An application program malicious behavior identification method based on semantic causal consistency constraint

Abstract

The application discloses an application program malicious behavior identification method based on semantic causal consistency constraint and belongs to the technical field of artificial intelligence, and aims to solve the technical problem of how to overcome the defects of low accuracy, poor real-time performance, weak cross-platform adaptability and difficult malicious behavior identification in the process of industrial internet host application program anomaly detection. By comparing the causal structure of the code intention and the actual behavior instead of the statistical characteristics, advanced malicious behaviors such as confusion and delayed triggering can be effectively identified, and it is not easy to be bypassed by simple code deformation or behavior noise; by introducing domain information for correction and designing a cross-domain stable loss, the model learns the core causal bias independent of the operating system and the device type, solving the problem of sudden performance degradation of traditional methods; when reasoning and predicting, the output result is not only a malicious probability, but also contains an abnormal explanation link, which can help security analysts understand the attack intention, respond quickly and take evidence.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a method for identifying malicious applications based on semantic causal consistency constraints. Background Technology

[0002] Industrial Internet mainframes are a new type of infrastructure that deeply integrates next-generation information and communication technologies with the industrial economy, and are an important cornerstone of the new round of industrial revolution. Through advanced technologies such as sensors, industrial software, and intelligent computing, the Industrial Internet mainframe serves as the core intelligent control device, enabling efficient interconnection and interoperability of massive amounts of industrial equipment. It also builds an industrial brain in the cloud for data processing and production decision-making, thereby supporting flexible production and driving the transformation and upgrading of the manufacturing industry from traditional manufacturing to intelligent manufacturing.

[0003] However, with the widespread deployment of the Industrial Internet, industrial internet hosts have increasingly become a prime target for malicious actors. Attackers exploit vulnerabilities in host systems to write and spread various malicious programs for illicit gains. As information technology continues to develop, these malicious programs exhibit characteristics such as strong obfuscation, persistence, and high concealment, effectively evading traditional intrusion detection systems and antivirus software. They can remain dormant in industrial internet hosts for extended periods, causing damage, leading to the leakage of core business secrets, production interruptions, and even incalculable economic losses and security incidents.

[0004] Currently, the security protection of industrial internet host applications mainly relies on traditional static security measures such as access control and encrypted transmission. While these measures can ensure basic system security to a certain extent, their detection capabilities are clearly insufficient when facing increasingly complex malicious applications. Malicious programs can often bypass traditional protection mechanisms and run covertly on the host, resulting in delayed security detection and untimely response, making it difficult to meet the high real-time and high reliability security requirements of the industrial internet.

[0005] Existing detection methods based on machine learning or deep learning typically concatenate code features, behavioral features, and environmental features before inputting them into a classifier, or learn code-side and behavioral-side representations separately through independent representation learning tasks, and then fuse them in the downstream classification stage. While these methods can improve detection accuracy on specific datasets, they primarily rely on statistical correlation and are easily affected by changes in operating system version, device type, deployment environment, and application coding style. When test data and training data come from different domains, the model may over-rely on local features in the source domain, leading to a decline in cross-domain recognition performance.

[0006] On the other hand, simply increasing model complexity or adding multiple training losses cannot fundamentally solve the problem of difficult malicious behavior identification. Malicious applications in industrial internet hosts often exhibit characteristics such as structural deformation, behavioral delays, and conditional triggering. Relying solely on local features such as code snippets, API frequency, network connection counts, or file operation counts is insufficient to accurately reveal the deviation between the code's intent and actual runtime behavior. Therefore, establishing an interpretable, transferable, and online-judgment-compatible consistency mechanism between expected behavior on the code side and observed behavior on the runtime side is crucial for improving the anomaly detection capabilities of industrial internet host applications.

[0007] Overcoming the shortcomings of low accuracy, poor real-time performance, weak cross-platform adaptability, and difficulty in identifying malicious behavior in the process of detecting anomalies in industrial internet host applications is a technical problem that needs to be solved. Summary of the Invention

[0008] The technical objective of this invention is to address the above-mentioned shortcomings by providing a method for malicious application identification based on semantic causal consistency constraints. This method aims to overcome the technical problems of low accuracy, poor real-time performance, weak cross-platform adaptability, and difficulty in identifying malicious behavior in the process of detecting anomalies in industrial Internet host applications.

[0009] This invention discloses a method for identifying malicious applications based on semantic causal consistency constraints, comprising the following steps: Data Acquisition: Collect paired code modality data and behavioral modality data of the application as samples, and record the environmental metadata to which the samples belong as cross-domain information. Pair the code modality data, behavioral modality data and cross-domain information corresponding to the application into sample triples, and label the samples with real category labels. Semantic template construction: Based on code modal data, a pre-trained code-side encoder is used to encode and predict expected execution behavior, outputting a global code representation vector and a code semantic causal template. The code semantic causal template includes key operation nodes, key causal edges, key event sequences, and key resource access links. Behavior graph construction: Based on behavioral modality data, a pre-trained behavior-side encoder is used to encode and predict actual execution behaviors, outputting a global representation vector of behavior and a running observation behavior graph. The running observation behavior graph includes the set of actual operation events, observation causal edges, event sequence, and resource access trajectory. Model Training: Calculate the consistency deviation between the code semantic causal graph and the runtime observation behavior graph. Construct semantic causal consistency deviation loss and deviation link representation based on the consistency deviation. Construct causal communities based on the deviation link representation of samples and cross-domain information. Generate a structured set of deviation patterns as a prototype for the causal community and assign community labels to samples. Construct abnormal link pattern consistency loss based on the prototype of the causal community and the deviation link representation of samples. Construct domain loss based on the deviation link representation of samples, community labels, and cross-domain information. Fuse the code global representation vector, behavior global representation vector, cross-domain information representation vector, and deviation link representation vector into a multimodal fusion representation. Based on the multimodal fusion representation, the predicted category label and probability value output by the classifier are used as the prediction result. Construct classification loss based on the true category label of the samples and the prediction result. Construct the total loss by weighted summing of semantic causal consistency deviation loss, abnormal link pattern consistency loss, domain loss, and classification loss. Train the code-side encoder, behavior-side encoder, and classifier based on minimizing the total loss. Inference and Prediction: Collect code modality data and behavioral modality data of the application to be identified. Construct a code semantic causal graph through a trained code-side encoder and a runtime observation behavior graph through a trained behavioral-side encoder. Calculate the consistency deviation between the code semantic causal graph and the runtime observation behavior graph to obtain the deviation link representation. Use the deviation link representation vector as input and perform anomaly identification through a trained classifier. Output the predicted category label and probability value as the prediction result. Execute the action based on the prediction result. Extract structured deviation descriptions from the consistency deviation calculation process, including key causal edge deviation details, key temporal deviation details, and key resource chain deviation details.

[0010] As a preferred option, data acquisition includes the following operations: Code modal data acquisition: Binary files or script files of the target application are collected through file scanning or application upload. Static analysis tools are used to parse the binary files or script files to identify the file structure, instruction sequence, and basic program elements, and obtain intermediate representations as code modal data. The intermediate representations include API call sequences, sensitive strings, permission request lists, control flow graphs, and data dependency graphs. API call sequences include import tables and dynamic calls. Sensitive strings include IP addresses, URLs, keys, and commands. Control flow graphs include function call relationships and basic block jumps. Data dependency relationships include variable-usage chains. Permission requests include Android permissions and Windows UAC. Behavioral modality data acquisition: The target application is deployed and run in a sandbox or real environment. Raw behavioral logs of the application are collected through multi-platform process or kernel tracing tools. The raw behavioral logs are analyzed, behavioral events are extracted and metadata is added. Behavioral events are associated with the same execution context to obtain behavioral modality data including event type, timestamp, process ID and parameters. Among them, behavioral events include process events, file events, network events, system call events, memory events and hardware I / O events, and metadata includes timestamp, process ID and parameters. Cross-domain information collection: Obtain cross-domain information of the target application. Cross-domain information is used to record the environment context in which the application runs. Data processing: unify code modal data, behavioral modal data, and cross-domain information into a standardized format, including mapping similar operations on different operating systems to unified semantic objects, unifying API names to standardized naming, aligning and sorting timestamps, and removing redundant and irrelevant events; Sample pairing: Associating and pairing code modality data, behavioral modality data, and cross-domain information from the same application to form a sample triple; Labeling: Each sample is labeled with a true category label. Category labels include binary labels for normal and abnormal categories, as well as abnormal category labels. Among them, abnormal category labels include data theft, ransomware encryption, backdoor communication, and mining.

[0011] Preferably, semantic template construction includes the following operations: Semantic mapping and abstraction: Perform instruction semantic recognition on code modal data, identify the semantic category of instructions, map API functions of different operating systems into standardized semantic units, identify and mark sensitive operation semantic units, abstract the specific parameter values ​​of sensitive operation semantic units into parameter types, and output semantic units including semantic type, parameter type and location information; Semantic unit sequence generation: Based on the control flow graph and data dependency graph in the code modality data, semantic units are sorted according to the program execution logic to generate a semantic unit sequence; Code causal graph construction: Based on semantic unit sequence, control flow graph and data dependency graph, control flow, data flow and function call analysis are performed. Based on the analysis results, causal relationship edges between key operations are extracted. With semantic units as nodes and causal relationship edges as directed edges, a directed graph is constructed as the code causal graph. The directed edges have type and weight. The types of directed edges include control dependency edges, data dependency edges, call dependency edges and execution order edges. Code semantic causal template construction: Taking semantic unit sequence and code causal graph as input, the semantic unit sequence is encoded by a pre-trained code-side encoder, and the expected execution behavior of the application at the code level is predicted. The output is a global code representation vector, and the output is a key causal structure related to security as a code semantic causal template. The code semantic causal graph template is represented in the form of a code semantic causal graph, or includes a code semantic causal graph composed of key operation nodes and key causal edges.

[0012] Preferably, the code-side encoder includes an embedding layer, a sequence coding layer, a graph coding layer, a pooling layer, and a multi-head prediction layer; The embedding layer is used to map each semantic unit in the sequence of semantic units to a trainable embedding vector, and outputs a sequence of embedding vectors; The sequence encoding layer is used to encode the embedded vector sequence using Transformer or bidirectional LSTM, capture long-distance dependencies and contextual information between semantic units, and output a context-aware hidden state sequence. The graph coding layer is used to construct a relational graph between semantic units based on the hidden state sequence and the edge relationships extracted through static analysis, and outputs a graph-aware node representation sequence. Pooling layers are used to extract semantic features based on node representation sequences and output a global code representation vector; The multi-head prediction layer is used to predict the causal relationships between key operations based on the intermediate states of the sequence coding layer or graph coding layer, output key operation nodes and key causal edges, predict the sequence constraints between key operations, output the time series set of key events, predict the resource paths that the program is expected to access, and output the key resource access links. The code-side encoder is pre-trained by performing the following operations: causal edge recovery is performed on the randomly occluded semantic unit sequence using the code encoder; a code-side causal edge recovery loss is constructed based on the recovered key operation causal edges and the original key operation causal edges; a code-side temporal recovery loss is constructed based on the recovered key event sequence and the original key event sequence; a code-side resource chain recovery loss is constructed based on the recovered key resource access link and the original key resource access link; the code-side causal edge recovery loss, code-side temporal recovery loss, and code-side resource chain recovery loss are weighted and summed to construct the code-side reconstruction loss; and the model is trained by minimizing the code-side reconstruction loss to obtain the pre-trained code-side encoder.

[0013] As a preferred approach, behavior graph construction includes the following operations: Event Identification and Mapping: For each behavioral event, the type of the behavioral event is identified. Based on a predefined mapping table, the event name of the behavioral event is converted into a standardized event type, and the parameter value of the behavioral event is abstracted into a standardized parameter type to obtain the cleaned behavioral event. The cleaned behavioral events are sorted according to the timestamp, a sequence position index is assigned to each behavioral event, and the event interval between adjacent behavioral events is calculated as an auxiliary feature to obtain a standardized event type sequence including standardized event type, parameter type, and timestamp. Based on the standard event type sequence, the actual operation events used to characterize the actual running behavior of the application are extracted. Behavioral causal graph construction: Based on standardized event type sequences, the dependencies between behavioral events are recovered through process tree construction, resource handle tracking, and time window association. The observed causal dependencies between key operations are extracted. A directed graph is constructed as the behavioral causal graph, with actual operation events as nodes and the observed causal dependencies between actual operation events as directed edges. Runtime observation behavior graph construction: Taking standardized event type sequences and behavior causal graphs as input, the standardized event type sequences are encoded by a pre-trained behavior side encoder, and the actual behaviors generated by the application in the real running environment are predicted. The output behavior global representation vector is output, and the actual events, dependencies and resource trajectories are output as the runtime observation behavior graph.

[0014] Preferably, the behavior-side encoder includes an embedding layer, a temporal coding layer, a graph coding layer, a pooling layer, and a multi-head observation layer; The embedding layer is used to map each event type in the normalized event type sequence to a continuous event embedding vector, outputting a sequence of event embedding vectors; The temporal coding layer is used to capture the temporal dependencies and sequence information in the sequence of behavioral events based on the event embedding vector sequence, through Transformer or temporal convolutional network, and output the temporal-aware hidden state sequence. The graph coding layer is used to encode the behavioral causal graph based on the hidden state sequence and the dependency edges in the behavioral causal graph through a graph convolutional network or a graph attention network, construct a heterogeneous graph, and output a node representation sequence that integrates graph structure information. In the heterogeneous graph, nodes represent events and edges represent the dependencies between events. The pooling layer takes the sequence of node representations as input, calculates the importance weight of each node based on the additive attention mechanism, and performs a weighted sum of all node representations, outputting a global representation vector. The multi-head observation layer is used to output the set of actual operation events, observation causal edges representing the causal dependencies between actual events, event sequence representing the order of occurrence of actual events, and resource access trajectory representing the resource paths actually accessed by the program, based on the intermediate states of the temporal coding layer or graph coding layer. The behavior-side encoder is pre-trained by performing the following operations: performing event dependency recovery on a standardized sequence of randomly occluded event types using the behavior-side encoder; constructing a behavior-side causal edge recovery loss based on the recovered event dependency edges and the original event dependency edges; constructing a behavior-side temporal recovery loss based on the recovered sequence of behavior events and the original sequence of behavior events; constructing a behavior-side resource chain recovery loss based on the recovered resource access trajectory and the original resource access trajectory; constructing a behavior-side reconstruction loss by weighted summing of the behavior-side causal edge recovery loss, the behavior-side temporal recovery loss, and the behavior-side resource chain recovery loss; and training the model by minimizing the behavior-side reconstruction loss to obtain the pre-trained behavior-side encoder.

[0015] Preferably, causal communities are constructed and community prototypes are generated based on the biased link representation and cross-domain information of the samples, including the following steps: Deviation link standardization: The deviation link representation of each sample is converted into a unified structured format to obtain the standardized deviation link representation. The standardized deviation link representation includes a set of key causal edges, a set of key time-series pairs, and a set of key resource chains. Causal similarity calculation: Based on the standardized deviation link representation, the edge similarity, temporal similarity and resource chain similarity between sample pairs are calculated, and the causal similarity is obtained by weighted summation of the edge similarity, temporal similarity and resource chain similarity. Candidate pattern construction: Traverse the abnormal samples, and use the abnormal samples that have not yet been assigned to the existing causal community as seed samples to create new causal communities. Expand the new abnormal samples to join the new causal community based on causal similarity, true class label and cross-domain stability conditions. The conditions for the new abnormal samples to join the new causal community include: the causal similarity between the new abnormal sample and the seed sample meets the causal similarity threshold, the new abnormal sample and the seed sample have the same true class label, and the new abnormal sample maintains the same key causal edge pattern with the seed sample in at least a predetermined number of different domains. Pattern label assignment: Assign a community label to the causal community to which each sample belongs, where normal samples are assigned a default community label; Pattern filtering: Filters out causal communities that do not meet the sample size condition or cross-domain stability condition, and outputs the final set of causal communities; Community Prototype Generation: For each causal community, a structured set of deviation patterns is generated as a prototype, and the center of the prototype is defined. The prototype serves as a standard template for causal deviation, including stable key causal edge patterns, stable time-series patterns, and stable key resource chain patterns. The stable key causal edge pattern is calculated as follows: the mean of the deviation link representation vectors within the causal community is calculated as the deviation center output, the frequency of occurrence of causal edges within the causal community is counted, and edges with frequencies exceeding the threshold are filtered out to obtain the stable key causal edge pattern. The stable key time series pattern is calculated as follows: the frequency of occurrence of time series pairs within the causal community is counted, time series pairs with frequencies exceeding a threshold are filtered out, and stable key time series patterns are output. The calculation method for the stable critical resource chain pattern is as follows: calculate the longest common subsequence of resource chain operation sequences within the causal community, filter resource chains with coverage exceeding the threshold, and output the stable critical resource chain pattern. The community prototype centers include cross-domain centers and overall centers. Cross-domain centers represent the deviation centers of the same causal community in a specific domain, while overall centers represent the overall deviation centers of the same causal community across all domains.

[0016] Preferably, the domain loss is constructed based on the sample's biased link representation, community labels, and cross-domain information, including the following operations: For each sample, a deviation link representation of the sample is constructed based on the consistency deviation between the code semantic causal graph and the runtime observation behavior graph. Deviation link representation for: , in, Indicates sample The key causal edge bias, Indicates sample Key timing deviations Indicates sample Key resource chain deviations; For the prototype of a causal community, the deviation center of the prototype in different domains is calculated. In the domain The deviation center below Represented as: , For the prototype of a causal community, the global center of the prototype is calculated across all domains. Overall center under all domains Represented as: , Domain loss is defined as the distance between the centers of different domain subcenters and the overall prototype center. The calculation formula is: , Based on the prototype of causal communities and the biased link representation of samples, an anomalous link pattern consistency loss is constructed, including the following operations: The structural distance is calculated as the distance between the deviation link representation of the sample and the prototype of each causal community. The Jaccard distance between the sample's key causal edge set and the stable edge pattern of the community is calculated. The Jaccard distance between the sample's time series pair set and the stable time series pattern of the community is also calculated. The edit distance or longest common subsequence distance between the sample's resource chain and the stable resource chain pattern of the community is calculated. The three distances are then weighted and summed according to preset weights to obtain the structural distance. Sample bias link to community prototype structural distance Represented as: , in, Representing the prototype Stable key causal edge pattern Representing the prototype Stable critical timing patterns, Representing the prototype Stable critical resource chain model , and The differences between the sample and the community prototype were calculated from three aspects: key edge, event sequence, and resource chain. Based on the community label of the sample and the distance from the sample bias link to its causal community prototype, the attraction loss of the sample to move closer to its community prototype is calculated. The causal community to which it belongs is The corresponding prototype is Attracting losses Represented as: , Based on the distance from the sample bias link to its own causal community prototype and the distance from the sample bias link to other causal community prototypes, the repulsion loss of a sample being farthest from other community prototypes is calculated. , reject loss Represented as: , in, Indicates the number of samples in the batch. Indicates the prototype interval; Based on the deviation link representation of normal samples and the prototype of normal causal communities, the normal constraint loss of community prototypes that are close to the normal causal community prototype and far away from the abnormal causal community is calculated. ; The attraction loss, repulsion loss, and normal constraint loss are weighted and combined into an abnormal link mode consistency loss.

[0017] As a preferred approach, when calculating consistency deviation based on the code semantic cause-effect graph and the runtime observation behavior graph, the following operations are performed: Map the key operation nodes, predictive causal edges, key event sequence constraints, and key resource access links in the code semantic causal template to a unified execution semantic object; Map the actual operational events, observation causal edges, event sequence relationships, and resource access trajectories in the runtime observation behavior graph into a unified execution semantic object; For the same application instance, establish a correspondence between code-side template objects and runtime-side observation objects on a unified set of execution semantic objects, and retain key objects that cannot be matched, have inconsistent order, or have inconsistent resource trajectories; Calculate the critical causal edge deviation, critical timing deviation, and critical resource chain deviation separately. The deviation calculation is jointly determined by the consistency of critical operation edges, the consistency of critical event timing, and the consistency of critical resource chains. Correspondingly, consistency deviation losses include critical edge consistency loss, temporal consistency loss, and resource chain consistency loss. The critical edge consistency loss is expressed as: , in, Represents the set of critical operation edges. Represents the semantic causal template of the code for key operation edges The predicted intensity Represents the critical operation edges in the runtime observation behavior graph. The intensity of observation, Indicates the critical operation edge Edge weights; The time consistency loss is expressed as: , in, Represents a set of key event pairs. Indicates events in the semantic causal template of the code. Prior to the event The predicted probability of v represents the event in the running observation behavior graph. Prior to the event The probability of observation; Resource chain consistency loss is represented as: , in, Represents a set of key resources. This represents the resource access trajectory predicted by the semantic causal template of the code. This represents the resource access trajectory in the runtime observation behavior graph. Indicates resource weight; The semantic causal consistency bias loss is expressed as: , in, , , These are non-negative weighting coefficients.

[0018] As a preferred approach, before anomaly identification is performed by a trained classifier with the deviation link representation vector as input, key causal edges, key temporal relationships, key resource chains, and cross-domain information are preprocessed. Through preprocessing, redundancy removal, object standardization, and causal stable component screening are performed to obtain a set of stable deviation objects for generating the deviation link representation vector. In the redundancy removal process, highly correlated redundant objects are removed through correlation analysis, but objects that are directly related to key operation edges, key event sequences, or key resource chains are retained. During objectification and standardization, logs and code objects from different platforms are mapped to a unified operation type, a unified resource type, and a unified subject type, and the Min-Max normalization or Z-Score standardization method is used to standardize the deviation intensity. When screening causal stable components, stable deviation objects related to key operation edges, key event sequences, and key resource chains are calculated. Then, stable components used for generating deviation link representation vectors are selected based on cross-domain stability and category discrimination, as follows: , in, This represents the set of input deviation objects. This represents the choice matrix of causal stable components.

[0019] The application malicious identification method based on semantic causal consistency constraints of the present invention has the following advantages: 1. By comparing the causal structure of code intent with actual behavior rather than statistical features, it can effectively identify advanced malicious behaviors such as obfuscation and delayed triggering, and is not easily bypassed by simple code transformations or behavioral noise. 2. By introducing domain information for correction and designing cross-domain stable loss, the model learns the core causal bias that is independent of the operating system and device type. Therefore, it can still maintain a high recognition rate on new platforms where the training data is not covered, thus solving the problem of the sharp drop in cross-platform performance of traditional methods. 3. The output of inference and prediction is not only a probability of malice, but also includes an anomaly explanation chain (e.g., "It was expected that the file should be 'opened' and then the content should be 'read', but an unauthorized 'read' operation was actually observed"), which can help security analysts understand the attack intent, respond quickly, and collect evidence; 4. During online inference, only a lightweight behavioral subgraph needs to be constructed, resulting in low computational cost. At the same time, by filtering causal stable components, redundant feature calculations are reduced, making it suitable for the high real-time requirements of industrial Internet hosts. 5. It can not only detect, but also output specific handling results (interception, isolation). Since the judgment basis is the deviation of the behavior intention, even in the face of unknown zero-day vulnerability attacks, as long as the behavior deviates from the code template, it can be effectively identified and blocked. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] The invention will be further described below with reference to the accompanying drawings.

[0022] Figure 1 This is a flowchart illustrating an application malicious identification method based on semantic causal consistency constraints. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0024] This invention provides a method for malicious application identification based on semantic causal consistency constraints, which addresses the technical problems of low accuracy, poor real-time performance, weak cross-platform adaptability, and difficulty in identifying malicious behavior in the process of detecting anomalies in industrial Internet host applications.

[0025] Example:

[0026] This invention provides a method for identifying malicious applications based on semantic causal consistency constraints, comprising five steps: data acquisition, semantic template construction, behavior graph construction, model training, and inference prediction.

[0027] Step S100 Data Acquisition: Collect paired code modality data and behavioral modality data of the application as samples, and record the environmental metadata to which the samples belong as cross-domain information. Pair the code modality data, behavioral modality data and cross-domain information corresponding to the application into sample triples, and label the samples with real category labels.

[0028] The collected sample data covers both normal and abnormal applications, and spans multiple operating system domains, industrial equipment domains, and user domains.

[0029] As a specific implementation of data collection, it includes the following operations: (1) Code modal data acquisition: The binary files or script files of the target application are collected by file scanning or application upload. The binary files or script files are parsed by static analysis tools to identify the file structure, instruction sequence and basic program elements, and the intermediate representation is obtained as code modal data. The intermediate representation includes API call sequence, sensitive strings, permission request list, control flow graph and data dependency graph. The API call sequence includes import table and dynamic call. Sensitive strings include IP address, URL, key and command. Control flow graph includes function call relationship and basic block jump. Data dependency relationship includes variable-usage chain. Permission request includes Android permission and Windows UAC. (2) Behavioral modality data collection: Deploy the target application in a sandbox or real environment and collect the application's original behavior logs through multi-platform process or kernel tracing tools. Analyze the original behavior logs, extract behavioral events and add metadata. Associate the behavioral events with the same execution context to obtain behavioral modality data including event type, timestamp, process ID and parameters. Among them, behavioral events include process events, file events, network events, system call events, memory events and hardware I / O events. The metadata includes timestamp, process ID and parameters. (3) Cross-domain information collection: Obtain cross-domain information of the target application. Cross-domain information is used to record the environment context in which the application runs. (4) Data processing: unify code modal data, behavioral modal data and cross-domain information into a standardized format, including mapping similar operations on different operating systems into unified semantic objects, unifying API names into standardized naming, aligning and sorting timestamps, and removing redundant and irrelevant events; (5) Sample pairing: Associating and pairing code modality data, behavioral modality data and cross-domain information of the same application to form a sample triple; (6) Labeling: Each sample is labeled with a real category label. The category labels include normal and abnormal binary labels and abnormal category labels. Among them, the abnormal category labels include data theft, ransomware encryption, backdoor communication and mining.

[0030] Step S200 Semantic Template Construction: Based on code modal data, encoding and predicting expected execution behavior are performed through a pre-trained code-side encoder, outputting a global code representation vector and a code semantic causal template. The code semantic causal template includes key operation nodes, key causal edges, key event sequences, and key resource access links.

[0031] As a specific implementation of semantic template construction, this step includes the following operations: (1) Semantic mapping and abstraction: Perform instruction semantic recognition on code modal data, identify the semantic category of instructions, map API functions of different operating systems into standardized semantic units, identify and mark sensitive operation semantic units, abstract the specific parameter values ​​of sensitive operation semantic units into parameter types, and output semantic units including semantic type, parameter type and location information; (2) Semantic unit sequence generation: Based on the control flow graph and data dependency graph in the code modality data, the semantic units are sorted according to the program execution logic to generate a semantic unit sequence; (3) Code causal graph construction: Based on the semantic unit sequence, control flow graph and data dependency graph, control flow, data flow and function call analysis are performed. Based on the analysis results, causal relationship edges between key operations are extracted. With semantic units as nodes and causal relationship edges as directed edges, a directed graph is constructed as the code causal graph. The directed edges have type and weight. The types of directed edges include control dependency edges, data dependency edges, call dependency edges and execution order edges. (4) Construction of code semantic causal template: Taking the semantic unit sequence and code causal graph as input, the semantic unit sequence is encoded by a pre-trained code-side encoder, and the expected execution behavior of the application at the code level is predicted. The code global representation vector is output, and the key causal structure related to security is output as the code semantic causal template. The code semantic causal graph template is represented in the form of code semantic causal graph, or includes a code semantic causal graph composed of key operation nodes and key causal edges.

[0032] In this embodiment, the code-side encoder includes an embedding layer, a sequence encoding layer, a graph encoding layer, a pooling layer, and a multi-head prediction layer. The embedding layer maps each semantic unit in the semantic unit sequence to a trainable embedding vector, outputting an embedding vector sequence. The sequence encoding layer encodes the embedding vector sequence using a Transformer or bidirectional LSTM to capture long-distance dependencies and contextual information between semantic units, outputting a context-aware hidden state sequence. The graph encoding layer constructs a relationship graph between semantic units based on the hidden state sequence and edge relationships extracted through static analysis, using a graph neural network, outputting a graph-aware node representation sequence. The pooling layer extracts semantic features based on the node representation sequence, outputting a global code representation vector. The multi-head prediction layer predicts causal relationships between key operations based on the intermediate states of the sequence encoding layer or graph encoding layer, outputting key operation nodes and key causal edges, predicting the sequence constraints between key operations, outputting a set of key event time sequences, predicting the resource paths expected to be accessed by the program, and outputting key resource access links.

[0033] The code-side encoder is pre-trained by performing the following operations: causal edge recovery is performed on the randomly occluded semantic unit sequence using the code encoder; a code-side causal edge recovery loss is constructed based on the recovered key operation causal edges and the original key operation causal edges; a code-side temporal recovery loss is constructed based on the recovered key event sequence and the original key event sequence; a code-side resource chain recovery loss is constructed based on the recovered key resource access link and the original key resource access link; the code-side causal edge recovery loss, code-side temporal recovery loss, and code-side resource chain recovery loss are weighted and summed to construct the code-side reconstruction loss; and the model is trained by minimizing the code-side reconstruction loss to obtain the pre-trained code-side encoder.

[0034] Step S300: Behavior Graph Construction: Based on behavioral modality data, the pre-trained behavior-side encoder is used to encode and predict actual execution behaviors, outputting a global representation vector of behavior and a running observation behavior graph. The running observation behavior graph includes the set of actual operation events, observation causal edges, event sequence, and resource access trajectory.

[0035] As a specific implementation of behavior graph construction, this step includes the following operations: (1) Event identification and mapping: For each behavioral event, identify the type of the behavioral event, convert the event name of the behavioral event into a standardized event type based on a predefined mapping table, abstract the parameter value of the behavioral event into a standardized parameter type, obtain the cleaned behavioral event, sort the cleaned behavioral events according to the timestamp, assign a sequence position index to each behavioral event, and calculate the event interval between adjacent behavioral events as an auxiliary feature to obtain a standardized event type sequence including standardized event type, parameter type and timestamp. Based on the standard event type sequence, extract the actual operation events used to characterize the actual running behavior of the application. (2) Construction of behavioral causal graph: Based on the standardized event type sequence, the dependencies between behavioral events are recovered through process tree construction, resource handle tracking and time window association, the observed causal dependencies between key operations are extracted, and a directed graph is constructed as the behavioral causal graph with actual operation events as nodes and the observed causal dependencies between actual operation events as directed edges. (3) Construction of runtime observation behavior graph: Taking the standardized event type sequence and behavior causal graph as input, the standardized event type sequence is encoded by the pre-trained behavior side encoder, and the actual behavior generated by the application in the real runtime environment is predicted. The global representation vector of behavior is output, and the actual events, dependencies and resource trajectories are output as runtime observation behavior graph.

[0036] In this embodiment, the behavior-side encoder includes an embedding layer, a temporal coding layer, a graph coding layer, a pooling layer, and a multi-head observation layer. The embedding layer maps each event type in the normalized event type sequence to a continuous event embedding vector, outputting an event embedding vector sequence. The temporal coding layer, based on the event embedding vector sequence, captures temporal dependencies and order information in the behavior event sequence using a Transformer or temporal convolutional network, outputting a temporally aware hidden state sequence. The graph coding layer, based on the hidden state sequence and dependency edges in the behavior causal graph, encodes the behavior causal graph using a graph convolutional network or a graph attention network, constructing... A heterogeneous graph is constructed, and the output is a sequence of node representations that integrates graph structure information. In the heterogeneous graph, nodes represent events and edges represent dependencies between events. The pooling layer takes the node representation sequence as input and is used to calculate the importance weight of each node based on the additive attention mechanism. It then performs a weighted summation of all node representations and outputs a global representation vector of the behavior. The multi-head observation layer is used to output the set of actual operation events, the observation causal edges representing the causal dependencies between actual events, the event sequence representing the order of occurrence of actual events, and the resource access trajectory representing the resource paths actually accessed by the program, based on the intermediate states of the temporal coding layer or the graph coding layer.

[0037] The behavior-side encoder is pre-trained by performing the following operations: performing event dependency recovery on a standardized sequence of randomly occluded event types using the behavior-side encoder; constructing a behavior-side causal edge recovery loss based on the recovered event dependency edges and the original event dependency edges; constructing a behavior-side temporal recovery loss based on the recovered sequence of behavior events and the original sequence of behavior events; constructing a behavior-side resource chain recovery loss based on the recovered resource access trajectory and the original resource access trajectory; constructing a behavior-side reconstruction loss by weighted summing of the behavior-side causal edge recovery loss, the behavior-side temporal recovery loss, and the behavior-side resource chain recovery loss; and training the model by minimizing the behavior-side reconstruction loss to obtain the pre-trained behavior-side encoder.

[0038] In this embodiment, the code-side encoder and the behavior-side encoder can be used as implementation methods for code semantic causal templates and runtime observation behavior graphs. Their pre-training goal is not to simply recover the occluded object, but to recover the key causal relationships related to security. The encoder output still needs to be transformed into key causal edges, key event sequences and key resource chains, and participate in the consistency deviation calculation.

[0039] Step S400 Model Training: Calculate the consistency deviation between the code semantic causal graph and the running observation behavior graph. Construct the semantic causal consistency deviation loss and deviation link representation based on the consistency deviation. Construct causal communities based on the deviation link representation of samples and cross-domain information. Generate a structured set of deviation patterns as a prototype for the causal community and assign community labels to the samples. Construct the abnormal link pattern consistency loss based on the prototype of the causal community and the deviation link representation of the samples. Construct the domain loss based on the deviation link representation of samples, community labels, and cross-domain information. Fuse the code global representation vector, behavior global representation vector, cross-domain information representation vector, and deviation link representation vector into a multimodal fusion representation. Based on the multimodal fusion representation, the predicted category label and probability value output by the classifier are used as the prediction result. Construct the classification loss based on the true category label of the samples and the prediction result. Construct the total loss by weighted summing of the semantic causal consistency deviation loss, abnormal link pattern consistency loss, domain loss, and classification loss. Train the code-side encoder, behavior-side encoder, and classifier based on minimizing the total loss.

[0040] In a specific implementation, when calculating consistency deviation based on the code semantic cause-effect graph and the runtime observation behavior graph, the following operations are performed: (1) Map the key operation nodes, predictive causal edges, key event sequence constraints and key resource access links in the code semantic causal template into a unified execution semantic object; (2) Map the actual operation events, observation causal edges, event sequence relationships and resource access trajectories in the operation observation behavior graph into a unified execution semantic object; (3) For the same application instance, establish a correspondence between code-side template objects and runtime-side observation objects on a unified execution semantic object set, and retain key objects that cannot be matched, have inconsistent order, or have inconsistent resource trajectories; (4) Calculate the critical causal edge deviation, critical timing deviation and critical resource chain deviation respectively. The deviation calculation is jointly determined by the consistency of critical operation edge, the consistency of critical event timing and the consistency of critical resource chain.

[0041] Correspondingly, consistency deviation losses include critical edge consistency loss, temporal consistency loss, and resource chain consistency loss.

[0042] The critical edge consistency loss is expressed as: , in, Represents the set of critical operation edges. Represents the semantic causal template of the code for key operation edges The predicted intensity Represents the critical operation edges in the runtime observation behavior graph. The intensity of observation, Indicates the critical operation edge Edge weights; The time consistency loss is expressed as: , in, Represents a set of key event pairs. Indicates events in the semantic causal template of the code. Prior to the event The predicted probability of v represents the event in the running observation behavior graph. Prior to the event The probability of observation; Resource chain consistency loss is represented as: , in, Represents a set of key resources. This represents the resource access trajectory predicted by the semantic causal template of the code. This represents the resource access trajectory in the runtime observation behavior graph. Indicates resource weight; The semantic causal consistency bias loss is expressed as: , in, , , These are non-negative weighting coefficients.

[0043] As a specific implementation of this embodiment, constructing a causal community and generating a community prototype based on the sample's biased link representation and cross-domain information includes the following steps: (1) Deviation Link Standardization: The deviation link representation of each sample is converted into a unified structured format to obtain the standardized deviation link representation. The standardized deviation link representation includes the set of key causal edges, the set of key time-series pairs, and the set of key resource chains. (2) Causal similarity calculation: Based on the standardized deviation link representation, the edge similarity, temporal similarity and resource chain similarity between sample pairs are calculated, and the causal similarity is obtained by weighted summation of the edge similarity, temporal similarity and resource chain similarity; (3) Candidate pattern construction: Traverse the abnormal samples, and use the abnormal samples that have not yet been assigned to the existing causal community as seed samples to create a new causal community. Based on causal similarity, true category label and cross-domain stability conditions, the new abnormal samples are extended to join the new causal community. The conditions for the new abnormal samples to join the new causal community include: the causal similarity between the new abnormal sample and the seed sample meets the causal similarity threshold, the new abnormal sample and the seed sample have the same true category label, and the new abnormal sample maintains the same key causal edge pattern with the seed sample in at least a predetermined number of different domains. (4) Pattern label assignment: Assign a community label to the causal community to which each sample belongs, where normal samples are assigned a default community label; (5) Pattern filtering: Filter out causal communities that do not meet the sample quantity condition or cross-domain stability condition, and output the final set of causal communities; (6) Community prototype generation: For each causal community, a structured set of deviation patterns is generated as a prototype, and the center of the prototype is defined.

[0044] The prototype serves as a standard template for causal deviations, including stable key causal edge patterns, stable temporal patterns, and stable key resource chain patterns. The stable key causal edge pattern is calculated as follows: the mean of the deviation link representation vectors within the causal community is calculated as the deviation center output; the frequency of causal edges within the causal community is statistically analyzed; edges with frequencies exceeding a threshold are filtered to obtain the stable key causal edge pattern. The stable key temporal pattern is calculated as follows: the frequency of time series pairs within the causal community is statistically analyzed; time series pairs with frequencies exceeding a threshold are filtered to output the stable key temporal pattern. The stable key resource chain pattern is calculated as follows: the longest common subsequence of resource chain operation sequences within the causal community is calculated; resource chains with coverage exceeding a threshold are filtered to output the stable key resource chain pattern. The center of the community prototype includes cross-domain centers and overall centers. Cross-domain centers represent the deviation centers of the same causal community in a specific domain, while overall centers represent the overall deviation centers of the same causal community across all domains.

[0045] In a specific implementation, a domain loss is constructed based on the sample's biased link representation, community labels, and cross-domain information, including the following operations: (1) For each sample, based on the consistency deviation between the code semantic causal graph and the runtime observation behavior graph, construct the deviation link representation of the sample. Deviation link representation for: , in, Indicates sample The key causal edge bias, Indicates sample Key timing deviations Indicates sample Key resource chain deviations; (2) For the prototype of the causal community, calculate the deviation center of the prototype in different domains. In the domain The deviation center below Represented as: , (3) For the prototype of a causal community, calculate the global center of the prototype across all domains. Overall center under all domains Represented as: , (4) Domain loss is defined as the distance between different domain subcenters and the overall prototype center. The calculation formula is: .

[0046] In this embodiment, domain loss is used to constrain the key causal relationships and deviation calculation results of the same application or the same abnormal behavior pattern to remain stable in different operating systems, different devices or different user domains, thereby reducing the model's dependence on local statistical features of the source domain; domain information is used to correct for differences in normal environments and is not used as an independent basis for malicious judgment.

[0047] In a specific implementation, an abnormal link pattern consistency loss is constructed based on the prototype of the causal community and the biased link representation of the samples, including the following operations: (1) Calculate the distance between the sample's deviation link representation and the prototype of each causal community, as the structural distance from the sample's deviation link to the community prototype. Calculate the Jaccard distance between the sample's key causal edge set and the community's stable edge pattern. Calculate the Jaccard distance between the sample's time series pair set and the community's stable time series pattern. Calculate the edit distance or longest common subsequence distance between the sample's resource chain and the community's stable resource chain pattern. Calculate the structural distance by weighting the distances in the three dimensions according to preset weights. Sample bias link to community prototype structural distance Represented as: , in, Representing the prototype Stable key causal edge pattern Representing the prototype Stable critical timing patterns, Representing the prototype Stable critical resource chain model , and The differences between the sample and the community prototype were calculated from three aspects: key edge, event sequence, and resource chain. (2) Based on the community label of the sample and the distance from the sample bias link to the prototype of the causal community, calculate the attraction loss of the sample to move closer to the prototype of the community. The causal community to which it belongs is The corresponding prototype is Attracting losses Represented as: , (3) Based on the distance from the sample bias link to its own causal community prototype and the distance from the sample bias link to other causal community prototypes, calculate the repulsion loss of the sample being far from other community prototypes. , reject loss Represented as: , in, Indicates the number of samples in the batch. Indicates the prototype interval; (4) Calculate the normal constraint loss of the community prototype that is close to the normal causal community prototype and far away from the abnormal causal community based on the deviation link representation of normal samples and the prototype of normal causal community. ; (5) The attraction loss, repulsion loss and normal constraint loss are weighted and combined into the abnormal link mode consistency loss.

[0048] Step S500 Inference and Prediction: Collect code modal data and behavioral modal data of the application to be identified. Construct a code semantic causal graph through a trained code-side encoder and a runtime observation behavior graph through a trained behavior-side encoder. Calculate the consistency deviation between the code semantic causal graph and the runtime observation behavior graph to obtain the deviation link representation. Use the deviation link representation vector as input and perform anomaly identification through a trained classifier. Output the predicted category label and probability value as the prediction result. Execute the action based on the prediction result. Extract a structured deviation description from the consistency deviation calculation process, including key causal edge deviation details, key temporal deviation details, and key resource chain deviation details.

[0049] As a specific implementation of inference and prediction, before anomaly identification is performed by a trained classifier with the deviation link representation vector as input, key causal edges, key temporal relationships, key resource chains, and cross-domain information are preprocessed. Through preprocessing, redundancy removal, object standardization, and causal stable component screening are performed to obtain a set of stable deviation objects for generating the deviation link representation vector.

[0050] In the redundancy removal process, highly correlated redundant objects are removed through correlation analysis, but objects directly related to key operation edges, key event sequences, or key resource chains are retained.

[0051] During objectification and standardization, logs and code objects from different platforms are mapped to a unified operation type, a unified resource type, and a unified subject type, and the bias intensity is standardized using Min-Max normalization or Z-Score standardization methods.

[0052] When screening causal stable components, stable deviation objects related to key operation edges, key event sequences, and key resource chains are calculated. Then, stable components used for generating deviation link representation vectors are selected based on cross-domain stability and category discrimination, as follows: , in, This represents the set of input deviation objects. This represents the choice matrix of causal stable components.

[0053] In specific calculations, to avoid numerical overflow caused by exponential operations or probability normalization, the similarity matrix or probability matrix constructed during causal similarity calculation can be shifted. This process does not change the relative probability after normalization, but it can improve the stability of the calculation.

[0054] During the inference phase, a code semantic causal template is first generated based on the code modality data of the application to be identified. Simultaneously, lightweight behavioral events are collected within the runtime window to construct a runtime observation behavior graph. Then, based on the consistency deviation between the code semantic causal template and the runtime observation behavior graph, the predicted category, probability value, and anomaly explanation link are output. This inference process is consistent with the consistency deviation discrimination mechanism calibrated during the training phase.

[0055] During the online detection phase, when a new application starts or runs on the industrial internet host, the monitoring tool is triggered in real time to collect its code modal data and lightweight behavioral events, calculating semantic causal consistency deviation and malicious probability. A final judgment is made based on the probability value and a preset threshold: if determined to be malicious, the anomaly category and anomaly explanation chain are output, and protective measures such as process interception, isolation, or alarms are implemented; if determined to be normal, it is allowed to continue running. This process supports periodic incremental updates to the model to adapt to constantly evolving new attack patterns.

[0056] Based on the method disclosed in this embodiment, specific implementation examples are given.

[0057] Implementation environment: Construct an industrial internet experimental environment with multiple hosts covering various operating systems such as Linux, Windows, and macOS, and covering different industrial equipment and different user domains. Deploy cross-platform tracking tools, data processing servers, model training servers, and online inference nodes.

[0058] The implementation steps include the following operations: (1) Abnormal behavior and code data collection: Start cross-platform monitoring tools and collect a large number of normal and abnormal samples within a week, and record the static structure, key parameter flow, runtime behavior event flow and domain information of the code side; (2) Semantic template construction and behavior graph construction: construct code semantic causal templates for code modal data, construct runtime observation behavior graphs for behavior modal data, and extract key operation edges, key event sequences and key resource chains; (3) Construction of abnormal link patterns and division of dataset: Based on the causal similarity of deviation links, construct behavioral causal communities or abnormal link patterns, divide the training set and test set according to 8:2, and ensure that different operating system domains and device domains participate in training and testing; (4) Anomaly detection model training: The weights of key objects, the weights of bias terms, the decision threshold and the model parameters are calibrated by classification loss, semantic causal consistency loss, anomaly link pattern consistency loss and cross-domain stability loss until the model converges. The final template generation model and the final anomaly discriminator are saved. (5) Application anomaly detection: Real-time collection of code modal data and lightweight behavioral events, execution of code semantic causal template construction, runtime observation behavior graph construction, consistency deviation calculation, model inference, and marking and interception processing.

[0059] Implementation Effectiveness Evaluation: The method was validated using a test set and compared with traditional rule-based and signature-based detection methods, detection methods using only code features, and detection methods using only behavioral statistical features. Experimental results show that this method maintains high recognition stability across operating systems and devices, and can trace anomaly detection results back to key operation edges, key event sequences, and key resource chains, effectively improving the security protection level of industrial internet hosts.

[0060] The present invention provides a detailed description of an application malicious identification method based on semantic causal consistency constraints. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for identifying malicious applications based on semantic causal consistency constraints, characterized in that, Includes the following steps: Data Acquisition: Collect paired code modality data and behavioral modality data of the application as samples, and record the environmental metadata to which the samples belong as cross-domain information. Pair the code modality data, behavioral modality data and cross-domain information corresponding to the application into sample triples, and label the samples with real category labels. Semantic template construction: Based on code modal data, a pre-trained code-side encoder is used to encode and predict expected execution behavior, outputting a global code representation vector and a code semantic causal template. The code semantic causal template includes key operation nodes, key causal edges, key event sequences, and key resource access links. Behavior graph construction: Based on behavioral modality data, a pre-trained behavior-side encoder is used to encode and predict actual execution behaviors, outputting a global representation vector of behavior and a running observation behavior graph. The running observation behavior graph includes the set of actual operation events, observation causal edges, event sequence, and resource access trajectory. Model Training: Calculate the consistency deviation between the code semantic causal graph and the runtime observation behavior graph. Construct semantic causal consistency deviation loss and deviation link representation based on the consistency deviation. Construct causal communities based on the deviation link representation of samples and cross-domain information. Generate a structured set of deviation patterns as a prototype for the causal community and assign community labels to samples. Construct abnormal link pattern consistency loss based on the prototype of the causal community and the deviation link representation of samples. Construct domain loss based on the deviation link representation of samples, community labels, and cross-domain information. Fuse the code global representation vector, behavior global representation vector, cross-domain information representation vector, and deviation link representation vector into a multimodal fusion representation. Based on the multimodal fusion representation, the predicted category label and probability value output by the classifier are used as the prediction result. Construct classification loss based on the true category label of the samples and the prediction result. Construct the total loss by weighted summing of semantic causal consistency deviation loss, abnormal link pattern consistency loss, domain loss, and classification loss. Train the code-side encoder, behavior-side encoder, and classifier based on minimizing the total loss. Inference and Prediction: Collect code modality data and behavioral modality data of the application to be identified. Construct a code semantic causal graph through a trained code-side encoder and a runtime observation behavior graph through a trained behavioral-side encoder. Calculate the consistency deviation between the code semantic causal graph and the runtime observation behavior graph to obtain the deviation link representation. Use the deviation link representation vector as input and perform anomaly identification through a trained classifier. Output the predicted category label and probability value as the prediction result. Execute the action based on the prediction result. Extract structured deviation descriptions from the consistency deviation calculation process, including key causal edge deviation details, key temporal deviation details, and key resource chain deviation details.

2. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, Data collection includes the following operations: Code modal data acquisition: Binary files or script files of the target application are collected through file scanning or application upload. Static analysis tools are used to parse the binary files or script files to identify the file structure, instruction sequence, and basic program elements, and obtain intermediate representations as code modal data. The intermediate representations include API call sequences, sensitive strings, permission request lists, control flow graphs, and data dependency graphs. API call sequences include import tables and dynamic calls. Sensitive strings include IP addresses, URLs, keys, and commands. Control flow graphs include function call relationships and basic block jumps. Data dependency relationships include variable-usage chains. Permission requests include Android permissions and Windows UAC. Behavioral modality data acquisition: The target application is deployed and run in a sandbox or real environment. Raw behavioral logs of the application are collected through multi-platform process or kernel tracing tools. The raw behavioral logs are analyzed, behavioral events are extracted and metadata is added. Behavioral events are associated with the same execution context to obtain behavioral modality data including event type, timestamp, process ID and parameters. Among them, behavioral events include process events, file events, network events, system call events, memory events and hardware I / O events, and metadata includes timestamp, process ID and parameters. Cross-domain information collection: Obtain cross-domain information of the target application. Cross-domain information is used to record the environment context in which the application runs. Data processing: unify code modal data, behavioral modal data, and cross-domain information into a standardized format, including mapping similar operations on different operating systems to unified semantic objects, unifying API names to standardized naming, aligning and sorting timestamps, and removing redundant and irrelevant events; Sample pairing: Associating and pairing code modality data, behavioral modality data, and cross-domain information from the same application to form a sample triple; Labeling: Each sample is labeled with a true category label. Category labels include binary labels for normal and abnormal categories, as well as abnormal category labels. Among them, abnormal category labels include data theft, ransomware encryption, backdoor communication, and mining.

3. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, Semantic template construction includes the following operations: Semantic mapping and abstraction: Perform instruction semantic recognition on code modal data, identify the semantic category of instructions, map API functions of different operating systems into standardized semantic units, identify and mark sensitive operation semantic units, abstract the specific parameter values ​​of sensitive operation semantic units into parameter types, and output semantic units including semantic type, parameter type and location information; Semantic unit sequence generation: Based on the control flow graph and data dependency graph in the code modality data, semantic units are sorted according to the program execution logic to generate a semantic unit sequence; Code causal graph construction: Based on semantic unit sequence, control flow graph and data dependency graph, control flow, data flow and function call analysis are performed. Based on the analysis results, causal relationship edges between key operations are extracted. With semantic units as nodes and causal relationship edges as directed edges, a directed graph is constructed as the code causal graph. The directed edges have type and weight. The types of directed edges include control dependency edges, data dependency edges, call dependency edges and execution order edges. Code semantic causal template construction: Taking semantic unit sequence and code causal graph as input, the semantic unit sequence is encoded by a pre-trained code-side encoder, and the expected execution behavior of the application at the code level is predicted. The output is a global code representation vector, and the output is a key causal structure related to security as a code semantic causal template. The code semantic causal graph template is represented in the form of a code semantic causal graph, or includes a code semantic causal graph composed of key operation nodes and key causal edges.

4. The application malicious identification method based on semantic causal consistency constraints according to claim 1 or 3, characterized in that, The code-side encoder includes an embedding layer, a sequence coding layer, a graph coding layer, a pooling layer, and a multi-head prediction layer; The embedding layer is used to map each semantic unit in the sequence of semantic units to a trainable embedding vector, and outputs a sequence of embedding vectors; The sequence encoding layer is used to encode the embedded vector sequence using Transformer or bidirectional LSTM, capture long-distance dependencies and contextual information between semantic units, and output a context-aware hidden state sequence. The graph coding layer is used to construct a relational graph between semantic units based on the hidden state sequence and the edge relationships extracted through static analysis, and outputs a graph-aware node representation sequence. Pooling layers are used to extract semantic features based on node representation sequences and output a global code representation vector; The multi-head prediction layer is used to predict the causal relationships between key operations based on the intermediate states of the sequence coding layer or graph coding layer, output key operation nodes and key causal edges, predict the sequence constraints between key operations, output the time series set of key events, predict the resource paths that the program is expected to access, and output the key resource access links. The code-side encoder is pre-trained by performing the following operations: causal edge recovery is performed on the randomly occluded semantic unit sequence using the code encoder; a code-side causal edge recovery loss is constructed based on the recovered key operation causal edges and the original key operation causal edges; a code-side temporal recovery loss is constructed based on the recovered key event sequence and the original key event sequence; a code-side resource chain recovery loss is constructed based on the recovered key resource access link and the original key resource access link; the code-side causal edge recovery loss, code-side temporal recovery loss, and code-side resource chain recovery loss are weighted and summed to construct the code-side reconstruction loss; and the model is trained by minimizing the code-side reconstruction loss to obtain the pre-trained code-side encoder.

5. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, Behavior graph construction includes the following operations: Event Identification and Mapping: For each behavioral event, the type of the behavioral event is identified. Based on a predefined mapping table, the event name of the behavioral event is converted into a standardized event type, and the parameter value of the behavioral event is abstracted into a standardized parameter type to obtain the cleaned behavioral event. The cleaned behavioral events are sorted according to the timestamp, a sequence position index is assigned to each behavioral event, and the event interval between adjacent behavioral events is calculated as an auxiliary feature to obtain a standardized event type sequence including standardized event type, parameter type, and timestamp. Based on the standard event type sequence, the actual operation events used to characterize the actual running behavior of the application are extracted. Behavioral causal graph construction: Based on standardized event type sequences, the dependencies between behavioral events are recovered through process tree construction, resource handle tracking, and time window association. The observed causal dependencies between key operations are extracted. A directed graph is constructed as the behavioral causal graph, with actual operation events as nodes and the observed causal dependencies between actual operation events as directed edges. Runtime observation behavior graph construction: Taking standardized event type sequences and behavior causal graphs as input, the standardized event type sequences are encoded by a pre-trained behavior side encoder, and the actual behaviors generated by the application in the real running environment are predicted. The output behavior global representation vector is output, and the actual events, dependencies and resource trajectories are output as the runtime observation behavior graph.

6. The application malicious identification method based on semantic causal consistency constraints according to claim 1 or 5, characterized in that, The behavior-side encoder includes an embedding layer, a temporal coding layer, a graph coding layer, a pooling layer, and a multi-head observation layer; The embedding layer is used to map each event type in the normalized event type sequence to a continuous event embedding vector, outputting a sequence of event embedding vectors; The temporal coding layer is used to capture the temporal dependencies and sequence information in the sequence of behavioral events based on the event embedding vector sequence, through Transformer or temporal convolutional network, and output the temporal-aware hidden state sequence. The graph coding layer is used to encode the behavioral causal graph based on the hidden state sequence and the dependency edges in the behavioral causal graph through a graph convolutional network or a graph attention network, construct a heterogeneous graph, and output a node representation sequence that integrates graph structure information. In the heterogeneous graph, nodes represent events and edges represent the dependencies between events. The pooling layer takes the sequence of node representations as input, calculates the importance weight of each node based on the additive attention mechanism, and performs a weighted sum of all node representations, outputting a global representation vector. The multi-head observation layer is used to output the set of actual operation events, observation causal edges representing the causal dependencies between actual events, event sequence representing the order of occurrence of actual events, and resource access trajectory representing the resource paths actually accessed by the program, based on the intermediate states of the temporal coding layer or graph coding layer. The behavior-side encoder is pre-trained by performing the following operations: performing event dependency recovery on a standardized sequence of randomly occluded event types using the behavior-side encoder; constructing a behavior-side causal edge recovery loss based on the recovered event dependency edges and the original event dependency edges; constructing a behavior-side temporal recovery loss based on the recovered sequence of behavior events and the original sequence of behavior events; constructing a behavior-side resource chain recovery loss based on the recovered resource access trajectory and the original resource access trajectory; constructing a behavior-side reconstruction loss by weighted summing of the behavior-side causal edge recovery loss, the behavior-side temporal recovery loss, and the behavior-side resource chain recovery loss; and training the model by minimizing the behavior-side reconstruction loss to obtain the pre-trained behavior-side encoder.

7. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, The process of constructing causal communities and generating community prototypes based on sample bias link representations and cross-domain information includes the following steps: Deviation link standardization: The deviation link representation of each sample is converted into a unified structured format to obtain the standardized deviation link representation. The standardized deviation link representation includes a set of key causal edges, a set of key time-series pairs, and a set of key resource chains. Causal similarity calculation: Based on the standardized deviation link representation, the edge similarity, temporal similarity and resource chain similarity between sample pairs are calculated, and the causal similarity is obtained by weighted summation of the edge similarity, temporal similarity and resource chain similarity. Candidate pattern construction: Traverse the abnormal samples, and use the abnormal samples that have not yet been assigned to the existing causal community as seed samples to create new causal communities. Expand the new abnormal samples to join the new causal community based on causal similarity, true class label and cross-domain stability conditions. The conditions for the new abnormal samples to join the new causal community include: the causal similarity between the new abnormal sample and the seed sample meets the causal similarity threshold, the new abnormal sample and the seed sample have the same true class label, and the new abnormal sample maintains the same key causal edge pattern with the seed sample in at least a predetermined number of different domains. Pattern label assignment: Assign a community label to the causal community to which each sample belongs, where normal samples are assigned a default community label; Pattern filtering: Filters out causal communities that do not meet the sample size condition or cross-domain stability condition, and outputs the final set of causal communities; Community Prototype Generation: For each causal community, a structured set of deviation patterns is generated as a prototype, and the center of the prototype is defined. The prototype serves as a standard template for causal deviation, including stable key causal edge patterns, stable time-series patterns, and stable key resource chain patterns. The stable key causal edge pattern is calculated as follows: the mean of the deviation link representation vectors within the causal community is calculated as the deviation center output, the frequency of occurrence of causal edges within the causal community is counted, and edges with frequencies exceeding the threshold are filtered out to obtain the stable key causal edge pattern. The stable key time series pattern is calculated as follows: the frequency of occurrence of time series pairs within the causal community is counted, time series pairs with frequencies exceeding a threshold are filtered out, and stable key time series patterns are output. The calculation method for the stable critical resource chain pattern is as follows: calculate the longest common subsequence of resource chain operation sequences within the causal community, filter resource chains with coverage exceeding the threshold, and output the stable critical resource chain pattern. The community prototype centers include cross-domain centers and overall centers. Cross-domain centers represent the deviation centers of the same causal community in a specific domain, while overall centers represent the overall deviation centers of the same causal community across all domains.

8. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, The domain loss is constructed based on the sample's biased link representation, community labels, and cross-domain information, including the following operations: For each sample, a deviation link representation of the sample is constructed based on the consistency deviation between the code semantic causal graph and the runtime observation behavior graph. Deviation link representation for: ， in, Indicates sample Key causal edge bias, Indicates sample Key timing deviations Indicates sample Key resource chain deviations; For the prototype of a causal community, the deviation center of the prototype in different domains is calculated. In the domain The deviation center below Represented as: ， For the prototype of a causal community, the global center of the prototype is calculated across all domains. Overall center under all domains Represented as: ， Domain loss is defined as the distance between the centers of different domain subcenters and the overall prototype center. The calculation formula is: ， Based on the prototype of causal communities and the biased link representation of samples, an anomalous link pattern consistency loss is constructed, including the following operations: The structural distance is calculated as the distance between the deviation link representation of the sample and the prototype of each causal community. The Jaccard distance between the sample's key causal edge set and the stable edge pattern of the community is calculated. The Jaccard distance between the sample's time series pair set and the stable time series pattern of the community is also calculated. The edit distance or longest common subsequence distance between the sample's resource chain and the stable resource chain pattern of the community is calculated. The three distances are then weighted and summed according to preset weights to obtain the structural distance. Sample bias link to community prototype structural distance Represented as: ， in, Representing the prototype Stable key causal edge pattern Representing the prototype Stable critical timing patterns, Representing the prototype Stable critical resource chain model , and The differences between the sample and the community prototype were calculated from three aspects: key edge, event sequence, and resource chain. Based on the community label of the sample and the distance from the sample bias link to its causal community prototype, the attraction loss of the sample to move closer to its community prototype is calculated. The causal community to which it belongs is The corresponding prototype is Attracting losses Represented as: ， Based on the distance from the sample bias link to its own causal community prototype and the distance from the sample bias link to other causal community prototypes, the repulsion loss of a sample being farthest from other community prototypes is calculated. , reject loss Represented as: ， in, Indicates the number of samples in the batch. Indicates the prototype interval; Based on the deviation link representation of normal samples and the prototype of normal causal communities, the normal constraint loss of community prototypes that are close to the normal causal community prototype and far away from the abnormal causal community is calculated. ; The attraction loss, repulsion loss, and normal constraint loss are weighted and combined into an abnormal link mode consistency loss.

9. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, When calculating consistency deviation based on code semantic cause-effect graphs and runtime observation behavior graphs, the following operations are performed: Map the key operation nodes, predictive causal edges, key event sequence constraints, and key resource access links in the code semantic causal template to a unified execution semantic object; Map the actual operational events, observation causal edges, event sequence relationships, and resource access trajectories in the runtime observation behavior graph into a unified execution semantic object; For the same application instance, establish a correspondence between code-side template objects and runtime-side observation objects on a unified set of execution semantic objects, and retain key objects that cannot be matched, have inconsistent order, or have inconsistent resource trajectories; Calculate the critical causal edge deviation, critical timing deviation, and critical resource chain deviation separately. The deviation calculation is jointly determined by the consistency of critical operation edges, the consistency of critical event timing, and the consistency of critical resource chains. Correspondingly, consistency deviation losses include critical edge consistency loss, temporal consistency loss, and resource chain consistency loss. The critical edge consistency loss is expressed as: ， in, Represents the set of critical operation edges. Represents the semantic causal template of the code for key operation edges. The predicted intensity Represents the critical operation edges in the runtime observation behavior graph. The intensity of observation, Indicates critical operation edge Edge weights; The time consistency loss is expressed as: ， in, Represents a set of key event pairs. Indicating events in the semantic causal template of the code Prior to the event The predicted probability of v represents the event in the running observation behavior graph. Prior to the event The probability of observation; Resource chain consistency loss is represented as: ， in, Represents a set of key resources. This represents the resource access trajectory predicted by the semantic causal template of the code. This represents the resource access trajectory in the runtime observation behavior graph. Indicates resource weight; The semantic causal consistency bias loss is expressed as: ， in, , , These are non-negative weighting coefficients.

10. The application malicious identification method based on semantic causal consistency constraints according to claim 1, characterized in that, Before anomaly identification is performed by a trained classifier with the deviation link representation vector as input, key causal edges, key temporal relationships, key resource chains and cross-domain information are preprocessed. Through preprocessing, redundancy removal, object standardization and causal stable component screening are performed to obtain a set of stable deviation objects for generating the deviation link representation vector. In the redundancy removal process, highly correlated redundant objects are removed through correlation analysis, but objects that are directly related to key operation edges, key event sequences, or key resource chains are retained. During objectification and standardization, logs and code objects from different platforms are mapped to a unified operation type, a unified resource type, and a unified subject type, and the Min-Max normalization or Z-Score standardization method is used to standardize the deviation intensity. When screening causal stable components, stable deviation objects related to key operation edges, key event sequences, and key resource chains are calculated. Then, stable components used for generating deviation link representation vectors are selected based on cross-domain stability and category discrimination, as follows: ， in, This represents the set of input deviation objects. This represents the choice matrix of causal stable components.

Images