Abnormal software detection method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention provides an abnormal software detection method and device, equipment, a storage medium and a program product, and relates to the field of information security. According to the method, software features of target software are obtained, and the target software is software applying for accessing a bank system. The software features are input into the collaborative detection model, binary labels of the software features are obtained based on an abnormal software detector in the collaborative detection model, the abnormal confidence coefficient of the software features is obtained based on an adversarial detector in the collaborative detection model, and the binary labels are used for representing whether the software features are abnormal features or not. Based on the binary label and the abnormal confidence coefficient, a detection result of the target software is determined, and the detection result is used for indicating whether the target software can access the bank system or not. According to the method, abnormal software and potential abnormal software can be accurately identified through multi-dimensional feature analysis and cooperative work of double detectors, the data security of a bank system is guaranteed, and risks and losses caused by software security problems are reduced.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to an abnormal software detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] The development of internet technology has brought convenience and efficiency to banking operations, enabling banking systems to connect with external systems through open interfaces and other means, thereby providing customers with flexible and convenient business functions.

[0003] To address the security challenges posed by internet technology and ensure the secure operation of banking systems, banks currently primarily employ machine learning-based risk control models for security detection. These models learn and analyze discrete features such as the bank's open interfaces and interface call sequences to construct a corresponding feature space. They then ensure that transaction instructions strictly correspond to this feature space, thereby determining whether a transaction poses a security risk and detecting and preventing potential cyberattacks.

[0004] However, attackers can now generate adversarial examples by tampering with non-functional instructions in executable files, allowing them to evade risk control models and prevent the models from accurately identifying potential cyberattacks. Furthermore, the discrete features upon which banking systems rely suffer from inverse mapping errors, making risk control models unable to effectively cope with complex and ever-changing cyberattack methods in real-world business scenarios, thus failing to meet the high stability and security requirements of banking systems. Summary of the Invention

[0005] This application provides an abnormal software detection method, apparatus, device, storage medium, and program product to solve the problem that existing risk control models cannot effectively detect whether software is abnormal, thus leading to a lack of security and stability in banking systems.

[0006] Firstly, this application provides a method for detecting abnormal software, including:

[0007] Obtain the software characteristics of the target software, which is the software that requests access to the bank system;

[0008] The software features are input into a collaborative detection model. The binary label of the software features is obtained based on the abnormal software detector in the collaborative detection model, and the anomaly confidence of the software features is obtained based on the adversarial detector in the collaborative detection model. The binary label is used to characterize whether the software features are abnormal features.

[0009] Based on the binary label and the anomaly confidence level, the detection result of the target software is determined, and the detection result is used to indicate whether the target software can access the bank system.

[0010] Secondly, this application provides an abnormal software detection device, comprising:

[0011] The acquisition module is used to acquire the software characteristics of the target software, which is the software that requests access to the bank system;

[0012] The determination module is used to input the software features into the collaborative detection model, obtain a binary label for the software features based on the abnormal software detector in the collaborative detection model, and obtain the anomaly confidence of the software features based on the adversarial detector in the collaborative detection model. The binary label is used to characterize whether the software features are abnormal features.

[0013] The determination module is used to determine the detection result of the target software based on the binary label and the anomaly confidence level, and the detection result is used to indicate whether the target software can access the bank system.

[0014] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0015] The memory stores computer-executed instructions;

[0016] The processor executes computer execution instructions stored in the memory to implement the abnormal software detection method as described in the first aspect and various possible implementations of the first aspect above.

[0017] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions thereon, which, when executed by a processor, are used to implement the abnormal software detection method as described in the first aspect and various possible implementations of the first aspect.

[0018] Fifthly, this application provides a program product, including a computer program, which, when executed by a processor, implements the abnormal software detection method described above.

[0019] The abnormal software detection method, apparatus, device, storage medium, and program product provided in this application, when software requests access to a banking system, first acquires software characteristics of the target software, including code structure and runtime behavior. These software characteristics are then input into a collaborative detection model. The abnormal software detector in the model outputs a binary label characterizing whether the target software exhibits abnormal features, while the adversarial detector outputs an anomaly confidence level reflecting the degree of deviation from normal features. Finally, the two are combined to determine whether the software can access the banking system. This method, through multi-dimensional feature analysis and the collaborative work of two detectors, can accurately identify abnormal software and potentially abnormal software, effectively preventing their intrusion into the banking system, ensuring the data security and stable operation of the banking system, and reducing the risks and losses caused by software security issues. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] Figure 1 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 1 ;

[0022] Figure 2 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 2 ;

[0023] Figure 3 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 3 ;

[0024] Figure 4 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 4 ;

[0025] Figure 5 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 5 ;

[0026] Figure 6 This is a schematic diagram of the structure of an abnormal software detection device provided in this application;

[0027] Figure 7 This is a schematic diagram of the structure of an electronic device provided in this application.

[0028] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, they do not violate public order and good morals, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0031] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0032] It should be noted that the abnormal software detection methods, apparatus, devices, storage media, and program products provided in this application can be used in the field of information security, or in any field other than information security. The application fields of the abnormal software detection methods, apparatus, devices, storage media, and program products in this application are not limited.

[0033] With the development of internet technology, the digital transformation of the financial industry, especially the banking system, is deepening. Internet technology has brought convenience and efficiency to banking operations, enabling banks to break through time and space limitations and connect with various external systems and services through open interfaces, thereby providing customers with diverse business functions and greatly improving customer experience and business processing efficiency.

[0034] To ensure the secure operation of banking systems, banks currently primarily employ machine learning-based risk control models for security defense. These models learn and analyze discrete features such as open interfaces and interface call sequences within the banking system to construct a corresponding feature space. They then ensure that transaction instructions strictly correspond to this feature space, thereby determining whether a transaction poses a security risk and detecting and preventing potential cyberattacks.

[0035] However, existing attackers can use technical means to tamper with the non-functional instructions of executable files, generating adversarial examples. These adversarial examples can evade detection by machine learning-based risk control models, making it impossible for the models to accurately identify potential cyberattacks. Furthermore, due to the non-differentiability of discrete features relied upon by banking systems and the existence of inverse mapping errors, effective parameter tuning of the models is difficult, limiting their performance. This makes the models ineffective in the business process, unable to effectively cope with complex and ever-changing cyberattack methods, and unable to meet the stringent stability and security requirements of banking systems.

[0036] To address the aforementioned issues, this application proposes an anomalous software detection method. It constructs an adversarial detector by introducing a learnable convex distance metric function, and trains a collaborative detection model by combining the anomalous software detector with pre-labeled historical software instances. When target software requests access to the banking system, the target software's binary label and anomalous confidence score are obtained based on the pre-trained adversarial detector and anomalous software detector in the collaborative detection model. Finally, the detection result of the target software is determined by combining the binary label and anomalous confidence score. This method ensures the theoretical convergence of perturbation quantization through convexity constraints, solves the model divergence problem caused by heuristic strategies in traditional adversarial training, and improves the model's defensive capabilities.

[0037] This application can be applied to core business scenarios in the financial industry, such as digital banking services and real-time transaction processing. By testing the access software, it can prevent issues such as loss of transaction information and transaction anomalies.

[0038] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0039] Figure 1 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 1 .like Figure 1 As shown, the abnormal software detection method provided in this embodiment is applied to an anomaly determination system and includes:

[0040] S101: Obtain the software characteristics of the target software.

[0041] The target software is the software that requests access to the bank's system.

[0042] Understandably, the security system of a bank requires rigorous testing of any software requesting access. When new software submits a request to access the bank's system, the system first identifies the relevant software characteristics of that target software.

[0043] These software characteristics can include the software's code structure, with different code reflecting the software's origin and purpose; they can also include the software's operational behavior characteristics, including the system resources that the software needs to access during operation, such as whether the target software needs to access sensitive files, or whether it consumes an unusually large amount of memory or network bandwidth; and they can also include information about the various library files and components that the software depends on, because some library files may have security vulnerabilities or be at risk of being misused.

[0044] By comprehensively collecting the software characteristics of the target software, a comprehensive data foundation can be provided for subsequent software detection, so as to accurately determine whether the software will pose a security threat to the banking system.

[0045] S102: Input the software features into the collaborative detection model, obtain the binary label of the software features based on the abnormal software detector in the collaborative detection model, and obtain the abnormal confidence of the software features based on the adversarial detector in the collaborative detection model.

[0046] The binary label is used to characterize whether a software feature is an anomalous feature. For example, if it is an anomalous feature, it can be represented by 1, and if it is not an anomalous feature, it can be represented by 0.

[0047] Understandably, the collaborative detection model is a trained detection tool that uses a dual-detector approach to analyze the software features of the target software. The abnormal software detector compares and analyzes the input software features, determining whether these features are anomalous by matching them with known anomalous software features. The final output is a binary label with only two possible results: "yes" or "no." "Yes" indicates that the software feature is anomalous, meaning the software may exhibit abnormal behavior and could potentially harm the banking system; "no" indicates that the software feature is not anomalous.

[0048] While the anomalous software detector is performing its checks, the adversarial detector in the collaborative detection model also detects software features. The adversarial detector primarily targets anomalous software that has been carefully modified and disguised to attempt to bypass conventional detection. It calculates anomaly confidence based on various characteristics of the software features. Anomaly confidence can be a numerical value that reflects the degree of deviation between the software features and those of normal software; the higher the value, the more anomalous the software features, and the greater the likelihood of a security risk.

[0049] S103: Determine the detection results of the target software based on binary labels and anomaly confidence.

[0050] The detection results are used to indicate whether the target software can access the bank's system.

[0051] Understandably, after obtaining the binary label and the anomaly confidence score, these two pieces of information can be combined to determine the detection result of the target software. A weighted approach can be used to combine these two pieces of information. For example, a fixed weight can be assigned to the binary label, and the anomaly confidence score can be scaled proportionally and then assigned another weight. Finally, the weighted sums are calculated, and the detection result is determined based on a threshold. This approach combines the determinism (explicit judgment) of the binary label with the continuity (degree of anomaly) of the anomaly confidence score, making it suitable for scenarios where a balance needs to be struck between the reliability of the two types of detectors.

[0052] A threshold triggering method can also be used to combine the two pieces of information. When the anomaly confidence level exceeds the threshold and the binary label output is 1 or 0, the target software is determined to be abnormal software and access to the bank system is prohibited.

[0053] The abnormal software detection method provided in this embodiment obtains the software characteristics of the target software, which is software requesting access to the bank system. The software characteristics are input into a collaborative detection model. Based on the abnormal software detector in the collaborative detection model, a binary label is obtained for the software characteristics, and an anomaly confidence score is obtained based on the adversarial detector in the collaborative detection model. The binary label is used to characterize whether the software characteristic is abnormal. Based on the binary label and the anomaly confidence score, the detection result of the target software is determined, indicating whether the target software can access the bank system. This method, through multi-dimensional feature analysis and the collaborative work of two detectors, can accurately identify abnormal software and potentially abnormal software, ensuring the data security of the bank system and reducing the risks and losses caused by software security issues.

[0054] Figure 2 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 2 .like Figure 2 As shown, in Figure 1 Based on the examples, the process of generating the collaborative detection model is described in detail, including:

[0055] S201: Obtain software samples of abnormal software instances, and extract and process the software samples to obtain feature representations.

[0056] Understandably, when studying the process of detecting anomalous software, the first step is to obtain software samples of anomalous software instances. These samples can be obtained from multiple sources, such as various anomalous software samples that have been analyzed and labeled by professionals.

[0057] After obtaining the software sample, preprocessing can be performed first. Preprocessing may include unpacking and parsing the sample, as many malicious software programs use encryption, compression, or other methods to hide themselves. Unpacking allows access to their true code and structure. Next, data cleaning can be performed on the software content to remove irrelevant information.

[0058] After preprocessing, feature extraction is performed. Features can be extracted from multiple dimensions, such as function call sequences at the code level, and file operation and network communication behaviors at the behavioral level. Through these extraction operations, the software sample is transformed into a feature representation that a computer can understand and process, providing foundational data for subsequent analysis and modeling.

[0059] S202: Construct an input convex neural network as an adversarial detection unit and initialize the abnormal software detection unit.

[0060] Understandably, an i-layer Input Convex Neural Network (ICNN) can be constructed as an adversarial detection unit, where i represents the number of layers in the input convex neural network and can be set according to actual needs. Its recursive mapping formula is:

[0061]

[0062] Among them, through constraint parameters A value ≥0 is used to ensure the convexity of the network, and smooth activation functions such as linear units or sigmoid growth curves can be selected. Smooth activation functions help make network training more stable and better able to handle non-linear relationships in the data.

[0063] After constructing the adversarial detection unit, it is also necessary to initialize the abnormal software detection unit. The initialization process includes setting the initial weights and biases of the network. The initial values ​​of these parameters will have a significant impact on the training effect of the network. Typically, random initialization or initialization based on some prior knowledge can be used.

[0064] S203: Perturb the feature representation to obtain perturbed samples.

[0065] Understandably, perturbation of feature representations can be achieved using salt-and-pepper noise. Salt-and-pepper noise is a common type of noise that can randomly generate extreme points in an image or data. In practice, certain elements in the feature representation can be randomly selected with a certain probability, and their values ​​can be changed to extreme values ​​(such as maximum or minimum values) close to the boundaries of the feature's value range, thereby simulating the situation of being disturbed by noise.

[0066] This perturbation process yields perturbed samples. These samples simulate various disturbances and changes that anomalous software features may experience in real-world environments, enabling the trained detection model to better adapt to complex situations in real-world scenarios and improving its robustness.

[0067] S204: Generate adversarial examples based on feature representation and step-by-step hybrid attack algorithm.

[0068] As is understandable, the step-hybrid attack algorithm refers to a iterative mechanism that progressively optimizes the perturbation vector. It can incorporate attack algorithms such as PGD (Projected Gradient Descent) to find the optimal perturbation through multiple rounds of iteration. This allows the adversarial example to both deceive the model and maintain visual similarity to the original sample, making it an effective method for generating adversarial examples. Specifically, the step-hybrid attack algorithm starts with an initial perturbation vector, and in each adjustment step, adjusts the feature values ​​according to certain rules and an objective function.

[0069] The adjustments are made gradually, with each adjustment being small, to ensure that the generated adversarial examples can fool the detection model without deviating too much from the original samples and losing the original characteristics of the anomalous software. The adversarial examples generated using the step-by-step hybrid attack algorithm can be used to test the detection model's adversarial attack defense capabilities, helping technicians discover vulnerabilities and weaknesses in the detection model, thereby further improving and optimizing it.

[0070] S205: Based on software samples, perturbation samples, and adversarial samples, the adversarial detection unit and the abnormal software detection unit are trained in parallel to obtain a collaborative detection model.

[0071] Understandably, adversarial detection units can be modeled as a single-class classification task, defining a specific loss function, which is formalized as follows:

[0072]

[0073] Where pert=0 corresponds to the original anomalous software sample, and pert=1 corresponds to the salt-and-pepper noise perturbation sample. By minimizing the loss function, the adversarial detection unit can learn to distinguish between the original sample and the perturbed sample affected by noise, thereby identifying possible adversarial samples.

[0074] Meanwhile, in terms of high-dimensional feature optimization, the Wasserstein distance quantization distribution perturbation can be utilized, and its formula is expressed as:

[0075]

[0076] This is crucial for the high-dimensional transaction feature space of banking systems (such as interface call frequency, permission requests, etc.), because the transaction features of banking systems are high-dimensional and complex. The Wasserstein distance can better measure the differences between different sample distributions, ensuring that the optimization process can converge in these high-dimensional feature spaces, thereby enabling the constructed adversarial detector to work effectively.

[0077] For the anomalous software detection unit, it needs to learn to accurately identify the characteristics of anomalous software from various samples. By continuously adjusting the network parameters, the anomalous software detection unit can classify all samples as accurately as possible.

[0078] After multiple rounds of parallel training, when the model's performance reaches the preset standard, an anomalous software detector and an adversarial example detector can be obtained. The anomalous software detector can accurately identify anomalous software, while the adversarial example detector can detect samples generated through adversarial attacks, thereby improving the overall collaborative detection model's ability to detect anomalous software and its adversarial variants.

[0079] The anomalous software detection method provided in this embodiment acquires anomalous software samples and preprocesses them to extract features. An input convex neural network is constructed as an adversarial detection unit, and the anomalous software detection unit is initialized. Salt-and-pepper noise is used to perturb the features to generate perturbed samples, and a step-hybrid attack algorithm is used to generate adversarial samples. Two detection units are then trained in parallel based on these three types of samples, ultimately resulting in an anomalous software detector and an adversarial sample detector. This process leverages the input convex neural network to ensure network convexity and improve stability, utilizes salt-and-pepper noise and the step-hybrid attack algorithm to simulate complex interference scenarios to enhance model robustness, and combines a specific loss function and Wasserstein distance for optimized training. This enables the detector to accurately identify anomalous software and its adversarial variants, effectively improving the monitoring model's ability to detect anomalous software.

[0080] Figure 3 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 3 .like Figure 3 As shown, in Figure 1Based on the examples, the process of generating adversarial examples is described in detail, including:

[0081] S301: Generate an initial perturbation vector based on feature representation.

[0082] Understandably, the randomly generated initial perturbation vector is the starting point for iteratively searching for adversarial examples. The initial perturbation vector introduces an initial, controllable direction of change into the sample space. Generating the initial perturbation vector can typically employ randomization methods, but this randomization needs to be limited to a reasonable range. For example, a set of values ​​with the same dimension as the feature representation can be randomly generated using a uniform or normal distribution; the magnitude and direction of these values ​​represent different degrees of change to the original features.

[0083] S302: Generates multiple candidate perturbation vectors based on the initial perturbation vector and various preset attack methods.

[0084] Understandably, generating multiple candidate perturbation vectors involves using the current perturbation vector (initial perturbation vector) and various attack methods (such as attacks based on different norm constraints), with each attack method generating candidate perturbation vectors that meet its own constraints. For example, Norm attacks tend to generate sparse perturbations, i.e., adjustments are made on a few feature dimensions; Norm attacks tend to generate perturbations uniformly across the entire system; Norm attacks tend to apply maximum perturbation across each feature dimension. By fusing these attack methods, candidate vectors that meet different constraints can be generated separately.

[0085] The formula for generating a new candidate perturbation vector based on the current perturbation vector and gradient direction is expressed as follows:

[0086]

[0087] Where t is the number of iterations, x is the input sample, and p is the norm label. Proj represents the projection operation, ensuring that the perturbed sample is within the allowable range. It's the step length. and These are the lower and upper bounds of the input sample x.

[0088] S303: Determine the target perturbation vector based on the scoring criteria corresponding to the preset attack method and multiple candidate perturbation vectors.

[0089] Understandably, after generating multiple candidate perturbation vectors, the target perturbation vector most likely to successfully deceive the detection model can be selected. This requires evaluation based on the scoring criteria corresponding to the preset attack method. The scoring criteria can comprehensively consider multiple factors, such as the probability that the candidate perturbation vector causes the detection model to misclassify, and the degree of change to the original sample.

[0090] By quantitatively evaluating and ranking multiple candidate perturbation vectors according to scoring criteria, the candidate perturbation vector with the highest score can be selected as the target perturbation vector. This target perturbation vector represents the sample change pattern that is most likely to effectively attack the detection model under the current attack method and scoring criteria.

[0091] Choose a target perturbation vector from multiple candidate perturbation vectors that maximizes the model output. The corresponding formula is:

[0092]

[0093] in, Output the model (e.g., the loss function). These are the parameters of the model. This represents the perturbation during iteration. λ is the regularization parameter. It is a regularization term used to control the complexity of the perturbation.

[0094] S304: Add the target perturbation vector to the feature representation to generate adversarial examples.

[0095] Understandably, adding the target perturbation vector to the original feature representation is equivalent to making a targeted modification to the original feature representation. During the addition process, it's crucial to ensure that the target perturbation vector and the original feature representation maintain dimensionality consistency. This is typically achieved through vector addition.

[0096] For example, suppose the feature representation is an n-dimensional vector and the target perturbation vector is also an n-dimensional vector. Adding the corresponding elements of the two vectors yields the perturbated new feature representation. The sample corresponding to this new feature representation is called the adversarial example. The adversarial example is similar to the original sample, but because the target perturbation vector is added, it changes in the feature space that the detection model focuses on, making it difficult for the detection model to correctly identify its true class.

[0097] The process of generating adversarial examples described above can be iterated: the newly generated adversarial examples can be used as a benchmark to enter the next round of iteration, repeating the process of candidate generation, scoring and screening, and iterative updates until the termination condition is met (such as reaching the maximum number of iterations or the convergence of the perturbation vector).

[0098] At the beginning of each iteration, the gradient direction can be calculated to determine the direction of the update perturbation. The calculation formula is as follows:

[0099]

[0100] in, It is the gradient of the perturbation.

[0101] The abnormal software detection method provided in this embodiment randomly generates an initial perturbation vector from the original feature representation. Starting from this, it combines multiple preset attack methods to generate several candidate perturbation vectors. Then, based on the scoring criteria corresponding to the preset attack methods, it determines the target perturbation vector from the candidate vectors and finally adds it to the feature representation to obtain the adversarial example. This method can generate diverse and targeted adversarial examples, effectively testing the robustness of the detection model, helping to discover model vulnerabilities, and providing crucial evidence for optimizing the detection model and improving its ability to resist adversarial attacks in real-world scenarios.

[0102] Figure 4 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 4 .like Figure 4 As shown, in Figure 1 Based on the implementation examples, the process of obtaining a collaborative detection model by combining multiple samples with parallel training of adversarial detection units and abnormal software detection units is described in detail, including:

[0103] S401: Input the software sample, perturbation sample, and adversarial sample into the adversarial detection unit and the abnormal software detection unit respectively, and obtain the classification result of each sample in the two detection units.

[0104] Understandably, when these different types of samples are input into the abnormal software detection unit, the abnormal software detection unit can analyze and judge the samples according to its internal pre-included algorithms, and output the classification result of whether the sample belongs to abnormal software or normal software.

[0105] These samples will also be input into the adversarial detection unit, which will focus on determining whether a sample is an adversarial sample, that is, whether it has been artificially modified to evade detection. It may look for some anomalous features in the sample, such as unnatural code structure, abnormal behavior sequences, etc., and thus output a classification result of whether the sample is an adversarial sample or a non-adversarial sample.

[0106] S402: Determine the classification error of each detection unit based on the classification results and the true labels of the samples.

[0107] Understandably, determining the classification error of a detection unit can be used to evaluate its performance. Common error calculation methods include mean squared error and cross-entropy loss function.

[0108] Mean squared error (MSE) is suitable for regression problems. In anomaly detection and adversarial detection, the detection problem is viewed as a regression prediction of the probability that a sample belongs to a certain category. In this case, MSE can be chosen to measure the difference between the predicted probability and the true probability. Specifically, MSE measures the error by calculating the squared difference between the predicted value and the true value.

[0109] The cross-entropy loss function is suitable for classification problems, and is more commonly used in classifying anomalous software and adversarial examples. It measures error by calculating the cross-entropy between the predicted probability distribution and the true probability distribution. The cross-entropy loss function provides a better measure of the difference between predicted probabilities and true labels in classification problems.

[0110] S403: The classification errors of the two detection units are weighted and summed to obtain the joint loss function.

[0111] Understandably, weighted summation allows for a more comprehensive consideration of the performance of the two detection units, leading to more complete model training. The weighting coefficients can be adjusted based on the importance and performance of the two detection units. The joint loss function is the sum of the classification errors of the two detection units multiplied by their respective weighting coefficients. By minimizing this joint loss function, the model parameters can be continuously adjusted to improve its detection performance.

[0112] S404: Determine the error of the output layer neurons of the detection unit based on the joint loss function.

[0113] Understandably, starting from the output layer, the error of each neuron in the output layer is calculated based on the loss function; this is the starting point of the backpropagation algorithm. For classification problems, the output layer error is the difference between the predicted probability and the true label. The error of each neuron is usually obtained by calculating the partial derivative of the loss function with respect to that neuron's output.

[0114] S405: Determine the first gradient information of the output layer weights and biases based on the error.

[0115] Understandably, for weight parameters, gradient information can be obtained from the error through the chain rule. The partial derivative of each weight with respect to the loss is equal to the product of the activation value of the previous neuron and the error of the current neuron. The gradient of the bias is directly equal to the error of the neuron (since the derivative of the bias is 1). The first gradient information is used to guide the update method of the output layer parameters.

[0116] S406: Backpropagate the first gradient information to the hidden layer of the detection unit to determine the weights and biases of the hidden layer neurons and the second gradient information.

[0117] Understandably, the chain rule can be used to backpropagate the gradient information from the output layer to the hidden layer. For each neuron in the hidden layer, the partial derivative of its output with respect to the input of the next layer's neuron needs to be calculated, and multiplied with the gradient propagated back from the next layer to obtain the total partial derivative of that neuron with respect to the loss function.

[0118] By calculating layer by layer, starting from the output layer, the gradient information is backpropagated to each hidden layer sequentially. For each neuron in the hidden layer, the above-mentioned partial derivative calculation process is performed to obtain the total partial derivative of that neuron with respect to the loss function. Then, based on these partial derivatives, the gradient of the weights and biases of each neuron in the hidden layer is calculated, which is the second gradient information.

[0119] S407: Integrate the first gradient information and the second gradient information to obtain the gradient vector.

[0120] The gradient vector is used to indicate the direction of parameter updates for the detection unit.

[0121] Understandably, after calculating the gradients of the output and hidden layers, summing the gradients of all parameters yields a unified vector for model optimization. The integration process involves concatenating and superimposing the first and second gradient information from the output layer at corresponding positions according to the parameter structure to obtain the gradient vector.

[0122] S408: Update the parameters of the two detection units based on the gradient vector to obtain a collaborative detection model.

[0123] Understandably, based on the calculated gradient vector, gradient descent or other optimization algorithms (such as stochastic gradient descent, momentum gradient descent, Adam optimizer, etc.) can be used to update the weights and bias parameters in the network, thereby obtaining the abnormal software detection model and the adversarial training model.

[0124] Taking stochastic gradient descent as an example, a sample is randomly selected in each iteration to calculate the gradient. The parameters are updated based on the gradient, gradually minimizing the loss function. The update formula is:

[0125]

[0126]

[0127] Where j represents the iteration number, Indicates the learning rate. Let be the perturbation vector after T perturbations. The choice of learning rate is crucial. If the learning rate is too large, it may lead to over-updating of parameters and missing the optimal solution; if the learning rate is too small, parameter updates will be slow, resulting in excessively long training times. By continuously iterating through this process, the loss function can be gradually minimized, thereby improving the model's detection performance and generalization ability.

[0128] Figure 5 A flowchart illustrating an abnormal software detection method provided in this application embodiment. Figure 5 .like Figure 5 As shown, in Figure 1 Based on the examples, the process of determining the detection results of the target software is described in detail, including:

[0129] S501: Determine whether the anomaly confidence level is greater than the risk control trigger threshold. If yes, proceed to step S503; otherwise, proceed to step S502.

[0130] Understandably, anomaly confidence represents the likelihood of detecting anomalies in the target software during the detection process. The risk control trigger threshold, on the other hand, is a pre-set standard value, which is determined by comprehensively considering factors such as extensive historical data, risk assessment, and security strategies.

[0131] When the anomaly confidence level is greater than the risk control trigger threshold, it means that the target software is likely to have an anomaly and may pose a potential threat to the bank's system, requiring further in-depth analysis and handling. Conversely, if the anomaly confidence level is less than or equal to the risk control trigger threshold, it means that the target software is relatively unlikely to have an anomaly and has not yet reached the level where risk control measures need to be taken.

[0132] S502: Determine that the detection result is the label result corresponding to the binary label.

[0133] Understandably, binary labels are a simplified classification method that can simply divide the software state into two cases, such as "yes" and "no" (or other two states with clear distinguishing significance). In this case, since the anomaly confidence level does not exceed the threshold, the detection result indicated by the binary label can be directly used as the final detection result according to preset rules and logic. This processing method is simple and direct, and can quickly make a preliminary judgment on the software state.

[0134] If the binary label indicates that the target software is abnormal, then the target software needs to be intercepted. This method can ensure the security and stability of the system. Only when both detectors indicate that the target software is normal software is the target software allowed to access the bank system, thereby enhancing the security of the system.

[0135] S503: Determine whether the result corresponding to the binary label is the preset label result. If yes, proceed to step S504; otherwise, proceed to step S505.

[0136] The preset label result refers to a binary label indicating that the target software is abnormal software. The label result can be "1" or "yes".

[0137] Understandably, if the anomaly confidence level exceeds the risk control trigger threshold, the target software is likely problematic. Anomalous software typically exhibits abnormal behaviors such as intentional sabotage, data theft, and interference with normal system operation. Binary labels categorize the software state, and further evaluation of the target software using the specific definitions of these binary labels ensures the accuracy of the detection results.

[0138] S504: The detection result indicates that the target software is abnormal software, and access to the bank system by the target software is prohibited.

[0139] Understandably, if the result of the binary label indicates that the target software is abnormal, then it can be determined that the software is abnormal, and a series of measures should be taken immediately to ensure the data and information security of the banking system.

[0140] Preventing target software from accessing the bank's system is a primary and effective measure, because once malicious software enters the system, it can spread rapidly, steal sensitive data, or cause serious damage. By blocking its access, the connection between the malicious software and the system can be effectively severed, preventing further harm.

[0141] Simultaneously, a risk control mechanism can be activated. This mechanism is a comprehensive protection system that may include real-time system status monitoring, enhanced access control, and the initiation of emergency response procedures, among other aspects. Once activated, the bank's system can promptly detect and address any potential security risks, ensuring the system's relative stability and security.

[0142] S505: Determine the detection result as an early warning level and activate the software early warning according to the early warning level.

[0143] Understandably, if the result of the binary label does not indicate that the target software is abnormal, the detection result is determined to be at the warning level. The warning level is a signal used to alert the user that the detection result is abnormal. The warning level can be activated when the target software has potential risks, but not enough to be directly identified as abnormal software, to remind users and relevant technical personnel to conduct further investigation and assessment.

[0144] The calculation formula for the above judgment process is expressed as follows:

[0145]

[0146] Where z represents the software characteristics of the target software. To counter the output of the detector, This is the output of the anomaly detection software. The binary labels are 1 and 0. "Not sure" indicates a warning level, meaning the detection result is uncertain, an anomaly exists, and manual judgment is required.

[0147] The abnormal software detection method provided in this embodiment determines the detection result by judging whether the anomaly confidence level exceeds the risk control trigger threshold. If it does not exceed the threshold, the detection result is determined by the binary label result. If it exceeds the threshold, the method further judges whether the binary label points to abnormal software. If it does, the software is identified as abnormal, its access to the system is blocked, and the risk control mechanism is activated. Otherwise, it is set to the warning level, prompting the user for manual judgment. This method, through a multi-level and refined judgment process, can accurately distinguish between normal, abnormal, and abnormal software states, avoiding misjudgment and mishandling of non-abnormal software and ensuring normal software access to the system. At the same time, timely identification of abnormal software and the implementation of blocking and protective measures effectively protect the security of the bank system and improve the accuracy and timeliness of security protection.

[0148] Figure 6 This is a schematic diagram of the structure of an abnormal software detection device provided in this application. Figure 6 As shown, this application provides an abnormal software detection device 600, which includes:

[0149] The acquisition module 601 is used to acquire the software characteristics of the target software, which is the software that requests access to the bank system.

[0150] The determination module 602 is used to input software features into the collaborative detection model, obtain binary labels for software features based on the abnormal software detector in the collaborative detection model, and obtain the anomaly confidence of software features based on the adversarial detector in the collaborative detection model. The binary labels are used to characterize whether the software features are abnormal features.

[0151] The determination module 602 is used to determine the detection result of the target software based on the binary label and the anomaly confidence level. The detection result is used to indicate whether the target software can access the banking system.

[0152] Optionally, the device may also include: a generation module 603 and a processing module 604;

[0153] The acquisition module 601 is also used to acquire software samples of abnormal software instances and to extract and process the software samples to obtain feature representations;

[0154] The generation module 603 is used to construct the input convex neural network as the adversarial detection unit and initialize the abnormal software detection unit;

[0155] Processing module 604 is used to perturb the feature representation to obtain perturbed samples;

[0156] The determination module 602 is used to generate adversarial examples based on feature representation and step-by-step hybrid attack algorithm;

[0157] The processing module 604 is used to train the adversarial detection unit and the abnormal software detection unit in parallel based on software samples, perturbation samples and adversarial samples to obtain a collaborative detection model.

[0158] Optionally, the generation module 603 is specifically used to generate an initial perturbation vector based on the feature representation;

[0159] The generation module 603 is specifically used to generate multiple candidate perturbation vectors based on the initial perturbation vector and multiple preset attack methods;

[0160] The determination module 602 is specifically used to determine the target perturbation vector based on the scoring criteria corresponding to the preset attack method and multiple candidate perturbation vectors;

[0161] The generation module 603 is specifically used to add the target perturbation vector to the feature representation to generate adversarial examples.

[0162] Optionally, the determining module 602 is specifically used to input the software sample, the perturbation sample, and the adversarial sample into the adversarial detection unit and the abnormal software detection unit, respectively, to obtain the classification result of each sample in the two detection units;

[0163] The determination module 602 is specifically used to determine the classification error of each detection unit based on the classification results and the true labels of the samples;

[0164] The processing module 604 is specifically used to perform a weighted summation of the classification errors of the two detection units to obtain the joint loss function;

[0165] The processing module 604 is specifically used to optimize and adjust the parameters of the two detection units according to the joint loss function to obtain a collaborative detection model.

[0166] Optionally, the determination module 602 is specifically used to determine the error of the output layer neurons of the detection unit based on the joint loss function;

[0167] The determination module 602 is specifically used to determine the first gradient information of the output layer weights and biases based on the error;

[0168] The determination module 602 is specifically used to backpropagate the first gradient information to the hidden layer of the detection unit to determine the weights and biased second gradient information of the hidden layer neurons.

[0169] The processing module 604 is specifically used to integrate the first gradient information and the second gradient information to obtain a gradient vector, which is used to indicate the update direction of the detection unit parameters.

[0170] The processing module 604 is specifically used to update the parameters of the two detection units based on the gradient vector to obtain a collaborative detection model.

[0171] Optionally, the device may also include: a judgment module 605;

[0172] Module 605 is used to determine whether the anomaly confidence level is greater than the risk control trigger threshold;

[0173] The determination module 602 is specifically used to determine the detection result as the label result corresponding to the binary label when the anomaly confidence level is not greater than the risk control trigger threshold.

[0174] The judgment module 605 is used to determine whether the result corresponding to the binary label is the preset label result when the abnormal confidence level is greater than the risk control trigger threshold.

[0175] The determination module 602 is specifically used to determine that the detection result is that the target software is abnormal software when the result corresponding to the binary label is the preset label result, and at the same time prohibit the target software from accessing the bank system;

[0176] The determination module 602 is specifically used to determine the detection result as an early warning level when the result corresponding to the binary label is not the preset label result, and to activate the software early warning according to the early warning level. The early warning level is used to indicate to the user that the detection result is abnormal.

[0177] The abnormal software detection device provided in this application embodiment has a similar implementation principle and technical effect to the implementation of each part of the aforementioned abnormal software detection method, and will not be described again here.

[0178] Figure 7 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 7 This application provides an electronic device 700, which includes a receiver 701, a transmitter 702, a processor 703, and a memory 704.

[0179] Receiver 701 is used to receive commands and data;

[0180] Transmitter 702 is used to send commands and data;

[0181] Memory 704 is used to store instructions executed by the computer;

[0182] The processor 703 is used to execute computer execution instructions stored in the memory 704 to implement the various steps of the abnormal software detection method in the above embodiments. For details, please refer to the relevant descriptions in the foregoing embodiments of the abnormal software detection method.

[0183] Optionally, the memory 704 described above can be either standalone or integrated with the processor 703.

[0184] When the memory 704 is set up independently, the electronic device also includes a bus for connecting the memory 704 and the processor 703.

[0185] The implementation principle and technical effects of the electronic device provided in this embodiment can be found in the foregoing embodiments, and will not be repeated here.

[0186] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method of any of the foregoing embodiments.

[0187] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method of any of the foregoing embodiments.

[0188] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0189] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0190] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0191] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or as software program modules.

[0192] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0193] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0194] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0195] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0196] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting abnormal software, characterized in that, include: Obtain the software characteristics of the target software, which is the software that requests access to the bank system; The software features are input into a collaborative detection model. The binary label of the software features is obtained based on the abnormal software detector in the collaborative detection model, and the anomaly confidence of the software features is obtained based on the adversarial detector in the collaborative detection model. The binary label is used to characterize whether the software features are abnormal features. Based on the binary label and the anomaly confidence level, the detection result of the target software is determined, and the detection result is used to indicate whether the target software can access the bank system.

2. The method according to claim 1, characterized in that, Before obtaining the software sample of the target software, the method further includes: Obtain software samples of abnormal software instances, and extract features from the software samples to obtain feature representations; Construct an input convex neural network as an adversarial detection unit and initialize the abnormal software detection unit; The feature representation is perturbed to obtain perturbed samples; Adversarial samples are generated based on the aforementioned feature representation and the step-by-step hybrid attack algorithm; Based on the software samples, the perturbation samples, and the adversarial samples, the adversarial detection unit and the abnormal software detection unit are trained in parallel to obtain a collaborative detection model.

3. The method according to claim 2, characterized in that, The generation of adversarial samples based on the feature representation and the step-by-step hybrid attack algorithm includes: Based on the feature representation, an initial perturbation vector is generated; Based on the initial perturbation vector and various preset attack methods, multiple candidate perturbation vectors are generated; The target perturbation vector is determined based on the scoring criteria corresponding to the preset attack method and the multiple candidate perturbation vectors. The target perturbation vector is added to the feature representation to generate adversarial examples.

4. The method according to claim 3, characterized in that, The parallel training of the adversarial detection unit and the abnormal software detection unit to obtain a collaborative detection model includes: The software sample, the perturbation sample, and the adversarial sample are respectively input into the adversarial detection unit and the abnormal software detection unit to obtain the classification result of each sample in the two detection units; Based on the classification results and the true labels of the samples, the classification error of each detection unit is determined; The classification errors of the two detection units are weighted and summed to obtain the joint loss function; Based on the joint loss function, the parameters of the two detection units are optimized and adjusted to obtain a collaborative detection model.

5. The method according to claim 4, characterized in that, The step of optimizing and adjusting the parameters of the two detection units according to the joint loss function to obtain a collaborative detection model includes: The error of the output layer neurons of the detection unit is determined based on the joint loss function. Based on the error, determine the first gradient information of the output layer weights and biases; The first gradient information is backpropagated to the hidden layer of the detection unit to determine the weights and biased second gradient information of the neurons in the hidden layer. The first gradient information and the second gradient information are integrated to obtain a gradient vector, which is used to indicate the update direction of the detection unit parameters. Based on the gradient vector, the parameters of the two detection units are updated to obtain a collaborative detection model.

6. The method according to claim 1, characterized in that, The step of determining the detection result of the target software based on the binary label and the anomaly confidence score includes: Determine whether the anomaly confidence level is greater than the risk control trigger threshold; If the anomaly confidence level is not greater than the risk control trigger threshold, the detection result is determined to be the label result corresponding to the binary label; If the abnormal confidence level is greater than the risk control trigger threshold, determine whether the result corresponding to the binary label is a preset label result; If the result of the binary label is the preset label result, the detection result is determined to be that the target software is abnormal software, and the target software is prohibited from accessing the bank system. If the result corresponding to the binary label is not a preset label result, the detection result is determined to be a warning level, and a software warning is activated according to the warning level. The warning level is used to indicate to the user that the detection result is abnormal.

7. An abnormal software detection device, characterized in that, include: The acquisition module is used to acquire the software characteristics of the target software, which is the software that requests access to the bank system; The determination module is used to input the software features into the collaborative detection model, obtain a binary label for the software features based on the abnormal software detector in the collaborative detection model, and obtain the anomaly confidence of the software features based on the adversarial detector in the collaborative detection model. The binary label is used to characterize whether the software features are abnormal features. The determination module is used to determine the detection result of the target software based on the binary label and the anomaly confidence level, and the detection result is used to indicate whether the target software can access the bank system.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images