Network security software abnormal behavior monitoring method and system

Abstract

The invention provides a network security software abnormal behavior monitoring method and system. The method comprises the following steps: acquiring process system layer calling data and constructing a calling sequence representing behavior characteristics; discrete call events in the sequence are vectorized and embedded, and a feature space capable of measuring behavior semantics is built; modeling is carried out on the feature space time sequence, a probability transfer model reflecting the dependency relationship between calls is established, and a high-frequency core behavior path and a low-frequency abnormal behavior mode are identified; then, a process behavior topological representation is constructed according to the process behavior topological representation, and a response is triggered when the risk reaches a preset condition through path analysis and risk assessment; and finally, multi-dimensional risk index quantitative evaluation is fused, a behavior credibility security score is generated, and a self-adaptive security policy is executed according to the score to monitor and deal with the abnormal behavior, so that the process abnormal behavior can be accurately identified, self-adaptive security response can be executed, and the network security is guaranteed.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and system for monitoring abnormal behavior of network security software. Background Technology

[0002] Server hosts are the carriers of core business operations. Ransomware, Trojans, and other malicious software often launch attacks by tampering with their process call sequences, leading to data leaks and system crashes. This necessitates monitoring technologies that possess high real-time performance and accuracy, capable of quickly capturing abnormal call sequences while avoiding misinterpretation of normal operations. Simultaneously, they must provide clear behavioral analysis data for risk response to ensure the security of both the server and business data.

[0003] Currently, the mainstream solution for this requirement is a matching detection technology based on a pre-set feature library. This involves first extracting typical process call characteristics of known malware attacks manually or semi-automatically and building a fixed library; during monitoring, host process call data is collected in real time and compared with malicious features in the library; if the matching degree meets the standard, an anomaly is determined and an alarm is triggered.

[0004] However, this solution has significant drawbacks. First, it is completely ineffective against unknown or mutated malware, only able to identify attack patterns already included in the database, and cannot deal with new ransomware or Trojans. Second, it ignores the temporal correlation of process call sequences, matching only single or local features, making it difficult to identify disguised attacks by malware, and is also prone to misjudgment due to mutations in normal process calls, affecting normal host operations. Summary of the Invention

[0005] The purpose of this application is to provide a method and system for monitoring abnormal behavior of network security software, so as to solve the problem of missed or false judgments caused by the inability to identify disguised attacks in the prior art.

[0006] To address the aforementioned technical problems, in a first aspect, this application provides a method for monitoring abnormal behavior of network security software, comprising:

[0007] Obtain call data from the process system layer, and construct a call sequence representing behavioral characteristics based on the call data;

[0008] The discrete call events in the call sequence are vectorized and embedded to construct a feature space that can measure behavioral semantics;

[0009] Temporal modeling is performed on the feature space to establish a probability transition model that reflects the dependencies between calls, and the high-frequency core behavior paths and low-frequency abnormal behavior patterns are identified based on the probability transition model.

[0010] Based on the core behavior path and abnormal behavior pattern, a topological representation of process behavior is constructed, and path analysis and risk assessment are performed on the topological representation. When the path risk reaches the preset condition, a response is triggered.

[0011] When a response is triggered, multi-dimensional risk indicators are integrated for comprehensive quantitative evaluation to generate a security score that represents the credibility of the behavior, and an adaptive security strategy is executed based on the security score.

[0012] Optionally, the discrete call events in the call sequence are vectorized and embedded to construct a feature space capable of measuring behavioral semantics, including:

[0013] By analyzing a representative set of call sequences, we learn the system call sequence patterns and contextual relationships, and establish a benchmark model for vectorized embedding.

[0014] Using the aforementioned baseline model, discrete call events in each call sequence are mapped to high-dimensional numerical vectors;

[0015] All the high-dimensional numerical vectors are combined to form a feature space that can measure the semantics of behavior, wherein the geometric distance in the feature space directly reflects the semantic correlation between corresponding call events.

[0016] Optionally, all the high-dimensional numerical vectors are collectively constructed to form a feature space capable of measuring behavioral semantics, wherein the geometric distance within the feature space directly reflects the semantic correlation between corresponding invocation events, including:

[0017] Iterate through all call sequences and, for each target call event in the sequence, extract neighboring call events within a preset range to form a context association set for the target call event;

[0018] Based on the co-occurrence relationship of each invocation event within the context association set, calculate the correction amount used to adjust the target invocation event vector;

[0019] The correction amount is applied to the high-dimensional numerical vector of the target invocation event to update the position of the target invocation event in the feature space;

[0020] Repeat the traversal and update process for all call sequences until the position change of all the high-dimensional numerical vectors in the feature space is lower than a preset threshold.

[0021] Optionally, temporal modeling is performed on the feature space to establish a probability transition model that reflects the dependencies between calls, and the high-frequency core behavior paths and low-frequency abnormal behavior patterns are identified based on the probability transition model, including:

[0022] Based on the call event sequence in the feature space, a probability transition model is established by statistically analyzing the transition relationship and frequency between adjacent call events, and combining it with common call relationships and intensities under normal operating conditions.

[0023] Based on the probability transition model, paths with transition probabilities higher than a preset high-frequency threshold are identified as core behavior paths, and paths with transition probabilities lower than a preset low-frequency threshold are identified as abnormal behavior patterns.

[0024] Optionally, based on the call event sequence within the feature space, a probabilistic transition model is established by statistically analyzing the transition relationships and frequencies between adjacent call events, and combining this with common call relationships and intensities under normal operating conditions. This model includes:

[0025] Extract frequently co-occurring call event pairs from historical normal operation data, and calculate a priori call relationship strength index for each call event pair based on the occurrence frequency and contextual relationship of the call event pairs.

[0026] For the current call event sequence, calculate the direct transfer frequency of all adjacent call events;

[0027] By combining the relationship strength index and the direct transition frequency, the transition probability is weighted and adjusted to construct a probabilistic transition model.

[0028] Optionally, based on the core behavior path and abnormal behavior pattern, a topological representation of process behavior is constructed, and path analysis and risk assessment are performed on the topological representation. A response is triggered when the path risk reaches a preset condition, including:

[0029] The core behavior paths and abnormal behavior patterns are integrated to construct a topological representation of process behavior;

[0030] Path analysis is performed based on the topology representation. The new call sequence is matched with the path in the topology representation, and the path risk is calculated cumulatively based on the matched path. The path risk is reduced for segments belonging to the core behavior path, while the path risk is increased for segments belonging to the abnormal behavior pattern.

[0031] A response is triggered when the value of the path risk reaches a preset condition.

[0032] Optionally, upon triggering a response, a comprehensive quantitative assessment is performed by integrating multi-dimensional risk indicators to generate a security score characterizing the credibility of the behavior, and an adaptive security strategy is executed based on the security score, including:

[0033] When a response is triggered, the transfer frequency and path risk associated with the response are extracted as multidimensional risk indicators.

[0034] Based on the ability of each multidimensional risk indicator to distinguish historical abnormal behavior, corresponding weight coefficients are set, and the multidimensional risk indicators are weighted and summed based on the weight coefficients to complete the comprehensive quantitative assessment.

[0035] The results of the comprehensive quantitative evaluation are transformed into a security score that represents the credibility of the behavior through a preset mapping function. The lower the security score, the higher the probability that the current process behavior is abnormal.

[0036] Based on whether the security score meets the preset conditions, the corresponding adaptive security strategy is executed.

[0037] Secondly, this application provides a network security software abnormal behavior monitoring system, comprising:

[0038] The acquisition module is used to acquire call data at the process system layer and construct a call sequence representing behavioral characteristics based on the call data;

[0039] A construction module is used to vectorize and embed discrete call events in the call sequence to construct a feature space that can measure behavioral semantics;

[0040] The identification module is used to perform temporal modeling on the feature space to establish a probability transition model that can reflect the dependencies between calls, and to identify high-frequency core behavior paths and low-frequency abnormal behavior patterns based on the probability transition model.

[0041] The evaluation module is used to construct a topological representation of process behavior based on the core behavior path and abnormal behavior pattern, and to perform path analysis and risk assessment on the topological representation, triggering a response when the path risk reaches a preset condition.

[0042] The generation module is used to integrate multi-dimensional risk indicators for comprehensive quantitative evaluation when a response is triggered, in order to generate a security score that represents the credibility of the behavior, and to execute an adaptive security strategy based on the security score.

[0043] Thirdly, this application provides an electronic device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor, configured to implement the steps of the network security software abnormal behavior monitoring method as described in the first aspect above when executing the computer program.

[0046] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the network security software abnormal behavior monitoring method described in the first aspect above.

[0047] The network security software abnormal behavior monitoring method provided in this application, through the embodiments of this application, obtains process system-level call data and constructs call sequences that characterize behavioral features, which can provide a precise and comprehensive raw behavioral data foundation for subsequent anomaly detection, ensuring the integrity of the analysis object; by embedding discrete call events in the call sequence into vectors to construct a feature space with measurable behavioral semantics, discrete events that cannot be directly calculated can be transformed into vectors that can be quantified and analyzed, achieving effective characterization of behavioral semantics; by establishing a probability transition model through temporal modeling of the feature space and identifying core behavioral paths and abnormal behavioral patterns, the dependency relationship between calls can be captured, accurately distinguishing between normal and abnormal behaviors, and improving the targeting of anomaly identification; by constructing a topological representation based on core paths and abnormal patterns and performing path analysis and risk assessment to trigger a response, the process behavioral logic can be presented intuitively, enabling rapid location and initial response to high-risk paths; by fusing multi-dimensional risk indicators to generate a security score and executing adaptive security strategies, the behavioral risk can be accurately quantified, ensuring the flexibility and effectiveness of security response measures.

[0048] Furthermore, by analyzing representative call sequence sets to learn patterns and contextual relationships, a vectorized embedding benchmark model is established. This model is then used to map discrete call events into high-dimensional numerical vectors. Finally, all high-dimensional numerical vectors constitute a feature space that can measure behavioral semantics, and the geometric distance within the space reflects the semantic correlation of call events. The technical effect of this step is to make the benchmark model fit the actual call patterns, ensure the accuracy of vector mapping, and achieve accurate measurement of the semantic correlation of call events through the design of high-dimensional vectors and geometric distances, providing high-quality feature support for subsequent time series modeling and anomaly identification. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating a method for monitoring abnormal behavior of network security software provided in an embodiment of this application;

[0051] Figure 2 A flowchart illustrating a specific implementation of a network security software abnormal behavior monitoring method provided in this application embodiment;

[0052] Figure 3 A scenario diagram illustrating a method for monitoring abnormal behavior of network security software provided in an embodiment of this application;

[0053] Figure 4 This is a schematic diagram of the structure of a network security software abnormal behavior monitoring system provided in an embodiment of this application. Detailed Implementation

[0054] In malware detection on server hosts, existing matching schemes based on preset signature databases face two major problems: First, they can only identify attack patterns already recorded in the database, making them completely incapable of dealing with constantly evolving new ransomware or Trojans, creating a blind spot for unknown threats. Second, these schemes only focus on single or localized process call characteristics, ignoring the logical relationships between call sequences. This makes it difficult to detect attacks carried out by malware disguised as normal call sequences, and may also misjudge abnormal calls of normal business processes as anomalies, affecting the normal operation of the host. These two problems make existing schemes significantly insufficient in accuracy and adaptability when dealing with complex and ever-changing malicious attacks.

[0055] To address the aforementioned issues, this application proposes a method for monitoring abnormal behavior in network security software. The core of this method is to dynamically identify and respond to abnormal behavior by analyzing the entire process call data. Specifically, the method first acquires process system-level call data and forms a sequence of behavioral features. Then, it transforms discrete call events into feature vectors with measurable semantics. Next, it captures the dependencies between calls through temporal modeling, thereby identifying normal high-frequency core behavior paths and abnormal low-frequency behavior patterns. Finally, it combines behavioral topology analysis and multi-dimensional risk assessment to generate a security score and execute adaptive security policies. This method does not rely on a pre-set malicious signature database. By analyzing the overall logic and semantic relationships of call sequences, it can autonomously identify abnormal patterns of new or mutated malicious software. Simultaneously, through comprehensive analysis of behavioral paths, it reduces misjudgments of normal processes, fundamentally solving the problems of insufficient ability to deal with unknown threats and easy omissions and misjudgments in existing solutions, thus providing more accurate protection for server host security.

[0056] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0057] The core of this application is to provide a method for monitoring abnormal behavior of network security software, and a flowchart of one specific implementation is shown below. Figure 1 As shown, the method includes:

[0058] S101. Obtain the call data of the process system layer, and construct a call sequence representing behavioral characteristics based on the call data;

[0059] The call data mainly includes various operation instructions executed by the process at the system level and related context information, specifically covering the system call function name, call parameters, call return value, call timestamp, and the identification information of the calling process. The system call function name includes the specific operation type, such as process creation, file read / write, and network connection; the call parameters include details such as the file path, network address, and permission identifier; the call return value includes the success or failure status code; the call timestamp records the time of each call; and the identification information of the calling process includes the process ID and parent process ID.

[0060] In terms of acquisition methods, system calls initiated by processes can be intercepted in real time through system call hooks provided by the operating system, or call data can be collected from the kernel mode using kernel modules. This method can ensure data integrity. Historical call records can also be extracted through system logs or dedicated monitoring tools.

[0061] Specifically, when constructing the call sequence representing behavioral characteristics, the acquired call data is first sorted by timestamp to ensure the temporal consistency of the call events. Then, taking a single process as a unit, the system calls of that process within a certain time window are chained together in the order of occurrence, forming a linear sequence with time as the axis. For example, if a process executes the system calls "open file, read data, send over network, close file" in sequence, the corresponding call sequence consists of these four ordered call events and related parameter information. In this way, the sequence can reflect both the operation type of the process behavior and the sequential logic of the operations, fully representing the dynamic behavioral characteristics of the process.

[0062] S102. Vectorize and embed the discrete call events in the call sequence to construct a feature space that can measure behavioral semantics;

[0063] Optionally, step S102 may specifically include the following steps:

[0064] S1021. By analyzing a representative set of call sequences, learn the system call sequence patterns and context relationships, and establish a benchmark model for vectorized embedding.

[0065] S1022. Using the benchmark model, map the discrete call events in each call sequence into a high-dimensional numerical vector;

[0066] S1023. All the high-dimensional numerical vectors are combined to form a feature space that can measure the semantics of behavior, wherein the geometric distance in the feature space directly reflects the semantic correlation between corresponding call events.

[0067] Specifically, step S1023 may include the following process: traversing all call sequences and extracting neighboring call events within a preset range for each target call event in the sequence to form a context association set for the target call event; calculating a correction amount for adjusting the target call event vector based on the co-occurrence relationship of each call event in the context association set; applying the correction amount to the high-dimensional numerical vector of the target call event to update the position of the target call event in the feature space; repeating the traversal and update process of all call sequences until the position change of all the high-dimensional numerical vectors in the feature space is lower than a preset threshold.

[0068] In the above steps, the representative call sequence set refers to a sample set containing call sequences of normal processes on the server host and call sequences of known malicious processes, used to provide a learning basis for the baseline model; the system call sequence pattern refers to the regular combination of system call events formed in chronological order when a process is in a normal or abnormal state; the context relationship refers to the logical association between a single system call event and its preceding and following adjacent call events; the baseline model is a basic model used to transform discrete call events into high-dimensional numerical vectors, and its parameters are trained from the representative call sequence set; the high-dimensional numerical vector is a mathematical form that uses multiple dimensions of numerical values ​​to represent the features of discrete call events, with each dimension corresponding to an attribute of the call event; the feature space is an abstract space composed of all high-dimensional numerical vectors, used to carry the call events. Semantic features; geometric distance refers to the distance between two high-dimensional numerical vectors in the feature space, common types include Euclidean distance and cosine distance; semantic relevance refers to the degree of similarity between different calling events in function or logic; preset range refers to the range of adjacent calling events set for extracting the context of the target calling event, such as 3 events before and after the target event; context association set refers to the set consisting of the target calling event and its neighboring calling events within the preset range; co-occurrence relationship refers to the frequency with which different calling events appear simultaneously in the same context association set; correction amount refers to the value used to adjust the high-dimensional numerical vector of the target calling event to make it more consistent with the actual semantic relevance; preset threshold refers to the critical value for judging whether the position of the high-dimensional numerical vector is stable. When the position change is lower than this value, the feature space construction is complete.

[0069] In this embodiment, firstly, a baseline model is constructed through step S1021. Specifically, from the historical process data of the server host, call sequences covering normal business processes such as type A data processing processes, type B network communication processes, and known malicious processes such as type C ransomware processes are selected to form a representative set of call sequences. Then, machine learning algorithms such as Word2Vec or GloVe are used to train this set, learning the occurrence patterns of different system call events, i.e., sequence patterns, and the logical connections between a single call event and its preceding and following events, i.e., contextual relationships. Finally, a baseline model capable of capturing the semantic features of call events is obtained. For example, during the learning process, the model may discover that an open file call event is often followed by a read data call event, and that encrypted file call events in ransomware sequences are often adjacent to delete the original file call events. These patterns are incorporated into the parameters of the baseline model.

[0070] Secondly, in step S1022, discrete call events are mapped into high-dimensional numerical vectors. Specifically, each discrete call event in the process call sequence collected in real time by the server host, such as creating a network connection or writing to a log file, is input into the baseline model trained in step S1021. The model assigns a high-dimensional numerical vector to each call event based on the learned sequence patterns and contextual relationships. Each dimension of the vector corresponds to a feature of the event in a certain semantic dimension, such as operation type or associated event type. For example, an open file call event might be mapped to a 100-dimensional vector, where the 15th dimension represents its association strength with the read data event, the 38th dimension represents its frequency of occurrence in normal processes, and the vector for an encrypted file call event would show a higher value in the dimension representing malicious operation tendencies.

[0071] Next, step S1023 constructs the feature space and optimizes vector positions. This step first performs traversal and context extraction: traversing all process call sequences to be processed, such as the call sequences of all running processes on the server, and for the target call event in each sequence, such as the network packet sending event in the E process sequence, extracting adjacent call events according to a preset range, such as two events before and after, such as resolving domain names, checking network permissions, receiving response data, and recording sending logs, forming a context association set for the target event. Then, co-occurrence relationship calculation and correction amount determination are performed: the frequency of different call events co-occurring in the same context association set is statistically analyzed, which is the co-occurrence relationship, and the correction amount is calculated based on the frequency. If two events have a high co-occurrence frequency, it indicates a strong semantic correlation, and the correction amount will make their corresponding vectors closer in the feature space; if the co-occurrence frequency is low, the correction amount will increase the vector distance. Finally, vector update is performed: the calculated correction amount is applied to the high-dimensional numerical vector of the target call event, adjusting the position of this vector in the feature space. Finally, repeat the above traversal, calculation, and update process until the positional changes of all high-dimensional numerical vectors are below a preset threshold, such as the change in the value of each dimension of the vector being less than 0.001. At this point, the feature space construction is complete. For example, when optimizing the vector of a network data packet sending event, because it has a high co-occurrence frequency with the domain name resolution event, the calculated correction amount will reduce the geometric distance between the two vectors. However, because it has a low co-occurrence frequency with the system file deletion event, the correction amount will increase the distance between the two vectors. After multiple rounds of updates, the vector positions stabilize, and semantically similar call event vectors in the feature space will naturally cluster together.

[0072] In practical applications, an enterprise server needs to monitor malicious behavior in its core business processes, such as the F-type order processing process and the G-type user data storage process. First, the server's normal call sequences for processes F and G, as well as the malicious call sequences of known H-type Trojan processes, are collected over the past six months to form a representative call sequence set. This set is trained using the Word2Vec algorithm to obtain a baseline model. Then, discrete call events from the real-time collected F process call sequences, such as querying the database, generating order numbers, and saving order data, are input into the baseline model and mapped to a 128-dimensional high-dimensional numerical vector. Subsequently, the F process call sequences are traversed. For the target event of saving order data, within a preset range of two events before and after it, the events generating order numbers, verifying user permissions, updating inventory data, and recording order logs are extracted to form a contextual association set. The co-occurrence relationships of events within the set are statistically analyzed, and correction amounts are calculated to adjust the vector position of the saving order data event. This process is repeated until all vector positions are stable, ultimately constructing a feature space that can measure the semantic correlation of call events. In this space, the vector distance between saving order data and updating inventory data is close, while the vector distance between saving order data and common events of the encrypted database file Trojan process is far.

[0073] In the overall scheme of step S102 above, by constructing a benchmark model and mapping high-dimensional numerical vectors, discrete call events that were originally difficult to analyze directly are transformed into quantifiable semantic features, providing a clear analytical basis for subsequent anomaly identification. By optimizing vector positions based on contextual co-occurrence relationships, the geometric distance of call events in the feature space can accurately reflect semantic correlation, making the feature differences between normal and abnormal call events more significant. The final constructed feature space can capture the internal logic of call events and reflect the semantic correlation of different events, effectively solving the problem that traditional schemes are difficult to characterize the semantics of call events, and laying the foundation for subsequent accurate identification of abnormal call patterns of malicious software (such as ransomware and Trojans).

[0074] S103. Perform time-series modeling on the feature space to establish a probability transition model that can reflect the dependency relationship between calls, and identify high-frequency core behavior paths and low-frequency abnormal behavior patterns based on the probability transition model.

[0075] Optionally, such as Figure 2 As shown, step S103 may specifically include the following steps:

[0076] S1031. Based on the call event sequence in the feature space, a probability transfer model is established by statistically analyzing the transfer relationship and transfer frequency between adjacent call events, and combining it with common call relationships and intensities under normal operating conditions.

[0077] Specifically, step S1031 may include the following process: extracting high-frequency co-occurring call event pairs from historical normal operation data, and calculating a priori call relationship strength index for each call event pair based on the occurrence frequency and contextual relationship of the call event pairs; for the current call event sequence, calculating the direct transition frequency of all adjacent call events; and fusing the relationship strength index and the direct transition frequency to perform weighted adjustment on the transition probability in order to construct a probability transition model.

[0078] S1032. Based on the probability transfer model, identify the path with a transfer probability higher than a preset high-frequency threshold as the core behavior path, and identify the path with a transfer probability lower than a preset low-frequency threshold as the abnormal behavior pattern.

[0079] In the above steps, temporal modeling refers to the process of mathematically modeling the chronological changes of call events within the feature space to capture the dynamic relationships between events; probabilistic transition model refers to a model that uses probability to represent the likelihood of adjacent call events transitioning from one to another, reflecting the dependencies between calls; call event sequence refers to a combination of call events arranged chronologically within the feature space; transition relationship refers to the sequential connection between two adjacent call events; transition frequency refers to the number of times a call event transitions to another call event within a certain period; common call relationships and strength under normal operating conditions refer to the connection between frequently occurring call events and the stability of this relationship when the server host is running normally; historical normal operating data refers to the process call data recorded by the server host in the past under normal business operation conditions without malicious attacks; high-frequency co-occurring call event pairs refer to two calls that frequently appear simultaneously and are sequentially connected in historical normal operating data. The terms "call event combination" and "preceding call relationship strength index" are used to measure the degree of correlation between call event pairs, calculated based on historical data. The closer the correlation, the higher the index value. The current call event sequence refers to the combination of process call events collected in real-time and being analyzed, arranged chronologically. The direct transfer frequency refers to the proportion of times adjacent call events transfer from one to the other in the current call event sequence out of the total number of transfers. The core behavior path refers to paths with high call event transfer probability that occur frequently in normal operation, representing the normal behavior of the process. Abnormal behavior patterns refer to paths with low call event transfer probability that occur rarely in normal operation, potentially corresponding to malicious behavior. The preset high-frequency threshold is a pre-set threshold for the transfer probability of core behavior paths; paths exceeding this value are considered core paths. The preset low-frequency threshold is a pre-set threshold for the transfer probability of abnormal behavior patterns; paths below this value are considered abnormal patterns.

[0080] In this embodiment, firstly, the strength index of the prior call relationship is calculated through the first sub-process of step S1031. Specifically, frequently occurring call event pairs are selected from the historical normal operation data of the server host, such as database query followed by return of query results, and configuration information reading followed by opening a configuration file. These are combinations that are frequently linked. Then, the frequency of these call event pairs in the historical data is counted, and their contextual relationships are considered, such as whether opening a configuration file usually directly leads to reading configuration information rather than other events. A statistical analysis algorithm is used to calculate the strength index of each call event pair. The higher the frequency and the stronger the contextual relationship, the larger the strength index value. For example, in the historical data of the Class A business server, the event pair of database query followed by return of query results appears a large number of times, and almost every database query is followed by a return of query results without any other extra events. The strength index of this event pair will be calculated to be a high value.

[0081] Secondly, the direct transfer frequency of the current call event sequence is calculated through the second sub-process of step S1031. Specifically, the current call event sequence collected in real time by the server host is obtained. For example, the current call sequence of process B is receiving user requests, verifying user permissions, querying the database, returning query results, and recording operation logs. Then, the sequence is traversed to count the number of transfers between adjacent call events. For example, the transfer from receiving user requests to verifying user permissions occurs 10 times, and the transfer from verifying user permissions to querying the database occurs 9 times. The number of each transfer is divided by the total number of all adjacent transfers in the current sequence to obtain the direct transfer frequency. For example, in the current sequence of process B above, there are 4 types of adjacent transfers, with a total of 30 transfers. Among them, the transfer from querying the database to returning query results occurs 8 times, and its direct transfer frequency is the value obtained by dividing 8 by 30.

[0082] Next, the third sub-process in step S1031 fuses the data to construct a probabilistic transition model. Specifically, the prior call relationship strength index obtained from the first two sub-processes is fused with the current direct transition frequency. The transition probability is adjusted using a weighted summation method, where the strength index and the direct transition frequency each have a certain weight, which can be set according to the reliability of historical data and the real-time nature of current data. After adjustment, the transition probability of each adjacent call event pair is obtained, and all transition probabilities together constitute the probabilistic transition model. For example, the prior strength index of the event pair of querying the database and transitioning to returning query results is 0.8 with a weight of 0.6, and the current direct transition frequency is 0.25 with a weight of 0.4. Then, the adjusted transition probability is 0.8 × 0.6 + 0.25 × 0.4 = 0.58. This value will be recorded in the probabilistic transition model, representing the transition probability of this event pair.

[0083] Finally, step S1032 identifies core paths and abnormal patterns. Specifically, based on the server host's business characteristics and historical normal data, preset high-frequency thresholds and preset low-frequency thresholds are first set, for example, the high-frequency threshold is set to 0.5 and the low-frequency threshold is set to 0.1. Then, all call event transfer paths in the probability transfer model are traversed, and paths with a transfer probability higher than 0.5 are identified as core behavior paths, while paths with a transfer probability lower than 0.1 are identified as abnormal behavior patterns. For example, in the constructed probability transfer model, the transfer probability of verifying user permissions to querying the database is 0.6, which is higher than the high-frequency threshold of 0.5, and is identified as a core behavior path; while the transfer probability of opening a system file to encrypting a system file is 0.05, which is lower than the low-frequency threshold of 0.1, and is identified as an abnormal behavior pattern.

[0084] In practical applications, a company's Class C business server needs to monitor abnormal process behavior. First, call event pairs are extracted from the server's normal operation data over the past year. Prior strength indices are calculated for event pairs such as receiving an order request and transferring to querying inventory data, and querying inventory data and transferring to generating an order. Then, the call sequence of the currently running Order D processing process is collected in real time, and the direct transfer frequency of adjacent transfers such as receiving an order request and transferring to querying inventory data, and querying inventory data and transferring to generating an order, is statistically analyzed. The two sets of data are combined to obtain the transfer probability of each event pair, and a probabilistic transfer model is constructed. Subsequently, a high-frequency threshold of 0.55 and a low-frequency threshold of 0.08 are set. In the model, the transfer probability of querying inventory data and transferring to generating an order is 0.7, which is identified as the core behavior path. The transfer probability of generating an order and transferring to deleting an order record is 0.06, which is identified as an abnormal behavior pattern, triggering subsequent risk assessment.

[0085] In the overall scheme of step S103 above, a probability transition model is constructed by combining historical data and real-time data. This utilizes historical experience to ensure the reliability of the model and incorporates real-time data to ensure its timeliness, allowing the transition probability to accurately reflect the actual situation of the current process call. By setting thresholds to identify core paths and abnormal patterns, the normal behavior and abnormal behavior of processes can be clearly distinguished, avoiding misjudging normal high-frequency paths as abnormal and not missing low-frequency malicious behavior paths. Ultimately, it achieves accurate classification of process behavior patterns, providing clear analysis objects for subsequent topology analysis and risk assessment, and effectively improving the ability to identify abnormal calls caused by ransomware, Trojans and other malicious software.

[0086] S104. Based on the core behavior path and abnormal behavior pattern, construct a topological representation of process behavior, perform path analysis and risk assessment on the topological representation, and trigger a response when the path risk reaches a preset condition.

[0087] Optionally, step S104 may specifically include the following steps:

[0088] S1041. Integrate the core behavior path with the abnormal behavior pattern to construct a topological representation of process behavior;

[0089] S1042. Path analysis is performed based on the topology representation by matching the new call sequence with the path in the topology representation and calculating the cumulative path risk based on the matched path. The fragments belonging to the core behavior path reduce the path risk, while the fragments belonging to the abnormal behavior pattern increase the path risk.

[0090] S1043. When the value of the path risk reaches a preset condition, a response is triggered.

[0091] In the above steps, the topological representation of process behavior refers to the graphical or network-based structure that presents the relationship between process call events, core behavior paths, and abnormal behavior patterns. Nodes represent call events, and edges represent the transition relationships between events. Different types of paths (core or abnormal) are distinguished by different identifiers. The new call sequence refers to the combination of the latest process call events collected in real time and arranged chronologically. Path matching refers to comparing segments in the new call sequence with the core behavior paths or abnormal behavior patterns in the topological representation to determine whether there are consistent or similar segments. Accumulated path risk calculation refers to the accumulation calculation of risk values ​​based on the core paths and abnormal pattern segments matched in the new call sequence, according to preset rules. Core path segments reduce risk, while abnormal pattern segments increase risk. The path risk value refers to the numerical value obtained through accumulated calculation, reflecting the overall risk level of the new call sequence. Preset conditions refer to the pre-set risk value threshold conditions that trigger a response. When the path risk value reaches or exceeds this condition, the response mechanism is activated. Triggered response refers to the operations such as warning, blocking, or recording performed when the path risk meets the preset conditions, used to address potential security threats.

[0092] In this embodiment, firstly, a topological representation of process behavior is constructed through step S1041. Specifically, the core behavior paths and abnormal behavior patterns identified in step S103 are integrated. Each call event is first determined as a node in the topological structure. Then, edges between nodes are drawn according to the transition relationships of events in the path. Different colors or line types are used to identify the core path and abnormal patterns—for example, a solid green line represents the core behavior path, and a dashed red line represents the abnormal behavior pattern. This ultimately forms a topological graph that intuitively reflects the relationships between process behaviors. For example, in the process analysis of a Class A data processing server, the core behavior path includes the sequential transitions of querying the database, returning data, and writing to the cache. The abnormal behavior pattern includes the sequential transitions of opening a system file, encrypting a system file, and deleting the original file. During integration, each call event in these paths is set as a node, and the nodes are connected according to the transition relationships. A solid green line connects querying the database, returning data, and writing to the cache, and a dashed red line connects opening a system file, encrypting a system file, and deleting the original file, thus constructing a topological representation of the server's process behavior.

[0093] Secondly, path analysis and risk accumulation calculation are performed through step S1042. Specifically, the new call sequence collected by the server in real time is first obtained. For example, the new sequence of process B is receiving data request, querying the database, returning data, encrypting data, and saving the encrypted file. Then, the sequence is split into multiple segments of fixed length, such as "receiving data request, querying the database, and returning data", "querying the database, returning data, and encrypting data", and "returning data, encrypting data, and saving the encrypted file". Then, these segments are matched with the path in the topology representation to determine whether each segment belongs to the core path or the abnormal mode. For example, "receiving data request, querying the database, and returning data" contains the core path's querying the database and returning data part, while "returning data, encrypting data, and saving the encrypted file" contains the abnormal mode's encrypted data part. Finally, the path risk is accumulated and calculated according to preset rules. Assuming that matching a core path segment reduces the risk value by 2 each time, matching an abnormal mode segment increases the risk value by 5 each time, the initial risk value is 10. This new sequence matches 1 core segment and 2 abnormal segments, so the final path risk value is 10-2+5×2=18. For example, in the new sequence of process B above, the fragment containing the database query and returned data matches the core path, reducing the risk value by 2. The fragment containing encrypted data matches the abnormal pattern twice, increasing the risk value by a total of 10. The initial risk value is 10, and the final risk value is calculated to be 18.

[0094] Finally, step S1043 determines whether a response should be triggered. Specifically, a preset condition is first established, such as triggering a response when the path risk value is greater than or equal to 15. Then, the path risk value calculated in step S1042 is compared with the preset condition. If the risk value reaches or exceeds the preset condition, a response is triggered, performing operations such as sending an alarm message to the administrator, temporarily blocking abnormal operations of the process, and recording the current call sequence and risk calculation process. If the preset condition is not met, monitoring for new call sequences continues. For example, if the path risk value of the new sequence of process B is 18, and the preset condition is a risk value greater than or equal to 15, and 18 meets this condition, the system will immediately send an alarm message to the server administrator, record the current call sequence and risk calculation details of process B, and temporarily block the process's encrypted data and encrypted file saving operations.

[0095] In practical applications, a company's Class C business server needs to monitor process security. First, the core behavior paths of this server, such as the sequential transfers of user login, permission verification, access to business data, and recording operation logs, are integrated with abnormal behavior patterns, such as the sequential transfers of password cracking, administrator privilege acquisition, business log deletion, and sensitive data upload, to construct a topological representation of process behavior. When the server collects a new call sequence from process D—user login, password cracking, administrator privilege acquisition, business data access, and business log deletion—the sequence is split into multiple segments and matched against the topological representation. This reveals segments containing user login and permission verification. The system is divided into three risk levels: a core path segment (reduced risk), a segment containing password cracking and administrator privilege acquisition (anomaly mode segment, increased risk), and a segment containing administrator privilege acquisition and business log deletion (anomaly mode segment, increased risk). The risk value is calculated according to preset rules: an initial risk value of 8, a risk reduction of 3 from the core segment, and a risk increase of 9 from the anomaly segment, resulting in a final risk value of 8-3+9=14. The server's preset condition is a risk value greater than or equal to 12. Since 14 meets the condition, the system triggers a response, sending an alarm to the security management platform, blocking process D's deletion of business logs, and saving the process's call records for subsequent tracing.

[0096] In the overall scheme of step S104 above, the relationship between process behaviors is made more intuitive by constructing a topological representation, which facilitates a quick understanding of the distribution of core paths and abnormal patterns; through path matching and risk accumulation calculation, the risk level of new call sequences can be dynamically assessed, taking into account both the risk reduction effect of normal behavior and the risk amplification effect of abnormal behavior, making the risk assessment more comprehensive; by triggering responses under preset conditions, measures can be taken in a timely manner when the risk reaches a certain level to prevent the further spread of security threats, effectively improving the dynamic prevention and control capabilities for abnormal process behavior, and providing a guarantee for the safe operation of the server host.

[0097] S105. When a response is triggered, multi-dimensional risk indicators are integrated for comprehensive quantitative evaluation to generate a security score that represents the credibility of the behavior, and an adaptive security strategy is executed based on the security score.

[0098] Optionally, step S105 may specifically include the following steps:

[0099] S1051. When a response is triggered, extract the transfer frequency and path risk associated with the response as multidimensional risk indicators.

[0100] S1052. Based on the ability of each of the multidimensional risk indicators to distinguish historical abnormal behaviors, set corresponding weight coefficients, and perform weighted summation on the multidimensional risk indicators based on the weight coefficients to complete the comprehensive quantitative assessment.

[0101] S1053. The results of the comprehensive quantitative evaluation are transformed into a security score that represents the credibility of the behavior through a preset mapping function. The lower the value of the security score, the higher the possibility of abnormal behavior of the current process.

[0102] S1054. Based on whether the security score meets the preset conditions, execute the corresponding adaptive security strategy.

[0103] In the above steps, multidimensional risk indicators refer to indicators from multiple different dimensions used to comprehensively assess the risk of process behavior. Specifically, this step includes transfer frequency and path risk associated with the response. Transfer frequency reflects the frequency of call event transfers, while path risk reflects the overall risk level of the call sequence. Historical abnormal behavior refers to data on past process behaviors of the server host that have been confirmed as malicious or abnormal. Discrimination capability refers to the ability of a risk indicator to distinguish between normal and abnormal behavior in historical data; the stronger the discrimination capability, the higher the importance of the indicator in risk assessment. Weighting coefficients are values ​​set based on the discrimination capability of risk indicators to adjust the influence of each indicator in the comprehensive assessment; indicators with stronger discrimination capabilities have larger weighting coefficients. Weighted calculation... The summation of all results, multiplying the value of each multidimensional risk indicator by its corresponding weighting coefficient, yields a comprehensive quantitative assessment result. The predefined mapping function is a predefined mathematical function that converts the comprehensive quantitative assessment result into a security score, mapping different ranges of assessment results to a fixed range of security scores. The security score is a numerical value representing the credibility of process behavior; a lower score indicates a higher probability of abnormal behavior, while a higher score indicates a higher probability of normal behavior. Predefined conditions are pre-set security score thresholds used to determine which security strategy to implement; different thresholds correspond to different strategies. Adaptive security strategies are security operations dynamically adjusted based on the security score; different scores result in different strategies, such as alarms, blocking, or operation restrictions.

[0104] In this embodiment, firstly, multidimensional risk indicators are extracted in step S1051. When the system triggers a response due to path risk reaching a preset condition, the transfer frequency and path risk associated with the response are extracted from the previously analyzed data. The transfer frequency is the proportion of the number of adjacent call events corresponding to the abnormal pattern segment in the process call sequence that triggers the response to the total number of transfers. The path risk is the risk value of the triggered response calculated in step S1042. For example, in a Class A business server, if process B triggers a response due to path risk, the transfer frequency of the abnormal segment "encrypt file, delete original file" in the process call sequence and the path risk value of 20 calculated in step S1042 are extracted and used as multidimensional risk indicators.

[0105] Secondly, in step S1052, weights are set and a weighted sum is performed. Specifically, historical abnormal behavior data is analyzed to determine the distinguishing ability of transfer frequency and path risk. For example, in historical data, path risk can more accurately identify malicious behavior and has a stronger distinguishing ability, while transfer frequency has a relatively weaker distinguishing ability. Then, weight coefficients are set according to the distinguishing ability, with higher weights for indicators with stronger distinguishing abilities. For example, the weight coefficient for path risk is set to 0.6, and the weight coefficient for transfer frequency is set to 0.4. Then, the value of each multidimensional risk indicator is multiplied by its corresponding weight coefficient, and the results are added together to obtain the comprehensive quantitative evaluation result. For example, the path risk value of process B above is 20, and the transfer frequency is 0.3. The comprehensive quantitative evaluation result is 20 × 0.6 + 0.3 × 0.4 = 12.12, where 20 is the path risk value, 0.6 is its weight coefficient, 0.3 is the transfer frequency value, and 0.4 is its weight coefficient.

[0106] Next, step S1053 converts the assessment result into a safety score. Specifically, a preset mapping function is used, which maps the comprehensive quantitative assessment result to a safety score range of 0-100. The higher the assessment result, the lower the safety score, as a higher assessment result represents a higher risk. For example, the mapping function is set as: Safety Score = 100 - Comprehensive Quantitative Assessment Result × 2. The comprehensive quantitative assessment result obtained in step S1052 is substituted into the function to calculate the safety score. For example, the comprehensive quantitative assessment result of process B is 12.12. After substituting it into the mapping function, the safety score = 100 - 12.12 × 2 = 75.76. This score represents the credibility of process B's behavior. The relatively low value indicates a higher probability of its abnormality.

[0107] Finally, in step S1054, an adaptive security policy is executed based on the security score. Specifically, preset conditions are first set, such as executing a "logging only" policy when the security score is greater than 80, executing a "send alarm and log" policy when the score is between 60 and 80, and executing a "block process operation and send emergency alarm" policy when the score is below 60. Then, the security score obtained in step S1053 is compared with the preset conditions, and the corresponding policy is executed. For example, if the security score of process B is 75.76, which is between 60 and 80, the system will execute the "send alarm and log" policy, sending an alarm message to the server administrator that process B has an abnormal risk, and at the same time recording the call sequence, risk indicators, and scoring process of process B in detail.

[0108] In a practical application, a company's Class C data storage server detected a response triggered by process D. First, it extracted the path risk value (18) and abnormal segment transfer frequency (0.25) of process D as multi-dimensional risk indicators. Based on historical data, it set a path risk weighting coefficient of 0.7 and a transfer frequency weighting coefficient of 0.3, calculating a comprehensive quantitative assessment result of 18 × 0.7 + 0.25 × 0.3 = 12.675. Then, using a preset mapping function: security score = 100 - comprehensive quantitative assessment result × 1.5, it obtained a security score of 100 - 12.675 × 1.5 = 81.4875. The server's preset condition was that a score greater than 80 would trigger "logging only," so the system only recorded relevant data for process D and did not take stricter blocking measures. Subsequent monitoring of process D's behavior continued.

[0109] In the overall solution of step S105 above, a comprehensive assessment is conducted by integrating multi-dimensional risk indicators, avoiding the one-sidedness of single-indicator assessment and making risk judgment more comprehensive and accurate; the importance difference of indicators is reflected by weight coefficients, further improving the reliability of the assessment results; the assessment results are transformed into intuitive security scores, which facilitates quick understanding of the credibility of process behavior; and adaptive security policies are executed based on the scores, which can dynamically adjust the response measures according to the risk level, avoiding over-protection that affects business and preventing risk omissions, effectively improving the flexibility and accuracy of server host security protection.

[0110] The following is a complete embodiment for steps S101 to S105:

[0111] like Figure 3As shown, a company's Class A business server handles order processing and data storage. It needs to monitor process anomalies caused by malware. The method implemented is as follows: First, the system-level call data of the order processing process B is collected in real-time through the server kernel module, including the function name, parameters, timestamp, and process ID. Call events within a 10-minute period are sorted and concatenated by timestamp to construct a call sequence. Next, normal call sequences of process B and known malicious Trojan sequences from the past 6 months are collected. A baseline model is trained using the Word2Vec algorithm, mapping real-time call events of process B to a 128-dimensional vector. The vector positions are adjusted until the change is below a threshold to construct a feature space. Then, high-frequency call event pairs are extracted from historical normal data, and the prior relationship strength index is calculated. The frequency of direct transitions between adjacent events in the current sequence of process B is statistically analyzed, and the transition probabilities are obtained by fusing them with weights of 0.6 and 0.4, constructing a probability transition model to identify core behavioral paths and abnormal behavior patterns. Subsequently, the core paths and abnormal patterns are integrated to construct a topological representation. New call sequences of process B are collected and segmented. After matching with the topology, the path risk is accumulated and calculated. A response is triggered when the risk value reaches a preset condition. Finally, the transfer frequency and path risk are extracted as multi-dimensional indicators, and the comprehensive evaluation results are calculated with weights of 0.7 and 0.3, respectively. A security score is generated through a mapping function, and the "send alarm + log" strategy is executed based on the score.

[0112] The network security software anomaly behavior monitoring method provided in this application achieves accurate identification and dynamic response to server process anomalies through refined analysis. At the identification level, it overcomes the limitations of traditional preset signature databases, enabling the discovery of low-frequency anomalies in novel malware; risk assessment integrates multi-dimensional indicators, with security scores intuitively reflecting behavioral credibility; at the response level, adaptive strategies are executed based on the scores, avoiding over-protection or risk omission. Overall, it improves the accuracy, adaptability, and timeliness of server malware monitoring, ensuring the security of core enterprise businesses.

[0113] Figure 4 This is a schematic diagram illustrating a specific implementation of a network security software abnormal behavior monitoring system provided in this application. (Refer to...) Figure 4 The system may include:

[0114] The acquisition module 41 is used to acquire call data at the process system layer and construct a call sequence representing behavioral characteristics based on the call data;

[0115] Construction module 42 is used to vectorize and embed discrete call events in the call sequence to construct a feature space that can measure behavioral semantics;

[0116] The identification module 43 is used to perform temporal modeling on the feature space to establish a probability transition model that can reflect the dependency relationship between calls, and to identify high-frequency core behavior paths and low-frequency abnormal behavior patterns based on the probability transition model.

[0117] The evaluation module 44 is used to construct a topological representation of process behavior based on the core behavior path and abnormal behavior pattern, and to perform path analysis and risk assessment on the topological representation, and trigger a response when the path risk reaches a preset condition.

[0118] The generation module 45 is used to integrate multi-dimensional risk indicators for comprehensive quantitative evaluation when a response is triggered, so as to generate a security score that represents the credibility of the behavior, and to execute an adaptive security strategy based on the security score.

[0119] The network security software abnormal behavior monitoring system of this application embodiment is used to implement the aforementioned network security software abnormal behavior monitoring method. Therefore, the specific implementation of the network security software abnormal behavior monitoring system can be found in the embodiment section of the network security software abnormal behavior monitoring method above. The specific implementation can be referred to the description of the corresponding embodiment, and will not be repeated here.

[0120] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described network security software abnormal behavior monitoring methods.

[0121] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-described methods for monitoring abnormal behavior of network security software.

[0122] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory, random access memory, portable hard drives, magnetic disks, or optical disks.

[0123] Embodiments of the present invention also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the embodiments of the network security software abnormal behavior monitoring method described above.

[0124] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0125] The above provides a detailed description of a method and system for monitoring abnormal behavior of network security software. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A method for monitoring abnormal behavior of network security software, characterized in that, include: Obtain call data from the process system layer, and construct a call sequence representing behavioral characteristics based on the call data; The discrete call events in the call sequence are vectorized and embedded to construct a feature space that can measure behavioral semantics; Temporal modeling is performed on the feature space to establish a probability transition model that reflects the dependencies between calls, and the high-frequency core behavior paths and low-frequency abnormal behavior patterns are identified based on the probability transition model. Based on the core behavior path and abnormal behavior pattern, a topological representation of process behavior is constructed, and path analysis and risk assessment are performed on the topological representation. A response is triggered when the path risk reaches a preset condition. When a response is triggered, multi-dimensional risk indicators are integrated for comprehensive quantitative evaluation to generate a security score that represents the credibility of the behavior, and an adaptive security strategy is executed based on the security score.

2. The method according to claim 1, characterized in that, Vectorizing and embedding discrete call events in the call sequence to construct a feature space capable of measuring behavioral semantics includes: By analyzing a representative set of call sequences, we learn the system call sequence patterns and contextual relationships, and establish a benchmark model for vectorized embedding. Using the aforementioned baseline model, discrete call events in each call sequence are mapped to high-dimensional numerical vectors; All the high-dimensional numerical vectors are combined to form a feature space that can measure the semantics of behavior, wherein the geometric distance in the feature space directly reflects the semantic correlation between corresponding call events.

3. The method according to claim 2, characterized in that, All the high-dimensional numerical vectors are collectively used to construct a feature space that can measure behavioral semantics. The geometric distance within this feature space directly reflects the semantic correlation between corresponding invocation events, including: Iterate through all call sequences and, for each target call event in the sequence, extract neighboring call events within a preset range to form a context association set for the target call event; Based on the co-occurrence relationship of each invocation event within the context association set, calculate the correction amount used to adjust the target invocation event vector; The correction amount is applied to the high-dimensional numerical vector of the target invocation event to update the position of the target invocation event in the feature space; Repeat the traversal and update process for all call sequences until the position change of all the high-dimensional numerical vectors in the feature space is lower than a preset threshold.

4. The method according to claim 1, characterized in that, Temporal modeling is performed on the feature space to establish a probabilistic transition model that reflects the dependencies between calls. Based on the probabilistic transition model, high-frequency core behavior paths and low-frequency abnormal behavior patterns are identified, including: Based on the call event sequence in the feature space, a probability transition model is established by statistically analyzing the transition relationship and frequency between adjacent call events, and combining it with common call relationships and intensities under normal operating conditions. Based on the probability transition model, paths with transition probabilities higher than a preset high-frequency threshold are identified as core behavior paths, and paths with transition probabilities lower than a preset low-frequency threshold are identified as abnormal behavior patterns.

5. The method according to claim 4, characterized in that, Based on the call event sequence within the feature space, a probabilistic transition model is established by statistically analyzing the transition relationships and frequencies between adjacent call events, and combining this with common call relationships and intensities under normal operating conditions. This model includes: Extract frequently co-occurring call event pairs from historical normal operation data, and calculate a priori call relationship strength index for each call event pair based on the occurrence frequency and contextual relationship of the call event pairs. For the current call event sequence, calculate the direct transfer frequency of all adjacent call events; By integrating the relationship strength index and the direct transition frequency, the transition probability is weighted and adjusted to construct a probabilistic transition model.

6. The method according to claim 1, characterized in that, Based on the core behavior paths and abnormal behavior patterns, a topological representation of process behavior is constructed, and path analysis and risk assessment are performed on the topological representation. A response is triggered when the path risk reaches a preset condition, including: The core behavior paths and abnormal behavior patterns are integrated to construct a topological representation of process behavior; Path analysis is performed based on the topology representation. The new call sequence is matched with the path in the topology representation, and the path risk is calculated cumulatively based on the matched path. The path risk is reduced for segments belonging to the core behavior path, while the path risk is increased for segments belonging to the abnormal behavior pattern. A response is triggered when the value of the path risk reaches a preset condition.

7. The method according to claim 1, characterized in that, When a response is triggered, a comprehensive quantitative assessment is performed by integrating multi-dimensional risk indicators to generate a security score representing the credibility of the behavior. An adaptive security strategy is then executed based on this security score, including: When a response is triggered, the transfer frequency and path risk associated with the response are extracted as multidimensional risk indicators. Based on the ability of each multidimensional risk indicator to distinguish historical abnormal behavior, corresponding weight coefficients are set, and the multidimensional risk indicators are weighted and summed based on the weight coefficients to complete the comprehensive quantitative assessment. The results of the comprehensive quantitative evaluation are transformed into a security score that represents the credibility of the behavior through a preset mapping function. The lower the security score, the higher the probability that the current process behavior is abnormal. Based on whether the security score meets the preset conditions, the corresponding adaptive security strategy is executed.

8. A network security software abnormal behavior monitoring system, characterized in that, include: The acquisition module is used to acquire call data at the process system layer and construct a call sequence representing behavioral characteristics based on the call data; A construction module is used to vectorize and embed discrete call events in the call sequence to construct a feature space that can measure behavioral semantics; The identification module is used to perform temporal modeling on the feature space to establish a probability transition model that can reflect the dependencies between calls, and to identify high-frequency core behavior paths and low-frequency abnormal behavior patterns based on the probability transition model. The evaluation module is used to construct a topological representation of process behavior based on the core behavior path and abnormal behavior pattern, and to perform path analysis and risk assessment on the topological representation, triggering a response when the path risk reaches a preset condition. The generation module is used to integrate multi-dimensional risk indicators for comprehensive quantitative evaluation when a response is triggered, in order to generate a security score that represents the credibility of the behavior, and to execute an adaptive security strategy based on the security score.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the network security software abnormal behavior monitoring method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the network security software abnormal behavior monitoring method as described in any one of claims 1 to 7.

Images