Data security protection method and system and storage medium

Abstract

The invention relates to the technical field of information security, and discloses a data security protection method and system and a storage medium, and the method comprises the steps: extracting a binary code sequence of a malicious software sample from a preset database, carrying out the analysis to obtain a function call relation graph and an instruction execution flow, and generating an initial code representation feature set; processing node representation and fusing semantic information to obtain a stable genetic marker feature set; calculating the similarity between the samples, and constructing a preliminary copy path relation graph; clustering the node features to obtain a classification variation feature set; constructing an evolutionary structure model and integrating path weight analysis to generate a dynamic family analysis model; inputting a new sample genetic marker, integrating the new sample genetic marker into the model after matching, updating traceability data, judging variation affiliation, and generating a family identifier; and generating a protection response sequence based on the family identifier, and associating the evolution path to obtain a threat blocking scheme, so that efficient traceability and accurate blocking of malicious software variants can be realized, and the data security protection capability is improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a data security protection method, system and storage medium. Background Technology

[0002] With the rapid development of information technology and the widespread adoption of internet applications, data security has increasingly become a global focus. Especially in the network environment, malware attack methods are constantly evolving, and traditional protection technologies are struggling to cope with the complex and ever-changing threats, particularly against malware variants. Malware often evades detection through replication, mutation, and reconstruction, posing a significant challenge to data security. Traditional malware protection methods rely heavily on virus databases and signature matching techniques, but due to the frequent updates of malware variants, these methods are prone to delayed response or missed detections. Furthermore, malware variants are constantly evolving; attackers modify malware code, encrypt communication, or change propagation paths, making it difficult for protection systems to accurately identify and promptly block threats. To address these challenges, malware protection technology urgently needs to move beyond traditional static signature matching methods and adopt more flexible, efficient, and adaptable technologies that can adapt to malware evolution. Therefore, how to achieve efficient source tracing and precise blocking based on the dynamic characteristics and variant evolution patterns of malware has become a crucial problem that urgently needs to be solved in the field of data security protection. Summary of the Invention

[0003] To address the aforementioned technical problems, this application provides a data security protection method, system, and storage medium to improve data security protection capabilities.

[0004] Firstly, this application provides a data security protection method, the method comprising: Step S1: Extract the binary code sequence of malware samples from the preset database, and use a code parsing tool to parse out the function call relationship graph and instruction execution flow to obtain an initial code representation feature set; Step S2: For the initial code representation feature set, a graph embedding model is used to process the node representations in the function call relationship graph, and the semantic information of the instruction execution flow is fused to obtain a stable genetic marker feature set; Step S3: Based on the stable genetic marker feature set, calculate the similarity index between samples. If the similarity index exceeds a preset threshold, it is determined that there is a potential replication relationship between the samples, and a preliminary replication path relationship graph is constructed. Step S4: Obtain the node features in the preliminary replication path relationship graph, and use a grouping algorithm to cluster the stable genetic marker features to distinguish between the direct replication group and the derived replication group, thereby obtaining a set of classification variant features; Step S5: Based on the set of classification variant features, construct an evolutionary structure model and incorporate path weight analysis to obtain a dynamic family analysis model; Step S6: Input the genetic markers of the new sample into the dynamic family analysis model. If the matching degree between the genetic markers of the new sample and the family structure in the model meets the preset conditions, then integrate the new sample into the evolutionary structure model to update the source data, and extract the attack mode based on the updated source data, determine the variant affiliation, and generate a family identifier. Step S7: Based on the family identifier, generate a protection response sequence and associate it with the evolution path to obtain a threat blocking scheme.

[0005] Secondly, this application provides a data security protection system, the system comprising: The code feature set unit is used to extract the binary code sequence of malware samples from the preset database. The function call relationship graph and instruction execution flow are parsed using code parsing tools to obtain the initial code representation feature set. The label feature set unit is used to process the node representations in the function call relationship graph using a graph embedding model for the initial code representation feature set, and to fuse the semantic information of the instruction execution flow to obtain a stable genetic label feature set; The relationship graph construction unit is used to calculate the similarity index between samples based on the stable genetic marker feature set. If the similarity index exceeds a preset threshold, it is determined that there is a potential replication relationship between the samples, and a preliminary replication path relationship graph is constructed. The classification variant set unit is used to obtain the node features in the preliminary replication path relationship graph, and to use a grouping algorithm to cluster the stable genetic marker features to distinguish between the direct replication group and the derived replication group, thereby obtaining the classification variant feature set. The family analysis unit is used to construct an evolutionary structure model based on the set of classification variant features, and incorporate path weight analysis to obtain a dynamic family analysis model; The family identifier unit is used to input the genetic markers of the new sample into the dynamic family analysis model. If the matching degree between the genetic markers of the new sample and the family structure in the model meets the preset conditions, the new sample is integrated into the evolutionary structure model to update the source data, and the attack mode is extracted based on the updated source data to determine the variant affiliation and generate a family identifier. The scheme acquisition unit is used to generate a protection response sequence based on the family identifier and associate it with the evolution path to obtain a threat blocking scheme.

[0006] A third aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the aforementioned data security protection method.

[0007] Compared with the prior art, the beneficial effects of the present invention are at least as follows: The technical solution provided in this application extracts binary code sequences of malware samples from a pre-set database and uses static analysis tools to parse and generate function call graphs and instruction execution flows to obtain a preliminary set of code representation features. Then, a graph embedding model is used to process the node representations in the function call graph and integrate the semantic information of the instruction execution flow to generate a stable set of genetic marker features. Further, by calculating the similarity between samples, a preliminary replication path graph is constructed, and cluster analysis is performed based on this graph to obtain a set of classification variant features. An evolutionary structure model is constructed and incorporated with path weight analysis to generate a dynamic family analysis model. The genetic markers of new samples are input into this model. If the new sample has a high matching degree with the family structure in the model, it is integrated into the evolutionary structure model to update the source data. Based on the updated data, the variant affiliation is determined, a family identifier is generated, and finally, a protection response sequence is generated based on the family identifier, associated with the evolutionary path, to obtain a threat blocking solution. This application enables efficient source tracing and precise blocking of malware variants, improving data security protection capabilities. First, through a dynamic family analysis model, it can quickly identify the association between malware samples and existing families, solving the problem of slow response times in traditional protection methods when facing rapidly evolving malware. Second, the protection response suite provided in this application can accurately match the propagation path of malware variants, ensuring effective threat blocking in the shortest possible time and reducing potential security risks. Finally, through in-depth analysis of the evolutionary patterns and characteristics of malware, this application enables malware identification and protection to move beyond simple feature matching, achieving efficient identification and precise source tracing of new variants, thereby significantly improving data security protection capabilities and enhancing the system's ability to resist complex attacks. Attached Figure Description

[0008] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a schematic diagram of one embodiment of a data security protection method in this application. Figure 2 This is a schematic diagram of the sample similarity matrix based on genetic markers in an embodiment of this application; Figure 3 This is a schematic diagram of the sample clustering distribution after PCA dimensionality reduction in this embodiment of the application; Figure 4 This is a schematic diagram of the classified copy path relationships in the embodiments of this application; Figure 5 This is a schematic diagram of one embodiment of a data security protection system according to the present application. Detailed Implementation

[0010] This application provides a data security protection method, system, and storage medium. The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices. Example

[0011] For ease of understanding, the specific process of the embodiments of this application is described below. Please refer to [link / reference]. Figure 1 One embodiment of a data security protection method in this application includes: Step S1: Extract the binary code sequence of the malware sample from the preset database, and use a code parsing tool to parse out the function call relationship graph and instruction execution flow to obtain the initial code representation feature set.

[0012] The binary code sequence is parsed using static analysis tools to extract function call graphs and instruction execution flows, generating an initial code representation feature set, which includes node embedding information and semantic vectors. A graph neural network is then used to enhance the node embedding information and semantic vectors in the initial code representation feature set, generating an enhanced feature set. If the matching degree between the node embedding information and semantic vectors in the enhanced feature set is lower than a first preset threshold, the semantic vectors are adjusted using cosine similarity calculation to obtain an optimized feature set. Based on the optimized feature set, a random forest algorithm is used to classify malware samples and determine their malicious behavior categories. Cluster analysis is used to process the classification results, extracting behavioral patterns corresponding to the malicious behavior categories to generate a behavioral pattern set. If the number of patterns in the behavioral pattern set is less than a second preset threshold, additional malware samples are obtained from a preset database, and the parsing and classification steps are repeated to obtain a supplementary behavioral pattern set. Based on the supplementary behavioral pattern set, a malware behavioral feature library is generated, which stores node embedding information, semantic vectors, and behavioral patterns.

[0013] Specifically, most existing malware protection technologies rely on static feature matching. However, with the continuous evolution and mutation of malware attack methods, traditional methods suffer from response delays and missed detections. Therefore, how to quickly and accurately identify malware and its variants, and provide timely and effective protection, has become a crucial issue that urgently needs to be addressed in the field of data security. This application constructs an efficient malware variant detection and protection system by extracting the binary code sequence of malware samples and combining various techniques such as graph embedding, feature enhancement, and cluster analysis. In a specific embodiment, the binary code sequence of malware samples is extracted from a pre-set malware sample database. Static analysis tools are used to parse the binary code of the malware, generating a function call graph and instruction execution flow. By extracting the code features of the samples, preliminary behavioral patterns of the malware are obtained, providing structural information for protection analysis. Then, a graph embedding model is used to process the node representations in the function call graph, and the semantic information of the instruction execution flow is fused with the node embedding information to generate a stable set of genetic marker features. The generated feature set can better capture the behavioral characteristics of malware samples and provides a foundation for malware classification and variant identification.

[0014] After the feature set is generated, a graph neural network is used to enhance the node embedding information and semantic vectors, thereby improving the accuracy of feature representation. In the enhanced feature set, when the matching degree between the node embedding information and the semantic vector is lower than a preset threshold, the cosine similarity calculation method is used to adjust the semantic vector, making the optimized feature set of semantic vectors more consistent with the characteristics of malware variants. The optimized feature set is then classified using a random forest algorithm to determine the malicious behavior category of the sample. The classification results will be further processed through cluster analysis to extract the behavioral patterns related to the malicious behavior category, forming a behavioral pattern set.

[0015] When the number of patterns in the behavior pattern set is less than the preset threshold, more malware samples will be retrieved from the database, and the feature extraction and classification steps will be re-executed to generate a supplementary behavior pattern set. Based on the supplementary behavior pattern set, a malware behavior feature library will be constructed. The content of the feature library is sufficiently broad to adapt to new malware variants. The malware behavior feature library not only includes node embedding information and semantic vectors, but also various behavior patterns, providing support for dynamic source tracing and precise protection.

[0016] In the overall technical solution, the interaction and cooperation of the above-mentioned technical features ensure accurate identification and effective protection against malware and its variants. Static analysis tools and graph embedding models are used to conduct in-depth analysis of malware samples, extracting representative code features. Feature enhancement and cosine similarity optimization techniques are employed to improve the accuracy and applicability of the features, ensuring that malware variants can be accurately classified after generating behavioral features. Cluster analysis based on the classification results and the generation of supplementary behavioral pattern sets further optimize malware protection capabilities and improve adaptability to malware evolution paths and variant families. These technical steps ensure rapid identification and protection response to malware, providing technical support for enhancing data security protection capabilities.

[0017] Step S2: For the initial code representation feature set, the node representation in the function call relationship graph is processed using a graph embedding model, and the semantic information of the instruction execution flow is fused to obtain a stable genetic marker feature set.

[0018] A stable genetic marker feature set is generated by processing node embedding information through a graph embedding model and fusing it with the semantic vector of the instruction execution flow. If the matching degree between the node embedding information and the semantic vector in the stable genetic marker feature set is lower than a third preset threshold, the semantic vector is adjusted using a cosine similarity calculation method to obtain an optimized genetic marker feature set. Based on the optimized genetic marker feature set, a support vector machine algorithm is used to classify malware samples and determine the malicious behavior category of the malware samples. The malicious behavior categories obtained by cluster analysis are processed to extract behavior patterns and generate a behavior pattern set. Based on the behavior pattern set, a behavior feature library of malware is constructed to store the optimized genetic marker feature set, semantic vector, and behavior patterns. If the number of behavior patterns in the behavior feature library is lower than a fourth preset threshold, additional malware samples are obtained from a preset database to repeat the parsing, classification, and clustering steps to obtain a supplementary behavior feature library.

[0019] Specifically, traditional malware protection methods often rely on static feature matching, which is prone to delays or missed detections when facing rapidly evolving malware variants. Therefore, this application proposes a malware protection method based on dynamic analysis and feature enhancement by combining advanced technologies such as graph neural networks, semantic vector analysis, and cluster analysis, thereby improving the accuracy of malware variant detection and the timeliness of protection. In a specific embodiment, binary code sequences of malware samples are extracted from a pre-set malware sample database. These binary codes are parsed using static analysis tools to generate function call graphs and instruction execution flows. For the generated function call graphs, a graph embedding model is used to process the node representations. A graph attention network is used to embed each node, and the node embedding vector is generated by calculating the attention weight of each node and aggregating neighbor information. At the same time, the semantic information of the instruction execution flow is processed by the Doc2Vec model to generate semantic vectors that reflect the semantic features of the code instructions. The node embedding vectors generated by GAT and the semantic vectors generated by Doc2Vec are fused together, and a weighted concatenation method is used to combine the two according to pre-set weights to obtain a comprehensive vector, thus constructing a preliminary feature set of malware.

[0020] To ensure the stability and efficiency of the features, principal component analysis is used to reduce the dimensionality of the fused features, thereby reducing redundant information and optimizing the representational power of the feature set. The resulting genetic marker feature set can fully characterize the behavioral features of malware, providing a stable input for classification and behavioral pattern extraction.

[0021] Based on this, when the matching degree between the node embedding information in the stable genetic marker feature set and the semantic vector is lower than the preset threshold, the semantic vector is adjusted by the cosine similarity method to optimize the genetic marker feature set. The optimized feature set is then input into the support vector machine algorithm for classification to identify the malicious behavior categories of malware samples. The classification results are then processed by cluster analysis to extract the behavior patterns related to each malicious behavior category and generate a behavior pattern set.

[0022] These behavioral pattern sets will be used to construct a behavioral feature library for malware. The feature library includes an optimized set of genetic marker features, semantic vectors, and behavioral patterns. If the number of behavioral patterns in the generated behavioral feature library is less than a preset threshold, more samples will be automatically obtained from the malware sample database, and the parsing, classification, and clustering steps will be re-executed to obtain a supplementary set of behavioral features. By continuously expanding and updating the behavioral feature library, the protection system can adapt to new malware variants and perform accurate malware identification and protection based on the constantly updated feature library.

[0023] Overall, the above technical solutions combine graph embedding, semantic analysis, feature optimization, and machine learning classification to form an effective framework for detecting and protecting against malware variants. Through progressive data processing and feature enhancement and optimization, it can provide an efficient response to new variants, thereby greatly improving the ability to protect against malware and ensuring more accurate and timely data security protection.

[0024] Step S3: Based on a stable set of genetic marker features, calculate the similarity index between samples. If the similarity index exceeds a preset threshold, it is determined that there is a potential replication relationship between the samples, and a preliminary replication path relationship graph is constructed.

[0025] Sample pairs are obtained from a stable set of genetic marker features, and the similarity matrix between samples is calculated using the cosine similarity method, such as... Figure 2The diagram shows a sample similarity matrix based on genetic markers. If the element value in the similarity matrix exceeds a fifth preset threshold, the corresponding sample pair is determined to have a potential replication relationship, and an initial sample pair set is generated. Based on the initial sample pair set, a preliminary replication path relationship graph is constructed, which includes graph nodes and path connections. The preliminary replication path relationship graph is processed by a graph convolutional network to optimize the representation of graph nodes, resulting in an enhanced replication path relationship graph. Cluster analysis is used to process the path connections in the enhanced replication path relationship graph, extract replication patterns, and generate a replication pattern set. Based on the replication pattern set, a replication behavior feature library is constructed to store the enhanced replication path relationship graph and replication patterns. If the number of replication patterns in the replication behavior feature library is lower than a sixth preset threshold, additional sample pairs are obtained from a preset database, and the calculation, construction, and clustering steps are repeated to obtain a supplementary replication behavior feature library.

[0026] Specifically, the data security protection method proposed in this application aims to solve the problem of lagging detection of malware variants in existing technologies, especially when malware conceals itself through mutations and replication, traditional protection systems often fail to detect new variants in a timely manner. Therefore, this application provides an efficient malware variant identification and protection mechanism by conducting in-depth feature analysis of malware samples, combined with similarity calculation and graph optimization techniques. It mainly identifies potential replication relationships between malware samples quickly and accurately by performing multi-dimensional feature extraction, similarity analysis, and replication path construction on malware samples, providing a reliable basis for protection responses. In a specific embodiment, features of malware samples are extracted from a stable genetic marker feature set. These features include, but are not limited to, the function node feature vector of each sample. A cosine similarity algorithm is used to calculate these feature vectors to obtain a similarity matrix between samples, thereby determining whether there is a potential replication relationship between samples. When the values ​​of certain elements in the similarity matrix exceed a preset threshold, it can be determined that there is a potential replication relationship between the corresponding sample pairs. A preliminary replication path relationship graph is constructed based on the initially determined sample pairs, where each sample corresponds to a node, the path between nodes represents a possible replication relationship, and the weight of each path represents the similarity value between nodes.

[0027] Based on this, the initial replication path relationship graph is processed by a graph convolutional network to optimize the representation of nodes, so that the nodes in the graph can better represent the feature information of malware, thereby obtaining an enhanced replication path relationship graph. Cluster analysis is used to process the path connections in the enhanced replication path relationship graph, extract the replication patterns, and generate a replication pattern set. The replication pattern set is used to identify and store potential replication behaviors between samples, thereby providing a basis for further protection responses.

[0028] To ensure the integrity of the replication behavior feature library, the number of patterns in the replication pattern set is also checked. If the number is less than a preset threshold, more sample pairs are obtained from a preset malware sample database, and the above calculation, construction, and clustering steps are repeated to generate a supplementary replication behavior feature library. Through this process, the replication behavior feature library can be continuously expanded and improved, thereby enhancing the ability to identify new variant malware and the accuracy of protection responses.

[0029] Overall, the above technical solution forms an efficient and dynamic malware variant identification and protection system through a series of steps, including calculating the similarity between samples, constructing a replication path relationship graph, optimizing graph node representation, extracting replication patterns, and constructing a replication behavior feature library. This system can provide timely and accurate protection responses in the face of rapid malware variants and ever-changing attack methods, effectively enhancing data security protection capabilities.

[0030] Step S4: Obtain the node features in the preliminary replication path relationship graph, and use a grouping algorithm to cluster the stable genetic marker features to distinguish between the direct replication group and the derived replication group, thereby obtaining a set of classification variant features.

[0031] Stable genetic marker features are reduced in dimensionality using feature extraction methods to obtain a dimensionality-reduced feature set, such as... Figure 3 The diagram shows the clustering distribution of samples after PCA dimensionality reduction. Based on the dimensionality reduction feature set, the K-means clustering algorithm is used to group the samples, distinguishing between direct replication groups and derived replication groups to obtain sample grouping results. If the number of samples in the direct replication group is lower than the seventh preset threshold, additional genetic marker samples are obtained from a preset database, and the dimensionality reduction and clustering steps are repeated to obtain supplementary sample grouping results. Based on the supplementary sample grouping results, a classification variant feature set is constructed, and a graph embedding method is used to generate association representations between nodes to obtain an enhanced node feature set. Based on the enhanced node feature set, the cosine similarity method is used to calculate the association strength between nodes, identify potential replication paths, and obtain a path association matrix. Based on the path association matrix, high-strength replication paths are extracted, and a community detection algorithm is used to classify replication patterns to obtain a replication pattern set. Based on the replication pattern set, a variant feature library is constructed to store the enhanced node feature set and the replication pattern set.

[0032] Specifically, because malware often evolves rapidly through replication and mutation, traditional feature matching methods are often unable to detect and block the threat of new variants in a timely manner. Therefore, this application achieves accurate tracking and efficient protection against malware variants through dynamic analysis and feature optimization of malware samples. Specifically, this application employs multiple techniques such as similarity analysis based on genetic marker features, clustering algorithms, graph convolutional networks, and community detection, aiming to accurately identify the replication path and variant type of malware through feature enhancement and cluster analysis. In specific implementation, the stable genetic marker features of malware samples are dimensionality-reduced using feature extraction methods to obtain a dimensionality-reduced feature set. Principal component analysis (PCA) is used for feature dimensionality reduction, which removes redundant features and reduces data dimensionality while retaining sufficient variance information to ensure the effectiveness of the feature set. Based on the dimensionality-reduced feature set, K-means clustering algorithm is further used to group the samples, aiming to distinguish which malware samples belong to the "direct replication group" and the "derived replication group." Figure 4 The diagram showing the categorized replication path relationships demonstrates how cluster analysis can group nodes with high feature similarity into the same category, further determining whether there are potential replication relationships for malware variants.

[0033] During the clustering process, by selecting appropriate clustering parameters, such as using the K-means algorithm to divide the samples into multiple clusters, the "direct copy group" and the "derived copy group" are processed separately. The sample features in the "direct copy group" have smaller variance, indicating that these samples may originate from the same original code, while the sample features in the "derived copy group" have larger variance, indicating that these samples may have undergone certain mutations or reconstructions. By calculating the distance between the average feature vector of each cluster and the preset malware template vector, such as using Manhattan distance, the category of each cluster is further confirmed, and each node is labeled as "direct copy" or "derived copy".

[0034] Next, graph embedding methods are used to generate association representations between nodes, constructing an enhanced set of node features. This process provides more accurate node information for subsequent graph optimization. Based on this, the association strength between nodes is calculated using the cosine similarity method, thereby generating a path association matrix. The path association matrix is ​​generated by comparing the similarity between each node to extract high-strength replication paths as potential malware propagation paths, which are then used to construct a malware propagation model.

[0035] To further enhance malware protection capabilities, a community detection algorithm is used to analyze the path association matrix, thereby identifying different replication patterns. Each replication pattern represents a possible malware variant propagation method. These replication patterns are stored in a replication pattern set, providing a foundation for malware identification and blocking. By building and updating the replication behavior feature library, effective protection against new variants is ensured. When the number of patterns in the replication pattern set falls below a preset threshold, more sample pairs are automatically retrieved from a preset malware sample database, and the above calculation, construction, and clustering steps are re-executed to ensure that the generated replication behavior feature library can cover all possible malware variant patterns.

[0036] Through the above steps, this application can achieve efficient detection and accurate source tracing of malware variants. It can not only identify and block the replication path of known malware, but also update in real time according to new variant samples, maintain the dynamic adaptability of the protection system, and effectively improve the response speed and protection effect of the malware protection system in the face of constantly changing threats.

[0037] Step S5: Based on the set of classification variant features, construct an evolutionary structure model and incorporate path weight analysis to obtain a dynamic family analysis model.

[0038] Based on the classification variant feature set, a graph convolutional network method is used to extract the evolutionary relationships between nodes, generating an initial evolutionary relationship graph. Based on the initial evolutionary relationship graph, the path weights between nodes are calculated, and the cosine similarity method is used to determine the node association strength. If the node association strength is lower than the eighth preset threshold, additional variant feature samples are obtained from the preset database, and the graph convolutional network extraction steps are repeated to obtain an enhanced evolutionary relationship graph. Based on the enhanced evolutionary relationship graph, a community detection algorithm is used to divide the family structure between nodes, generating a family structure set. Based on the family structure set, the dynamic change trend of each family structure is calculated, and the time series analysis method is used to obtain dynamic evolutionary features. Based on the dynamic evolutionary features, a dynamic family analysis model is constructed and path weight information is incorporated to generate a final family analysis model. Based on the final family analysis model, high-weight path features are extracted and stored in a preset variant feature library to obtain a dynamic variant feature library.

[0039] Specifically, because malware expands its attack surface through continuous mutation and replication, existing static matching methods are insufficient to cope with rapidly evolving malware variants. Therefore, this application constructs a dynamic family analysis model to effectively identify and track malware variants and provides more precise protection strategies based on evolution paths and replication behaviors. In specific implementation, node features are extracted from the initial replication path relationship graph using a feature extraction algorithm. Each node corresponds to a function of a malware sample, and the feature vector represents the genetic marker features of that function. Principal component analysis (PCA) is used to reduce the dimensionality of the feature vectors, preserving most of the variance information, making the features of each node more distinctive and comparable. After dimensionality reduction, the resulting feature vectors are further processed, and the nodes are grouped using the K-means clustering algorithm to distinguish between direct replication groups and derived replication groups. Specifically, the node feature variance of the direct replication group is smaller, indicating that these functions may come from the same original code, while the node feature variance of the derived replication group is larger, indicating the existence of code mutations or refactoring. After analyzing these clusters, the category of each cluster can be accurately determined and labeled by calculating the distance between the average feature vector of each cluster and the preset known malware template vector.

[0040] The clustered node labels and feature vectors are integrated to form a classification variant feature set, and the relationship between nodes is further optimized using graph convolutional networks. Graph convolutional networks can capture complex dependencies between nodes through the propagation of local neighborhood information, thereby generating an initial evolutionary relationship graph. This relationship graph not only includes basic connection information between nodes, but also provides a basis for path weight calculation. By calculating the path weight between nodes and combining it with the cosine similarity method to determine the association strength between nodes, the accuracy of the graph structure and its ability to reflect the propagation path of malware are further improved.

[0041] If the correlation strength between nodes is lower than a preset threshold, more variant samples are obtained from a preset malware sample database. The graph convolutional network extraction step is executed again to obtain an enhanced evolutionary relationship graph. This graph enhances the connections between nodes, which helps to identify more potential malware variant propagation paths. Based on the enhanced evolutionary relationship graph, a community detection algorithm is used to divide the family structure between nodes, classifying malware into different families according to similar propagation patterns. By analyzing the dynamic changes in the family structure, the evolution process of malware can be further captured, providing a more accurate basis for protection.

[0042] By combining dynamic evolution characteristics, a dynamic family analysis model is constructed. This model can be updated in real time and automatically adapt to new malware variants and attack patterns. By incorporating path weight information, the final family analysis model can not only effectively identify malware variant families, but also provide important references for optimizing protection strategies. Based on this model, high-weight path features are extracted and stored in a preset variant feature library to form a dynamic variant feature library. This library can be continuously updated and provides a solid technical foundation for malware identification, tracking, and protection.

[0043] Through the above technical solutions, this application can effectively identify the replication paths and variants of malware, track the dynamic evolution of malware families, and provide accurate guidance for security protection. Through dynamic family analysis and path weight optimization, this technical solution not only solves the problem of delayed response of traditional methods when facing new variants, but also improves the adaptability and accuracy of the protection system, and greatly enhances the data security protection capability.

[0044] Step S6: Input the genetic markers of the new sample into the dynamic family analysis model. If the matching degree between the genetic markers of the new sample and the family structure in the model meets the preset conditions, the new sample is integrated into the evolutionary structure model to update the source data. Based on the updated source data, the attack pattern is extracted, the variant affiliation is determined, and a family identifier is generated.

[0045] Genetic marker data of new samples are acquired, and redundant information is removed through preprocessing to obtain standardized marker data. Cosine similarity is used to calculate the matching degree between the standardized marker data and the family structure in the dynamic family analysis model, yielding a matching degree value. If the matching degree value is higher than a ninth preset threshold, the standardized marker data is integrated into the evolutionary structure model, and node association information is updated to obtain enhanced tracing data. Based on the enhanced tracing data, K-means clustering is used to divide attack patterns, resulting in an attack pattern set. Based on the attack pattern set, the feature similarity between each attack pattern and patterns in a preset pattern library is calculated to determine the matching pattern. If a matching pattern exists in the preset pattern library, a family identifier is generated based on the family affiliation information corresponding to the matching pattern. Based on the family identifier, the variant feature information in the preset pattern library is updated to obtain the dynamic pattern library.

[0046] Specifically, traditional protection methods often rely on static feature matching and rule bases. However, with the rapid evolution and continuous replication of malware variants, these methods cannot identify new variants in a timely manner and are ill-equipped to handle complex malware families. To address this issue, this application proposes a malware variant tracking and protection method based on a dynamic family analysis model. Through techniques such as graph neural networks, path weight analysis, time series analysis, and Markov chain models, it accurately tracks the evolutionary trends of malware families, providing efficient real-time response capabilities for malware protection.

[0047] In the specific implementation of this technical solution, corresponding features are extracted from the genetic marker data of the new sample, preprocessed to remove redundant information, and new standardized marker data is generated through standardization. In order to verify the family affiliation of the new sample, the cosine similarity algorithm is used to calculate the matching degree between the standardized marker data of the new sample and the family structure in the pre-constructed dynamic family analysis model. When the matching degree exceeds the preset threshold, it means that the new sample has a high degree of similarity with the existing family. The standardized marker data of the new sample is then integrated into the existing evolutionary structure model to update the node association information of the model and obtain enhanced tracing data.

[0048] Based on enhanced source tracing data, the K-means clustering algorithm is used to classify the samples into attack patterns. The clustering analysis generates a set of attack patterns, each representing a specific malicious behavior or malware variant propagation method. Then, the feature similarity between these attack patterns and patterns in a preset malware pattern library is calculated to further determine whether a matching pattern exists. If a matching pattern exists in the preset pattern library, a family identifier for the new sample is generated based on the family affiliation information corresponding to the matching pattern. This family identifier not only reflects the relationship between the sample and the malware family, but also provides an important basis for malware tracking and protection.

[0049] Based on family identifiers, the variant feature information in the preset pattern library is updated to keep the pattern library dynamically updated, thereby enabling real-time response to newly emerging malware variants. This process, through a continuously updated dynamic pattern library, ensures that the protection system can adapt to new malware samples and attack patterns, providing effective support for threat detection and protection.

[0050] The entire process utilizes a dynamic family analysis model based on genetic markers, combined with various techniques such as graph neural network-extracted node evolutionary relationships, path weight analysis, and time series analysis, to achieve accurate tracking and identification of malware families. By comprehensively analyzing the propagation path, attack patterns, and variant evolution trends of malware, the aforementioned techniques construct a complete malware protection system that can efficiently detect malware variants and provide real-time protection responses.

[0051] Step S7: Based on the family identifier, generate a protection response sequence and associate it with the evolution path to obtain a threat blocking scheme.

[0052] Based on family identifiers, corresponding path data is retrieved from a pre-defined evolution path database to obtain a set of associated paths. A graph embedding algorithm is used to vectorize the associated path set, generating path embedding vectors. The similarity between the path embedding vectors and strategies in a pre-defined protection strategy library is calculated; if the similarity is higher than a tenth pre-defined threshold, a matching protection strategy is determined. Based on the matching protection strategy, an initial protection response sequence is generated, resulting in a set of protection sequences. For the protection sequence set, a sequence optimization algorithm is used to adjust the sequence priority, resulting in optimized protection sequences. Based on the optimized protection sequences, they are mapped to a pre-defined threat blocking template to generate a threat blocking scheme. Based on the threat blocking scheme, the response rules in the pre-defined protection strategy library are updated, resulting in a dynamic protection library.

[0053] Specifically, with the rapid evolution of malware variants, traditional protection methods often rely on static signature databases, which cannot respond to new variants in a timely manner, resulting in a lag in the identification of new threats by security protection systems. Therefore, this application provides a dynamic and intelligent protection mechanism for dealing with variant malware by combining family identifiers, evolution path correlation analysis, and automated protection strategy generation. It can quickly generate and deploy protection response schemes based on the evolution trend and attack behavior of malware variants. In practice, malware characteristic information, such as port scanning behavior and encryption algorithms, is extracted through family identifiers. This information is then combined with machine learning classifiers, such as random forests, to analyze historical attack data and confirm the threat type. For example, assuming the input malware family identifier is "X-Worm," its characteristics include specific ports, such as TCP ports 80 and 443, and packet encryption modes such as AES-128. Based on these characteristics, the threat type is identified and confirmed as "X-Worm." Protection response sequences are automatically generated based on historical attack data, especially known attack behavior patterns, to create protection rules for specific ports, such as TCP port 80, and abnormal traffic. For instance, assuming there are 1000 attack records in the database, and 80% of the attacks involve TCP port 80, firewall rules are automatically generated to block abnormal traffic on this port. For example, abnormal traffic might be defined as more than 100 requests per second. This rule is generated based on a rule engine, and its priority is set according to the severity of the threat.

[0054] Furthermore, the evolution path of the associated malware family identifier "X-Worm" is traced. A graph database such as Neo4j is used to store the relationships between malware variants and calculate the similarity between variants using the Jaccard coefficient. Assuming that a new variant of "X-Worm" "X-Worm.v2" uses a different port, such as port 445, the attack characteristics of the new variant are analyzed and the protection rules are automatically updated to include a blocking strategy for port 445.

[0055] When generating threat blocking solutions, a complete threat blocking solution is constructed based on the generated protection rules and the evolution path of malware, and deployed to the Intrusion Prevention System (IPS) for real-time traffic monitoring. Traffic is analyzed every minute, and when abnormal behavior is detected, such as a surge in port 445 traffic to 200 times / second, a blocking operation is automatically triggered, blocking the source IP address and setting the blocking time, such as 3600 seconds. Through API integration, the entire process is automated from feature extraction to solution deployment, ensuring seamless integration from data collection to protection deployment.

[0056] This application combines family identifiers, machine learning classification, path weight analysis, and automated protection response generation to not only identify the attack characteristics of malware variants in real time, but also automatically generate and deploy protection strategies based on the evolution trend and attack patterns of the variants. The above process ensures that the protection system can respond quickly and effectively block threats when facing malware variants, greatly improving the data security protection capability and response speed.

[0057] Through the coordination of the above steps, this application can achieve efficient source tracing and precise blocking of malware variants, thereby improving data security protection capabilities. Example

[0058] The above describes a data security protection method according to an embodiment of this application. The following describes a data security protection system according to an embodiment of this application. Please refer to [link / reference]. Figure 5 One embodiment of a data security protection system in this application includes: The code feature set unit is used to extract the binary code sequence of malware samples from the preset database. The function call relationship graph and instruction execution flow are parsed using code parsing tools to obtain the initial code representation feature set. The labeled feature set unit is used to process the node representations in the function call relationship graph using a graph embedding model for the initial code representation feature set, and to fuse the semantic information of the instruction execution flow to obtain a stable genetic labeled feature set; The relationship graph construction unit is used to calculate the similarity index between samples based on a stable set of genetic marker features. If the similarity index exceeds a preset threshold, it is determined that there is a potential replication relationship between the samples, and a preliminary replication path relationship graph is constructed. The classification variant set unit is used to obtain node features in the preliminary replication path relationship graph. The stable genetic marker features are clustered using a grouping algorithm to distinguish between the direct replication group and the derived replication group, thus obtaining the classification variant feature set. The family analysis unit is used to construct an evolutionary structure model based on the feature set of classification variants, and incorporate path weight analysis to obtain a dynamic family analysis model; The family identifier unit is used to input the genetic markers of new samples into the dynamic family analysis model. If the matching degree between the genetic markers of new samples and the family structure in the model meets the preset conditions, the new samples are integrated into the evolutionary structure model to update the source data. Based on the updated source data, the attack pattern is extracted, the variant affiliation is determined, and a family identifier is generated. The scheme acquisition unit is used to generate a protection response sequence based on the family identifier and associate it with the evolution path to obtain a threat blocking scheme.

[0059] Through the collaborative efforts of the aforementioned components, efficient tracing and precise blocking of malware variants have been further achieved, enhancing data security protection capabilities. Example

[0060] This application also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the steps of the data security protection method.

[0061] In summary, this application enables efficient tracing and precise blocking of malware variants, improving data security protection capabilities. Firstly, the dynamic family analysis model quickly identifies the association between malware samples and existing families, solving the problem of slow response in traditional protection methods when facing rapidly evolving malware. Secondly, the protection response sequence provided by this application accurately matches the propagation path of malware variants, ensuring effective threat blocking in the shortest possible time and reducing potential security risks. Finally, through in-depth analysis of the evolutionary patterns and characteristics of malware, this application enables malware identification and protection to move beyond simple feature matching, achieving efficient identification and precise tracing of new variants, thereby significantly enhancing data security protection capabilities and strengthening the system's ability to resist complex attacks.

[0062] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0063] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0064] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data security protection method, characterized by, The method comprises: Step S1, extracting a binary code sequence of a malware sample from a preset database, parsing a function call relationship graph and an instruction execution flow by using a code analysis tool, and obtaining an initial code representation feature set; Step S2, processing node representation in the function call relationship graph by using a graph embedding model, and fusing semantic information of the instruction execution flow to obtain a stable genetic marker feature set; Step S3, calculating a similarity index between samples based on the stable genetic marker feature set, and if the similarity index exceeds a preset threshold, determining that there is a potential replication relationship between the samples, and constructing a preliminary replication path relationship graph; Step S4, obtaining node features in the preliminary replication path relationship graph, clustering the stable genetic marker features by using a grouping algorithm, distinguishing a direct replication group and a derivative replication group, and obtaining a classification variant feature set; Step S5, constructing an evolution structure model based on the classification variant feature set, and fusing path weight analysis to obtain a dynamic family analysis model; Step S6, inputting a genetic marker of a new sample into the dynamic family analysis model, and if a matching degree of the genetic marker of the new sample and a family structure in the model satisfies a preset condition, integrating the new sample into the evolution structure model to update traceability data, extracting an attack mode based on the updated traceability data, judging variant attribution, and generating a family identifier; Step S7, generating a protection response sequence based on the family identifier, and associating an evolution path to obtain a threat blocking scheme.

2. The method of claim 1, wherein, The step S1 further comprises: parsing the binary code sequence by using a static analysis tool, extracting a function call relationship graph and an instruction execution flow, generating an initial code representation feature set, and the initial code representation feature set comprises node embedding information and a semantic vector; performing feature enhancement on the node embedding information and the semantic vector in the initial code representation feature set by using a graph neural network to generate an enhanced feature set; if a matching degree of the node embedding information and the semantic vector in the enhanced feature set is lower than a first preset threshold, adjusting the semantic vector by using a cosine similarity calculation method to obtain an optimized feature set; based on the optimized feature set, classifying malware samples by using a random forest algorithm to determine a malicious behavior category of the malware samples; processing the classification result by using clustering analysis, extracting a behavior mode corresponding to the malicious behavior category, and generating a behavior mode set; if a mode quantity in the behavior mode set is less than a second preset threshold, obtaining additional malware samples from the preset database, repeatedly executing the parsing and classification steps to obtain a supplementary behavior mode set, and generating a behavior feature library of malware based on the supplementary behavior mode set.

3. The method of claim 1, wherein, The step S2 further comprises: processing the node embedding information by using the graph embedding model, fusing a semantic vector of the instruction execution flow, and generating a stable genetic marker feature set; If the matching degree of the node embedding information in the stable genetic marker feature set and the semantic vector is lower than a third preset threshold, a cosine similarity calculation method is used to adjust the semantic vector to obtain an optimized genetic marker feature set; Based on the optimized genetic marker feature set, a support vector machine algorithm is used to classify the malware samples to determine the malicious behavior category of the malware samples; Through clustering analysis processing of the classified malicious behavior category, a behavior pattern is extracted to generate a behavior pattern set; Based on the behavior pattern set, a behavior feature library of the malware is constructed; If the number of behavior patterns in the behavior feature library is lower than a fourth preset threshold, additional malware samples are obtained from the preset database to repeat the parsing, classification and clustering steps to obtain a supplementary behavior feature library.

4. The method of claim 1, wherein, The step S3 further includes: A sample pair is obtained from the stable genetic marker feature set, and a cosine similarity method is used to calculate the similarity matrix between samples; If the element value in the similarity matrix exceeds a fifth preset threshold, it is determined that the corresponding sample pair has a potential replication relationship, and an initial sample pair set is generated; Based on the initial sample pair set, the preliminary replication path relationship graph is constructed, and the relationship graph includes relationship graph nodes and path connections; The preliminary replication path relationship graph is processed through a graph convolution network to obtain an enhanced replication path relationship graph; A clustering analysis method is used to process the path connections in the enhanced replication path relationship graph to extract replication patterns and generate a replication pattern set; Based on the replication pattern set, a replication behavior feature library is constructed; If the number of replication patterns in the replication behavior feature library is lower than a sixth preset threshold, additional sample pairs are obtained from the preset database to repeat the calculation, construction and clustering steps to obtain a supplementary replication behavior feature library.

5. The method of claim 1, wherein, The step S4 further includes: A feature extraction method is used to reduce the dimension of the stable genetic marker features to obtain a reduced dimension feature set, and based on the reduced dimension feature set, a K-means clustering algorithm is used to group samples to determine direct replication groups and derivative replication groups to obtain a sample grouping result; If the number of samples in the direct replication group in the sample grouping result is lower than a seventh preset threshold, additional genetic marker samples are obtained from the preset database to repeat the dimension reduction and clustering steps to obtain a supplementary sample grouping result; Based on the supplementary sample grouping result, the classification variant feature set is constructed, and a graph embedding method is used to generate the associated representation between nodes to obtain an enhanced node feature set; Based on the enhanced node feature set, a cosine similarity method is used to calculate the association strength between nodes to determine potential replication paths to obtain a path association matrix; Based on the path association matrix, high-intensity replication paths are extracted, and a community detection algorithm is used to divide replication patterns to obtain a replication pattern set; based on the replication pattern set, a variant feature library is constructed.

6. The method of claim 1, wherein, The step S5 further includes: Based on the classification variant feature set, a graph convolution network method is used to extract the evolution relationship between nodes to generate an initial evolution relationship graph; Based on the initial evolution relationship diagram, the path weight between nodes is calculated, and the cosine similarity method is used to determine the node association strength; If the node association strength is lower than the eighth preset threshold, additional variant feature samples are obtained from the preset database, the graph convolution network extraction step is repeatedly executed, and an enhanced evolution relationship diagram is obtained; Based on the enhanced evolution relationship diagram, a community detection algorithm is used to divide the family structure between nodes, and a family structure set is generated; Based on the family structure set, the dynamic change trend of each family structure is calculated, and a time series analysis method is used to obtain the dynamic evolution feature; Based on the dynamic evolution feature, the dynamic family analysis model is constructed, and the path weight information is integrated to generate the final family analysis model; Based on the final family analysis model, high-weight path features are extracted and stored in a preset variant feature library to obtain a dynamic variant feature library.

7. The method of claim 1, wherein, The step S6 further comprises: Obtain the genetic marker data of the new sample, and remove redundant information through preprocessing to obtain standardized marker data; The cosine similarity is used to calculate the matching degree of the standardized marker data and the family structure in the dynamic family analysis model to obtain a matching degree value; If the matching degree value is higher than the ninth preset threshold, the standardized marker data is integrated into the evolution structure model, and the node association information is updated to obtain enhanced traceability data; Based on the enhanced traceability data, a K-means clustering algorithm is used to divide the attack mode to obtain an attack mode set; Based on the attack mode set, the feature similarity of each attack mode and the mode in the preset mode library is calculated to determine the matching mode; If the matching mode exists in the preset mode library, the family identification is generated according to the family attribution information corresponding to the matching mode; Based on the family identification, the variant feature information in the preset mode library is updated to obtain a dynamic mode library.

8. The method of claim 1, wherein, The step S7 further comprises: Based on the family identification, the corresponding path data is obtained from the preset evolution path database to obtain an associated path set; The graph embedding algorithm is used for vectorization processing of the associated path set to generate a path embedding vector; The similarity of the path embedding vector and the strategy in the preset protection strategy library is calculated, and if the similarity is higher than the tenth preset threshold, the matching protection strategy is determined; Based on the matching protection strategy, an initial protection response sequence is generated to obtain a protection sequence set; For the protection sequence set, a sequence optimization algorithm is used to adjust the sequence priority to obtain an optimized protection sequence; Based on the optimized protection sequence, the preset threat blocking template is mapped to generate the threat blocking scheme; Based on the threat blocking scheme, the response rules in the preset protection strategy library are updated to obtain a dynamic protection library.

9. A data security system for implementing the method according to any one of claims 1 to 8, characterized in that The system comprises: A code feature set unit is configured to extract the binary code sequence of the malware sample from the preset database, and use a code analysis tool to parse the function call relationship diagram and the instruction execution flow to obtain an initial code representation feature set; The label feature set unit is configured to process node representations in the function call relationship graph by using a graph embedding model and fuse semantic information of the instruction execution flow, to obtain a stable genetic label feature set for the initial code representation feature set; The relationship graph construction unit is configured to calculate a similarity index between samples based on the stable genetic label feature set, determine that there is a potential replication relationship between samples if the similarity index exceeds a preset threshold, and construct a preliminary replication path relationship graph; The classification variant set unit is configured to obtain node features in the preliminary replication path relationship graph, cluster the stable genetic label features by using a grouping algorithm, distinguish a direct replication group and a derivative replication group, and obtain a classification variant feature set; The family analysis unit is configured to construct an evolution structure model based on the classification variant feature set, and obtain a dynamic family analysis model by incorporating path weight analysis; The family identification unit is configured to input genetic labels of a new sample into the dynamic family analysis model, integrate the new sample into the evolution structure model to update traceability data if a matching degree of the genetic labels of the new sample and a family structure in the model satisfies a preset condition, extract an attack mode based on the updated traceability data, determine variant attribution, and generate a family identification; The scheme acquisition unit is configured to generate a protection response sequence based on the family identification, associate an evolution path, and obtain a threat blocking scheme.

10. A computer-readable storage medium having stored thereon instructions, the instructions comprising, The instructions are executed by the processor to implement the data security protection method in any one of claims 1-8.

Images