Ransomware dynamic detection system based on multi-modal large model
By using a multimodal large-scale ransomware dynamic detection system, which combines multi-dimensional data collection, deep learning, and rule matching, high-precision, rapid response, and self-optimization against ransomware are achieved. This solves the problem of insufficient detection capabilities for new ransomware in existing technologies and improves the accuracy and adaptability of detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-15
- Publication Date
- 2026-03-31
AI Technical Summary
Existing ransomware detection methods rely on known virus signature libraries, making it difficult to deal with new or variant ransomware. Furthermore, single-modal deep learning models struggle to fully capture the multi-dimensional and complex malicious characteristics of ransomware, resulting in high false positive rates and insufficient ability to identify unknown attack patterns.
A ransomware dynamic detection system based on a multimodal large model is adopted. The data acquisition module captures multi-dimensional behavioral data, the dynamic analysis module runs the program in an isolated environment, the multimodal feature extraction module constructs a unified multimodal feature vector, and uses a pre-trained large model to perform deep correlation analysis and pattern recognition. The system is combined with rule matching and feedback learning modules for self-optimization.
It significantly enhances the detection capabilities for new and variant ransomware, improves the accuracy and adaptability of detection, can proactively identify complex malicious patterns, and continuously adapts to new threats through a self-optimization mechanism, reducing potential losses.
Smart Images
Figure CN121765722A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and more specifically, to a ransomware dynamic detection system based on a multimodal large model. Background Technology
[0002] Ransomware is a highly dangerous type of malware that extorts users by encrypting or locking their files or systems. Traditional ransomware detection methods mainly include signature-based static scanning and behavior-based dynamic analysis. Static scanning relies on signature libraries of known viruses, making it difficult to deal with new, variant, or obfuscated ransomware. Dynamic analysis runs the program in a controlled environment and monitors its behavior, but it usually relies on predefined, limited rules or single-modal characteristics (such as focusing only on file operation sequences), resulting in a high false positive rate and insufficient ability to identify unknown or complex attack patterns.
[0003] With the development of artificial intelligence technology, deep learning models have shown potential in malware classification. However, existing deep learning models based on a single modality are struggling to fully capture the complex and interconnected malicious characteristics of ransomware across multiple dimensions, including file systems, networks, and process behavior.
[0004] Therefore, there is an urgent need for a ransomware dynamic detection system that can comprehensively utilize multi-dimensional information generated during program execution and perform deep correlation analysis and pattern recognition through deep learning, in order to achieve high precision and strong adaptability. Summary of the Invention
[0005] The purpose of this invention is to overcome the shortcomings of existing technologies and propose a ransomware dynamic detection system based on a multimodal large model.
[0006] To address the aforementioned technical problems, the present invention adopts the following technical solution: A ransomware dynamic detection system based on a multimodal large model includes: The data acquisition module is used to dynamically capture multi-dimensional behavioral data streams generated during the runtime of the program under test in a monitored computing environment. A dynamic analysis module, connected to the data acquisition module, is used to load and run the program to be detected in a controlled, isolated analysis environment, and to receive the multi-dimensional behavioral data stream from the data acquisition module. A multimodal feature extraction module, connected to the dynamic analysis module, is used to parse and fuse the multidimensional behavioral data stream, extract and construct a unified multimodal feature vector including static attribute features, dynamic behavioral sequence features and runtime context features; The detection and judgment module is connected to the multimodal feature extraction module. It has a built-in pre-trained multimodal large model for receiving the unified multimodal feature vector, performing deep correlation analysis and pattern recognition through the multimodal large model, and outputting intelligent detection results and corresponding model confidence scores on whether the program to be detected is ransomware.
[0007] As a further aspect of the present invention: the data acquisition module includes: The decoy file management unit is used to generate and deploy multiple decoy files with highly enticing file attributes in the key directories and non-system disk partitions of the monitored environment. The file operation monitoring unit is used to monitor and record the operations of the program to be detected on the file system in real time. The objects of the operation monitoring include the decoy file, regular user files and system directories. A network behavior acquisition unit is used to capture network connection requests and data transmission characteristics initiated by the program to be detected. The system call tracing unit is used to collect the system call sequence generated by the program under test during execution.
[0008] As a further aspect of the present invention, the decoy file generated by the decoy file management unit has at least one of the following characteristics: the file extension is a common document or database type, the file content is randomly generated high-entropy data, and the file path is located in a directory frequently accessed by the user.
[0009] As a further aspect of the present invention, the file operation monitoring unit records at least the following operations: file reading, encryption, renaming, deletion, and large-scale input to the recycle bin.
[0010] As a further aspect of the present invention: the detection and determination module further includes a rule matching unit and a comprehensive decision-making unit. The rule matching unit is directly connected to the data acquisition module and is used to quickly analyze the real-time behavioral data captured by the data acquisition module based on a preset anomaly comparison algorithm and output the rule matching detection results.
[0011] Furthermore, the anomaly comparison algorithm includes at least: unauthorized access to or modification of the decoy file, batch regular modification of filenames, a sudden increase in the number of files input to the recycle bin within a short period of time, or process behavior matching known ransomware characteristics in the malicious signature database.
[0012] The integrated decision-making unit is connected to both the multimodal large model and the rule matching unit, and is used to receive the intelligent detection results and the rule matching detection results.
[0013] Furthermore, the integrated decision-making unit is configured to determine that the program to be detected is ransomware if the rule matching detection result indicates an anomaly, or if the model confidence of the intelligent detection result exceeds a preset threshold.
[0014] As a further aspect of the present invention: the system further includes a feedback learning module. The feedback learning module is connected to the detection and judgment module and is used to collect the final judgment result of the comprehensive decision-making unit, its corresponding multi-dimensional behavioral data stream and unified multimodal feature vector as feedback data, and use the feedback data to perform incremental training and optimization of the multimodal large model, as well as to dynamically update the thresholds of the malicious feature library and anomaly comparison algorithm in the rule matching unit.
[0015] As a further aspect of the present invention, the system further includes a response handling module, which is connected to the detection and judgment module and is used to execute a preset response action when the program to be detected is determined to be ransomware.
[0016] Furthermore, the response actions include: generating an alert containing process information, associated files, and rule violations; blocking further execution of the process and network connection; and initiating a backup and recovery process for the maliciously encrypted files.
[0017] Compared with the prior art, the advantages of this invention are: I. This solution integrates multi-dimensional dynamic data such as file operations, network behavior, and system calls, and constructs a unified multimodal feature vector, providing the model with more comprehensive and richer analytical materials, which helps to identify complex, cross-modal malicious patterns. By using a pre-trained multimodal large model for deep correlation analysis and pattern recognition, it can learn deeper and more abstract behavioral characteristics of ransomware, significantly improving the detection and generalization capabilities for new and variant ransomware.
[0018] Second, this solution, by deploying highly enticing bait files, can proactively attract and expose ransomware behaviors targeting files, thereby improving the targeting and effectiveness of behavioral monitoring.
[0019] Third, this solution combines rule-based rapid response with deep intelligent analysis based on large models to form a dual detection mechanism that combines speed and slowness and complements each other's advantages. While ensuring real-time detection, it greatly improves the accuracy of detection and the ability to discover unknown threats.
[0020] Fourth, through the feedback learning module, this solution enables the system to continuously optimize itself using the latest detection results and samples, dynamically update the model and rule base, and enable the system to continuously evolve and adapt to new threats; the integrated automated response and handling process can quickly take measures such as isolation, blocking, and recovery after a threat is detected, effectively curbing the destructive behavior of ransomware and reducing potential losses. Attached Figure Description
[0021] Figure 1 This is a system block diagram of the present invention; Figure 2 This is a system block diagram of the detection and judgment module of the present invention; Figure 3 This is a system block diagram of the data acquisition module of the present invention; Figure 4 This is a decision-making flowchart for the integrated decision-making unit of the present invention. Detailed Implementation
[0022] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0023] Please see Figure 1-4 A ransomware dynamic detection system based on a multimodal large model includes: Data acquisition module: Used to dynamically capture multi-dimensional behavioral data streams generated during the runtime of the program under monitoring in a monitored computing environment. For example... Figure 3 As shown, this module includes: a decoy file management unit, a file operation monitoring unit, a network behavior acquisition unit, and a system call tracing unit, enabling fine-grained data acquisition from multiple levels such as files, networks, and systems.
[0024] The decoy file management unit pre-deploys multiple decoy files with highly enticing file attributes in key directories and non-system disk partitions (document directories, desktops, shared folders, and non-system partition root directories, etc.) of the monitored environment. These files are named things like "Financial Report.docx" and "Customer Data.xlsx," and are filled with randomly generated high-entropy data. The file operation monitoring unit uses hook technology or file system filtering to capture in real-time read, write, encryption, renaming, and deletion operations on all files (including decoy and real files), recording the operation object, timestamp, and result. The network behavior acquisition unit collects network connections initiated by the monitored process, recording the target IP / port, transmission protocol, and packet characteristics. The system call tracing unit records the system call sequence and its parameters generated during program execution.
[0025] Dynamic Analysis Module: Provides a secure sandbox environment for executing programs under test, ensuring that their malicious behavior does not affect the real host system. Simultaneously, it performs preliminary integration and time synchronization of the raw, multi-dimensional behavioral data streams acquired by the data acquisition module.
[0026] The multimodal feature extraction module performs deep processing on the behavior data stream integrated by the dynamic analysis module, extracting key features from the raw logs: static attribute features (such as file information), dynamic behavior sequence features (such as time-sorted file encryption operation sequences and specific system call sub-sequences), and runtime context features (such as attempting to connect to suspicious domains after encrypting files). These heterogeneous features are then mapped to a unified vector space using techniques such as embedding, and concatenated or fused through attention mechanisms to form a unified multimodal feature vector that comprehensively represents program behavior.
[0027] The detection and judgment module, connected to the multimodal feature extraction module, incorporates a pre-trained multimodal large-scale model (e.g., based on Transformer or graph neural networks). This model receives a unified multimodal feature vector and has been pre-trained on a large number of labeled malware and normal software samples, enabling it to understand the complex relationships between cross-modal features. Through deep correlation analysis and pattern recognition, it outputs intelligent detection results regarding whether the program to be detected is ransomware, along with the corresponding model confidence level.
[0028] In addition, such as Figure 2 As shown, the detection and judgment module also integrates a rule matching unit and a comprehensive decision-making unit. The rule matching unit directly connects to the real-time data stream of the data acquisition module, runs an efficient anomaly comparison algorithm, quickly analyzes the real-time behavioral data captured by the data acquisition module, and outputs the rule matching detection results.
[0029] Furthermore, the anomaly comparison algorithm includes at least the following: unauthorized access to or modification of decoy files, regular batch modification of filenames, a sudden increase in the number of files sent to the recycle bin within a short period of time, or process behavior matching known ransomware characteristics in the malicious signature database. For example, once it detects that a program is massively modifying file extensions, rapidly encrypting multiple decoy files, or deleting a large number of files to the recycle bin within a short period of time, the rule matching unit will immediately generate a high-priority "rule matching detection result" (such as "suspected ransomware behavior detected").
[0030] The integrated decision-making unit is connected to both the multimodal large model and the rule matching unit, and is used to receive intelligent detection results and rule matching detection results. For example... Figure 4 As shown, the decision-making strategy configuration of the integrated decision-making unit is as follows: 1) If the rule matching unit gives a highly suspicious alarm, it will be directly judged as malicious, so as to achieve a rapid response; 2) If rule matching is not triggered, but the confidence level given by the large model exceeds the threshold (e.g., 90%), it is judged as malicious, and a rapid response is achieved; 3) If the two results conflict, they can be handled by weighting the confidence level or submitting for manual review. Finally, the comprehensive decision-making unit outputs a final determination on whether the program to be detected is ransomware.
[0031] Feedback Learning Module: This module stores the final judgment result, corresponding raw behavioral data, and feature vectors from each detection into a sample library. Periodically or after accumulating a certain number of samples, these new samples are used to incrementally fine-tune the multimodal large model, enabling it to learn the latest threat patterns. Simultaneously, it analyzes malicious patterns appearing in the new samples that are not covered by the rule base, extracts and updates them to the malicious feature library of the rule matching unit, or adjusts the threshold of the anomaly comparison algorithm.
[0032] The response and handling module, connected to the detection and judgment module, starts immediately upon receiving the final malicious determination. It first generates detailed alert information, including process information, associated files, and violated rules, and notifies the administrator. Subsequently, it automatically terminates the malicious process and its derived child processes, blocking any network connections established by the malicious process. Furthermore, if the system has file backup or version snapshot functionality deployed, this module can trigger a process to restore files modified or encrypted by the malicious process.
[0033] In summary, through the collaborative work of the above modules, the system of this invention achieves a complete closed-loop protection against ransomware, from behavioral trapping, multi-dimensional monitoring, in-depth intelligent analysis, rapid response to self-evolution, significantly improving the proactive defense capabilities of enterprise networks against ransomware threats.
[0034] The above description is merely a preferred embodiment of the present invention; however, the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and its improved concepts, should be covered within the scope of protection of the present invention.
Claims
1. A ransomware dynamic detection system based on a multimodal large model, characterized in that: include: The data acquisition module is used to dynamically capture multi-dimensional behavioral data streams generated during the runtime of the program under test in a monitored computing environment. A dynamic analysis module, connected to the data acquisition module, is used to load and run the program to be detected in a controlled, isolated analysis environment, and to receive the multi-dimensional behavioral data stream from the data acquisition module. A multimodal feature extraction module, connected to the dynamic analysis module, is used to parse and fuse the multidimensional behavioral data stream, extract and construct a unified multimodal feature vector including static attribute features, dynamic behavioral sequence features and runtime context features; The detection and judgment module is connected to the multimodal feature extraction module. It has a built-in pre-trained multimodal large model for receiving the unified multimodal feature vector, performing deep correlation analysis and pattern recognition through the multimodal large model, and outputting intelligent detection results and corresponding model confidence scores on whether the program to be detected is ransomware.
2. The ransomware dynamic detection system based on a multimodal large model according to claim 1, characterized in that: The data acquisition module includes: The decoy file management unit is used to generate and deploy multiple decoy files with highly enticing file attributes in the key directories and non-system disk partitions of the monitored environment. The file operation monitoring unit is used to monitor and record the operations of the program to be detected on the file system in real time. The objects of the operation monitoring include the decoy file, regular user files and system directories. A network behavior acquisition unit is used to capture network connection requests and data transmission characteristics initiated by the program to be detected. The system call tracing unit is used to collect the system call sequence generated by the program under test during execution.
3. The ransomware dynamic detection system based on a multimodal large model according to claim 2, characterized in that: The decoy files generated by the decoy file management unit have at least one of the following characteristics: the file extension is a common document or database type, the file content is randomly generated high-entropy data, and the file path is located in a directory frequently accessed by the user.
4. The ransomware dynamic detection system based on a multimodal large model according to claim 2, characterized in that: The file operation monitoring unit records at least the following operations: file reading, encryption, renaming, deletion, and large-scale input to the recycle bin.
5. The ransomware dynamic detection system based on a multimodal large model according to claim 1, characterized in that: The detection and determination module also includes: The rule matching unit is directly connected to the data acquisition module and is used to quickly analyze the real-time behavioral data captured by the data acquisition module based on a preset anomaly comparison algorithm and output the rule matching detection result. The integrated decision-making unit is connected to both the multimodal large model and the rule matching unit, and is used to receive the intelligent detection results and the rule matching detection results.
6. The ransomware dynamic detection system based on a multimodal large model according to claim 5, characterized in that: The anomaly comparison algorithm includes at least the following: unauthorized access to or modification of the decoy file, batch regular modification of filenames, a sudden increase in the number of files input to the recycle bin in a short period of time, or process behavior that matches the characteristics of known ransomware in the malicious signature database.
7. The ransomware dynamic detection system based on a multimodal large model according to claim 5, characterized in that: The integrated decision-making unit is configured to determine that the program to be detected is ransomware if the rule matching detection result indicates an anomaly, or if the model confidence of the intelligent detection result exceeds a preset threshold.
8. The ransomware dynamic detection system based on a multimodal large model according to claim 5, characterized in that: The system also includes a feedback learning module. The feedback learning module is connected to the detection and judgment module and is used to collect the final judgment result of the comprehensive decision-making unit, its corresponding multi-dimensional behavioral data stream and unified multimodal feature vector as feedback data, and use the feedback data to perform incremental training and optimization of the multimodal large model, as well as to dynamically update the thresholds of the malicious feature library and anomaly comparison algorithm in the rule matching unit.
9. The ransomware dynamic detection system based on a multimodal large model according to claim 7, characterized in that: The system also includes a response handling module, which is connected to the detection and judgment module and is used to execute preset response actions when the program to be detected is determined to be ransomware.
10. The ransomware dynamic detection system based on a multimodal large model according to claim 9, characterized in that: The response actions include: generating an alert containing process information, associated files, and rule violations; blocking further execution of the process and network connection; and initiating a backup and recovery process for the maliciously encrypted files.