Malicious cyber asset identification method and system

Abstract

The application discloses a malicious network asset identification method and system, the method comprises the following steps: determining a dynamic sampling probability based on the historical state and detection time difference of a network resource address, comparing a preset random number to filter out a network resource address to be analyzed from each network resource address; constructing a multi-modal evidence package for the address, inputting a preset multi-modal large model to generate a risk judgment result; calibrating the risk score of the judgment result, and combining a preset risk decision strategy to obtain the final risk level. The application realizes differentiated screening of massive network resources through dynamic sampling, avoids the waste of computing power of full-depth detection, balances the contradiction between insufficient computing power and detection real-time performance; relying on a multi-modal large model to complete cross-modal analysis, making up for the defects of insufficient multi-modal fusion depth; combining score calibration and decision integration time dimension characteristics and multi-modal information to solve the problem of missing time dimension analysis, improving the accuracy, reliability and practicality of risk identification.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method and system for identifying malicious network assets. Background Technology

[0002] Identifying malicious network assets (including malicious URLs, phishing domains, and malware distribution IPs) is the core foundation of a network security defense system. As network attack technologies continue to evolve, network security defense technologies have gradually developed from traditional static feature matching to dynamic behavior analysis and multimodal deep detection.

[0003] Currently, two main types of detection solutions have emerged: one is a multimodal malicious URL detection system based on end-to-end deep learning. This type of solution integrates multimodal data such as URL text and webpage screenshots, and replaces manual feature engineering with deep neural networks. However, it adopts a static full-data analysis mode, performing the complete multimodal data acquisition and analysis process indiscriminately on all URLs to be detected, resulting in huge computing power consumption, extremely low resource utilization, and a mechanical multimodal fusion method that lacks attention to intermodal interactions. It also ignores the temporal evolution characteristics of network assets and cannot establish a full lifecycle reputation profile for assets. The other type is anomaly detection system based on traffic behavior sequences, which focuses on time-series statistical analysis at the traffic level and triggers alarms by detecting traffic anomalies. However, it lacks in-depth verification of the semantics of webpage content. The time-series model is only used for post-event alarms and cannot achieve pre-event prediction and resource scheduling. Furthermore, it is disconnected from the content detection system and it is difficult to form a complete closed loop of "prediction-sampling-verification-feedback".

[0004] In summary, existing malicious network asset identification technologies generally suffer from three core problems: First, low resource utilization. The full-scale multimodal deep detection process consumes a large amount of computing resources, which cannot adapt to the real-time detection needs of massive network data and makes it difficult to balance the contradiction between insufficient deep detection computing power and the real-time nature of threat identification. Second, lack of time dimension analysis. Most static detection solutions do not consider the historical state and time evolution characteristics of network assets, losing key risk judgment information and thus limiting detection accuracy. Third, insufficient depth of multimodal fusion. Shallow fusion methods cannot capture the correlation and inconsistency between modalities, making it difficult to focus on key modalities that expose attack intentions, further affecting the accuracy of threat identification. Summary of the Invention

[0005] Therefore, it is necessary to provide a method and system for identifying malicious network assets in order to solve at least one of the problems existing in the prior art.

[0006] The embodiments of this application are implemented as follows: Firstly, a method for identifying malicious network assets is provided, comprising: Based on the historical state of each network resource address and the detection time difference, a dynamic sampling probability is determined. If the historical state is benign, a trust decay model is used to obtain the dynamic sampling probability, which increases with the increase of the detection time difference. If the historical state is malicious, a threat decay model is used to obtain the dynamic sampling probability, which decreases with the increase of the detection time difference. If the historical state is unknown, an exploration strategy is used, combining a baseline probability with static features to fine-tune the sampling probability to obtain the dynamic sampling probability. Based on the comparison between the dynamic sampling probability and the preset random number, the network resource addresses to be analyzed are selected from each network resource address; Based on the network resource address to be analyzed, a multimodal evidence packet is constructed; The multimodal evidence package is input into a preset multimodal large model to generate a risk assessment result; The risk assessment results are assigned a risk score, and the final risk level is obtained through a preset risk decision-making strategy.

[0007] In one possible implementation, before determining the dynamic sampling probability based on the historical state of each network resource address and the detection time difference, the method further includes: Obtain all network resource addresses, preprocess each network resource address to obtain valid network resource addresses; Obtain the historical status and detection time difference of the valid network resource address from the network asset ledger.

[0008] In one possible implementation, the step of selecting the network resource addresses to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and the preset random number includes: Generate the preset random number according to the preset random number generation rules; The dynamic sampling probability is compared with the preset random number; If the dynamic sampling probability is greater than the preset random number, then the network resource address is determined as the network resource address to be analyzed. If the dynamic sampling probability is less than or equal to the preset random number, the network resource address will be either allowed or discarded directly.

[0009] In one possible implementation, constructing a multimodal evidence packet based on the address of the network resource to be analyzed includes: A headless browser is used to dynamically render the network resource address to be analyzed in order to restore the actual running state of the page and obtain multimodal information, which includes text information, image information and structured information. Based on the multimodal information, the multimodal evidence package is constructed.

[0010] In one possible implementation, the step of inputting the multimodal evidence package into a preset multimodal large model to generate a risk assessment result includes: The multimodal evidence package is converted into a model input format to obtain the information to be predicted; The information to be predicted is input into the preset multimodal large model, and the information to be predicted is subjected to cross-modal semantic alignment and joint inference through the preset multimodal large model to generate the risk judgment result.

[0011] In one possible implementation, the multimodal evidence package includes text information, image information, and structured information. The step of converting the multimodal evidence package into a model input format to obtain the information to be predicted includes: The image information is normalized and used as input information for the visual channel; The text information and structured information are concatenated into structured prompt words, which are used as input information for the language channel. The structured information is extracted into preset structured fields and injected into the model input to form structured field input information; The visual channel input information, the language channel input information, and the structured field input information are used as the information to be predicted.

[0012] In one possible implementation, the step of assigning a risk score to the risk assessment result and obtaining the final risk level through a preset risk decision-making strategy includes: Based on the risk assessment results and the multimodal evidence package, risk scores, binarized feature variables, and count feature variables are obtained. The comprehensive risk intensity is obtained by weighted and fused calculation of the risk score, binarized feature variable, and count feature variable. The comprehensive risk intensity is mapped to the calibrated standardized risk probability; According to the preset dual-threshold decision-making strategy, the standardized risk probability is determined to obtain the risk level of the network resource address to be analyzed, and the risk level is written back to the network asset ledger.

[0013] In one possible implementation, the step of obtaining a risk score, a binarized feature variable, and a count feature variable based on the risk assessment result and the multimodal evidence package includes: Based on the risk assessment results, a risk score and risk factor labels are obtained; Based on the multimodal evidence package, the number of redirections and the number of sensitive fields corresponding to the network resource address to be analyzed are obtained; Convert the risk factor labels into binary feature variables; The count feature variables are obtained by truncating the upper limit of the number of redirections and the number of sensitive fields respectively.

[0014] Secondly, a malicious network asset identification system is provided, including: A dynamic sampling probability determination unit is used to determine the dynamic sampling probability based on the historical state of each network resource address and the detection time difference. Specifically, if the historical state is benign, a trust decay model is used to obtain the dynamic sampling probability, which increases with the increase of the detection time difference; if the historical state is malicious, a threat decay model is used to obtain the dynamic sampling probability, which decreases with the increase of the detection time difference; if the historical state is unknown, an exploration strategy is used to fine-tune the sampling probability using a baseline probability combined with static features to obtain the dynamic sampling probability. The network resource address determination unit is used to select the network resource address to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and the preset random number. A multimodal evidence packet construction unit is used to construct a multimodal evidence packet based on the address of the network resource to be analyzed. The risk assessment result generation unit is used to input the multimodal evidence package into a preset multimodal large model to generate a risk assessment result; The final risk level generation unit is used to assign a risk score to the risk assessment result and obtain the final risk level through a preset risk decision-making strategy.

[0015] Thirdly, a readable storage medium is provided that stores computer-readable instructions thereon, which, when executed by a processor, implement the malicious network asset identification method as described above.

[0016] The aforementioned malicious network asset identification method and system include the following steps: determining a dynamic sampling probability based on the historical state and detection time difference of each network resource address; selecting network resource addresses to be analyzed from among the network resource addresses based on the comparison between the dynamic sampling probability and a preset random number; constructing a multimodal evidence package based on the network resource addresses to be analyzed; inputting the multimodal evidence package into a preset multimodal large model to generate a risk assessment result; assigning a risk score to the risk assessment result and obtaining the final risk level through a preset risk decision-making strategy. In this embodiment, dynamic sampling probabilities are determined based on the historical status and detection time difference of each network resource address, enabling differentiated screening of massive network resources. This avoids the waste of computing power caused by full-scale deep detection, significantly improves resource utilization, and effectively balances the contradiction between insufficient computing power and the real-time nature of threat identification in a massive data environment. By selecting network resource addresses to be analyzed from each network resource address and constructing a multimodal evidence package, and combining it with a preset multimodal large model for cross-modal analysis, the shortcomings of insufficient multimodal fusion depth in existing technologies are compensated for, improving the accuracy of threat identification. By scoring and making decisions on the risk assessment results, integrating time dimension features and multimodal information, the problems of lack of time dimension analysis and limited detection accuracy in existing technologies are solved. At the same time, a complete detection closed loop is formed, further improving the reliability and practicality of malicious network asset identification and providing efficient and accurate technical support for network security defense. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating a malicious network asset identification method in one embodiment of this application; Figure 2 This is a flowchart illustrating a method for sampling network resource addresses to be analyzed in one embodiment of this application; Figure 3 This is a flowchart illustrating a risk level determination method in one embodiment of this application; Figure 4 This is a schematic diagram of the structure of a malicious network asset identification system in one embodiment of this application; Figure 5 This is a schematic diagram of a computer device according to one embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] In one embodiment, such as Figure 1 As shown, a method for identifying malicious network assets is provided, including the following steps: In step S110, a dynamic sampling probability is determined based on the historical state of each network resource address and the detection time difference. If the historical state is benign, a trust decay model is used to obtain the dynamic sampling probability, which increases with the increase of the detection time difference. If the historical state is malicious, a threat decay model is used to obtain the dynamic sampling probability, which decreases with the increase of the detection time difference. If the historical state is unknown, an exploration strategy is used to fine-tune the sampling probability using a baseline probability combined with static features to obtain the dynamic sampling probability. It should be noted that "historical status" refers to the past risk assessment results of each network resource address (such as Uniform Resource Locator (URL), domain name / subdomain, IP address, etc.) recorded in the network asset ledger before this detection. Specifically, it is divided into three categories: Safe, Risky, and Unknown. Safe means that no risk was found in the past detection and the network resource address has a good reputation. Risky means that the network resource address has been confirmed to have risks such as malicious attacks or phishing in the past detection. Unknown means that there are no historical detection records or the historical records are incomplete and the risk cannot be determined. The detection time difference refers to the time interval between the current detection time and the last valid detection time of the network resource address (the unit can be set to hours or days, depending on the actual detection needs). If this is the first detection, the detection time difference takes the preset initial value.

[0021] Optionally, the network asset detection engine obtains all network resource addresses across the entire network and performs preprocessing operations on them, specifically including address deduplication, filtering invalid and non-detection addresses (such as invalid domain names, non-HTTP / HTTPS protocol addresses, etc.), and filters out valid network resource addresses with detection value. Then, it retrieves the historical status information corresponding to each valid network resource address from the locally deployed network asset ledger, as well as the timestamp of the last valid risk detection completed for that address (Last_Check_Time). Based on the current timestamp of this detection and the aforementioned historical detection timestamps, the time interval calculated is the detection time difference. If the valid network resource address is included in the detection scope for the first time and has no historical detection record, its detection time difference is assigned a value. An initial threshold is preset; then, for each valid network resource address, according to its different historical status classifications, corresponding probability calculation rules are matched to calculate the dynamic sampling probability of each valid network resource address. For example, malicious addresses use a threat attenuation model (such as an attenuation nonlinear function), where the longer the detection time difference, the higher the sampling probability (prioritizing the detection of malicious address variants that have not been detected for a long time); benign addresses use a trust attenuation model (such as a smooth nonlinear function), where the sampling probability is extremely low when the detection time difference is short (reducing unnecessary detection); unknown addresses use an exploration strategy (an incremental nonlinear function), where the sampling probability gradually increases as the detection time difference increases (gradually covering undetected addresses), ultimately achieving differentiated sampling weight allocation for valid addresses with different risks and different detection intervals.

[0022] Among them, the network asset ledger refers to a high-performance storage system built on Redis, which is specifically used to uniformly record core asset information of network resource addresses (such as URLs, domain names, IP addresses, etc.). The core record fields include the historical status of the network resource address (divided into three categories: Safe, Risky, and Unknown) and the last detection timestamp (Last_Check_Time). It also supports fast reading, writing, updating and retrieval of asset information, providing accurate and real-time historical data support for the calculation of dynamic sampling probability. It is the core data carrier for realizing risk tracking of network assets throughout their entire life cycle.

[0023] In step S120, based on the comparison result between the dynamic sampling probability and the preset random number, the network resource addresses to be analyzed are selected from each network resource address; Optionally, a random sampling strategy is adopted. For each valid network resource address with a calculated dynamic sampling probability, a preset random number (a floating-point number between 0 and 1) is generated according to a uniform distribution rule. The random number for each network resource address is generated independently to ensure the randomness and fairness of the screening process. Then, the dynamic sampling probability of the valid network resource address is compared with the preset random number generated this time, and a binary classification screening logic is executed. Specifically, if the dynamic sampling probability of the valid network resource address is greater than the preset random number, it indicates that it has a higher detection priority. It is marked and determined as a network resource address to be analyzed and included in the subsequent multimodal evidence package construction and deep detection process. If the dynamic sampling probability of the valid network resource address is less than or equal to the preset random number, it indicates that its current detection priority is low. The address is directly allowed or temporarily stored and not included in the subsequent deep detection stage. By using random number comparison to achieve non-full-scale differentiated screening, only high-priority network resource addresses are included in the subsequent deep detection scope, realizing intelligent screening of massive effective network resource addresses. This ensures that high-risk addresses with long detection intervals are prioritized for detection, while avoiding meaningless full-scale deep analysis of low-risk addresses that have been recently detected. This achieves reasonable allocation of computing resources from the source of detection, effectively balancing the contradiction between detection efficiency and computing cost in the context of massive data.

[0024] In step S130, a multimodal evidence packet is constructed based on the address of the network resource to be analyzed; Optionally, for each network resource address to be analyzed, three types of core multimodal information can be collected simultaneously: text information, image information, and structured information. Text information may include the URL string itself, the webpage's HTML source code, and visible text after webpage rendering (such as titles, body text, button text, etc.). Image information may include screenshots of the complete webpage rendering and screenshots of key areas (such as login forms, pop-up ads, etc.). Structured information may include structured and parsable features such as the webpage's DOM node nesting structure, HTML tag distribution, script loading paths, and form submission addresses. After collection, various types of multimodal information can be preprocessed, specifically: text information undergoes noise reduction, word segmentation, and standardization, removing invalid whitespace characters and garbled text; image information undergoes size standardization and grayscale preprocessing to unify image formats; and structured information is parsed and formatted, converting it into a structured data format that can be directly input into the model. Subsequently, the preprocessed text information, image information, and structured information are associated and integrated, bound to the corresponding network resource address identifier to be analyzed, and the basic information of the address retrieved from the network asset ledger, to construct a complete multimodal evidence package. Each network resource address to be analyzed corresponds to an independent multimodal evidence package, ensuring the unique correspondence between the evidence package and the address, which facilitates the accurate association and backtracking of subsequent risk assessment results with the address.

[0025] In step S140, the multimodal evidence package is input into a preset multimodal large model to generate a risk assessment result; Optionally, the constructed multimodal evidence package is converted into a model input format and then input into a preset multimodal large model (such as BLIP-2, LLaVA (multimodal large language model), or a fusion optimization model of CLIP and large language model, etc.) for processing. The semantic alignment of multiple feature vectors is achieved through a cross-modal attention mechanism to mine the correlation features and risk correlation points between text, visual, and structured information. For example, matching whether the domain name information in the visual login form of a webpage is consistent with the domain name in the text, and verifying whether there are any abnormal cross-domain issues between the script loading path in the structured DOM structure and the domain name in the text. Subsequently, the model performs joint inference and risk feature classification on the aligned fused feature vectors. The model output layer generates the risk judgment result of the network resource address to be analyzed. The judgment result includes the risk category (such as phishing, malware distribution, benign and normal, etc.), the preliminary risk probability (floating point number in the range of 0-1), and the annotation of core risk features (such as containing sensitive words, visually imitating legitimate websites, form pointing to cross-domain IPs, etc.), providing the core judgment basis for the risk score labeling in subsequent steps. Each multimodal evidence package for the network resource address to be analyzed is independently input into the model for inference. After the inference is completed, the risk judgment result is bound to the corresponding address identifier to ensure that the result can be accurately traced back to the network resource address to be analyzed. At the same time, the judgment result is temporarily stored in a temporary data cache for later use.

[0026] In step S150, the risk assessment result is assigned a risk score, and the final risk level is obtained through a preset risk decision-making strategy.

[0027] Optionally, since the risk score output by a large model may exhibit distribution drift, potentially leading to inaccurate risk quantification and thus affecting the reliability of the final risk level determination, a lightweight calibration layer can be introduced. C(.) Calibrate the risk scores to ensure the stability and rationality of the score calibration. Specifically, retrieve the risk assessment results (including risk category, preliminary risk probability, and core risk feature annotations) corresponding to the network resource address to be analyzed from the temporary data cache. Simultaneously, retrieve the multimodal evidence package and basic information from the network asset ledger for that address. Then, based on the extracted information, preprocess the various types of information, input the processed features into the lightweight calibration layer. After weighted fusion and Sigmoid mapping by the lightweight calibration layer, obtain the standardized risk probability in the 0-1 range, correcting the distribution drift problem. After the score calibration is completed, execute the preset risk decision-making strategy to determine the final risk level. After the risk level determination is completed, uniquely bind the final risk level, standardized risk probability, and disposal result of the network resource address to be analyzed to the address identifier, and synchronously write back to the network asset ledger built on Redis, updating the historical status and latest detection timestamp (Last_Check_Time) of the address, realizing risk status tracking throughout the entire lifecycle of network assets.

[0028] This application provides a method for identifying malicious network assets, comprising: determining a dynamic sampling probability based on the historical state and detection time difference of each network resource address; selecting network resource addresses to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and a preset random number; constructing a multimodal evidence package based on the network resource addresses to be analyzed; inputting the multimodal evidence package into a preset multimodal large model to generate a risk assessment result; assigning a risk score to the risk assessment result and obtaining a final risk level through a preset risk decision-making strategy. In this embodiment, dynamic sampling probabilities are determined based on the historical status and detection time difference of each network resource address, enabling differentiated screening of massive network resources. This avoids the waste of computing power caused by full-scale deep detection, significantly improves resource utilization, and effectively balances the contradiction between insufficient computing power and the real-time nature of threat identification in a massive data environment. By selecting network resource addresses to be analyzed from each network resource address and constructing a multimodal evidence package, and combining it with a preset multimodal large model for cross-modal analysis, the shortcomings of insufficient multimodal fusion depth in existing technologies are compensated for, improving the accuracy of threat identification. By scoring and making decisions on the risk assessment results, integrating time dimension features and multimodal information, the problems of lack of time dimension analysis and limited detection accuracy in existing technologies are solved. At the same time, a complete detection closed loop is formed, further improving the reliability and practicality of malicious network asset identification and providing efficient and accurate technical support for network security defense.

[0029] like Figure 2 As shown in one embodiment of this application, before determining the dynamic sampling probability based on the historical state of each network resource address and the detection time difference, the method further includes: Obtain all network resource addresses, preprocess each network resource address to obtain valid network resource addresses; Obtain the historical status and detection time difference of the valid network resource address from the network asset ledger.

[0030] Optionally, a massive amount of network resource addresses across the entire network can be collected first through a network asset detection engine. A dual filtering algorithm is then used to preprocess the collected addresses to filter for valid addresses: first, a hash deduplication algorithm is used to remove duplicate URLs, avoiding wasted computing power due to repeated detections; second, a suffix matching algorithm is used to remove URLs with non-webpage characteristics (such as static resource addresses with suffixes like .jpg, .png, .mp4, etc.), retaining only webpage URLs with HTTP / HTTPS protocols, thus obtaining valid network resource addresses with detection value. Then, for each filtered valid network resource address, its top-level domain name is extracted using a domain name resolution tool to reduce the overhead of repeated queries caused by subdomain differences and improve data query efficiency. Subsequently, the network asset ledger built on Redis is queried, and the historical judgment results (i.e., historical status, divided into Safe, Risky, and Unknown) corresponding to the valid address are retrieved based on the top-level domain name association, along with the time difference since the last valid detection (unit: days; if it is the first detection, the time difference is a preset initial threshold, such as 7 days). Afterwards, within a preset detection period (e.g., ... Based on the different historical states of valid network resource addresses, a corresponding nonlinear calculation model is used, combined with the detection time difference, to calculate the dynamic sampling probability of each valid address. For example, if the historical state of a valid network resource address is benign, a trust decay model (first-order exponential growth model) is used to calculate the dynamic sampling probability. Under this rule, the sampling probability increases nonlinearly with the increase of the detection time difference. That is, the sampling probability of benign addresses that have been detected recently is extremely low, reducing meaningless repeated detections; however, as time goes on, benign addresses that have not been detected for a long time have a gradually increasing sampling probability due to the risk of being tampered with or hijacked, achieving a reasonable decay of trust over time. The trust decay model can be expressed as: ; in, Indicates the detection time difference. [0,60] This represents the maximum sampling probability. The minimum sampling probability. is a hyperparameter, and e represents the base of the exponential function.

[0031] when When = 0, the probability is extremely low (e.g., 0.01), saving resources; when As the number of days approaches 60, the probability becomes closer to... (e.g., 0.6), force a re-examination to refresh the state, where These are hyperparameters used to control the arrival time. The speed.

[0032] If the historical status of a valid network resource address is malicious, a threat attenuation model (exponential decay function) is used to calculate the dynamic sampling probability. Under this rule, the sampling probability decreases non-linearly with the increase of the detection time difference. That is, recently detected malicious addresses have a higher sampling probability, and their variants and updated statuses are tracked first; for malicious addresses that have not been detected for a long time, the sampling probability gradually decreases because mature defense strategies have been formed, and computing power is reasonably allocated to high-priority threats. The threat attenuation model can be expressed as: ; in, The lowest baseline value representing the sampling probability. represents the hyperparameter, and e represents the base of the exponential function. Indicates the detection time difference. 0,60].

[0033] when When =0, the probability is 100% (continuous tracking); when Approaching 60 days, the probability drops to its lowest baseline. (e.g., 0.2), only low-frequency spot checks are conducted to prevent a resurgence.

[0034] If the historical state of a valid network resource address is unknown, an exploration strategy is used to calculate the dynamic sampling probability. First, an intermediate baseline sampling probability is set. (For example, 0.4~0.6) serves as the base detection probability for unknown addresses. Then, the static features of the address (such as URL length, proportion of special characters, and reputation of the first-level domain) are extracted and slightly adjusted. The higher the feature risk, the slightly higher the sampling probability, and vice versa. While ensuring the basic detection coverage of unknown addresses, priority is given to detecting unknown addresses with risky static features.

[0035] ; in, Indicates the weighting coefficient. This represents the static feature risk score (calculated from features such as URL length, sensitive words, and domain registration time).

[0036] It should be noted that the aforementioned differentiated rules match the effective network resource addresses with different historical states and detection intervals with appropriate dynamic sampling probabilities. This ensures the detection priority of high-risk, high-potential-threat addresses while significantly reducing the detection frequency of low-risk addresses, achieving optimal allocation of computing resources from the source. Compared to full scanning, the "threat attenuation" model avoids invalid scanning of invalid malicious links; and the "trust attenuation" model avoids repeated scanning of links that are safe in the short term.

[0037] like Figure 2 As shown, in one embodiment of this application, the step of filtering out the network resource addresses to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and the preset random number includes: Generate the preset random number according to the preset random number generation rules; The dynamic sampling probability is compared with the preset random number; If the dynamic sampling probability is greater than the preset random number, then the network resource address is determined as the network resource address to be analyzed. If the dynamic sampling probability is less than or equal to the preset random number, the network resource address will be either allowed or discarded directly.

[0038] Optionally, for each valid network resource address that has passed preprocessing and whose dynamic sampling probability has been calculated, a [0-1] uniform distribution random number generation algorithm is used to generate a unique preset random number for it. The value range of this random number is strictly limited to the [0,1] interval, and it is in floating-point format (such as 0.23, 0.78, etc.). The random number generation process for each valid network resource address is independent and does not interfere with each other, avoiding screening bias caused by the convergence of batch random numbers, and ensuring that each address can obtain a fair screening opportunity based on its own dynamic sampling probability. Then, a comparison operation between the dynamic sampling probability and the preset random number can be performed. The dynamic sampling probability corresponding to each valid network resource address (also a floating-point number in the [0,1] interval, consistent with the random number format, for easy direct numerical comparison) is compared one-to-one with the preset random number unique to that address. During the comparison process, precise floating-point comparison logic is employed to avoid comparison errors caused by numerical precision issues, ensuring the accuracy of the comparison results. For example, if the dynamic sampling probability of an address is 0.65 and its exclusive preset random number is 0.52, then the dynamic sampling probability is determined to be greater than the preset random number; if the dynamic sampling probability is 0.38 and the preset random number is 0.45, then the dynamic sampling probability is determined to be less than the preset random number. Finally, differentiated screening and processing logic can be executed based on the comparison results. If the dynamic sampling probability of a valid network resource address is greater than its exclusive preset random number, it indicates that the address currently has a high detection priority (e.g., historically malicious but not recently detected, historically benign but not detected for a long time, historically unknown but with risky static characteristics, etc.), and it is directly marked and determined as a network resource address to be analyzed, with the screening identifier, dynamic sampling probability, and random number value recorded simultaneously. If the dynamic sampling probability of a valid network resource address is less than or equal to its own preset random number, it indicates that the address currently has a low detection priority (e.g., historically benign and recently completed detection, historically malicious but no variants have appeared for a long time and a defense strategy has been formed). In this case, differentiated treatment is applied to the address: for addresses with a clearly benign historical status and no recent abnormalities, they are directly allowed to access normally; for addresses with an unknown historical status but no obvious risks in static characteristics, they are temporarily stored and discarded (not permanently discarded), and are not included in subsequent deep detection. After the dynamic sampling probability is recalculated in the next detection cycle, they will participate in the screening again. This avoids meaningless computing power consumption and preserves the possibility of subsequent detection for low-priority addresses.

[0039] In one embodiment of this application, constructing a multimodal evidence packet based on the address of the network resource to be analyzed includes: A headless browser is used to dynamically render the network resource address to be analyzed in order to restore the actual running state of the page and obtain multimodal information, which includes text information, image information and structured information. Based on the multimodal information, the multimodal evidence package is constructed.

[0040] Optionally, when constructing a multimodal evidence packet based on the addresses of the network resources to be analyzed, Headless authentication is first initiated for each address of the network resource to be analyzed. High-performance headless browser tools such as Chrome and Playwright simulate real user access behavior to initiate requests to web pages and complete the entire dynamic rendering process, fully loading various resources such as JS scripts and CSS styles to restore the real running state of the page. Simultaneously, it collects text information including URL strings, HTML source code, and visible text on the page; image information including full-page high-definition screenshots of the web page and partial screenshots of key areas such as login forms / logos; and structured information including DOM node structure, JS script loading path, and form submission address. Subsequently, the three types of multimodal information collected are standardized and preprocessed: the text information is denoising, deduplicating, and uniformly encoded; the image information is normalized in size and format; and the structured information is parsed and converted into key-value pairs, structured arrays, and other easily recognizable formats. Finally, all the preprocessed information is associated and integrated, and bound to a unique identifier corresponding to the address of the network resource to be analyzed. This is encapsulated into an independent, structured, and traceable multimodal evidence package that corresponds one-to-one with the address, providing comprehensive and accurate feature data support for subsequent cross-modal analysis of large multimodal models.

[0041] like Figure 3 As shown, in one embodiment of this application, the step of inputting the multimodal evidence package into a preset multimodal large model to generate a risk assessment result includes: The multimodal evidence package is converted into a model input format to obtain the information to be predicted; The information to be predicted is input into the preset multimodal large model, and the information to be predicted is subjected to cross-modal semantic alignment and joint inference through the preset multimodal large model to generate the risk judgment result.

[0042] Optionally, firstly, the multimodal evidence package E is converted to the model input format to obtain input X. For example, the image information in the evidence package is normalized and its size is standardized. The text information and structured information in the evidence package are concatenated into structured prompts that the model can recognize. At the same time, the structured information is extracted into preset structured fields and directly injected into model M, and model M is required to output Y according to a fixed structure. Specifically, model M can achieve semantic alignment of multiple feature vectors through a cross-modal attention mechanism, and mine the correlation features and risk correlation points between text, visual, and structured information. For example, it can match whether the domain name information in the webpage visual login form is consistent with the domain name in the text, and verify whether there is any foreign domain anomaly between the script loading path in the structured DOM structure and the domain name in the text. Then, the model performs joint inference and risk feature classification on the aligned fused feature vectors, and generates the risk judgment result of the network resource address to be analyzed through the model output layer. Y=M(X); The Y can include risk categories (such as phishing, malware distribution, normal benign, etc.), preliminary risk probability (a floating-point number in the range of 0-1), and core risk feature annotations (such as the presence of sensitive words, visual imitation of legitimate websites, forms pointing to foreign IP addresses, etc.).

[0043] The output Y of the model can be formatted, for example, it can be output in JSON format: label∈{SAFE,RISKY,UNKNOWN}; risk_score∈[0,1] (model self-assessment risk score); evidence: a list of evidence (corresponding to screenshot area / text fragment / DOM structure point); reasoning_tags: a set of risk factor tags (such as "high return inducement", "counterfeit brand", "abnormal form", "forced redirection", "download guidance", etc.).

[0044] The multimodal evidence package for each network resource address to be analyzed can be independently input into the model for inference. After the inference is completed, the risk judgment result is bound to the corresponding address identifier to ensure that the result can be accurately traced back to the network resource address to be analyzed. At the same time, the judgment result is temporarily stored in a temporary data cache for later retrieval.

[0045] It should be noted that the preset multimodal large model can be BLIP-2, LLaVA (Multimodal Large Language Model), or a fusion and optimization model of CLIP and a large language model, etc. It can include a visual branch and a language branch. The model first receives multimodal evidence package data after format conversion and assigns it to the corresponding feature extraction branch according to modality. Specifically, in the visual branch, the converted image information is input into the ViT (Visual Transformer) backbone network to extract visual feature vectors, capturing visual risk features such as webpage layout, visual imitation, and key elements (e.g., login forms, fake pop-ups). In the language branch, textual and structured information are concatenated into structured prompt words (including URL strings, webpage text, and structured information descriptions) and then input into the large language model (e.g., LLaMA, BERT) backbone network to extract textual semantic feature vectors, mining language risk features such as sensitive words, abnormal domain names, and textual logical contradictions. Finally, structured feature injection converts the parsed DOM structure, form submission address, script path, and other structured fields into model-recognizable feature embeddings, directly injecting them into the cross-modal attention fusion layer to supplement structured logical risk features. The model first achieves deep semantic alignment of visual, linguistic, and structured feature vectors through a self-attention + cross-attention mechanism. Based on linguistic features, it uses cross-attention to focus on the semantically related regions of visual features, and combines structured features to verify the logical consistency of visual-text features, uncovering the correlation and contradictory risk features between modalities, and avoiding feature dilution. Then, the semantically aligned fused feature vector is input into the risk inference layer, which consists of a fully connected layer and an activation function. Based on a finely tuned malicious network asset detection knowledge base, risk classification and probability calculation are completed, and then risk category labels such as phishing and benign are matched. The initial risk probability in the 0-1 range is output through the Sigmoid function, and core risk features are mined and labeled. Finally, the model output layer integrates the risk judgment results.

[0046] Furthermore, in actual deployment, this model has undergone lightweight optimization for network security detection scenarios (such as model pruning and feature vector dimensionality reduction), and has been fine-tuned based on massive multimodal samples of malicious / benign URLs. This significantly improves the accuracy of risk identification for network assets such as phishing and malicious domains, while ensuring inference speed to meet the real-time requirements of deep detection. Compared to simple feature concatenation, by introducing cross-modal attention, it can identify advanced adversarial examples that are "visually spoofed but textually evasive" or "textually induced but visually normal," reducing false positives and false negatives and effectively improving the adversarial example detection rate.

[0047] like Figure 3 As shown, in one embodiment of this application, the multimodal evidence package includes text information, image information, and structured information. The step of converting the multimodal evidence package into a model input format to obtain the information to be predicted includes: The image information is normalized and used as input information for the visual channel; The text information and structured information are concatenated into structured prompt words, which are used as input information for the language channel. The structured information is extracted into preset structured fields and injected into the model input to form structured field input information; The visual channel input information, the language channel input information, and the structured field input information are used as the information to be predicted.

[0048] Optionally, this preset multimodal large model can integrate visual feature extraction branches and language feature extraction branches, and has been fine-tuned for malicious network asset detection scenarios. It possesses the ability to semantically align and jointly infer image content (page layout, logo, button, form) and text content (inducement text, promises, contact information). By converting the model input format of the multimodal evidence package E, the image information in the evidence package... (For example, a full-screen screenshot of the current website page) After normalization and size standardization, it is input into the visual feature extraction branch of the model, and visual feature vectors such as the visual layout and key element distribution of the webpage are extracted through a convolutional neural network or ViT backbone network; the evidence package contains (such as the URL string and its parsing information (domain name, path, parameters, redirection chain, etc.)) (Such as core key page titles, meta tags, and visible body text (including text near key buttons / form fields)), and The structural summary (such as HTML / DOM structural information (“structured summary after text removal”)) is concatenated into structured prompts that the model can recognize, and then input into the language feature extraction branch. The pre-trained language model extracts text semantics, keyword features, and structured logical feature vectors. At the same time, the structured information is extracted into preset structure fields and directly injected into the model feature fusion layer to form structured field input information. For example, the DOM summary is injected in the form of structure fields such as “hierarchy / form / redirect / script density” to avoid misjudgment based solely on visual screenshot features. For example, a fake page screenshot may look similar, but the DOM structure and form submission behavior are obviously abnormal.

[0049] like Figure 3 As shown in one embodiment of this application, the step of assigning a risk score to the risk assessment result and obtaining the final risk level through a preset risk decision-making strategy includes: Based on the risk assessment results and the multimodal evidence package, risk scores, binarized feature variables, and count feature variables are obtained. The comprehensive risk intensity is obtained by weighted and fused calculation of the risk score, binarized feature variable, and count feature variable. The comprehensive risk intensity is mapped to the calibrated standardized risk probability; According to the preset dual-threshold decision-making strategy, the standardized risk probability is determined to obtain the risk level of the network resource address to be analyzed, and the risk level is written back to the network asset ledger.

[0050] Optionally, the risk assessment results temporarily stored in the temporary data cache and the multimodal evidence package corresponding to the network resource address to be analyzed are retrieved. A preliminary risk score (risk_score, the higher the score, the more likely it is to be risky) and risk factor labels corresponding to core risk features (such as "counterfeit brand," "login form," etc.) are extracted from the risk assessment results. Quantifiable count features such as redirection hops and the number of sensitive fields (such as identity information / verification codes, etc.) are extracted from the multimodal evidence package. Subsequently, the extracted features are standardized and preprocessed to obtain binary feature variables and count feature variables. According to the preset optimal weights (determined based on training with massive detection samples), the preliminary risk score, the preprocessed binary feature variables, and the count feature variables are weighted and fused to obtain a comprehensive risk intensity that reflects the overall risk level of the address. The comprehensive risk intensity can be calculated using the following formula: ; Where z represents the "overall risk intensity" before calibration (it can be any real number, and the larger the value, the higher the risk); The weight represents the model score s (the larger the weight, the more trust is placed in the original score of the larger model). This indicates the additional risk associated with the appearance of the "counterfeit brand" label; This indicates the increased risk when the "Login / Payment Form" label appears; This represents the increment coefficient of risk based on the number of redirections (each additional redirection increases z by 0). ); represents the incremental coefficient of the number of sensitive fields on risk; b represents the bias term (overall "baseline risk"). The larger b is, the more inclined the overall risk assessment is; the smaller b is, the more conservative the overall assessment is.

[0051] Then, the comprehensive risk intensity can be mapped to a standardized risk probability in the 0-1 interval using the Sigmoid function, thus accurately calibrating the risk score and effectively correcting the distribution drift problem that may exist in the output scores of multimodal large models, ensuring the accuracy of risk quantification. The standardized risk probability can be calculated using the following formula: ; Where p∈(0,1) represents the standardized risk probability after calibration (the closer to 1, the higher the risk), and e is the natural constant.

[0052] Finally, the standardized risk probabilities are classified and determined according to the preset dual-threshold decision-making strategy, and a high threshold is set. (Thresholds for determining risk (higher thresholds indicate greater caution, fewer false positives but potentially more false negatives) and low thresholds) (The threshold for determining safety (the lower the threshold, the more cautious the approach, resulting in fewer false negatives but potentially more false positives)), when the probability P is greater than or equal to When P is less than or equal to RISKY, When the condition is met, it is marked SAFE; when it is in the middle, it is marked UNKNOWN, indicating insufficient evidence / uncertainty, and no conclusion is drawn. After the determination is completed, the final risk level and standardized risk probability of the network resource address to be analyzed are bound to the address's unique identifier and synchronously written back to the network asset ledger built on Redis, updating the address's historical status and the latest detection timestamp (Last_Check_Time) in real time.

[0053] like Figure 3 As shown in one embodiment of this application, obtaining the risk score, binarized feature variable, and count feature variable based on the risk assessment result and the multimodal evidence package includes: Based on the risk assessment results, a risk score and risk factor labels are obtained; Based on the multimodal evidence package, the number of redirections and the number of sensitive fields corresponding to the network resource address to be analyzed are obtained; Convert the risk factor labels into binary feature variables; The count feature variables are obtained by truncating the upper limit of the number of redirections and the number of sensitive fields respectively.

[0054] Optionally, a preliminary risk probability is first extracted as a preliminary risk score based on the risk assessment results, and risk factor labels (such as impersonating legitimate websites, forms pointing to foreign IP addresses, and containing phishing keywords) are extracted from the results. Then, quantifiable feature indicators are extracted from the multimodal evidence package, including count features such as the number of redirects and the number of sensitive fields. The risk factor labels are converted into binary feature variables, and the upper limit is truncated for the number of redirects and the number of sensitive fields to obtain count feature variables.

[0055] For example, several 0 / 1 variables can be defined (1 if they appear, 0 if they don't), specifically: [“Counterfeit Brands”∈T] is used to mark the risk characteristics of whether a webpage contains counterfeit brands. The value of this feature is 1 when the text information T of the webpage to be analyzed contains a description related to “counterfeit brands”; otherwise, it is 0.

[0056] ["Login / Payment Form"∈T] is used to mark whether a webpage contains a high-risk login or payment form. Similarly, when the webpage text information T contains a description related to "login / payment form", the value of this feature is 1; if it does not contain it, the value is 0.

[0057] Then, the frequency of occurrence of these risk features can be counted, but an upper limit (truncation) will be set to avoid extreme outliers from having an excessive impact on the model. The specific truncation rule is as follows: ; The number of redirects to a webpage is counted as redirect_hops, but it is recorded as a maximum of 3 times (that is, when the number of redirects is ≥3, the feature value is still 3, because more than 3 times is usually suspicious, but increasing it further does not yield much benefit).

[0058] Excessive redirects are usually a characteristic of malicious web pages, but after more than 3 redirects, further increases do not provide much benefit to risk assessment. Truncation can reduce interference from extreme values.

[0059] ; The number of sensitive fields in a webpage, sensitive_fields, is counted, but the maximum number is 2 (i.e., when the number of sensitive fields is ≥2, the feature value is still 2).

[0060] The more sensitive fields there are, the higher the risk, but more than two are sufficient to indicate a risk tendency. Truncating them can simplify calculations and avoid outliers.

[0061] Through the aforementioned feature transformation and truncation processes, text-based risk factor labels that could not be directly used in numerical calculations are transformed into binary and count feature variables that the model can directly process. This not only accurately marks the presence or absence of risk features, but also improves the model stability and computational efficiency of subsequent risk calculations through upper limit truncation.

[0062] In this embodiment, dynamic sampling probabilities are determined based on the historical status and detection time difference of each network resource address, enabling differentiated screening of massive network resources. This avoids the waste of computing power caused by full-scale deep detection, significantly improves resource utilization, and effectively balances the contradiction between insufficient computing power and the real-time nature of threat identification in a massive data environment. By selecting network resource addresses to be analyzed from each network resource address and constructing a multimodal evidence package, and combining it with a preset multimodal large model for cross-modal analysis, the shortcomings of insufficient multimodal fusion depth in existing technologies are compensated for, improving the accuracy of threat identification. By scoring and making decisions on the risk assessment results, integrating time dimension features and multimodal information, the problems of lack of time dimension analysis and limited detection accuracy in existing technologies are solved. At the same time, a complete detection closed loop is formed, further improving the reliability and practicality of malicious network asset identification and providing efficient and accurate technical support for network security defense.

[0063] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0064] In one embodiment, a malicious network asset identification system is provided, which corresponds one-to-one with the malicious network asset identification methods described in the above embodiments. For example... Figure 4 As shown, the malicious network asset identification system includes a dynamic sampling probability determination unit 10, a network resource address determination unit 20, a multimodal evidence package construction unit 30, a risk assessment result generation unit 40, and a final risk level generation unit 50. Detailed descriptions of each functional module are as follows: The dynamic sampling probability determination unit 10 is used to determine the dynamic sampling probability based on the historical state of each network resource address and the detection time difference. If the historical state is benign, a trust decay model is used to obtain the dynamic sampling probability, which increases with the increase of the detection time difference. If the historical state is malicious, a threat decay model is used to obtain the dynamic sampling probability, which decreases with the increase of the detection time difference. If the historical state is unknown, an exploration strategy is used to fine-tune the sampling probability using a baseline probability combined with static features to obtain the dynamic sampling probability. The network resource address determination unit 20 is used to select the network resource address to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and the preset random number. The multimodal evidence packet construction unit 30 is used to construct a multimodal evidence packet based on the address of the network resource to be analyzed. The risk assessment result generation unit 40 is used to input the multimodal evidence package into a preset multimodal large model to generate a risk assessment result; The final risk level generation unit 50 is used to assign a risk score to the risk assessment result and obtain the final risk level through a preset risk decision-making strategy.

[0065] In one embodiment of this application, the system further includes a data acquisition unit, used for: Obtain all network resource addresses, preprocess each network resource address to obtain valid network resource addresses; Obtain the historical status and detection time difference of the valid network resource address from the network asset ledger.

[0066] In one embodiment of this application, the network resource address determination unit 20 to be analyzed is further configured to: Generate the preset random number according to the preset random number generation rules; The dynamic sampling probability is compared with the preset random number; If the dynamic sampling probability is greater than the preset random number, then the network resource address is determined as the network resource address to be analyzed. If the dynamic sampling probability is less than or equal to the preset random number, the network resource address will be either allowed or discarded directly.

[0067] In one embodiment of this application, the multimodal evidence package construction unit 30 is further configured to: A headless browser is used to dynamically render the network resource address to be analyzed in order to restore the actual running state of the page and obtain multimodal information, which includes text information, image information and structured information. Based on the multimodal information, the multimodal evidence package is constructed.

[0068] In one embodiment of this application, the risk assessment result generation unit 40 is further configured to: The multimodal evidence package is converted into a model input format to obtain the information to be predicted; The information to be predicted is input into the preset multimodal large model, and the information to be predicted is subjected to cross-modal semantic alignment and joint inference through the preset multimodal large model to generate the risk judgment result.

[0069] In one embodiment of this application, the multimodal evidence package includes text information, image information, and structured information. The risk assessment result generation unit 40 is further used for: The image information is normalized and used as input information for the visual channel; The text information and structured information are concatenated into structured prompt words, which are used as input information for the language channel. The structured information is extracted into preset structured fields and injected into the model input to form structured field input information; The visual channel input information, the language channel input information, and the structured field input information are used as the information to be predicted.

[0070] In one embodiment of this application, the final risk level generation unit 50 is further configured to: Based on the risk assessment results and the multimodal evidence package, risk scores, binarized feature variables, and count feature variables are obtained. The comprehensive risk intensity is obtained by weighted and fused calculation of the risk score, binarized feature variable, and count feature variable. The comprehensive risk intensity is mapped to the calibrated standardized risk probability; According to the preset dual-threshold decision-making strategy, the standardized risk probability is determined to obtain the risk level of the network resource address to be analyzed, and the risk level is written back to the network asset ledger.

[0071] In one embodiment of this application, the final risk level generation unit 50 is further configured to: Based on the risk assessment results, a risk score and risk factor labels are obtained; Based on the multimodal evidence package, the number of redirections and the number of sensitive fields corresponding to the network resource address to be analyzed are obtained; Convert the risk factor labels into binary feature variables; The count feature variables are obtained by truncating the upper limit of the number of redirections and the number of sensitive fields respectively.

[0072] In this embodiment, dynamic sampling probabilities are determined based on the historical status and detection time difference of each network resource address, enabling differentiated screening of massive network resources. This avoids the waste of computing power caused by full-scale deep detection, significantly improves resource utilization, and effectively balances the contradiction between insufficient computing power and the real-time nature of threat identification in a massive data environment. By selecting network resource addresses to be analyzed from each network resource address and constructing a multimodal evidence package, and combining it with a preset multimodal large model for cross-modal analysis, the shortcomings of insufficient multimodal fusion depth in existing technologies are compensated for, improving the accuracy of threat identification. By scoring and making decisions on the risk assessment results, integrating time dimension features and multimodal information, the problems of lack of time dimension analysis and limited detection accuracy in existing technologies are solved. At the same time, a complete detection closed loop is formed, further improving the reliability and practicality of malicious network asset identification and providing efficient and accurate technical support for network security defense.

[0073] Specific limitations regarding the malicious network asset identification system can be found in the limitations of the malicious network asset identification method described above, and will not be repeated here. Each module in the aforementioned malicious network asset identification system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0074] In one embodiment, a computer device is provided, which may be a terminal device, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, and network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a readable storage medium storing computer-readable instructions. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer-readable instructions implement a method for identifying malicious network assets. The readable storage medium provided in this embodiment includes both non-volatile and volatile readable storage media.

[0075] In this application embodiment, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, it implements the steps of the malicious network asset identification method described above.

[0076] In this embodiment of the application, a readable storage medium is provided, which stores computer-readable instructions. When the computer-readable instructions are executed by a processor, they implement the steps of the malicious network asset identification method described above.

[0077] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware with computer-readable instructions. These computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When executed, these computer-readable instructions can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0078] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0079] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for identifying malicious network assets, characterized in that, The method includes: Based on the historical state of each network resource address and the detection time difference, a dynamic sampling probability is determined. If the historical state is benign, a trust decay model is used to obtain the dynamic sampling probability, which increases with the detection time difference. If the historical state is malicious, a threat decay model is used to obtain the dynamic sampling probability, which decreases with the detection time difference. If the historical state is unknown, an exploration strategy is used, combining a baseline probability with static features to fine-tune the sampling probability to obtain the dynamic sampling probability. The detection time difference is the time interval between the current timestamp of this detection and the timestamp of the last valid risk detection. Based on the comparison between the dynamic sampling probability and the preset random number, the network resource addresses to be analyzed are selected from each network resource address; Based on the network resource address to be analyzed, a multimodal evidence packet is constructed; The multimodal evidence package is input into a preset multimodal large model to generate a risk assessment result; The risk assessment results are assigned a risk score, and the final risk level is obtained through a preset risk decision-making strategy.

2. The malicious network asset identification method as described in claim 1, characterized in that, Before determining the dynamic sampling probability based on the historical status of each network resource address and the detection time difference, the following steps are also included: Obtain all network resource addresses, preprocess each network resource address to obtain valid network resource addresses; Obtain the historical status and detection time difference of the valid network resource address from the network asset ledger.

3. The malicious network asset identification method as described in claim 1, characterized in that, The step of selecting network resource addresses to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and the preset random number includes: Generate the preset random number according to the preset random number generation rules; The dynamic sampling probability is compared with the preset random number; If the dynamic sampling probability is greater than the preset random number, then the network resource address is determined as the network resource address to be analyzed. If the dynamic sampling probability is less than or equal to the preset random number, the network resource address will be either allowed or discarded directly.

4. The malicious network asset identification method as described in claim 1, characterized in that, The construction of a multimodal evidence package based on the network resource address to be analyzed includes: A headless browser is used to dynamically render the network resource address to be analyzed in order to restore the actual running state of the page and obtain multimodal information, which includes text information, image information and structured information. Based on the multimodal information, the multimodal evidence package is constructed.

5. The malicious network asset identification method as described in claim 1, characterized in that, The step of inputting the multimodal evidence package into a preset multimodal large model to generate a risk assessment result includes: The multimodal evidence package is converted into a large model input format to obtain the information to be predicted; The information to be predicted is input into the preset multimodal large model, and the information to be predicted is subjected to cross-modal semantic alignment and joint inference through the preset multimodal large model to generate the risk judgment result.

6. The malicious network asset identification method as described in claim 5, characterized in that, The multimodal evidence package includes text information, image information, and structured information. Converting the multimodal evidence package into a large model input format to obtain the information to be predicted includes: The image information is normalized and used as input information for the visual channel; The text information and structured information are concatenated into structured prompt words, which are used as input information for the language channel. The structured information is extracted into preset structured fields and injected into the preset multimodal large model input to form structured field input information; The visual channel input information, the language channel input information, and the structured field input information are used as the information to be predicted.

7. The malicious network asset identification method according to any one of claims 1-6, characterized in that, The step of assigning a risk score to the risk assessment result and obtaining the final risk level through a preset risk decision-making strategy includes: Based on the risk assessment results and the multimodal evidence package, risk scores, binarized feature variables, and count feature variables are obtained. The comprehensive risk intensity is obtained by weighted and fused calculation of the risk score, binarized feature variable, and count feature variable. The comprehensive risk intensity is mapped to the calibrated standardized risk probability; According to the preset dual-threshold decision-making strategy, the standardized risk probability is determined to obtain the risk level of the network resource address to be analyzed, and the risk level is written back to the network asset ledger.

8. The malicious network asset identification method as described in claim 7, characterized in that, Based on the risk assessment result and the multimodal evidence package, the risk score, binarized feature variables, and count feature variables are obtained, including: Based on the risk assessment results, a risk score and risk factor labels are obtained; Based on the multimodal evidence package, the number of redirections and the number of sensitive fields corresponding to the network resource address to be analyzed are obtained; Convert the risk factor labels into binary feature variables; The count feature variables are obtained by truncating the upper limit of the number of redirections and the number of sensitive fields respectively.

9. A malicious network asset identification system, characterized in that, The system includes: A dynamic sampling probability determination unit is used to determine the dynamic sampling probability based on the historical state of each network resource address and the detection time difference. If the historical state is benign, a trust decay model is used to obtain the dynamic sampling probability, which increases with the increase of the detection time difference. If the historical state is malicious, a threat decay model is used to obtain the dynamic sampling probability, which decreases with the increase of the detection time difference. If the historical state is unknown, an exploration strategy is used to fine-tune the sampling probability using a baseline probability combined with static features to obtain the dynamic sampling probability. The detection time difference is the time interval between the current timestamp of this detection and the timestamp of the last successful effective risk detection. The network resource address determination unit is used to select the network resource address to be analyzed from each network resource address based on the comparison result between the dynamic sampling probability and the preset random number. A multimodal evidence packet construction unit is used to construct a multimodal evidence packet based on the address of the network resource to be analyzed. The risk assessment result generation unit is used to input the multimodal evidence package into a preset multimodal large model to generate a risk assessment result; The final risk level generation unit is used to assign a risk score to the risk assessment result and obtain the final risk level through a preset risk decision-making strategy.

10. A readable storage medium having computer-readable instructions stored thereon, characterized in that, When the computer-readable instructions are executed by a processor, they implement the malicious network asset identification method as described in any one of claims 1 to 8.

Images