port 22 open + unknown IP connection": it is recommended to "close port 22 and add IP:203.xxx to the blacklist";

[0144] Regarding "unauthorized user escalation of privileges": It is recommended to "revoke the user's privileges and check the sudo configuration file ( / etc / sudoers)".

[0145] Dynamic updates are the core mechanism for ensuring the long-term adaptability of detection methods to terminal environments. This is achieved through "real-time sample replenishment and lightweight model iteration" to enable rapid response to new threats and systems. The optimized solution abandons complex algorithms and adopts a lightweight approach of "rule-driven + manual assistance," balancing practicality and operability.

[0146] Furthermore, in conjunction with the appendix Figure 3 As shown, step S107 involves updating the samples and the model based on the intelligent detection model, specifically including the following steps:

[0147] Step S1071: Automatically collect the features of scene data at fixed intervals as basic samples. Scene data includes daily operation data of the terminal and abnormal detection data.

[0148] Step S1073: If a triggering event occurs, start targeted data collection to obtain corrected samples. Triggering events include terminal environment change events, known threat events, and false alarm feedback events.

[0149] Step S1075: Based on the basic samples and the modified samples, classify and store them in the order of terminal type, scenario, and time to obtain the stored data.

[0150] Step S1077: Perform sample annotation on the stored data to obtain labeled data, which includes normal candidate sample data and abnormal candidate sample data.

[0151] Step S1079: Generate a sample library based on the labeled data and complete the sample update.

[0152] Step S1081: Update the update rules of the intelligent detection model to obtain the updated rules.

[0153] Step S1083: Adjust the parameters of the intelligent detection model based on the updated rules to obtain the intelligent detection model with adjusted parameters.

[0154] Step S1085: Verify the intelligent detection model after parameter adjustment and complete the model update.

[0155] In this embodiment, (1) Sample update: Iteration of the sample library based on “scenario-based collection + standardized annotation”.

[0156] The sample library is updated with the goal of "covering common scenarios and ensuring accurate annotation". It achieves continuous supplementation and optimization of samples through a fixed process without the need for complex algorithms.

[0157] 1) New Sample Collection: Focusing on "Terminal Changes + High-Frequency Threat Scenarios"

[0158] Regular data collection (automatically triggered):

[0159] The system automatically collects feature data for the following scenarios at fixed intervals (daily) as base samples:

[0160] Terminal daily operation data: System state characteristics (such as port status and permission configuration at 8:00 every day) and behavioral characteristics (such as network connection and file access records during working hours) of each terminal are selected, and the characteristics that "appear stably for 7 consecutive days" are used as the "normal sample benchmark".

[0161] Detecting abnormal data: "Abnormal" results marked by the intelligent detection module (such as login failure, connection from an unknown IP) are saved as "samples to be verified" regardless of whether they are ultimately confirmed as threats.

[0162] Triggered data collection (manual / event-triggered):

[0163] Targeted collection will be initiated when the following events occur to ensure that no critical samples are missed:

[0164] Terminal environment changes: After operating system upgrades (such as Kylin V10→V11) or hardware replacements (such as replacing X86 terminals with ARM terminals), manually trigger data collection to record the default configuration (such as new services and default ports) and hardware characteristics (such as power consumption parameters of ARM terminals) of the new system.

[0165] Known threat emergence: After receiving industry notifications (such as "malicious programs targeting the Tongxin system"), collect typical characteristics of the threat (such as the MD5 value of the virus file and the network connection IP during the attack);

[0166] False alarm feedback: If maintenance personnel report a certain type of detection result as a false alarm (such as the low power consumption of an ARM terminal being judged as abnormal), the complete characteristics of the terminal (such as CPU utilization and process list) will be collected immediately as a "correction sample".

[0167] Dynamic sample collection comprehensively covers security scenarios. It employs a combined approach of fixed-period automatic collection and event-triggered targeted collection. This involves periodically collecting data from daily terminal operation and anomaly detection to accumulate routine security feature samples, ensuring a robust foundation for the sample library. Simultaneously, it enables timely targeted collection when critical events occur, such as changes in the terminal environment, the emergence of known threats, or false alarms, accurately capturing security features in specific scenarios. These two collection methods complement each other, comprehensively covering various terminal operating scenarios and security events. This ensures that the sample library data accurately and promptly reflects the dynamic changes in the terminal's security status, providing rich and timely data support for model training.

[0168] Sample storage specifications: All samples are stored categorized by "terminal type + scenario + time", with a uniform format:

[0169] Sample ID: Terminal type (e.g., Kylin-ARM) - Scenario (e.g., office) - Collection time (e.g., 20250720).

[0170] Features: System-level features (ports, permissions, etc.) + Behavioral features (network, files, etc.).

[0171] Temporary tags: Automatically label "normal candidate" and "abnormal candidate".

[0172] Basic and modified samples are categorized and stored according to terminal type, scenario, and time, constructing a structured and hierarchical sample storage system. This facilitates rapid location and retrieval of sample data of specific types, scenarios, and time periods, significantly improving sample management efficiency. Detailed labeling of stored data, distinguishing between normal and abnormal data, clarifies data label attributes and effectively avoids data confusion. This provides standardized, high-quality training samples for subsequent model training, enabling the model to learn terminal security feature patterns based on accurate labeling information, thus enhancing model training effectiveness and detection accuracy.

[0173] 2) Sample labeling: “Rule matching + manual confirmation” to ensure accuracy.

[0174] Automatic pre-labeling (based on fixed rules): The system performs preliminary labeling of collected samples according to preset rules, without the need for algorithm calculation.

[0175] Normal sample rule: A sample is marked as a "normal candidate" if it meets any of the following conditions:

[0176] The characteristics are consistent with the "normal sample baseline" (characteristics that appear stably for 7 consecutive days);

[0177] The features are within the scope of the "security configuration white paper" provided by the operating system vendor (such as the ports that are opened by default in the Kylin system and the recommended permission settings).

[0178] Abnormal sample rules: A sample is marked as an "abnormal candidate" if it meets any of the following conditions:

[0179] Feature matching is performed against a known threat database (such as virus MD5 values ​​and malicious IP addresses).

[0180] Features that violate basic security standards (such as enabling remote login for root users and exposing sensitive port 23 to the outside world).

[0181] Manual verification (key sample confirmation): Maintenance personnel process the following samples daily to finalize the labels:

[0182] “Abnormal Candidate” samples: Confirm one by one whether it is a real threat (e.g., whether “unknown IP connection” is a newly added partner IP). If it is confirmed as a threat, mark it with the corresponding type (e.g., “unauthorized access”).

[0183] “Normal candidate” samples: Focus on reviewing samples from “new terminals / new systems” (such as the first data collection data of ARM terminals) to ensure that they conform to the actual use scenario;

[0184] Samples with no matching rules: These are manually labeled by security personnel (e.g., early characteristics of new attacks) and the labeling rules are updated synchronously (e.g., adding "newly discovered malicious IPs" to the threat database).

[0185] Sample library maintenance:

[0186] Regular cleanup: Delete samples that have not reappeared for more than 6 months (such as features unique to old systems) monthly, and retain samples that are "persistent or distinctive" (such as typical features of common threats);

[0187] Balance control: Ensure that the ratio of normal samples to abnormal samples is 4:1 (retain typical values ​​when there are too many normal samples, and supplement with samples of the same scenario when there are too few abnormal samples).

[0188] (2) Model update: Lightweight optimization of "rule base iteration + parameter fine-tuning":

[0189] The model update follows the principle of "rapid adaptation and low complexity", and is achieved by updating the detection rules and fine-tuning the basic parameters, without the need for complex algorithms such as incremental learning.

[0190] 1) Update triggering mechanism: Clearly define the triggering conditions to avoid invalid updates.

[0191] Regular updates (fixed cycle): Updates are automatically performed every Monday morning (when terminal load is low), mainly dealing with "slowly changing characteristics" (such as gradual changes in terminal usage habits).

[0192] Condition-triggered update (meeting any one of the conditions):

[0193] The number of newly added samples in the sample library meets the standard: ≥100 newly labeled samples (covering at least 3 types of scenarios);

[0194] Known threats have emerged: New threats reported by the industry have been included in the sample database;

[0195] False alarm rate exceeds the standard: The false alarm rate of a certain type of terminal (such as Tongxin X86) is ≥5% for 3 consecutive days;

[0196] System upgrade: Mainstream operating systems release new versions (such as Tongxin UOSV22 officially launched).

[0197] 2) Model update process: "Rule update → Parameter adjustment → Verification and deployment".

[0198] Detection rule base update (core step): The rule base is the "judgment basis" for model detection. It is updated directly based on new samples, without the need for algorithms.

[0199] New rule: Extract common features from "abnormal samples" and convert them into detection rules. For example:

[0200] Sample characteristics: "ARM terminal + port 3389 open + connection during non-working hours" were repeatedly marked as "malicious remote control", and a new rule was added: "ARM terminal should not open port 3389 during non-working hours";

[0201] Adjusting rules: Optimizing existing rules for false positive samples. For example:

[0202] The original rule, "CPU usage < 5% is considered abnormal," has been adjusted to "CPU usage < 5% for more than 1 hour and no normal processes running" due to frequent false alarms in normal low-power scenarios on ARM terminals.

[0203] Deleting rules: If the threat corresponding to a rule has disappeared (e.g., the vulnerability has been patched and there are no related samples within 6 months), then delete the rule (e.g., "Specific port attack detection rule for old versions of Kylin V10").

[0204] Fine-tuning of basic parameters (adapting to terminal characteristics): Adjusting basic parameters such as detection thresholds for different terminal types without complex calculations.

[0205] Operating system compatibility: Kylin terminals have strict default permission control, so the threshold for judging "permission abnormality" has been relaxed from "30% deviation from default value" to "50% deviation"; some services of Tongxin terminals are enabled by default, so the threshold for judging "non-essential service operation" has been adjusted from "abnormal if it exists" to "abnormal only if it runs continuously and has no reasonable process association";

[0206] Hardware architecture adaptation: Due to the different hardware performance characteristics of ARM terminals, the threshold for judging "abnormal network traffic" (based on X86 terminals) is lowered by 20% (because normal traffic on ARM terminals is generally low).

[0207] By updating the rules of the intelligent detection model and incorporating newly collected sample data, the model parameters are specifically adjusted to ensure the model can adapt to the evolution of endpoint security threats and environmental changes. A verification process is added after parameter adjustments to rigorously test the effectiveness of the model update and prevent performance degradation due to improper parameter adjustments. This closed-loop update mechanism of "update rules - parameter adjustment - effectiveness verification" continuously optimizes the model structure and parameters, ensuring the model maintains high sensitivity and accurate identification capabilities against various endpoint security threats (malicious attacks, unauthorized access, etc.), achieving long-term dynamic adaptation of the detection method to the endpoint security environment.

[0208] Including false alarm events in the trigger events allows for timely and targeted data collection based on these false alarms. This enables in-depth analysis of the causes of false alarms and the addition of relevant samples, helping the model learn characteristic patterns in false alarm scenarios, reducing false alarms in subsequent detection processes, and improving the reliability of detection results. Simultaneously, targeted data collection for known threat events allows for the rapid inclusion of newly emerging threat features into the sample library, enabling the model to learn and identify such threats in a timely manner, enhancing the detection method's ability to respond quickly and effectively to both new and known threats.

[0209] Verification and Deployment (Ensuring Stability):

[0210] Offline validation: Test the updated model with historical samples (100 normal + 50 abnormal), requiring an accuracy of ≥90% and a false positive rate of ≤5%, otherwise return to adjustment;

[0211] Small-scale testing: Deployed on 10 representative terminals (covering Kylin / Tongxin, X86 / ARM) for 24 hours to confirm no obvious performance issues (such as detection latency <2 seconds);

[0212] Full deployment: Push the update package (containing only the rule base and parameter file, size <10MB) through the terminal management tool and record the update log (version, time, verification result).

[0213] This invention constructs a dual-modal feature acquisition mechanism to simultaneously acquire system-state and behavioral-state features to overcome the limitations of single feature extraction; it employs a dual-modal fusion method based on an attention mechanism to achieve effective fusion by dynamically adjusting the weights of the two modal features, thereby improving the comprehensiveness and relevance of feature representation; it designs an adaptive detection model that incorporates terminal type features, enabling it to adapt to terminals with different operating systems and hardware architectures, thus enhancing detection adaptability; and it establishes a dynamic update mechanism based on sample updates and model iterations to ensure the continuous adaptability of the detection method to new security threats and changes in terminal features, forming a complete intelligent terminal detection solution covering feature acquisition, fusion, detection, and dynamic adaptation.

[0214] On the other hand, the present invention proposes an electronic device, characterized in that it includes: at least one processor; a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute any one of the terminal security detection methods based on multimodal features.

[0215] In this embodiment, combined with Figure 2 As shown, the electronic device is equipped with a dual-modal feature acquisition module, a feature fusion module, an intelligent detection module, and a dynamic update module. These modules work together to achieve intelligent detection of the terminal.

[0216] 1. The dual-modal feature acquisition module includes a system-state feature acquisition unit and a behavioral-state feature acquisition unit.

[0217] System-level feature acquisition unit: This unit interacts with the terminal operating system kernel to collect system configuration information (such as user permission settings, port open status, patch installation status, etc.), system logs (such as login logs, process startup logs, etc.), and hardware information (such as CPU architecture, memory usage, etc.). It employs a combination of scheduled and triggered acquisition methods. The scheduled acquisition cycle can be set according to terminal performance and security requirements (e.g., 5 minutes / time), while real-time acquisition is triggered when critical system events occur (such as changes in user permissions, the startup of new processes, etc.).

[0218] Behavioral Feature Acquisition Unit: By deploying a lightweight monitoring program on the terminal, it collects user operation behaviors (such as keyboard input frequency, mouse operation trajectory, file access path, etc.) and application behaviors (such as network connection behavior, file read and write operations, system call frequency, etc.). The acquisition process adopts a low-overhead design, and the impact on the normal operation of the terminal is controlled within an acceptable range (e.g., CPU utilization does not exceed 5%).

[0219] 2. The structure of the feature fusion module includes a feature alignment unit and a dual-modal fusion unit.

[0220] Feature Alignment Unit: Due to potential differences in the acquisition time and granularity of system-state features and behavioral features, time alignment and granularity unification are required. Using system time as a reference, behavioral features are aggregated according to the acquisition time granularity of system-state features. For example, if system-state features are acquired every 5 minutes, then the behavioral features within those 5 minutes are summarized and statistically analyzed (e.g., calculating the average keyboard input frequency within that time period).

[0221] The bimodal fusion unit employs an attention-based feature fusion algorithm to fuse system-state and behavioral-state features. First, the features of both modalities are encoded separately to obtain a system-state feature vector S and a behavioral-state feature vector B. Then, the weights of the two modalities are calculated using an attention mechanism, and finally, a weighted fusion is performed to obtain the fused feature F.

[0222] 3. The intelligent detection module mainly consists of a basic detection model unit, an adaptive adjustment unit, and a result output unit.

[0223] The basic detection model unit employs an improved Deep Belief Network (DBN). This model consists of multiple layers of Restricted Boltzmann Machines (RBMs) and is trained through a combination of unsupervised pre-training and supervised fine-tuning. The fused feature vector F is input into the model, and through multiple layers of nonlinear transformations, the classification of security states (e.g., normal, abnormal) is achieved.

[0224] Adaptive Adjustment Unit: This unit adaptively adjusts the basic detection model for terminals with different operating systems and hardware architectures by introducing terminal type features (such as operating system type identifiers and CPU architecture identifiers). During model training, terminal type features are input together with the fused feature F into the model, enabling it to learn the security feature differences between different types of terminals. During detection, the model's parameters and decision thresholds are automatically adjusted based on the current terminal type.

[0225] The output unit generates a detection report based on the model's output, clearly identifying the terminal's security status (normal or abnormal) and the type of abnormality (such as malicious program attack, unauthorized access, etc.). It also records detection time, feature data, and other information to provide a basis for subsequent analysis and tracing.

[0226] 4. The dynamic update module includes a sample update unit and a model update unit.

[0227] Sample Update Unit: Regularly collects new endpoint security sample data (including normal and abnormal samples). These samples can come from new cases discovered during actual testing, publicly available security vulnerability databases, and shared data from other endpoints. The collected samples are then filtered and labeled before being added to the training sample set.

[0228] Model Update Unit: Based on the new training sample set, an incremental learning algorithm is used to update the intelligent detection model, enabling the model to adapt to new security threats and changes in terminal characteristics. During incremental learning, the knowledge already learned by the model is retained, and only parameters relevant to new samples are adjusted, avoiding retraining the entire model and improving update efficiency.

[0229] This invention achieves comprehensive capture of terminal system-state and behavioral characteristics through dual-modal feature fusion, effectively improving the comprehensiveness of security threat detection and reducing missed detections. Leveraging a terminal adaptive mechanism, it adapts to the characteristics of different operating systems and hardware architectures, reducing false alarm rates. Through real-time detection and dynamic update mechanisms, it can respond promptly to new security threats and changes in the terminal environment, improving the real-time performance and adaptability of detection. Simultaneously, the anomaly tracing and rectification suggestion functions provide clear guidance for operation and maintenance, improving the efficiency of security incident handling, and overall meeting the terminal's security detection needs in critical areas.

[0230] Application Examples

[0231] Taking "malicious program attack detection on a company's Kylin operating system (x86 architecture) terminal" as an example, following the technical solution's process of "dual-modal feature acquisition → feature fusion → intelligent detection → dynamic update," combined with... Figure 3 As shown, the specific implementation steps are as follows:

[0232] I. Dual-modal feature acquisition (corresponding technical solution "Dual-modal feature acquisition module")

[0233] For this Kirin X86 terminal, data is acquired synchronously through system state and behavioral state feature acquisition units:

[0234] System state feature collection: Timed collection (5-minute cycle): 9:00 collected "Port 22 (SSH) open", "User privileges are ordinary user", "Memory usage rate 30%"; 9:05 collected "User privileges elevated to root" and "Patch installation status normal".

[0235] Triggered data collection: At 9:03, a new process (name: unknown.exe) was detected to be starting, and the startup log of this process (path: / tmp / unknown.exe) was immediately collected.

[0236] Behavioral feature acquisition: Real-time acquisition by a lightweight monitoring program.

[0237] User actions: From 9:00 to 9:05, "keyboard input frequency was 0 times (no operation)" and "mouse did not click on any sensitive directories".

[0238] Application behavior: 9:02 "unknown.exe initiates network connection (IP: 203.xxx.xxx.xxx, unknown IP)"; 9:04 "This process reads sensitive file ( / etc / passwd)", CPU usage during the data collection process is 3.2% (below the 5% threshold).

[0239] II. Dual-modal feature fusion (corresponding technical solution "feature fusion module")

[0240] Feature alignment (time alignment + granularity uniformity):

[0241] Time alignment: Based on the system state feature acquisition time points (9:00, 9:05), the behavioral state features within 9:00-9:05 are associated with the 9:05 time point.

[0242] Uniform particle size:

[0243] Numerical behavioral characteristics (such as the number of network connections): Calculate the average over 5 minutes to obtain "Number of connections from unknown IPs = 1".

[0244] Categorical behavioral characteristics (such as file access paths): Statistical frequency, resulting in "accessed / etc / passwd = 1 time".

[0245] Bimodal fusion (based on attention mechanism):

[0246] Feature encoding: The system state feature is encoded as vector S: [port 22 open (1), root privileges (1), new process started (1), memory usage 30% (after 0.3 normalization)].

[0247] The behavioral features are encoded as vector B: [unknown IP connection (1), sensitive file access (1), keyboard input frequency 0 (0)].

[0248] Attention weight calculation: Since detecting "malicious programs" requires focusing on behavioral characteristics, the weights are calculated as α = 0.3 (system state) and 1-α = 0.7 (behavioral state).

[0249] Weighted fusion: F = 0.3 × S + 0.7 × B + 0.2 × (S ⊙ B) (interaction term γ = 0.2, capturing the risk association of "root privileges + sensitive file access").

[0250] III. Intelligent Detection (corresponding technical solution "Intelligent Detection Module")

[0251] Basic detection model inference: Improving the DBN model by fusing feature F input:

[0252] Feature Attention Layer: Automatically increases the weight of "unknown IP connection" and "sensitive file access" (from 0.2 to 0.4).

[0253] 3-layer RBM extracts high-level features: identifies malicious program attack features such as "root privileges + unfamiliar IP + access to sensitive files".

[0254] Output: "Malicious program attack (probability 0.94)", confidence level 0.94.

[0255] Terminal adaptive adjustment:

[0256] Terminal type embedding: The Kylin X86 terminal is encoded as T = [1,0,1,0], which is concatenated with F to form a 68-dimensional input.

[0257] Dynamic threshold adjustment: This terminal is for an office scenario, and the calculated threshold is 0.7 (base threshold 0.7 + terminal type correction 0 + scenario correction 0).

[0258] Judgment: Confidence level 0.94 ≥ 0.7, confirmed as "abnormal".

[0259] Anomaly source tracing analysis:

[0260] Key feature localization: Gradient analysis shows that "root privilege escalation", "connection from unfamiliar IPs", and "access to sensitive files" are the main contributing features.

[0261] Threat path reconstruction: The time sequence is "9:03 unknown.exe starts → 9:03 user privilege escalation → 9:02 unknown IP connection → 9:04 access to sensitive files", which is verified by matching system logs.

[0262] Recommended rectification: Execute the following commands: "Terminate the unknown.exe process, close port 22, and add 203.xxx.xxx.xxx to the blacklist".

[0263] IV. Dynamic Updates (corresponding to the "Dynamic Update Module" in the technical solution)

[0264] Sample update:

[0265] New sample collection: The characteristics (system state + behavioral state) of this "malicious program attack" are marked as "abnormal candidates".

[0266] Manual annotation: Security personnel confirmed that the sample was a "malicious attack" and added it to the sample database (ID: Kylin-X86_Office_20250720).

[0267] Model update:

[0268] Triggering condition: ≥100 new abnormal samples are added (meeting the update condition).

[0269] Rule base update: Added rule "In the Kylin X86 terminal, if a process with root privileges accesses / etc / passwd and connects to an unknown IP, it is identified as a malicious program".

[0270] Deployment verification: The offline test accuracy was 92%. After testing on 10 similar terminals without any performance issues, full deployment was carried out.

[0271] On the other hand, the present invention proposes a medium, which is a computer storage medium storing a computer program, wherein the computer program, when executed by a processor, implements any one of the terminal security detection methods based on multimodal features.

[0272] Computer storage media may be simply referred to as media. Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Dual Data SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), Rambus Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM). The various embodiments described in this specification are presented in a progressive manner, and similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, for embodiments of apparatus, devices, and non-volatile computer storage media, since they are substantially similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to the description of the method embodiments.

[0273] The above embodiments are merely illustrative examples and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for terminal security detection based on multi-modal features, characterized in that, The system state feature and the real-time behavior state feature of the terminal are collected, the system state feature includes system configuration information, system log and hardware information, and the real-time behavior state feature includes user operation behavior and application program behavior. The system state feature and the real-time behavior state feature are weighted and fused to obtain a fused feature. The terminal type feature and the fused feature are input into an improved deep belief network for training to obtain an intelligent detection model, and the intelligent detection model outputs terminal security data, the terminal security data includes normal and abnormal, and the abnormal includes malicious program attack, unauthorized access, configuration anomaly, virus infection and unknown threat. The system state feature and the real-time behavior state feature are weighted and fused to obtain a fused feature, specifically including: 2.The method of claim 1, wherein, The system state feature and the real-time behavior state feature are aligned in feature through time alignment and granularity unification to obtain aligned features; The aligned features are encoded to obtain system state feature vectors and behavior state feature vectors; The system state feature vectors and the behavior state feature vectors are weighted and fused according to attention weights to obtain the fused feature. Further including: 3.The method of claim 2, wherein, A multi-modal feature consistency loss is added during training of the intelligent detection model; And / or A product term of the system state feature vector and the behavior state feature vector is added when the system state feature and the real-time behavior state feature are weighted and fused to obtain an optimized fused feature F: F=α×S+(1-α)×B+γ×(S⊙B); In the formula, α is the system state feature weight; S is the system state feature vector; (1-α) is the real-time behavior state feature weight; B is the behavior state feature vector; and is the element product; and γ is the interaction term weight. The terminal type feature and the fused feature are input into an improved deep belief network for training to obtain an intelligent detection model, and the intelligent detection model outputs terminal security data, specifically including:

4. The method of claim 1 to 3, wherein, The fused feature is input into an improved deep belief network for training to obtain an initial model; The terminal type feature is input into the initial model to obtain the intelligent detection model; Terminal security data is output based on the intelligent detection model. The fused feature is input into an improved deep belief network for training to obtain an initial model, specifically including: 5.The method of claim 4, wherein, The improved deep belief network gives higher weight to key dimensions in the fused feature to obtain a modified feature; High-order threat features are extracted from the modified feature layer by layer through multi-layer nonlinear transformation to obtain the initial model. The terminal type feature is input into the initial model to obtain the intelligent detection model, specifically including: 6.The method of claim 4, wherein, The initial model generates a terminal type vector based on the terminal type feature and hardware architecture encoding; The terminal type vector and the fused feature are spliced to obtain a spliced feature vector; An abnormal judgment dynamic correction threshold is dynamically constructed according to the application scenario and the terminal type vector, and the expression of the abnormal judgment dynamic correction threshold threshold is: threshold=base_threshold+α×f(T)+β×g(S); ​ In the formula, base_threshold is a base threshold, base_threshold = 0.7; f(T) is a terminal type correction term; g(S) is a scene correction term; alpha = 0.5; beta = 0.5; Based on the spliced feature vector, the spliced feature vector and the initial model, the intelligent detection model is obtained.

7. The method of claim 1-3, wherein, Also includes: If the output terminal security data includes an exception, an exception trace analysis is performed, specifically including: Through feature contribution analysis, the original feature that has the greatest impact on abnormal judgment is identified; Combined with the time sequence of the original feature, the threat path triggered by the anomaly is restored; Based on the terminal characteristics and the threat path, a targeted suggestion is generated.

8. The method of claim 1-3, wherein, Based on the intelligent detection model, sample updating and model updating are performed, specifically including: Collecting features of scene data as basic samples at a fixed period, the scene data including terminal daily operation data and detection abnormal data; If a trigger event occurs, start directional collection to obtain a correction sample, the trigger event including a terminal environment change event, a known threat event and a feedback false alarm event; Based on the basic sample and the correction sample, store the samples in order of terminal type, scene and time to obtain storage data; Sample labeling is performed on the storage data to obtain labeled data, the labeled data including normal candidate sample data and abnormal candidate sample data; Based on the labeled data, a sample library is generated to complete sample updating; The updating rule of the intelligent detection model is updated to obtain an updated rule; Based on the updated rule, the parameters of the intelligent detection model are adjusted to obtain an intelligent detection model after parameter adjustment; The intelligent detection model after parameter adjustment is verified to complete model updating.

9. An electronic device, comprising: Includes: At least one processor; The memory is in communication connection with the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the terminal security detection method based on multi-modal features in any one of claims 1 to 8.

10. A medium characterized by, The computer program is stored in the memory and is executed by the processor to implement the terminal security detection method based on multi-modal features in any one of claims 1 to 8.

Images