Computer system network security risk monitoring system and method

Abstract

The invention relates to the technical field of information security, in particular to a computer system network security risk monitoring system and method.The method comprises the steps that a code analysis tool is used for extracting a plurality of code snippets capable of being independently executed from a source code, a binary file or a running environment, and a function attribute tag is added to each code snippet capable of being independently executed; setting at least one attack purpose according to a preset security threat type, wherein the security threat type comprises a permission enhancement attack, a data leakage attack, a service interruption attack, a supply chain attack or an identity authentication bypassing attack; based on the attack purpose and the code snippets capable of being independently executed, a genetic algorithm is adopted to generate a plurality of code combination paths, static fitness scoring is conducted on the code combination paths, and when a novel attack means does not appear, timely response is conducted, potential attack paths which are not utilized are found out, and blocking is conducted in advance.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a computer system network security risk monitoring system and method. Background Technology

[0002] As cybersecurity threats continue to evolve, attackers are increasingly employing methods that break malicious code into multiple fragments, bypass security mechanisms, and then reassemble and execute them. This segmented code combination attack, such as return-oriented programming attacks, shellcode segmentation execution, and segmented payload attacks, has become a significant threat type in enterprise security protection. Existing security protection methods mainly rely on static rule matching, signature detection, or manual penetration testing, which have the following limitations:

[0003] 1. As software scales up, the amount of code grows exponentially, making it difficult for traditional methods to achieve comprehensive analysis of large-scale codebases.

[0004] 2. Security rules are often updated behind the emergence of new attack methods, making it difficult for defense systems to respond in a timely manner.

[0005] 3. Combination attacks are difficult to detect. Existing static analysis tools mainly target single code snippets or known vulnerabilities, making it difficult to discover entirely new attack paths formed by the combination of multiple snippets. Summary of the Invention

[0006] To address the aforementioned problems, this invention provides a computer system network security risk monitoring system and method.

[0007] This invention employs the following technical solution: a computer system network security risk monitoring method, comprising:

[0008] Use code analysis tools to extract multiple independently executable code snippets from source code, binary files, or runtime environments, and add functional attribute tags to each independently executable code snippet;

[0009] At least one attack objective is set according to the preset security threat types, including privilege escalation attacks, data leakage attacks, service interruption attacks, supply chain attacks, or identity authentication bypass attacks.

[0010] Based on the attack objective and the independently executable code fragment, a genetic algorithm is used to generate multiple code combination paths, and a static fitness score is performed on the code combination paths. The static fitness score is calculated based on executability, parameter matching score, code combination path length score, and functional attribute label sequence constraint compliance.

[0011] The code combination path is dynamically executed in a secure sandbox environment to obtain a dynamic score. Based on the static fitness score and the dynamic score, the code combination path is filtered to output the target code combination path that can achieve the preset attack purpose and has low defense visibility.

[0012] Each code segment in the target code combination path is uniquely numbered, and the execution process is terminated when the execution process corresponding to the number is detected.

[0013] Furthermore, the extraction module extracts code fragments through a combination of static analysis and disassembly, and generates the functional attribute tags using abstract syntax trees, symbol tables, function prototype information, and interface descriptions; the functional attribute tags include input parameter types and formats, output parameter types and formats, system call types and accessed resources, permission requirements, and sensitive operation and control flow characteristics.

[0014] Furthermore, methods for generating multiple code combination paths using genetic algorithms include:

[0015] Step 1: Based on the preset attack target type, randomly generate a code combination path composed of multiple independently executable code fragments according to preset requirements, which is an individual and forms the initial population;

[0016] Step 2: Perform static fitness scoring on the code combination path;

[0017] Step 3: Using the roulette wheel selection method, sort the static fitness scores in descending order, select the code combination path corresponding to the top Y static fitness scores as the parent individual, perform two-point crossover on the parent individuals, swap the parts that can be executed independently to generate offspring individuals; randomly replace some parts of the offspring individuals that can be executed independently or adjust their order to generate new individuals.

[0018] Step 4: Repeat steps 2-3 until the preset termination condition is met, then output the path of the top n code combinations in the static fitness score.

[0019] Furthermore, the sum of the syntax and compilation static check error counts as the numerator and the sum of the syntax and compilation static check error counts and the smoothing constant as the denominator, and the ratio of 1 to obtain the build compliance score.

[0020] Determine the number of independently executable code snippets in the code combination path, determine the number of interfaces for independently executable code snippets based on the number of independently executable code snippets in the code combination path, and obtain the first... Each segment can independently execute code snippets and output parameter vectors. The code snippet can be executed independently. It takes an input parameter vector as input and outputs the distance between the output parameter vector and the input parameter vector to determine the mismatch. Different degrees of matching correspond to different values. The mismatch distance is subtracted from 1, and then... From 1 to Summation, then division Obtain a parameter matching score;

[0021] When the code combination path length is within the minimum and maximum length range, the code combination path length score is full. If it exceeds the range, the score is deducted in a linear decay manner according to the degree of deviation between the code combination path length and the range, and the code combination path length is obtained.

[0022] Furthermore, the conformity score of the functional attribute label sequence constraint represents the score of whether the concatenation order of all independently executable code segments in the code composition path satisfies the sequence constraint. The methods for obtaining the conformity score of the functional attribute label sequence constraint include:

[0023] Extract the corresponding functional attribute labels according to the concatenation order of all independently executable code segments in the code combination path, and obtain the functional attribute label feature vector. Based on the functional attribute label feature vector and the pre-trained functional attribute evaluation model, obtain the functional attribute label sequential constraint compliance degree. The functional attribute labels in the functional attribute label feature vector are arranged according to the concatenation order of all independently executable code segments in the code combination path.

[0024] Furthermore, the training methods for functional attribute evaluation models include:

[0025] Pre-collect feature vectors of functional attribute labels and the corresponding functional attribute label sequence constraint compliance degrees; the feature vectors of functional attribute labels and the corresponding functional attribute label sequence constraint compliance degrees form a set of training data;

[0026] The training data is input into the functional attribute evaluation model. The functional attribute evaluation model outputs the degree of conformity of the predicted functional attribute labels to the feature vectors of functional attribute labels, and takes the degree of conformity of the actual functional attribute labels to the feature vectors of functional attribute labels as the prediction target. When the prediction error reaches the preset convergence condition, the training stops and the functional attribute evaluation model is obtained. The functional attribute evaluation model is a regression prediction model based on deep neural networks.

[0027] Furthermore, the dynamic score is a weighted sum of the attack objective score, execution stability value, defense visibility reverse index, and resource consumption value; the attack objective score is 1 if at least one attack objective is achieved, otherwise the attack objective score is 0; when the code combination path is simulated and executed in the enterprise security sandbox environment, the number of abnormal exits is used as the abnormal numerator, the total number of execution steps plus 1 is used as the abnormal denominator, and the execution stability value is obtained by subtracting the ratio of the abnormal numerator to the abnormal denominator from 1; the defense visibility reverse index is obtained by subtracting the ratio of the number of days of security alerts to the alert limit from 1.

[0028] Furthermore, the method for outputting code combination paths that can achieve the preset attack objectives is as follows:

[0029] Only code combination paths with an attack objective score of 1 and a weighted sum of dynamic and static fitness scores below a predetermined threshold are retained, and these are output as code combination paths that are difficult to monitor and can achieve the preset attack objective.

[0030] Furthermore, an avoidance score is added to the dynamic scoring. The avoidance score is the sum of the sandbox fingerprint detection score, the time difference avoidance score, the memory and process enumeration score, and the abnormal execution flow score.

[0031] If code in the code combination path is detected to read system characteristics at runtime, a predetermined score is added and recorded as the sandbox fingerprint detection score.

[0032] If a code in the code combination path is found to use a high-precision timing function, a predetermined score will be added and recorded as a time difference avoidance score.

[0033] If code scanning system processes or memory mappings are detected in the code combination path to find sandbox analysis tools or security agent processes, a predetermined score is added and recorded as memory and process enumeration score.

[0034] If any behavior is detected, such as reading system characteristics, using high-precision timing functions, scanning system processes, or memory mapping to find sandbox analysis tools or security agent processes, the attack process will be interrupted and a predetermined score will be added, which will be recorded as memory and process enumeration score.

[0035] A computer system network security risk monitoring system executes the computer system network security risk monitoring method, the system comprising:

[0036] The extraction module is used to extract multiple independently executable code snippets from source code, binary files, or runtime environments using code analysis tools, and to add functional attribute tags to each independently executable code snippet;

[0037] The attack objective setting module is used to set at least one attack objective according to preset security threat types, including privilege escalation attacks, data leakage attacks, service interruption attacks, supply chain attacks, or identity authentication bypass attacks.

[0038] The generation module is used to generate multiple code combination paths using a genetic algorithm based on the attack objective and the independently executable code fragment, and to perform static fitness scoring on the code combination paths. The static fitness score is calculated based on executability, parameter matching score, code combination path length score, and functional attribute label sequence constraint compliance.

[0039] The verification module is used to dynamically execute the code combination path in a security sandbox environment, obtain a dynamic score, and filter the code combination path based on the static fitness score and the dynamic score, and output the target code combination path that can achieve the preset attack purpose and has low defense visibility.

[0040] The numbering and monitoring module is used to assign a unique number to each code segment in the target code combination path, and to terminate the execution process when an execution process corresponding to the number is detected.

[0041] Beneficial effects:

[0042] By extracting multiple independently executable code snippets using code analysis tools and generating functional attribute tags, and combining this with a genetic algorithm to generate various code combination paths, we can exhaustively explore more possible combinations in a large-scale codebase, discovering combined attack paths that are difficult to detect with traditional single-snippet analysis, and significantly improving coverage. The static fitness score is calculated by weighting the construction compliance score, parameter matching score, code combination path length score, and functional attribute tag sequence constraint compliance. By comprehensively evaluating the feasibility and attack probability of the combination path through multi-dimensional indicators, we can effectively reduce false negatives and false positives. The functional attribute evaluation model is used to calculate the sequence constraint compliance to ensure that the code combination path meets the logical order required for the attack (such as "acquire token first → then access controlled resources"), filtering out combination paths with unreasonable logical order, and retaining high-risk paths that are more consistent with the actual attack process, thereby improving the detection rate.

[0043] Dynamically executing combined paths within a secure sandbox environment calculates dynamic scores such as attack objective score, execution stability value, defense visibility reverse index, and resource consumption value. This allows for the timely elimination of paths with high static fitness scores that fail during operation or are easily detected by defenses, improving the executability and concealment of the output results. Introducing evasion detection scores (sandbox fingerprint detection score, time difference evasion score, process / memory enumeration score, and abnormal execution flow score) into the dynamic scoring system identifies malicious paths actively detected by the sandbox or evasion analysis, significantly improving their risk scores, reducing false negatives, enhancing defense targeting, lowering the risk of sandbox escape, preventing high-privilege malicious code from affecting the detection system itself, and enabling timely responses to new attack methods before their emergence, discovering potential attack paths that have not yet been exploited, and blocking them in advance. Attached Figure Description

[0044] Figure 1 Flowchart of the computer system network security risk monitoring method provided by the present invention;

[0045] Figure 2 A schematic diagram of a computer system network security risk monitoring system provided by the present invention;

[0046] Figure 3 The flowchart of the genetic algorithm code combination path provided by this invention;

[0047] Figure 4 The flowchart for the output target code combination path provided by the present invention. Detailed Implementation

[0048] To make the technical means, creative features, objectives, and effects of this invention readily understandable, the invention is further described below with reference to specific illustrations. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0049] See Figure 2 This invention provides a computer system network security risk monitoring system: the system includes an extraction module, an attack target setting module, a generation module, and a numbering and monitoring module.

[0050] The extraction module uses enterprise-level code analysis tools such as SonarQube and Fortify SCA, which support multiple programming languages ​​and development environments. It can extract all independently executable code snippets from source code, binary files, or runtime environments, and add functional attribute tags to each independently executable code snippet. The functional attribute tags include input parameter types and formats, output parameter types and formats, system call types and accessed resources, permission requirements, and sensitive operations and control flow characteristics; control flow characteristics include jump instructions, return addresses, etc.

[0051] The attack objective setting module allows for the preset of at least one attack objective type based on the actual security threats faced by the enterprise. Attack objective types include, but are not limited to: privilege escalation attacks, data leakage attacks, service interruption attacks, supply chain attacks, and identity authentication bypass attacks.

[0052] Privilege escalation attacks include obtaining administrator or root privileges; data breach attacks include reading sensitive files and stealing user credentials; service interruption attacks include triggering buffer overflows and causing system crashes; supply chain attacks include tampering with third-party components and inserting malicious code; and authentication bypass attacks include cracking passwords and forging identities.

[0053] The generation module, based on the preset attack target type and independently executable code fragments, uses a genetic algorithm to generate n possible code combination paths. For example... Figure 3 As shown, the methods for generating n possible code combination paths include:

[0054] Step 1: Based on the preset attack target type, randomly generate code combination paths composed of multiple independently executable code fragments according to preset requirements. These are individuals, forming the initial population. The population size is determined based on the enterprise's code size and computing resources, typically set to 50-200 individuals to ensure initial population diversity.

[0055] Step 2: Set up a runnable attack fitness function to calculate the static fitness score. The static fitness score is a weighted sum of compliance score, parameter matching score, and functional attribute label priority constraint compliance. The specific calculation method is as follows:

[0056]

[0057] For static fitness scoring, To construct a compliance score (0-1 points). Rate the parameter matching (0-1 points). The degree of compliance of the functional attribute label sequence constraint (0-1 points). , , , These are weighting coefficients, and their sum is 1. They are dynamically adjusted based on the enterprise's security strategy and attack type.

[0058] Construct a compliance score to score whether the syntax rules are followed, whether the parameters match, and whether the control flow is continuous (e.g., whether it contains valid jump instructions).

[0059]

[0060] To build a compliance score; Counts syntax and static compilation errors, including unclosed, undefined flags, and disassembled instructions that cannot be resolved, by resolving error statistics from compiler, assembler, linker logs, linter, or disassembler logs; This is a smoothing constant, for example, a value of 5, to avoid a sharp drop in score when there are a few errors, and to tolerate a very small number of automatically correctable errors.

[0061]

[0062] Scoring based on parameter matching; This represents the number of independently executable code segments within the code combination path. for Number of independently executable code snippets per interface; For the first Each segment can independently execute code snippets and output parameter vectors, including type, quantity, length, whether a handle / token is required, etc., which are derived from type signatures, function prototypes or call point arguments, and extracted from AST, symbol table, debugging symbols, decompiled results, and interface descriptions; Input parameter vectors for the next independently executable code segment; The distance between the output parameter vector and the input parameter vector is denoted as follows: 0 for fully compatible matches; 0.2–0.4 for implicit conversions only; and 0.8–1 for critical type incompatibility or quantity discrepancies. The parameter matching score reflects interface-by-interface compatibility, i.e., checking whether each interface can be connected, and averaging the scores to obtain the overall connectivity of the code combination path.

[0063]

[0064] Score the code combination path length. This is the minimum length of the code combination path, for example, a value of 5; This is the maximum length of the code combination path, for example, a value of 20; As a buffer zone, for example, a value of 5; if the length is too short, it is difficult to achieve the goal, and if it is too long, it is easy to become unstable or trigger defense. The length is full marks if it is within a reasonable range, and the more it deviates, the more points are deducted. Therefore, it shows a step-like and linear decay trend.

[0065] The sequential constraint compliance of the functional attribute label represents the score of whether the concatenation order of all independently executable code fragments in the code combination path meets the sequential constraint. Meeting the sequential constraint is, for example, "obtain the token first → then access the controlled resource". The higher the sequential constraint compliance of the functional attribute label, the higher the implementability of the corresponding code combination path.

[0066] Methods for obtaining the conformity of functional attribute label order constraints include:

[0067] Functional attribute labels are extracted according to the concatenation order of all independently executable code segments in the code combination path, resulting in functional attribute label feature vectors. Based on these feature vectors and a pre-trained functional attribute evaluation model, the constraint compliance degree of the functional attribute labels is obtained. The functional attribute labels in the feature vectors are arranged according to the concatenation order of all independently executable code segments in the code combination path, allowing the functional attribute evaluation model to understand the length of the code combination path and the concatenation order of the functional attribute labels.

[0068] Training methods for functional attribute evaluation models include:

[0069] Pre-collect feature vectors of functional attribute labels and the corresponding functional attribute label sequence constraint compliance degrees. These feature vectors and their corresponding functional attribute label sequence constraint compliance degrees form a set of training data. The functional attribute label sequence constraint compliance degree is implemented by technical personnel based on the length of the code combination path and the number of times the concatenation order of functional attribute labels within that path satisfies the sequence constraint. An example of the scoring formula is as follows:

[0070]

[0071]

[0072] Constraints on the order of functional attribute tags to ensure compliance; , , The coefficients are 1, and their sum is 1. It is recommended that... The value is 0.35. The value is 0.45. The value is 0.2, which is a penalty. The value is 0.5. This is the penalty coefficient, with a value of 0.15; The priority constraint score is calculated as follows: the ratio of the number of functional attribute tags in the code combination path that satisfy priority constraints to the number of applicable hard priority constraints. The number of applicable hard priority constraints is the number of functional attribute tags that actually appear in the code combination path. It is obtained by instantiating, deduplicating, and counting the applicable hard priority constraint rules one by one, and is observed and counted by technical personnel.

[0073] in, This is used to reduce situations where the priority constraint score is very low but the score is high; , The interaction score is specifically designed to reward cases where both the code combination path length score and the sequential constraint score are high, in order to reflect the effect of 1+1>2. The extra points are awarded to increase the interaction score corresponding to both high scores and decrease the interaction score for cases where one end is good and the other end is bad, which is more in line with the actual situation and increases the accuracy of detecting combined attack paths.

[0074] For example, if there are 6 applicable hard precedence constraints, then 4 of them must be satisfied. Approximately equal to 0.667, greater than 0.5, no penalty is triggered. Falling within a reasonable range =1, and the result calculated by substituting into the scoring formula is 0.783.

[0075] The training data is input into the functional attribute evaluation model. The functional attribute evaluation model outputs the degree of conformity of the predicted functional attribute labels to the feature vectors of functional attribute labels, and takes the degree of conformity of the actual functional attribute labels to the feature vectors of functional attribute labels as the prediction target. When the prediction error reaches the preset convergence condition, the training stops and the functional attribute evaluation model is obtained. The functional attribute evaluation model is a regression prediction model based on deep neural networks.

[0076] Step 3: Using the roulette wheel selection method, sort the static fitness scores in descending order, select the code combination path corresponding to the top Y static fitness scores as the parent individuals, perform two-point crossover on the parent individuals, swap the parts that can be executed independently to generate offspring individuals; randomly replace some parts of the offspring individuals that can be executed independently or adjust their order to generate new individuals.

[0077] Step 4: Repeat steps 2-3 until the preset termination condition is met, then output the path of the top n code combinations in the static fitness score. The preset termination condition includes the static fitness score exceeding a preset threshold or reaching the maximum number of iterations.

[0078] The verification module simulates the execution of n code combination paths in an enterprise security sandbox environment, calculates a dynamic score, and filters code combination paths based on the dynamic score and static fitness score. It outputs target code combination paths that can achieve the preset attack objectives and have low defense visibility. The dynamic score calculation method is as follows:

[0079]

[0080] For dynamic scoring, , , , The preset weights are 1, and the sum of the preset weights is 1. =0.4, =0.3, =0.2, =0.1; The attack objective is scored. The score is determined by whether the attack objective is achieved when the code combination path is simulated and executed in the enterprise security sandbox environment. If at least one attack objective is achieved, the score is 1; otherwise, the score is 0. To achieve a stable value, A score of 1 indicates normal execution, while a score approaching 0 indicates a crash. To defend against reverse visibility indicators, The fewer the alarms, the higher the score; This represents the resource consumption value. , For memory, Choose the minimum value within the parentheses to avoid When a negative value appears, a high resource consumption value indicates that the code combination path is "slender" and the execution traces are light, while a negative value indicates that the code combination path is "fat" and more easily discovered.

[0081] like Figure 4 As shown, the method for outputting target code combination paths that can achieve the preset attack objectives and have low defense visibility is as follows:

[0082] Only code combination paths with an attack objective score of 1 and a weighted sum of dynamic and static fitness scores below a predetermined threshold are retained and output as code combination paths that can achieve the preset attack objective and have low defense visibility.

[0083] , , and Both are 0.5. Paths with high static scores but dynamic failures will be significantly lowered, improving the accuracy of code combination paths that are not easy to monitor and can achieve the preset attack objectives.

[0084] The numbering and monitoring module is used to assign a unique number to each code segment in the target code combination path, and to terminate the execution process when an execution process corresponding to the number is detected, so as to avoid losses to the enterprise.

[0085] By using target code combination paths as individuals in the initial population, the convergence speed of the genetic algorithm is accelerated, more new target code combination paths are output more quickly, the latency of the computer system threat intelligence analysis system is reduced, and the practicality of real-time threat detection scenarios such as online protection of financial transaction systems and industrial control systems is increased.

[0086] Example 2

[0087] The dynamic scoring phase requires running potential malicious code combination paths within a security sandbox. However, in some high-privilege attack path tests, the sandbox itself may be exploited to escape vulnerabilities, leading to a breach of security boundaries. Specific malicious payloads may detect the runtime environment (sandbox fingerprinting), triggering evasion behaviors and resulting in inaccurate scoring. The sandbox itself, when attacked, can become an intrusion point, leading to missed detections and the erroneous conclusion that certain malicious code combination paths cannot achieve their attack objectives. To address this issue, this embodiment incorporates an evasion detection score into the dynamic scoring to identify malicious code combination paths that actively detect the sandbox. The evasion detection score measures whether the code combination path exhibits behavior that identifies or evades the sandbox environment. The score ranges from 0 to 1; a higher value indicates more obvious evasion behavior and a higher risk score. The dynamic scoring calculation formula is as follows:

[0088]

[0089] To avoid detection scores, , , , , The sum of these is 1; the detection avoidance score is the sum of the sandbox fingerprint detection score, the time difference avoidance score, the memory and process enumeration score, and the abnormal execution flow score.

[0090] If it is detected that code in the code combination path reads system characteristics (such as BIOS serial number, MAC address, CPU model, virtual hard disk signature, etc.) at runtime to determine the running environment, a predetermined score is added and recorded as the sandbox fingerprint detection score.

[0091] If it is detected that code in the code combination path uses high-precision timing functions (such as RDTSC, QueryPerformanceCounter) to determine instruction execution delay, and uses this to infer the virtualization environment, a predetermined score is added, which is recorded as the time difference avoidance score.

[0092] If code scanning system processes or memory mappings are detected in the code combination path to find sandbox analysis tools or security agent processes (such as sandbox.exe, procmon.exe), a predetermined score is added, which is recorded as memory and process enumeration score.

[0093] If any of the following behaviors are detected: reading system characteristics, using high-precision timing functions, scanning system processes, or memory mapping to find sandbox analysis tools or security agent processes, the attack process is interrupted, and a predetermined score is added, recorded as memory and process enumeration points. Interrupting the attack process includes entering an empty loop or performing harmless operations. This significantly improves the risk of highly evasive malicious code, reduces false negatives, and can be deployed in high-security scenarios such as finance, industrial control, and cloud computing.

[0094] Example 3

[0095] like Figure 1 As shown, this embodiment provides a method for monitoring network security risks in computer systems, including:

[0096] Use code analysis tools to extract multiple independently executable code snippets from source code, binary files, or runtime environments, and add functional attribute tags to each independently executable code snippet;

[0097] At least one attack objective is set according to the preset security threat types, including privilege escalation attacks, data leakage attacks, service interruption attacks, supply chain attacks, or identity authentication bypass attacks.

[0098] Based on the attack objective and the independently executable code fragment, a genetic algorithm is used to generate multiple code combination paths, and a static fitness score is performed on the code combination paths. The static fitness score is calculated based on executability, parameter matching score, code combination path length score, and functional attribute label sequence constraint compliance.

[0099] The code combination path is dynamically executed in a secure sandbox environment to obtain a dynamic score. Based on the static fitness score and the dynamic score, the code combination path is filtered to output the target code combination path that can achieve the preset attack purpose and has low defense visibility.

[0100] Each code segment in the target code combination path is uniquely numbered, and the execution process is terminated when the execution process corresponding to the number is detected.

[0101] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for monitoring network security risks in computer systems, characterized in that, include: Use code analysis tools to extract multiple independently executable code snippets from source code, binary files, or runtime environments, and add functional attribute tags to each independently executable code snippet; At least one attack objective is set according to the preset security threat types, including privilege escalation attacks, data leakage attacks, service interruption attacks, supply chain attacks, or identity authentication bypass attacks. Based on the attack objective and the independently executable code fragment, a genetic algorithm is used to generate multiple code combination paths, and a static fitness score is performed on the code combination paths. The static fitness score is calculated based on executability, parameter matching score, code combination path length score, and functional attribute label sequence constraint compliance. The code combination path is dynamically executed in a secure sandbox environment to obtain a dynamic score. Based on the static fitness score and the dynamic score, the code combination path is filtered to output the target code combination path that can achieve the preset attack purpose and has low defense visibility. Each code segment in the target code combination path is uniquely numbered, and the execution process is terminated when the execution process corresponding to the number is detected.

2. The computer system network security risk monitoring method according to claim 1, characterized in that, Methods for generating multiple code combination paths using genetic algorithms include: Step 1: Based on the preset attack target type, randomly generate a code combination path composed of multiple independently executable code fragments according to preset requirements, which is an individual and forms the initial population; Step 2: Perform static fitness scoring on the code combination path; Step 3: Using the roulette wheel selection method, sort the static fitness scores in descending order, select the code combination path corresponding to the top Y static fitness scores as the parent individual, perform two-point crossover on the parent individuals, swap the parts that can be executed independently to generate offspring individuals; randomly replace some parts of the offspring individuals that can be executed independently or adjust their order to generate new individuals. Step 4: Repeat steps 2-3 until the preset termination condition is met, then output the path of the top n code combinations in the static fitness score.

3. The computer system network security risk monitoring method according to claim 1, characterized in that, The build compliance score is obtained by subtracting the sum of the syntax and static compilation error counts from the smoothing constant, using the sum of the syntax and static compilation error counts as the numerator and 1 as the denominator.

4. Determine the number of independently executable code fragments in the code combination path, and based on this number, determine the number of interfaces for each independently executable code fragment, and obtain the... The segment can independently execute code snippets and output parameter vectors, and The code snippet can be executed independently. It takes an input parameter vector as input and outputs the distance between the output parameter vector and the input parameter vector to determine the mismatch. Different degrees of matching correspond to different values. The mismatch distance is subtracted from 1, and then... From 1 to Summation, then division Obtain a parameter matching score; When the code combination path length is within the minimum and maximum length range, the code combination path length score is full. If it exceeds the range, the score is deducted in a linear decay manner according to the degree of deviation between the code combination path length and the range, and the code combination path length is obtained.

5. The computer system network security risk monitoring method according to claim 3, characterized in that, The functional attribute label sequence constraint compliance score represents the score of whether the concatenation order of all independently executable code segments in the code composition path satisfies the sequence constraint. Methods for obtaining the functional attribute label sequence constraint compliance score include: Extract the corresponding functional attribute labels according to the concatenation order of all independently executable code segments in the code combination path, and obtain the functional attribute label feature vector. Based on the functional attribute label feature vector and the pre-trained functional attribute evaluation model, obtain the functional attribute label sequential constraint compliance degree. The functional attribute labels in the functional attribute label feature vector are arranged according to the concatenation order of all independently executable code segments in the code combination path.

6. The computer system network security risk monitoring method according to claim 4, characterized in that, Training methods for functional attribute evaluation models include: Pre-collect feature vectors of functional attribute labels, as well as the corresponding functional attribute label sequence constraint compliance degrees; the feature vectors of functional attribute labels and the corresponding functional attribute label sequence constraint compliance degrees form a set of training data; The training data is input into the functional attribute evaluation model. The functional attribute evaluation model outputs the degree of conformity of the predicted functional attribute labels to the feature vectors of functional attribute labels, and takes the degree of conformity of the actual functional attribute labels to the feature vectors of functional attribute labels as the prediction target. When the prediction error reaches the preset convergence condition, the training stops and the functional attribute evaluation model is obtained. The functional attribute evaluation model is a regression prediction model based on deep neural networks.

7. The computer system network security risk monitoring method according to claim 1, characterized in that, The dynamic score is a weighted sum of attack objective score, execution stability value, defense visibility reverse index, and resource consumption value; the attack objective score is 1 if at least one attack objective is achieved, otherwise the attack objective score is 0; when the code combination path is simulated and executed in the enterprise security sandbox environment, the number of abnormal exits is used as the abnormal numerator, the total number of execution steps plus 1 is used as the abnormal denominator, and the execution stability value is obtained by subtracting the ratio of the abnormal numerator to the abnormal denominator from 1; the defense visibility reverse index is obtained by subtracting the ratio of the number of days of security alert hits to the alert limit from 1.

8. The computer system network security risk monitoring method according to claim 6, characterized in that, The method for outputting a code combination path that can achieve the preset attack objective is as follows: Only code combination paths with an attack objective score of 1 and a weighted sum of dynamic and static fitness scores below a predetermined threshold are retained, and these are output as code combination paths that are difficult to monitor and can achieve the preset attack objective.

9. The computer system network security risk monitoring method according to claim 7, characterized in that, A detection avoidance score is added to the dynamic scoring. The detection avoidance score is the sum of the sandbox fingerprint detection score, the time difference avoidance score, the memory and process enumeration score, and the abnormal execution flow score. If code in the code combination path is detected to read system characteristics at runtime, a predetermined score is added and recorded as the sandbox fingerprint detection score. If a code in the code combination path is found to use a high-precision timing function, a predetermined score will be added and recorded as a time difference avoidance score. If code scanning system processes or memory mappings are detected in the code combination path to find sandbox analysis tools or security agent processes, a predetermined score is added and recorded as memory and process enumeration score. If any behavior is detected, such as reading system characteristics, using high-precision timing functions, scanning system processes, or memory mapping to find sandbox analysis tools or security agent processes, the attack process will be interrupted and a predetermined score will be added, which will be recorded as memory and process enumeration score.

10. A computer system network security risk monitoring system, characterized in that, The computer system network security risk monitoring method according to any one of claims 1-9, wherein the system comprises: The extraction module is used to extract multiple independently executable code snippets from source code, binary files, or runtime environments using code analysis tools, and to add functional attribute tags to each independently executable code snippet; The attack objective setting module is used to set at least one attack objective according to preset security threat types, including privilege escalation attacks, data leakage attacks, service interruption attacks, supply chain attacks, or identity authentication bypass attacks. The generation module is used to generate multiple code combination paths using a genetic algorithm based on the attack objective and the independently executable code fragment, and to perform static fitness scoring on the code combination paths. The static fitness score is calculated based on executability, parameter matching score, code combination path length score, and functional attribute label sequence constraint compliance. The verification module is used to dynamically execute the code combination path in a secure sandbox environment, obtain a dynamic score, and filter the code combination path based on the static fitness score and the dynamic score, and output the target code combination path that can achieve the preset attack purpose and has low defense visibility. The numbering and monitoring module is used to assign a unique number to each code segment in the target code combination path, and to terminate the execution process when an execution process corresponding to the number is detected.

Images