AI-driven malicious software real-time monitoring method in network space
By using a distributed monitoring engine and AI-driven kernel behavior analysis methods, the problems of incomplete data collection, fuzzy representation, and low clustering efficiency in malware monitoring are solved, enabling comprehensive tracking of malware behavior and efficient family identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BESTTONE HOLDING
- Filing Date
- 2025-11-18
- Publication Date
- 2026-05-08
AI Technical Summary
Existing technologies for malware detection suffer from incomplete behavioral data collection, vague and insufficiently standardized behavioral representations, and low clustering efficiency and family identification accuracy, resulting in detection lag and significant errors.
A distributed monitoring engine is used to collect multi-dimensional kernel behavior data. Through kernel behavior semantic transformation and model building, combined with n-gram model and TF-IDF algorithm, feature extraction and hierarchical clustering are performed to achieve comprehensive tracking of malware behavior and accurate identification of its family affiliation.
It achieves comprehensive tracking of malware behavior and improves the accuracy of family identification, with clustering efficiency improved by 30%-40% and family identification accuracy improved by 15%-20%, meeting the needs of real-time monitoring and tracing of malware in cyberspace.
Smart Images
Figure CN121997322A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of malware detection technology, specifically an AI-driven real-time malware detection method in cyberspace. Background Technology
[0002] With the intensification of cyberspace attack and defense confrontation, malware exhibits significant characteristics such as "rapid mutation and iteration, multiple evasion methods, and family-based propagation," posing a severe challenge to traditional monitoring technologies. Traditional malware detection relies on static signature matching, but malware frequently evades signature database identification through techniques such as packing, code obfuscation, and dynamic behavioral mutation, resulting in significant detection lag. Even behavioral analysis-based solutions suffer from three core flaws: 1. Incomplete collection of behavioral data: Most solutions only monitor single-dimensional behavior (such as API calls), ignoring key malicious behaviors such as process lifecycle, registry tampering, and network interaction, resulting in incomplete coverage of behavioral features and easy missed detections.
[0003] 2. The behavioral representation is vague and lacks standardization: The original kernel function call logs are directly used as features, resulting in a condensed log semantics (such as multiple sets of function call combinations for the same malicious operation), and a lack of structured modeling. It is difficult to accurately distinguish between malicious and normal behavior, and the features are subject to significant noise interference.
[0004] 3. Low clustering efficiency and low family identification accuracy: The behavioral sequences are not redundancy-processed, and repeated behaviors lead to a surge in data volume. After vectorization, the dimensionality expands, and similarity calculation takes too long. At the same time, relying only on a single behavioral feature (such as call frequency) for family clustering ignores deep features such as behavioral parameters and operation objects, resulting in a large error in judging the family affiliation of variant malware. Therefore, it is necessary to improve the current situation. Summary of the Invention
[0005] In order to overcome the shortcomings of the prior art, this invention provides an AI-driven real-time monitoring method for malware in cyberspace, which effectively solves the problems of incomplete data collection, vague and insufficient standardization of behavior representation, low clustering efficiency and low family identification accuracy in the prior art.
[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for real-time monitoring of AI-driven malware in cyberspace, characterized by comprising the following steps: Step 1: Multi-dimensional kernel behavior data collection: A distributed monitoring engine composed of process thread monitoring submodule, registry monitoring submodule, file system monitoring submodule, network monitoring submodule and system service monitoring module comprehensively captures system kernel behavior logs; among them, each submodule performs targeted monitoring for process life cycle, registry operation, file operation, network interaction and system service call scenarios, to achieve multi-dimensional coverage of the core behavior of malware. Step Two: Kernel Behavior Semantic Conversion and Model Construction: The raw kernel function call logs collected in Step One are semantically converted, transforming the semantically condensed function call sequence into a semantically discrete and clearly defined kernel behavior representation, and constructing a kernel behavior model containing four parts: BEHAVIOR, ARGBLOCK, TARGET, and HANDLE; the kernel behavior model achieves standardization of behavioral features through structured partitioning, highlighting the core operation types, common parameters, and targets of malware; Step 3: Malware Clustering Analysis Based on Behavioral Features: The kernel behavior sequences generated in Step 2 are preprocessed, and redundant behaviors that occur repeatedly in the sequences are merged to reduce the amount of data; the preprocessed behavior sequences are extracted using a sliding window model using an n-gram model, and feature weights are calculated using the TF-IDF algorithm and mapped to a multi-dimensional vector space; hierarchical clustering algorithms are used to cluster the malware behavior features in the vector space, where the inter-cluster distance is calculated using the complete linkage algorithm, and the family affiliation of malware is determined based on the distance in the vector space.
[0007] Preferably, in step one, the process thread monitoring submodule registers process creation callback functions, process deletion callback functions, thread start callback functions, thread termination callback functions, and image loading callback functions to capture in real time the entire lifecycle events of the process from creation to deletion, thread state change events, and the path and timestamp information of the image file being loaded.
[0008] Preferably, in step one, the file system monitoring submodule adopts a file micro-filtering driven approach, registers filtering rules for file creation, file reading, file writing, file deletion, and file renaming with the system filter manager, captures file operation events of specified paths (including system directories, user directories, and temporary directories) through callback functions, and records the operation initiating process ID, operation type, and operation result.
[0009] Preferably, in step one, the network monitoring submodule intercepts the system network IRP packets through TDI filtering driver, parses and extracts the source IP address, destination IP address, source port, destination port and protocol type in the network connection establishment event, the data length and direction in the network data transmission and reception event, and the timestamp and status code of the network connection disconnection event, so as to achieve a comprehensive record of the network interaction behavior of malicious software.
[0010] Preferably, the BEHAVIOR part in step two consists of "class identifier + operation identifier", where the class identifier is used to classify the major category to which the behavior belongs (including process operation, file operation, network operation, registry operation, system service call), and the operation identifier is used to characterize the specific behavior type under the major category, together realizing the accurate definition of the specific behavior type of API call.
[0011] Preferably, the core parameters of the ARGBLOCK part of the recorded behavior in step two are common characteristics that are stable for the same family of malware, including but not limited to the type of image file, the system path where the image file is located, the key value path of the registry operation, and the target port range of the network connection.
[0012] Preferably, the process of mapping the behavior sequence to a multidimensional vector space using the n-gram model and TF-IDF algorithm in step three includes: extracting behavior subsequences as feature units by sliding the n-gram model with a preset window size (n=2 or n=3), calculating the weight of each feature unit in the behavior sequence using the TF-IDF algorithm, and the weight value is positively correlated with the frequency of occurrence of the feature unit and negatively correlated with the distribution breadth in different malware samples, and finally generating a multidimensional vector representing the behavior characteristics of malware.
[0013] Preferably, the inter-cluster distance calculation for hierarchical clustering in step three adopts the complete linkage algorithm. That is, for two sample clusters to be clustered, the Euclidean distance between all data points in the cluster is calculated, and the maximum distance is taken as the inter-cluster distance between the two clusters. This distance metric is used to achieve accurate division of malware family boundaries.
[0014] Compared with the prior art, the beneficial effects of the present invention are: the present invention, 1. By integrating five sub-modules—process threads, registry, file system, network, and system services—through a distributed monitoring engine, it can target and capture the core behaviors of malware throughout its entire lifecycle (such as process creation, file tampering, and network communication), avoiding the missed detection problems of single-dimensional monitoring and achieving comprehensive tracking of malicious behavior.
[0015] 2. By converting fuzzy kernel function call logs into a structured model containing BEHAVIOR (behavior type), ARGBLOCK (common parameters), TARGET (target object), and HANDLE (auxiliary identifier), behavior types are precisely defined through "class identifier + operation identifier". Family common parameters and tamper-resistant object features are selected to solve the problems of semantic ambiguity and high feature noise in traditional logs, providing a high-quality feature foundation for subsequent clustering.
[0016] 3. By merging redundant behaviors in the preprocessing stage and combining n-gram and TF-IDF algorithms to achieve dimensionality reduction of behavior sequences, the amount of data is reduced while retaining core features, and the clustering efficiency is improved by 30%-40% compared with traditional methods. By adopting the completelinkage hierarchical clustering algorithm, family boundaries are divided based on multi-dimensional vector space distance, and multi-dimensional features such as behavior type, parameters, and objects are fully utilized to capture the commonalities of variants. The family identification accuracy is improved by 15%-20% compared with single feature methods, meeting the actual needs of real-time monitoring and tracing of malicious software in cyberspace. Attached Figure Description
[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof.
[0018] In the attached diagram: Figure 1 This invention provides a framework for an AI-driven real-time malware detection method in cyberspace. Detailed Implementation
[0019] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0020] Please see Figure 1 This invention discloses an AI-driven real-time malware monitoring method in cyberspace, comprising the following steps: Step 1: Multi-dimensional kernel behavior data collection: A distributed monitoring engine composed of process thread monitoring submodule, registry monitoring submodule, file system monitoring submodule, network monitoring submodule and system service monitoring module comprehensively captures system kernel behavior logs; among them, each submodule performs targeted monitoring for process life cycle, registry operation, file operation, network interaction and system service call scenarios, to achieve multi-dimensional coverage of the core behavior of malware. Step Two: Kernel Behavior Semantic Conversion and Model Construction: The raw kernel function call logs collected in Step One are semantically converted, transforming the semantically condensed function call sequence into a semantically discrete and clearly defined kernel behavior representation, and constructing a kernel behavior model containing four parts: BEHAVIOR, ARGBLOCK, TARGET, and HANDLE; the kernel behavior model achieves standardization of behavioral features through structured partitioning, highlighting the core operation types, common parameters, and targets of malware; Step 3: Malware Clustering Analysis Based on Behavioral Features: The kernel behavior sequences generated in Step 2 are preprocessed, and redundant behaviors that occur repeatedly in the sequences are merged to reduce the amount of data; the preprocessed behavior sequences are extracted using a sliding window model using an n-gram model, and feature weights are calculated using the TF-IDF algorithm and mapped to a multi-dimensional vector space; hierarchical clustering algorithms are used to cluster the malware behavior features in the vector space, where the inter-cluster distance is calculated using the complete linkage algorithm, and the family affiliation of malware is determined based on the distance in the vector space.
[0021] The system employs a distributed monitoring engine to comprehensively capture system kernel behavior. This includes: a process / thread monitoring submodule, which registers callback functions for process creation / deletion, thread startup / termination, and image loading, capturing process lifecycle and image file loading events in real time; a registry monitoring submodule, which monitors registry key creation, modification, and deletion operations via a registry callback mechanism, recording operation paths and parameter information; a file system monitoring submodule, which uses file micro-filtering driver technology to register file creation, reading, writing, and deletion filtering rules with the filter manager, capturing file operation events at specified paths; a network monitoring submodule, which intercepts IRP packets based on a TDI filter driver, parses network connection establishment / disconnection and data transmission / reception events, and extracts source / destination IPs, ports, and protocol types; and a system service monitoring module, which intercepts system service function calls by hooking the system service dispatch table, recording function names, input parameters, and return values. The collected raw logs undergo behavioral feature standardization: Behavioral semantic transformation: Semantic kernel function call logs are converted into semantically discrete and clearly defined kernel behavior representations. Specifically, through preset behavior mapping rules, continuous function call sequences are mapped into structured behavioral units. Kernel behavior model construction: A single behavior log is divided into four parts: BEHAVIOR part: Represents the specific behavior type of an API call, composed of "category identifier + operation identifier" (e.g., in "0f01", "0f" represents the image loading category, and "01" represents the loading operation); ARGBLOCK part: Records the core parameters of the behavior, selecting parameters common to the same family of malware; TARGET part: Represents the object of the behavior, prioritizing features that are not easily tampered with by malware; HANDLE part: Records the system handle related to the behavior, serving as an auxiliary identifier for the operation object. AI-based malware clustering analysis includes: Behavior sequence preprocessing: Based on kernel function usage patterns and kernel behavior models, TARGET and HANDLE blocks are used to merge redundant behaviors that occur repeatedly in the behavior sequence, reducing the sequence length; Behavior vectorization: An n-gram model is used to extract features from the preprocessed behavior sequence using a sliding window, and the TF-IDF algorithm is used to calculate feature weights, mapping the behavior sequence to a multi-dimensional vector space; Hierarchical clustering analysis: A hierarchical clustering algorithm is used to cluster malware behavior features in the vector space, where the distance between clusters is calculated using the complete linkage algorithm (i.e., the distance between the farthest data points in two clusters), and the malware family affiliation is determined based on the distance in the vector space.
[0022] Taking image loading behavior as an example, the kernel behavior model is represented as "0f01|00006b2c 0c7d3f9c|000d4000": • BEHAVIOR section “0f01”: “0f” indicates the image loading category, and “01” indicates the specific loading operation.
[0023] • The ARGBLOCK section “00006b2c 0c7d3f9c”: “00006b2c” indicates that the image type is DLL (obtained by parsing FullImageName), and “0c7d3f9c” indicates the system path where the image is located.
[0024] • The TARGET part “000d4000”: indicates the size of the loaded image (avoiding interference from randomized image names).
[0025] Clustering process description: The behavioral sequence processing for a certain family of malware and its variants is as follows: 1. Merging duplicate "image loading-DLL-system path" behaviors reduces sequence length by approximately 25%.
[0026] 2. The behavior subsequences are extracted using a 3-gram model, and the weights are calculated using TF-IDF to generate a 1024-dimensional feature vector.
[0027] 3. Using complete linkage hierarchical clustering, samples with a vector distance less than a threshold (e.g., 0.3) are grouped into the same cluster to achieve family clustering.
[0028] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0029] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A method for real-time monitoring of AI-driven malware in cyberspace, characterized in that: Includes the following steps: Step 1: Multi-dimensional kernel behavior data collection: A distributed monitoring engine composed of process thread monitoring submodule, registry monitoring submodule, file system monitoring submodule, network monitoring submodule and system service monitoring module comprehensively captures system kernel behavior logs; among them, each submodule performs targeted monitoring for process life cycle, registry operation, file operation, network interaction and system service call scenarios, to achieve multi-dimensional coverage of the core behavior of malware. Step Two: Kernel Behavior Semantic Conversion and Model Construction: The raw kernel function call logs collected in Step One are semantically converted, transforming the semantically condensed function call sequence into a semantically discrete and clearly defined kernel behavior representation, and constructing a kernel behavior model containing four parts: BEHAVIOR, ARGBLOCK, TARGET, and HANDLE; the kernel behavior model achieves standardization of behavioral features through structured partitioning, highlighting the core operation types, common parameters, and targets of malware; Step 3: Malware Clustering Analysis Based on Behavioral Features: The kernel behavior sequences generated in Step 2 are preprocessed, and redundant behaviors that occur repeatedly in the sequences are merged to reduce the amount of data; the preprocessed behavior sequences are extracted using a sliding window model using an n-gram model, and feature weights are calculated using the TF-IDF algorithm and mapped to a multi-dimensional vector space; hierarchical clustering algorithms are used to cluster the malware behavior features in the vector space, where the inter-cluster distance is calculated using the completelinkage algorithm, and the family affiliation of malware is determined based on the distance in the vector space.
2. The method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: In step one, the process thread monitoring submodule registers process creation callback functions, process deletion callback functions, thread start callback functions, thread termination callback functions, and image loading callback functions to capture in real time the entire lifecycle events of the process from creation to deletion, thread state change events, and the path and timestamp information of the image file being loaded.
3. The method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: In step one, the file system monitoring submodule adopts a file micro-filtering driver approach, registering filtering rules for file creation, file reading, file writing, file deletion, and file renaming with the system filter manager. It captures file operation events in specified paths (including system directories, user directories, and temporary directories) through callback functions and records the process ID of the operation initiating process, the operation type, and the operation result.
4. The method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: In step one, the network monitoring submodule intercepts the system network IRP packets through TDI filtering, parses and extracts the source IP address, destination IP address, source port, destination port and protocol type in the network connection establishment event, the data length and direction in the network data transmission and reception event, and the timestamp and status code of the network connection disconnection event, so as to achieve a comprehensive record of the network interaction behavior of malicious software.
5. A method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: In step two, the BEHAVIOR part consists of "class identifier + operation identifier". The class identifier is used to classify the major category to which the behavior belongs (including process operation, file operation, network operation, registry operation, system service call). The operation identifier is used to characterize the specific behavior type under the major category, together realizing the precise definition of the specific behavior type of API call.
6. The method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: In step two, the ARGBLOCK part records the core parameters of the behavior. These parameters are common characteristics that make the same family of malware stable, including but not limited to the type of the image file, the system path where the image file is located, the key value path of the registry operation, and the target port range of the network connection.
7. A method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: The process of mapping the behavior sequence to a multidimensional vector space using the n-gram model and TF-IDF algorithm in step three includes: extracting behavior subsequences as feature units by sliding the n-gram model with a preset window size (n=2 or n=3); calculating the weight of each feature unit in the behavior sequence using the TF-IDF algorithm; the weight value is positively correlated with the frequency of occurrence of the feature unit and negatively correlated with the distribution breadth in different malware samples; and finally generating a multidimensional vector representing the behavior characteristics of malware.
8. A method for real-time monitoring of AI-driven malware in cyberspace according to claim 1, characterized in that: In step three, the inter-cluster distance calculation for hierarchical clustering adopts the complete linkage algorithm. That is, for two sample clusters to be clustered, the Euclidean distance between all data points in the cluster is calculated, and the maximum distance is taken as the inter-cluster distance between the two clusters. This distance metric is used to achieve accurate division of the boundaries of malware families.