Malware detection method and system based on multi-dimensional code analysis and encrypted traffic behavior cooperation

Abstract

The present application relates to the technical field of malware detection, in particular to a malware detection method and system based on multi-dimensional code analysis and encrypted traffic behavior cooperation, comprising the following steps: extracting the cyclic jump instruction count and the encryption operation instruction count generated by the target process in the unit time window according to the operating system performance monitoring unit, and establishing the instruction time domain discrete set.In the present application, when it is determined that it falls into the preset constant fluctuation interval item and the interface call frequency value is greater than the preset upper limit frequency, the associated file read-write permission is cancelled and the malicious spying instruction is blocked, the automatic interception success rate for the highly concealed advanced persistent threat and the ransomware spying behavior is improved, the false positive rate caused by single dimension detection is reduced, the cross verification of the host bottom layer abnormal instruction and the external network data interaction is realized, and the robustness of the overall security defense system is enhanced.

Description

Technical Field

[0001] This invention relates to the field of malware detection technology, and in particular to a malware detection method and system based on multi-dimensional code analysis and encrypted traffic behavior collaboration. Background Technology

[0002] The field of malware detection technology refers to a computer security defense system dedicated to identifying, analyzing, intercepting, and removing various malicious codes that attempt to disrupt the normal operation of computer systems, steal sensitive data, or obtain unauthorized access permissions.

[0003] Current computer security defense systems rely excessively on static signature matching based on known malicious signature databases and dynamic behavioral heuristics analysis targeting a single dimension. Faced with the widespread adoption of high-strength encrypted communication protocols in today's network threats, simply intercepting data packets at the network boundary or monitoring system interface calls in a sandbox environment is insufficient to penetrate the encryption layer and parse the true payload content, creating detection blind spots. Single-dimensional data capture mechanisms are easily interfered with by malicious code obfuscation and process injection masquerading techniques, leading to fragmented criteria for behavioral pattern judgment and making it difficult to accurately reconstruct the complete attack chain of covert theft or ransomware attacks. For example, when facing highly targeted advanced persistent threats, malicious code often disguises itself as a legitimate system service process, slowly reading sensitive local files in the background, encrypting them using legitimate system encryption / decryption libraries, and then sending them out through a standard TLS encrypted network channel. Because the amount of data read in a single instance is extremely small and the external communication traffic is globally encrypted, conventional single-detection systems based on network packet surge thresholds or specific file read frequencies struggle to identify abnormal data flows amidst massive amounts of normal business background noise. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a malware detection method and system based on multi-dimensional code analysis and encrypted traffic behavior collaboration.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration, comprising the following steps: Based on the operating system performance monitoring unit, extract the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window, establish a discrete set of instructions in the time domain, record the total number of network packets sent by the target process within and outside the same unit time window, and establish a discrete set of traffic in the time domain. Discrete Fourier transforms are performed on the discrete set of instructions in the time domain and the discrete set of traffic flow in the time domain, respectively, to extract the instruction frequency component and traffic frequency component corresponding to the target process, generate a frequency domain spectrum parameter set, calculate the cross power spectral density values ​​between the corresponding instruction frequency component and traffic frequency component within the frequency domain spectrum parameter set, and filter to generate a list of resonance peaks at the same frequency. When it is determined that the number of elements in the same frequency resonance peak list is greater than zero, the total number of bytes read from the disk file corresponding to the target process and the frequency of calls to the corresponding interface of the system encryption and decryption library are intercepted at the operating system kernel layer. The code dimension flow parameter set is obtained, the total number of uplink bytes corresponding to the TLS encrypted application layer payload sent by the target process is recorded, and the three-dimensional data flow magnitude combination is obtained. Extract the total number of bytes read from the internal disk file and the total number of bytes read from the upstream of the three-dimensional data flow volume combination, calculate the flow aggregation deformation degree value, compare the flow aggregation deformation degree value with the preset constant fluctuation range item, and obtain the malicious data theft blocking instruction.

[0006] Preferably, the step of obtaining the discrete set of traffic flow in the time domain is as follows: The operating system performance monitoring unit is invoked to retrieve the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window. The timestamps corresponding to the instructions are obtained, and the counts of loop jump instructions and encryption operation instructions are merged according to the timestamp order to establish a discrete set of instructions in the time domain. Obtain the time node of the instruction time domain discrete set, record the total number of network packets sent by the target process within and outside the same unit time window, verify that the time of the total number of network packets sent is the same as the time node of the instruction time domain discrete set, and generate a synchronous packet sending feature item. Retrieve the total number of network packets in the synchronous packet sending feature item, locate the time node of the instruction time domain discrete set associated with the total number of network packets, arrange the total number of network packets in the order of the instruction time domain discrete set generation time nodes, and establish the traffic time domain discrete set.

[0007] Preferably, the steps for obtaining the frequency domain spectrum parameter set are as follows: Extract the discrete time series items within the discrete time domain set of the traffic flow, perform a mathematical mapping transformation on the discrete time series items to a complex frequency domain sequence, obtain the command frequency component and traffic frequency component corresponding to each discrete frequency point, and combine the command frequency component and traffic frequency component according to the frequency point distribution order to generate a frequency domain spectrum parameter set.

[0008] Preferably, the step of obtaining the list of resonance peaks at the same frequency is as follows: Extract the command frequency component and the flow frequency component corresponding to the same frequency point within the frequency domain spectrum parameter group, and calculate the cross power spectral density value between the command frequency component and the flow frequency component. Retrieve preset judgment constants, compare the cross power spectral density values ​​corresponding to each frequency point position with the preset judgment constants, filter out spectral line nodes with cross power spectral density values ​​greater than the preset judgment constants within the same frequency band, and combine the extracted spectral line nodes according to the frequency band distribution order to generate a list of resonance peaks at the same frequency.

[0009] Preferably, the steps for obtaining the code dimension flow parameter set are as follows: The number of elements recorded in the list of resonant peaks at the same frequency is counted. When it is determined that the number of elements in the list of resonant peaks at the same frequency is greater than zero, the total number of bytes read from the disk file corresponding to the target process is intercepted at the operating system kernel layer. The frequency value of the corresponding interface call for the system encryption and decryption library is extracted. The total number of bytes read from the disk file and the frequency value of the interface call are combined to obtain the code dimension flow parameter set.

[0010] Preferably, the step of obtaining the combination of three-dimensional data flow magnitudes is as follows: Continuously locate the network communication data stream sent out by the target process, record the total number of uplink bytes associated with the TLS encrypted application layer payload sent by the target process at the application layer network protocol stack, extract the total number of uplink bytes to generate the corresponding time node, align the generated time node with the generation time of the code dimension flow parameter set, and obtain the total number of uplink bytes at the communication layer. Extract the total number of bytes read from the disk file and the frequency of interface calls recorded within the code dimension flow parameter set. Merge the total number of bytes read from the communication layer, the total number of bytes read from the disk file, and the frequency of interface calls according to the preset feature dimension arrangement order to complete cross-dimensional feature splicing and obtain a three-dimensional data flow magnitude combination.

[0011] Preferably, the step of obtaining the flow polymerization deformation value is as follows: The total number of bytes read from the disk file and the total number of bytes read from the upstream are separated within the three-dimensional data flow magnitude combination. The associated interface call frequency values ​​are extracted. A benchmark smoothing constant is introduced to the total number of bytes read from the upstream and the total number of bytes read from the disk file to eliminate calculation singularities, and a smooth flow parameter set is obtained. Extract the total number of bytes read from the disk file, the total number of bytes read upstream, and the frequency of interface calls from the smooth flow parameter group, and calculate the flow aggregation deformation value.

[0012] Preferably, the step of obtaining the malicious data theft blocking instruction is as follows: By comparing the value of the flow aggregation deformation degree with the preset constant fluctuation range item, when it is determined that the value falls within the preset constant fluctuation range item and the frequency of interface calls in the smooth flow parameter group is greater than the preset frequency upper limit item, the read and write permissions of the associated file are cancelled, and a malicious data theft blocking instruction is obtained.

[0013] The present invention also provides a system comprising: The time-domain feature extraction module is used to extract the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window based on the operating system performance monitoring unit, establish a discrete set of instruction time domains, record the total number of network packets sent by the target process within and outside the same unit time window, and establish a discrete set of traffic time domains. The frequency domain resonance analysis module is used to perform discrete Fourier transform on the instruction time domain discrete set and the flow time domain discrete set respectively, extract the instruction frequency component and flow frequency component corresponding to the target process, generate a frequency domain spectrum parameter set, calculate the cross power spectral density value between the corresponding instruction frequency component and flow frequency component within the frequency domain spectrum parameter set, and filter to generate a list of resonance peaks at the same frequency. The three-dimensional data flow monitoring module is used to intercept the total number of bytes read from the disk file corresponding to the target process and the frequency of calls to the corresponding interface of the system encryption and decryption library at the operating system kernel layer when it is determined that the number of elements in the same frequency resonance peak list is greater than zero, obtain the code dimension flow parameter set, record the total number of uplink bytes corresponding to the TLS encrypted application layer payload sent by the target process, and obtain the three-dimensional data flow magnitude combination. The data theft detection and blocking response module is used to extract the total number of bytes read from the disk file and the total number of bytes read from the upstream of the three-dimensional data flow volume combination, calculate the flow aggregation deformation degree value, compare the flow aggregation deformation degree value with the preset constant fluctuation range item, and obtain the malicious data theft blocking instruction.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, the operating system performance monitoring unit synchronously extracts the count of loop jump instructions and encryption operation instructions generated by the target process, and aligns and splices them with the total number of bytes of network packets sent outwards in the time domain to construct a discrete set of instruction time domain and a discrete set of traffic time domain. A discrete Fourier transform is performed to map the microscopic instruction flow characteristics and macroscopic network communication characteristics to the frequency domain, extracting instruction frequency components and traffic frequency components. The cross-power spectral density (CPS) value is calculated, and spectral line nodes with CPS values ​​greater than a preset judgment constant are selected within the same frequency band. A list of resonant peaks at the same frequency is generated, capturing periodic encryption and outbound behavior hidden within regular processes. This penetrates the traffic masquerading of strong encryption protocols on the network side. When the number of elements in the resonant peak list is greater than zero, the total number of bytes read from the disk file and the frequency of calls to the system encryption / decryption library interface are intercepted at the operating system kernel layer, and then merged and sent to the TLS encryption application layer. The system calculates the total number of bytes in the uplink, obtains the three-dimensional data flow magnitude combination, extracts the total number of bytes read from the disk file within the three-dimensional data flow magnitude combination and the total number of bytes in the uplink, performs a quotient calculation operation and multiplies it by a preset weight coefficient value, accumulates the interface call frequency value and the product value of the corresponding frequency weight item, obtains the flow aggregation deformation degree value, establishes the full-link causal relationship from the execution of the underlying code to the network packet sending at the top level, compares the flow aggregation deformation degree value with the preset constant fluctuation range item, and when it is determined that it falls into the preset constant fluctuation range item and the interface call frequency value is greater than the preset frequency upper limit item, cancels the read and write permissions of the associated file and blocks malicious data theft commands, improves the success rate of automated interception of highly concealed advanced persistent threats and ransomware data theft behavior, reduces the false alarm rate caused by single-dimensional detection, realizes cross-verification of abnormal commands at the host level and external network data interaction, and enhances the robustness of the overall security defense system. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0017] Please see Figure 1 This invention provides a technical solution for malware detection based on multi-dimensional code analysis and encrypted traffic behavior collaboration, comprising the following steps: Based on the operating system performance monitoring unit, extract the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window, establish a discrete set of instructions in the time domain, record the total number of network packets sent by the target process within and outside the same unit time window, and establish a discrete set of traffic in the time domain. Discrete Fourier transforms are performed on the discrete sets of command time domain and the discrete sets of flow time domain respectively to extract the command frequency components and flow frequency components corresponding to the target process, generate a frequency domain spectrum parameter set, calculate the cross power spectral density values ​​between the corresponding command frequency components and flow frequency components within the frequency domain spectrum parameter set, and filter to generate a list of resonance peaks at the same frequency. When the number of elements in the list of resonant peaks is determined to be greater than zero, the total number of bytes read from the disk file corresponding to the target process and the frequency of calls to the corresponding interface of the system encryption and decryption library are intercepted at the operating system kernel layer. The code dimension flow parameter set is obtained, the total number of uplink bytes corresponding to the TLS encrypted application layer payload sent by the target process is recorded, and the three-dimensional data flow magnitude combination is obtained. Extract the total number of bytes read from the internal disk file and the total number of bytes read from the upstream of the three-dimensional data flow volume combination, calculate the flow aggregation deformation value, compare the flow aggregation deformation value with the preset constant fluctuation range item, and obtain malicious data theft blocking instructions.

[0018] The steps to obtain the discrete set of traffic flow in the time domain are as follows: The operating system performance monitoring unit is invoked to retrieve the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window. The timestamps corresponding to the instructions are obtained, and the counts of loop jump instructions and encryption operation instructions are merged according to the timestamp order to establish a discrete set of instructions in the time domain. Obtain the time node generated by the discrete set of instruction time domain, record the total number of network packets sent by the target process within and outside the same unit time window, verify that the time of the total number of network packets sent is the same as the time node generated by the discrete set of instruction time domain, and generate synchronous packet sending feature items. Retrieve the total number of network packets in the synchronous packet sending feature item, locate the time node of the instruction time domain discrete set associated with the total number of network packets, arrange the total number of network packets in the order of the time nodes of the instruction time domain discrete set, and establish the traffic time domain discrete set.

[0019] Specifically, the hardware performance monitoring interface at the operating system kernel level is invoked to write configuration parameters to specific control registers, setting the length of the unit time window to 10 milliseconds, binding the unique process identifier of the target process, selecting monitoring flags corresponding to branch prediction and loop jumps from the general hardware event list, selecting block encryption instruction flags related to the Advanced Encryption Standard Instruction Set from the monitoring list of the specific architecture, allocating a circular kernel buffer for temporary storage of the collected high-frequency data, and starting a kernel-mode counter polling mechanism. When each 10-millisecond unit time window reaches its boundary, the cumulative execution count of loop jump instructions stored in the corresponding specific register is read as the loop jump instruction count, and the cumulative execution count of encryption instructions in another register is read as the encryption instruction count. The kernel high-precision clock is invoked to read the timestamp counter and convert it to obtain the current machine time value, which is then used as the instruction to generate the corresponding timestamp. Here, the reference content for setting the time offset matching threshold is the CPU clock frequency and the average physical time of hardware interrupt context switching. The setting process is demonstrated through actual examples; for example, the CPU clock frequency in the current operating environment is rated at 2.5GHz, and the single hardware... Interrupt and register read / write context switching takes approximately 2 microseconds. Multiplying this by 1.5 (3 microseconds) allows us to use it as a tolerance range. Setting the time offset matching threshold to 3 microseconds, we determine whether the absolute value of the difference between the timestamp obtained from reading the loop jump instruction count and the timestamp obtained from reading the encryption operation instruction count is less than this time offset matching threshold. For example, if the timestamp for reading the loop jump instruction is recorded as 10005 microseconds and the timestamp for reading the encryption operation instruction is recorded as 10007 microseconds within a certain sampling period, the absolute value of the difference is 2 microseconds. We then compare the 2-microsecond and 3-microsecond offsets... The size of the matching threshold is compared. 2 microseconds is within the effective range of less than 3 microseconds and meets the requirement of taking values ​​at the same microscopic time section. The two count values ​​at the same section are extracted, and a continuous two-dimensional array space is allocated in memory. The timestamp is used as the row index primary key of the array. The counts of the confirmed loop jump instructions and the counts of the encryption operation instructions are merged into a data tuple containing two elements. According to the natural time growth order of the timestamp from small to large, all the collected data tuples are appended to the two-dimensional array space one by one to form a discrete number sequence distributed by time point and establish the instruction time domain discrete set.

[0020] The process reads the two-dimensional array generated in memory space in the preceding steps, iterates through all row index keys of the array, extracts the precise time value corresponding to each data tuple, and uses it as a time node to generate the instruction time domain discrete set. By mounting an extended Berkeley packet filter program in the operating system's network protocol stack, it monitors the transmission control protocol and user datagram protocol sending functions. When it identifies an identifier belonging to the target process, it intercepts the corresponding socket buffer data structure, reads the sum of the application layer payload length and various protocol header lengths recorded in this data structure, and accumulates all intercepted socket buffer sums within a 10-millisecond time window. This accumulated result is saved as the total number of network packets sent by the target process within and outside this window. Simultaneously, at the instant the socket buffer is pushed into the network card driver queue, the kernel time function is called to capture the current system runtime timestamp as the time when the total number of network packets is generated. The reference content for setting the packet delay matching threshold is the average internal residence time of the operating system's network protocol stack in processing encapsulated data. This is demonstrated through actual calculations. The setup process, for example, involves setting the average hardware time consumed in copying application layer data to kernel mode and completing the encapsulation of transport layer headers and network layer headers to 50 microseconds. A packet transmission latency matching threshold is set to a fixed value of twice this time, i.e., 100 microseconds. The time taken to generate the total number of network packets is subtracted from the time of the corresponding instruction time-domain discrete set generation within the same period. The difference is then checked to see if it falls within the valid range of 0 to 100 microseconds. For example, if the time of a certain instruction generation is 20,000 microseconds, the corresponding network packet transmission time intercepted during the network data capture process... The stamp is 20060 microseconds. The difference between the two is 60 microseconds. The 60 microseconds is compared with the interval from 0 microseconds to 100 microseconds. The 60 microseconds is within this interval, which meets the logical order of network communication triggered by the instruction and the time synchronization requirements. The total number of network packets sent at this time node is extracted. The network byte value is combined with the time node generated by the corresponding instruction time domain discrete set to form a new key-value pair structure and stored in a hash table. Isolated network traffic data that does not fall within the interval from 0 microseconds to 100 microseconds are removed to generate a synchronous packet sending feature item.

[0021] The system accesses the hash table structure maintained in memory for storing feature data, iterates through all active key-value pairs, extracts the total number of network packets sent in bytes verified by the time window from the data field of each key-value pair, and simultaneously reads the hash index field of the key-value pair to extract the time nodes generated by the instruction time-domain discrete set that have a strong logical binding relationship with the total number of network packets sent. It then allocates a contiguous block of memory in the main memory area and creates a one-dimensional single-precision floating-point array with a length exactly matching the total number of instruction time-domain discrete set nodes. Initial elements are all cleared and assigned values ​​using a memory set function. The extracted instruction time-domain discrete set is used as the reference scale for the time axis. The absolute projection position of the time node generated by the total number of bytes sent for each network packet on the virtual time axis is found. Here, the reference content for setting the time point alignment tolerance is the small data deviation caused by the interrupt jitter of the underlying network device. The setting process is calculated through actual examples. For example, if the average statistical value of the scheduling jitter of the network driver submission queue of the target operating system is 10 microseconds, then the time point alignment tolerance is set to 1 times this average value, which is 10 microseconds. The network... The absolute value of the difference between the instruction time node associated with the network packet and the preset time scale reference value of the floating-point array is used to determine whether the absolute value of the difference is less than a tolerance range of 10 microseconds. For example, if the preset time scale of the array is 30000 microseconds and the read network packet associated instruction time node is 30005 microseconds, the calculated absolute value of the difference is 5 microseconds. The 5 microseconds are compared with the 10 microsecond alignment tolerance. Since 5 microseconds is less than the 10 microsecond range limit, the numerical alignment is determined to be successful. The total number of bytes of the network packet is then overwritten into the corresponding scale position index of the one-dimensional single-precision floating-point array. If a certain... If the preset benchmark fails to find a matching total number of network packets during the traversal of the hash table, the initial zero value at the array index position is retained without any overwriting or modification. Following the natural time-incrementing order of the time nodes generated by the instruction time-domain discrete set from the past to the present, all element data points inside the one-dimensional single-precision floating-point array are indexed and sorted from front to back to form a continuous, equally spaced data point time series containing padding zero values ​​and actual valid byte values. The sequence data composed of padding zero values ​​and valid byte values ​​is packaged and encapsulated into a matrix vector format to establish the traffic time-domain discrete set.

[0022] The steps for obtaining the frequency domain spectral parameter set are as follows: Extract discrete time series items from the discrete time-domain set of traffic flow, perform mathematical mapping transformation on the discrete time series items to the complex frequency domain sequence, obtain the command frequency component and traffic frequency component corresponding to each discrete frequency point, combine the command frequency component and traffic frequency component according to the frequency point distribution order, and generate a frequency domain spectrum parameter set.

[0023] Specifically, the discrete time series items contained within the discrete time-domain set of traffic flow and the discrete time-domain set of instructions obtained in the preceding steps are extracted. It is then checked whether the data length of these two discrete time series items reaches the preset Fourier transform processing reference length. Here, the processing reference length is set based on the hardware alignment size of the processor's L2 cache and the power-of-2 property of the Fourier transform. For example, if the processing reference length is set to 1024 data points, and the actual length of the extracted discrete time series item is 1000 data points, then 24 data points with values ​​of 0 are added to the end of the sequence to meet the length alignment requirement. The discrete-time series terms aligned to degree undergo a mathematical mapping transformation to a complex frequency domain sequence. Using the underlying Fast Fourier Transform algorithm, the amplitude variation data in the time dimension is converted into a frequency domain polynomial composed of real and imaginary parts. The complex frequency domain sequence output after the mapping transformation is traversed, and complex plane coordinate data representing amplitude energy and time delay are extracted from this sequence. On multiple discrete frequency scales divided at fixed frequency intervals, the command frequency component and flow frequency component corresponding to each discrete frequency point are obtained. The command frequency component contains the periodic fluctuation intensity and initial time phase characteristics of the command execution at the corresponding frequency. The frequency component contains the periodic surge intensity and latency characteristics of network data transmission at the corresponding frequency. An array space with a multi-dimensional feature storage structure is allocated and initialized in memory. The continuously distributed frequency domain scale is used as the retrieval key of this array. Following the frequency point distribution order from 0 Hz (low frequency) to high frequency, under each specific frequency point key, the instruction frequency component and the traffic frequency component at the current frequency point are extracted and combined. These two frequency components from completely different physical dimensions are fused and encapsulated into a 5-tuple data structure containing a frequency point index, instruction real part, instruction imaginary part, traffic real part, and traffic imaginary part. This is then merged. During the combination process, the underlying floating-point verification function is called to check whether there is a calculation overflow or a null value caused by memory read in the components inside the combination unit. If an abnormal mark of infinity or non-numeric is found in one of the components at a specific frequency point, all values ​​of the instruction frequency component and the flow frequency component at that frequency point are uniformly reset to 0 to prevent irreversible error interruption in subsequent cross-dimensional calculation steps. Then, according to the natural ascending order of the frequency points starting from 0, they are stored in the continuous array space of the multi-dimensional feature storage structure to establish a complete frequency domain feature mapping table, thereby generating the frequency domain spectrum parameter group.

[0024] The steps to obtain the list of resonance peaks at the same frequency are as follows: Extract the command frequency component and the flow frequency component corresponding to the same frequency point within the frequency domain spectral parameter set, and calculate the cross-power spectral density value between the command frequency component and the flow frequency component. The calculation formula is as follows: ; in, Representing the Cross-power spectral density values ​​at discrete frequency points The sorting index subscript representing discrete frequency points. Representing the Command frequency components at discrete frequency points Representing the The flow frequency components at discrete frequency points Representing the The complex conjugate term of the flow frequency component at each discrete frequency point This represents the background noise energy constant set for the command frequency component. This represents the background noise energy constant set for the frequency component of the flow rate. Represents the natural constant. This represents the preset phase difference penalty adjustment coefficient. Representing the The actual physical frequency value corresponding to each discrete frequency point. Representing the The phase angle of the command frequency component at each discrete frequency point. Representing the Phase angle of the flow frequency component at each discrete frequency point; Retrieve preset judgment constants, compare the cross power spectral density values ​​corresponding to each frequency point with the preset judgment constants, filter out spectral line nodes with cross power spectral density values ​​greater than the preset judgment constants within the same frequency band, combine the extracted spectral line nodes according to the frequency band distribution order, and generate a list of resonance peaks at the same frequency.

[0025] Specifically, in the numerical calculation formula of cross power spectral density, the cooperative characteristics are quantified by calculating the dimensionless cross energy ratio and introducing a phase penalty. The numerator is calculated by taking the square of the absolute value of the cross energy, the denominator is introduced with dimensionless background noise to normalize the energy and suppress the background noise, and the tail is used to apply a natural decay penalty to the phase difference using an exponential function. The sorted index subscript representing discrete frequency points serves as a memory pointer to guide the reading of the frequency domain spectrum parameter group; for example, when reading the 4th frequency point... The value is 3; Representing the instruction frequency component, the real part 3 and the imaginary part 4 of the 5-tuple are extracted and concatenated to obtain... ; Representing the frequency component of the flow, measured in bytes, it is obtained by combining the real part 4 and the imaginary part 3 of the corresponding block. ; Representing its complex conjugate term, keeping the real part unchanged and reversing the sign of the imaginary part to obtain... ; The energy constant representing the background noise of the instruction has the same dimension as the square of the instruction amplitude. It is obtained by averaging the squared energy of the idle window. For example, the total squared energy of 100 samples is 20, which is divided by 100 to get 0.2. This represents the background noise constant of the traffic, with the dimension of bytes squared. Similarly, the mean square value of the background energy of the idle network can be obtained, for example, it is calculated to be 0.5. Represents the natural constant, and its approximate value of 2.718 is obtained directly from the floating-point library. The phase difference penalty adjustment coefficient, in seconds, is calculated to be 0.102 based on the maximum phase deviation of 0.5 radians and the average frequency of 10 Hz of historical violation samples, combined with an attenuation rate of 0.6. This represents the corresponding physical frequency, with the dimension of Hertz. Multiplying the subscript 3 by 10 Hertz resolution yields 30. The phase angle represents the instruction. The arctangent is used to calculate the imaginary part 4, which is divided by the real part 3 to obtain 0.927 radians. Representing the flow phase angle, the imaginary part 3 is calculated by dividing the inverse tangent of the real part 4, yielding 0.644 radians; Calculations based on parameters: Substituting into the numerator of the formula, we get The square of the absolute value is 625. The energy and noise floor of the denominator instruction are: Flow rate plus background noise is ; The total value in the denominator is The energy ratio is ; The absolute value of the phase difference is 0.283, and the exponent term is... ; The natural exponential decay value is 0.421, and the final quantified value is... for ; The result shows that the command and flow at the current 30 Hz have a co-frequency resonance correlation of 0.409, which is a dimensionless relative correlation coefficient. This coefficient is compared with a preset dimensionless determination constant to derive and generate a list of co-frequency resonance peaks.

[0026] A preset judgment constant is retrieved, and the cross-power spectral density value corresponding to each frequency point is compared with the preset judgment constant. Since the cross-power spectral density value obtained from the aforementioned calculation is a dimensionless correlation coefficient between 0 and 1, the reference content for this preset judgment constant is set as the statistical limit of dimensionless background cross-power fluctuations in a clean operating environment without malicious data theft applications residing within a stable operating cycle. Under normal daily service conditions, 100,000 discrete frequency positions of normal cross-power spectral density data are continuously captured, and the mathematical average of these 100,000 dimensionless records is calculated as the baseline median for tolerable fluctuations. At the same time, the deviation of these normal fluctuation values ​​is calculated. The variance and corresponding standard deviation from the average value measure the overall dispersion and clustering of fluctuations caused by harmless random operations. The calculated average baseline median plus three times the standard deviation of the fluctuations is used as the final dimensionless preset judgment constant covering the vast majority of normal situations. For example, statistically accumulating historical sample data yields an average value of 0.12 for the cross-power data under normal system service conditions. The standard deviation of its fluctuation amplitude, calculated by square root, is 0.05. Adding three times the standard deviation, or 0.15, to the average value of 0.12, the preset judgment constant is finally set to 0.27, which is then used as input to the judgment logic. A loop traversal mechanism is then initiated, starting from the record of all frequencies... The cross-power spectral density (CPD) value corresponding to each frequency point calculated by the preceding mathematical model steps is read sequentially from the energy state array. This CPD value is then compared with a preset judgment constant of 0.27 using both large and small Boolean logic. For example, if the calculated output value at 30 Hz is 0.409, this quantization index is compared with the safety boundary constant of 0.27. If 0.409 is found to be greater than the preset judgment constant, the energy aggregation at 30 Hz is determined to exhibit an anomalous code packet coupling resonance phenomenon. This 30 Hz point exhibiting abnormal resonance is marked as an associated spectral line node and temporarily stored in a separate risk collection queue. The process is then reversed... If the value corresponding to the adjacent 40 Hz is only 0.15, and the comparison confirms that the value is less than 0.27 and has a reasonable normal interpretation, then it is marked as safe and removed from the risk flow queue. After maintaining this comparison mode until all discrete frequency points are covered, all spectral line nodes that are in the same frequency band and whose cross power spectral density values ​​are greater than the preset judgment constant are screened in the temporary queue. These suspected nodes that are extracted and scattered at different physical frequency points are repackaged and sorted in the underlying memory view, and according to the physical distribution order of their original frequency bands extending from low frequency to high frequency, they are combined and spliced ​​in a unidirectional feature structure order to generate a list of resonance peaks at the same frequency.

[0027] The steps for obtaining the parameter set in the code dimension flow are as follows: The number of elements recorded in the list of resonant peaks at the same frequency is counted. When the number of elements in the list of resonant peaks at the same frequency is determined to be greater than zero, the total number of bytes read from the disk file corresponding to the target process is intercepted at the operating system kernel layer. The frequency value of the corresponding interface call for the system encryption and decryption library is extracted. The total number of bytes read from the disk file and the frequency value of the interface call are combined to obtain the code-dimensional flow parameter set.

[0028] Specifically, the system counts the number of elements recorded in the list of resonant peaks at the same frequency, reads the total number of spectral nodes at abnormal frequency points stored in the list, and determines whether the number of elements meets the trigger condition of being greater than 0. If the count is 0, the target process is determined to be in a silent or legal running state. If the count is greater than 0, deep code-dimensional flow parameter monitoring is immediately initiated. At the operating system kernel level, virtual file system hook functions are mounted to intercept and count disk file read operations triggered by the target process within a specified time observation window in real time. The size of the read buffer corresponding to the underlying file descriptor is read, and the total number of bytes read from the disk file is accumulated. Using dynamic instrumentation tools or kernel function tracers, locate the core interfaces related to symmetric encryption, asymmetric encryption, and hash calculation in system encryption / decryption libraries such as OpenSSL or Libgcrypt. Extract the call frequency values ​​of the corresponding interfaces for the system encryption / decryption libraries in real time, record the function entry address and corresponding return status of each call, and encapsulate the total number of bytes read from the disk file and the interface call frequency values ​​into a two-dimensional data structure to establish the resource consumption mapping relationship of the process when executing code logic. By merging the data of the above two key dimensions in a structured manner, obtain the code dimension flow parameter set.

[0029] The steps for obtaining the combination of three-dimensional data flow magnitudes are as follows: Continuously locate the network communication data stream sent out by the target process, record the total number of uplink bytes associated with the TLS encrypted application layer payload sent by the target process at the application layer network protocol stack, extract the total number of uplink bytes to generate the corresponding time node, align the generation time node with the generation time of the code dimension flow parameter set, and obtain the total number of uplink bytes at the communication layer. Extract the total number of bytes read from the disk file and the frequency of API calls recorded within the code dimension flow parameter set. Then, merge the total number of bytes read from the communication layer, the total number of bytes read from the disk file, and the frequency of API calls according to the preset feature dimension arrangement order to complete cross-dimensional feature splicing and obtain a three-dimensional data flow magnitude combination.

[0030] Specifically, the system continuously locates the network communication data stream sent by the target process. By setting observation points in the handshake phase of the transport layer security protocol in the application layer network protocol stack, it records the total number of uplink bytes associated with the TLS encrypted application layer payload sent by the target process in real time. Since TLS encryption has obvious protocol header characteristics, the encrypted net payload size is obtained by parsing the length field in the record packet and summing the data. The total number of uplink bytes is extracted synchronously to generate the corresponding time node. The time node and the generation time of the code dimension flow parameter set are aligned, and a time tolerance range for time axis alignment is set. The reference content for setting this range is the average time slice length of the operating system task scheduler. The setting process is calculated through actual examples. For example, if the current kernel scheduling cycle is 10 milliseconds, in order to offset the time jitter of the kernel hook and the application layer protocol stack, the time tolerance range is set to 1.5 times the scheduling cycle, i.e., 15 milliseconds. The time node of the total number of uplink bytes is subtracted from the time record of the code dimension flow parameter set. If the absolute value of the difference is within the range of 0 milliseconds to 15 milliseconds, it is determined that the two types of data belong to the same logical flow behavior, and the total number of uplink bytes at the communication layer is obtained.

[0031] Extract the total number of bytes read from the disk file and the frequency of API calls from the internal records of the code-dimensional flow parameter set. Retrieve the pre-defined feature dimension arrangement order, defining the total number of bytes read from the communication layer as the first feature dimension, the total number of bytes read from the disk file as the second feature dimension, and the frequency of API calls as the third feature dimension. Allocate memory space continuously according to this order, merge the total number of bytes read from the communication layer, the total number of bytes read from the disk file, and the frequency of API calls to complete cross-dimensional feature concatenation. Normalize and map the concatenated data, setting a mapping baseline value. The reference content is the average peak resource consumption of a normal process under the same load in history. The setting process is calculated through actual examples. For example, the maximum file read value in the historical samples is 1024KB, the maximum outbound traffic is 512KB, and the maximum call frequency is 100 times. The current measured values ​​are divided by the above reference values ​​to complete the dimensional alignment. For example, the measured 256KB traffic is mapped to 0.5, the measured 512KB read is mapped to 0.5, and the measured 20 calls are mapped to 0.2. The mapped values ​​are encapsulated into a three-dimensional floating-point vector to obtain the combination of three-dimensional data flow magnitudes.

[0032] The steps for obtaining the deformation value of the flow polymerization are as follows: The total number of bytes read from disk files and the total number of bytes read from upstream are separated within the three-dimensional data flow magnitude combination. The frequency values ​​of associated interface calls are extracted. A benchmark smoothing constant is introduced to eliminate calculation singularities for the total number of bytes read from upstream files and the total number of bytes read from disk files, resulting in a smooth flow parameter set. Extract the total number of bytes read from the disk file, the total number of bytes read upstream, and the frequency of interface calls from within the smooth flow parameter group. Calculate the flow aggregation deformation value using the following formula: ; in, Representing the The flow aggregation deformation value of each target process. The sorted index subscript representing the target process. Represents the first parameter in the smooth flow parameter group Total number of bytes read from disk files by the target process. Represents the first parameter in the smooth flow parameter group Total number of bytes uploaded by each target process. This represents the baseline smoothing constant, which is preset to bytes. This represents the dimensionless preset weighting coefficient value set for the data flow quotient. Represents the first parameter in the smooth flow parameter group The frequency of interface calls for a target process. This represents the set reference frequency constant. This represents a frequency weighting item set based on the frequency of API calls. Represents the natural constant.

[0033] Specifically, the underlying resource consumption data encapsulated within the three-dimensional data flow magnitude combination obtained in the aforementioned steps is extracted. This three-dimensional data structure is then decomposed into data dimensions, separating the total number of bytes read from the disk and the total number of bytes sent from the network. The corresponding interface call frequency values ​​are then read and extracted from the memory mapping table. Considering that some legitimate silent processes in the computer's underlying operating environment may exist in an extreme static state within a specific time window, where they do not read local files or generate any external network communication, this state manifests as an absolute extreme point where disk read bytes or network sent bytes are 0. In subsequent calculations, a value of 0 can lead to computational singularities such as negative infinity. Therefore, a baseline smoothing constant is introduced to the extracted total number of bytes sent from the network and the total number of bytes read from the disk to eliminate computational singularities. The reference content for this baseline constant is set as the minimum file cluster and the network protocol header. The average capacity level is determined by recording the basic environment resident read / write bytes and network link hold bytes generated during 100 hours of continuous standby operation. The average file base byte size is obtained by averaging all resident read / write byte data, and the average network base byte size is obtained by averaging all network link hold bytes. The two are added together and averaged as the baseline smoothing constant. For example, the average file byte size is 4096 and the network byte size is 64. The sum is 4160, and the division by 2 gives 2080 bytes as the baseline smoothing constant. This value of 2080 is added to the extracted uplink and disk byte counts for smoothing padding, so that the byte order of magnitude deviates from the absolute value of 0 and maintains positive continuity. The uplink and disk byte counts after smoothing addition, as well as the unsmoothed call frequency, are recombined and arranged in memory space and encapsulated into a one-dimensional sequence structure consisting of 3 elements to obtain the smoothing flow parameter set.

[0034] In the formula for calculating the deformation degree of circulation aggregation, the circulation quotient and the call index penalty are combined to quantify the behavioral variability. The front part measures the data asymmetry, and the back part applies an exponential penalty to abnormal high-frequency encryption and decryption. This represents the sort index of the target process. The specific steps to obtain this parameter are to traverse the active process control block queue and extract the number starting from 1. For example, if the process is in the 5th position, the value obtained is 5. This represents the number of bytes read from the disk. The specific steps to obtain this parameter are to read the byte accumulation value of the corresponding storage block according to the memory offset address. For example, the value obtained is 15000. This represents the total number of uplink bytes. The specific steps to obtain this parameter are to extract the cumulative number of bytes sent from the protocol stack statistics in consecutive blocks. For example, the extracted value is 5000. This represents the baseline smoothing constant. The specific steps to obtain this parameter are to statistically analyze the average noise floor of the standby environment, for example, by collecting and calculating the average noise floor of the file and the network to obtain a value of 2000. The quotient is a preset weight. The specific steps to obtain this parameter are to collect 100 samples, calculate the inverse of the variance of the read-write ratio, and normalize it. For example, the value obtained by mapping is 0.5. This parameter represents the frequency of API calls. The specific steps to obtain this parameter are to extract the interception and trigger count value of the associated encryption library API. For example, reading the cumulative call value will yield 30. This represents the baseline frequency constant. The specific steps to obtain this parameter are to capture the total number of security process call logs and divide it by the average value of the time window. For example, the average value obtained is 10. This represents the frequency weighting term, with the unit being the reciprocal of frequency for unit unification. The specific steps to obtain this parameter are to extract the mean of the reciprocals of the execution cycle and map it, for example, to obtain a value of 0.2. This represents the natural constant. The specific steps to obtain this parameter are to extract a dimensionless double-precision floating-point approximation from the underlying mathematical library. For example, the value obtained by truncating the first three decimal places is 2.718. Calculations based on parameters: Calculate the logarithmic terms of the data. ; The quotient ratio is calculated as follows: ; Calculate the front product ; Calculate the frequency difference ratio ; Calculate the exponential penalty ; Calculate the product of the two parts ; Sum the values ​​to obtain the degree of deformation. ; The result indicates that the current process score deviates from the safety baseline and exceeds the safety limit, thus identifying it as a high-risk Trojan and further deriving the blocking command.

[0035] The steps to obtain a malicious data theft blocking command are as follows: Compare the deformation degree value of the flow aggregation with the preset constant fluctuation range item. If it is determined that the value falls within the preset constant fluctuation range item and the frequency of interface calls in the smooth flow parameter group is greater than the preset frequency upper limit item, cancel the read and write permissions of the associated file and obtain the malicious data theft blocking instruction.

[0036] Specifically, the system retrieves the discrimination boundary values ​​stored in the underlying security policy configuration library, extracts the flow aggregation deformation degree value of 46.788 output from the preceding calculation steps, initiates the kernel-mode Boolean logic discrimination mechanism, and compares its value with the preset constant fluctuation interval item. It details the setting reference content and calculation logic of the preset constant fluctuation interval item, setting the reference content of this interval item as the historical deformation degree score distribution characteristics of known data-stealing programs captured and confirmed by the sandbox within the past year. It extracts the deformation degree scores of 1000 known samples during peak operation periods, calculates the average value of this batch of data as 60, and calculates the standard deviation reflecting the dispersion of the distribution as 10. It extends downwards by two standard deviations as the lower bound of the interval and upwards by two standard deviations as the upper bound, obtaining a lower bound of 40 and an upper bound of 80. It sets the obtained fluctuation interval item as a closed interval range of 40 to 80, substitutes the measured value of 46.788 into the interval comparison, and finds that 46.788 is greater than 40 and less than 8. 0. If the value falls within the range representing malicious behavior, and the match is confirmed, the associated interface call frequency value is extracted from the smoothing parameter group. This value is then compared with the preset frequency upper limit value. The reference content for this preset frequency upper limit value is the number of compliant concurrent requests generated by legitimate software when processing security protocols. The concurrent data during peak daily access periods is tracked and recorded, and the 95th percentile call extreme value is extracted as the upper limit. For example, if the 95th percentile frequency of the obtained requests is 25, the preset frequency upper limit value is set to 25. The actual call frequency value is extracted as 30. After comparison, it is determined that 30 is greater than the upper limit value of 25. Under the judgment that the two violation conditions are simultaneously met, all file read and write permissions associated with the target process are revoked in the underlying access control list. A hardware-level forced reclamation signal is sent to the micro-filter driver to cut off the process's read path to the local disk directory. The action sequence of revoking permissions is encapsulated and signed, and distributed to the execution core unit as a low-level interrupt instruction to obtain the malicious data theft blocking instruction.

[0037] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration, characterized in that, Includes the following steps: Based on the operating system performance monitoring unit, extract the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window, establish a discrete set of instructions in the time domain, record the total number of network packets sent by the target process within and outside the same unit time window, and establish a discrete set of traffic in the time domain. Discrete Fourier transforms are performed on the discrete set of instructions in the time domain and the discrete set of traffic flow in the time domain, respectively, to extract the instruction frequency component and traffic frequency component corresponding to the target process, generate a frequency domain spectrum parameter set, calculate the cross power spectral density values ​​between the corresponding instruction frequency component and traffic frequency component within the frequency domain spectrum parameter set, and filter to generate a list of resonance peaks at the same frequency. When it is determined that the number of elements in the same frequency resonance peak list is greater than zero, the total number of bytes read from the disk file corresponding to the target process and the frequency of calls to the corresponding interface of the system encryption and decryption library are intercepted at the operating system kernel layer. The code dimension flow parameter set is obtained, the total number of uplink bytes corresponding to the TLS encrypted application layer payload sent by the target process is recorded, and the three-dimensional data flow magnitude combination is obtained. Extract the total number of bytes read from the internal disk file and the total number of bytes read from the upstream of the three-dimensional data flow volume combination, calculate the flow aggregation deformation degree value, compare the flow aggregation deformation degree value with the preset constant fluctuation range item, and obtain the malicious data theft blocking instruction.

2. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the discrete set of traffic flow in the time domain are as follows: The operating system performance monitoring unit is invoked to retrieve the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window. The timestamps corresponding to the instructions are obtained, and the counts of loop jump instructions and encryption operation instructions are merged according to the timestamp order to establish a discrete set of instructions in the time domain. Obtain the time node of the instruction time domain discrete set, record the total number of network packets sent by the target process within and outside the same unit time window, verify that the time of the total number of network packets sent is the same as the time node of the instruction time domain discrete set, and generate a synchronous packet sending feature item. Retrieve the total number of network packets in the synchronous packet sending feature item, locate the time node of the instruction time domain discrete set associated with the total number of network packets, arrange the total number of network packets in the order of the instruction time domain discrete set generation time nodes, and establish the traffic time domain discrete set.

3. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the frequency domain spectrum parameter set are as follows: Extract the discrete time series items within the discrete time domain set of the traffic flow, perform a mathematical mapping transformation on the discrete time series items to a complex frequency domain sequence, obtain the command frequency component and traffic frequency component corresponding to each discrete frequency point, and combine the command frequency component and traffic frequency component according to the frequency point distribution order to generate a frequency domain spectrum parameter set.

4. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the list of resonance peak values ​​at the same frequency are as follows: Extract the command frequency component and the flow frequency component corresponding to the same frequency point within the frequency domain spectrum parameter group, and calculate the cross power spectral density value between the command frequency component and the flow frequency component. Retrieve preset judgment constants, compare the cross power spectral density values ​​corresponding to each frequency point position with the preset judgment constants, filter out spectral line nodes with cross power spectral density values ​​greater than the preset judgment constants within the same frequency band, and combine the extracted spectral line nodes according to the frequency band distribution order to generate a list of resonance peaks at the same frequency.

5. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the code dimension flow parameter set are as follows: The number of elements recorded in the list of resonant peaks at the same frequency is counted. When it is determined that the number of elements in the list of resonant peaks at the same frequency is greater than zero, the total number of bytes read from the disk file corresponding to the target process is intercepted at the operating system kernel layer. The frequency value of the corresponding interface call for the system encryption and decryption library is extracted. The total number of bytes read from the disk file and the frequency value of the interface call are combined to obtain the code dimension flow parameter set.

6. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the combination of the three-dimensional data flow magnitudes are as follows: Continuously locate the network communication data stream sent out by the target process, record the total number of uplink bytes associated with the TLS encrypted application layer payload sent by the target process at the application layer network protocol stack, extract the total number of uplink bytes to generate the corresponding time node, align the generated time node with the generation time of the code dimension flow parameter set, and obtain the total number of uplink bytes at the communication layer. Extract the total number of bytes read from the disk file and the frequency of interface calls recorded within the code dimension flow parameter set. Merge the total number of bytes read from the communication layer, the total number of bytes read from the disk file, and the frequency of interface calls according to the preset feature dimension arrangement order to complete cross-dimensional feature splicing and obtain a three-dimensional data flow magnitude combination.

7. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the flow polymerization deformation value are as follows: The total number of bytes read from the disk file and the total number of bytes read from the upstream are separated within the three-dimensional data flow magnitude combination. The associated interface call frequency values ​​are extracted. A benchmark smoothing constant is introduced to the total number of bytes read from the upstream and the total number of bytes read from the disk file to eliminate calculation singularities, and a smooth flow parameter set is obtained. Extract the total number of bytes read from the disk file, the total number of bytes read upstream, and the frequency of interface calls from the smooth flow parameter group, and calculate the flow aggregation deformation value.

8. The malware detection method based on multi-dimensional code analysis and encrypted traffic behavior collaboration according to claim 1, characterized in that, The steps for obtaining the malicious data theft blocking command are as follows: By comparing the value of the flow aggregation deformation degree with the preset constant fluctuation range item, when it is determined that the value falls within the preset constant fluctuation range item and the frequency of interface calls in the smooth flow parameter group is greater than the preset frequency upper limit item, the read and write permissions of the associated file are cancelled, and a malicious data theft blocking instruction is obtained.

9. The system for malware detection based on multi-dimensional code analysis and encrypted traffic behavior collaboration as described in any one of claims 1-8, characterized in that, include: The time-domain feature extraction module is used to extract the count of loop jump instructions and the count of encryption operation instructions generated by the target process within a unit time window based on the operating system performance monitoring unit, establish a discrete set of instruction time domains, record the total number of network packets sent by the target process within and outside the same unit time window, and establish a discrete set of traffic time domains. The frequency domain resonance analysis module is used to perform discrete Fourier transform on the instruction time domain discrete set and the flow time domain discrete set respectively, extract the instruction frequency component and flow frequency component corresponding to the target process, generate a frequency domain spectrum parameter set, calculate the cross power spectral density value between the corresponding instruction frequency component and flow frequency component within the frequency domain spectrum parameter set, and filter to generate a list of resonance peaks at the same frequency. The three-dimensional data flow monitoring module is used to intercept the total number of bytes read from the disk file corresponding to the target process and the frequency of calls to the corresponding interface of the system encryption and decryption library at the operating system kernel layer when it is determined that the number of elements in the same frequency resonance peak list is greater than zero, obtain the code dimension flow parameter set, record the total number of uplink bytes corresponding to the TLS encrypted application layer payload sent by the target process, and obtain the three-dimensional data flow magnitude combination. The data theft detection and blocking response module is used to extract the total number of bytes read from the disk file and the total number of bytes read from the upstream of the three-dimensional data flow volume combination, calculate the flow aggregation deformation degree value, compare the flow aggregation deformation degree value with the preset constant fluctuation range item, and obtain the malicious data theft blocking instruction.

Images