A virus detection method for open source honkong

Abstract

The application provides a virus detection method for open source Hongmeng, belongs to the technical field of computer data processing, and is used for realizing real-time virus detection at the data stream level in a distributed file transmission process and forming a cooperative protection mechanism among multiple devices. The application injects a series interception mechanism into a bottom communication module of a distributed software bus, performs non-blocking bypass interception in an initial stage when data flow through the bottom network interface and has not triggered a callback to the application layer, breaks through the limitation that the traditional scheme must wait for complete downloading or landing of a full amount of files before scanning, does not need hard dependence on external multi-node network consensus feedback, can realize extremely fast risk perception and link blocking in the initial stage of file streaming transmission, and effectively curbs lateral flow and rapid spread of abnormal data flow among distributed device networks.

Description

Technical Field

[0001] This invention relates to the field of computer data processing technology, and in particular to a virus detection method for the open-source HarmonyOS operating system. Background Technology

[0002] HarmonyOS, an open-source distributed operating system designed for the era of the Internet of Things, aims to provide a unified software platform for various types of smart terminal devices. One of its core features is distributed soft bus technology, which enables seamless discovery and efficient connection between devices. This makes cross-device collaborative operations such as file transfer and data sharing increasingly frequent and convenient. In this highly interconnected ecosystem, a security vulnerability in one device can quickly spread to the entire device network, thus placing higher demands on the security protection of cross-device data flows.

[0003] There are two main types of virus detection technologies for file transfer. The first is the traditional terminal local scanning method, which waits for the file to be completely transferred from the sending end to the receiving end and stored before the security software on the receiving end calls the local virus database to perform a full file scan. The second is streaming scanning technology applied to the network boundary, which is usually deployed on the gateway or proxy server. It segments the data stream flowing through the network nodes and performs real-time feature matching in an attempt to detect threats before the data is stored.

[0004] However, the aforementioned existing technologies have significant drawbacks when applied to the open-source HarmonyOS distributed environment. The terminal local scanning method has a significant detection delay, and malicious files can only be detected after they have completed cross-device propagation, making it impossible to intercept them in advance. Furthermore, traditional streaming scanning technologies are mostly designed for specific network architectures and lack deep adaptation to the underlying distributed soft bus communication mechanism of open-source HarmonyOS. When dealing with virus features that are precisely truncated by data block boundaries, the existing block scanning mechanism is prone to missed detections due to incomplete features, posing a security risk. Summary of the Invention

[0005] This invention provides a virus detection method for the open-source HarmonyOS, which enables real-time virus detection at the data stream level during distributed file transfer and forms a collaborative protection mechanism among multiple devices.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: Firstly, a virus detection method for the open-source HarmonyOS is provided. This method is applied to the main control device terminal, and the method includes: Acquire a target file data stream, which is generated by the sending device when transmitting a file via a distributed soft bus; The intercepted initial file data stream is divided into multiple consecutive data blocks of a preset size, and a streaming sliding window mechanism is introduced to splice adjacent data blocks to construct a cross-block detection stream containing redundant boundary data. Sliding feature extraction is performed on the cross-block detection stream to generate a dynamic feature data stream corresponding to the time series of the current data stream; The dynamic feature data stream is input into the locally configured abnormal feature index library for real-time comparison to obtain the streaming detection status of the corresponding data block; If the streaming detection status meets the preset anomaly judgment conditions, a link control signaling is triggered to forcibly cut off the current transmission link of the file data stream through the underlying communication protocol and discard subsequent data blocks in the transmission buffer.

[0007] Optionally, the introduction of a streaming sliding window mechanism to concatenate adjacent data blocks and construct a cross-block detection stream containing redundant boundary data includes: Construct a streaming sliding window buffer, the window width of which is determined by the sum of the preset size of the data block and the byte length of the largest feature code in the local anomaly feature index library, minus one byte unit; When a new target data block is appended to the streaming sliding window buffer, a data segment is extracted from the end of the previous data block and whose length is one byte less than the byte length of the maximum feature code. The extracted data fragments are then concatenated with the current target data block at the physical memory level to obtain a cross-block concatenation feature flow that eliminates feature truncation blind spots.

[0008] Optionally, after generating the dynamic feature data stream, the following steps are also included: Calculate the rate of change between adjacent feature segments in the feature data stream to generate dynamic flow parameters that reflect the data fluctuation characteristics; The dynamic flow parameters are compared with a locally preset library of known abnormal structure patterns to generate a file header and footer data structure consistency anomaly flag. The inconsistency markers of the file header and footer data structures are used as real-time context attributes of the file data stream and introduced into the subsequent link control decision process.

[0009] Optionally, the streaming detection status includes accurate feature hit markers and behavioral trend anomaly markers; after acquiring the streaming detection status, it further includes: The number of currently intercepted streaming data includes a first number of data containing the precise feature hit markers and a second number of data containing the behavioral trend anomaly markers. Obtain a preset scoring model that assigns different risk weights to the first quantity and the second quantity; substitute the first quantity and the second quantity into the preset scoring model for weighted summation calculation to generate a real-time risk score for the current file data stream; If the real-time risk score exceeds the preset score threshold, the blocking decision will be confirmed as the direct blocking state in the anomaly determination condition.

[0010] Optionally, it also includes: If the real-time risk score does not reach the preset score threshold, and the proportion of abnormal behavior trend markers exceeds the preset verification threshold, then the blocking decision will be confirmed as a deep verification state. In the deep verification state, the intercepted file data stream is asynchronously bypassed to a locally built isolated security sandbox for full file deep parsing; Based on the deep analysis results output by the isolated security sandbox, the blocking decision is updated in real time until all file data streams are processed or the direct blocking state is triggered.

[0011] Optionally, before intercepting the initial file data stream in real time, the following steps are also included: Obtain the peer device trust score table maintained at the underlying layer by the distributed soft bus. The trust score table includes the peer device's historical behavior reputation, current device capability status, and network link quality. Extract the trust score of the peer device currently transmitting data with this end, and adaptively adjust the strategy configuration in the streaming comparison stage according to the level of the trust score. The strategy configuration includes the sliding step size of the streaming sliding window buffer, the retrieval depth of feature comparison, or the real-time risk score threshold for triggering blocking.

[0012] Optionally, when preset collaborative triggering conditions are met, the streaming comparison stage further includes a distributed collaborative control step: The cross-block detection stream is divided into multiple continuous streaming feature segments, and a unique identifier is assigned to each streaming feature segment to obtain a set containing multiple identified feature segments; Through the broadcast capability of the distributed soft bus, each identified feature fragment in the set is sent to multiple collaborative detection nodes in the network to trigger the collaborative detection nodes to perform parallel matching detection based on the locally stored abnormal feature index. The system receives collaborative feedback information returned by the multiple collaborative detection nodes. The collaborative feedback information includes the unique identifier of the corresponding identifiable feature fragment and the corresponding local flow detection result.

[0013] Optionally, sending each identifiable feature fragment in the set to multiple collaborative detection nodes in the network includes: Obtain a device trust score table that includes the device's historical behavior reputation, current device capability status, and network link quality; Devices with a trust score exceeding a preset threshold are selected from the candidate devices in the network as the collaborative detection nodes; Each identifiable feature fragment in the set is distributed to the selected cooperative detection nodes through an encrypted channel; Optionally, receiving the collaborative feedback information returned by the plurality of collaborative detection nodes includes: The system receives feedback information with digital signatures generated by the collaborative detection node after completing heuristic trend analysis locally, and uses the digital signatures to verify the integrity of each feedback information to obtain a set of reliable detection results to update the current streaming detection status.

[0014] Secondly, a virus detection device for the open-source HarmonyOS is provided, deployed on the main control device terminal, including: The streaming interception module is used to intercept the initial file data stream in real time at the underlying network interface during the process of establishing an underlying communication link and transmitting file data streams between the sending and receiving devices. The streaming reassembly module is used to divide the intercepted initial file data stream into multiple consecutive data blocks according to a preset size, and introduces a streaming sliding window mechanism to splice adjacent data blocks to construct a cross-block detection stream containing redundant boundary data. The feature extraction module is used to perform sliding feature extraction on the cross-block detection stream to generate a dynamic feature data stream corresponding to the time series of the current data stream; The streaming comparison module is used to input the dynamic feature data stream into a locally configured abnormal feature index library for real-time comparison and obtain the streaming detection status of the corresponding data block. The link control module is used to trigger link control signaling when the streaming detection state meets the preset abnormal judgment conditions, and to forcibly cut off the current transmission link of the file data stream through the underlying communication protocol and discard subsequent data blocks in the transmission buffer.

[0015] Thirdly, an electronic device is provided, comprising: a processor and a memory; the memory is used to store a computer program, which, when executed by the processor, causes the electronic device to perform the virus detection method against open-source HarmonyOS as described in the first aspect.

[0016] In one possible design, the electronic device described in the third aspect may further include a transceiver. This transceiver may be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the electronic device described in the third aspect and other electronic devices.

[0017] In the embodiments of the present invention, the electronic device described in the third aspect may be a terminal, or a chip (system) or other component or assembly disposed in the terminal, or a system containing the terminal.

[0018] Fourthly, a computer-readable storage medium is provided, comprising: a computer program or instructions; when the computer program or instructions are executed on a computer, the computer causes the computer to perform the virus detection method against the open-source HarmonyOS described in the first aspect.

[0019] In summary, the above methods and systems have the following technical effects: 1. This invention injects a serial interception mechanism into the underlying communication module of the distributed soft bus, and performs non-blocking bypass interception in the initial stage when the data stream passes through the underlying network interface and has not yet triggered a callback to the application layer. By using a streaming detection method, it gets rid of the limitation of traditional solutions that must wait for the entire file to be downloaded or committed before scanning. It does not require a hard dependence on external multi-node network consensus feedback, and can achieve extremely fast risk perception and link blocking in the very early stage of file streaming transmission, thereby effectively curbing the lateral flow and rapid spread of abnormal data streams between distributed device networks.

[0020] 2. This invention introduces a streaming sliding window mechanism to splice adjacent data blocks at the physical memory level, dynamically constructing a cross-block connection feature stream containing boundary redundancy information. This mechanism ensures that any cut-off feature at the physical block boundary can be completely and continuously reproduced in the spliced ​​and recombined streaming scan detection area, fundamentally overcoming the risks of missed detections and escapes caused by incomplete features in traditional network streaming scans, and effectively improving the ability to audit and restore data flow of deep camouflage and malicious variant code.

[0021] 3. This invention configures a feature-level real-time scoring mechanism in the streaming scanning pipeline. By dividing the streaming detection state into multi-dimensional labels such as accurate features and abnormal behavior trends and assigning different risk weights, it can realize dynamic pipeline operation of scanning and accumulating scores while the data flows through the memory. Once a high-risk accurate feature is hit or the accumulated real-time score exceeds a preset threshold, an early termination mechanism is immediately triggered, instantly discarding all subsequent untransmitted or cached data blocks. This avoids performing indiscriminate carpet scanning on the data stream, reducing the computing power consumption of single-end devices and unnecessary disk read / write overhead. Attached Figure Description

[0022] Figure 1This is a flowchart illustrating the virus detection method for open-source HarmonyOS provided in an embodiment of the present invention. Figure 2 This is a structural block diagram of a virus detection device for the open-source HarmonyOS provided in an embodiment of the present invention; Figure 3 A flowchart illustrating the virus detection method for open-source HarmonyOS provided in this embodiment of the invention. Figure 4 This is a data flow diagram of a virus detection method for the open-source HarmonyOS provided in an embodiment of the present invention. Detailed Implementation

[0023] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0024] In this embodiment of the invention, "instruction" can include direct and indirect instructions, as well as explicit and implicit instructions. The information indicated by a certain piece of information is called the information to be instructed. In specific implementation, there are many ways to instruct the information to be instructed, such as, but not limited to, directly instructing the information to be instructed, such as the information to be instructed itself or its index. It can also indirectly instruct the information to be instructed by instructing other information, where there is a correlation between the other information and the information to be instructed. It can also instruct only a part of the information to be instructed, while the other parts are known or pre-agreed upon. For example, the instruction of specific information can be achieved by using a pre-agreed (e.g., protocol-defined) arrangement of various pieces of information, thereby reducing instruction overhead to some extent. Simultaneously, common parts of various pieces of information can be identified and uniformly indicated to reduce the instruction overhead caused by individually indicating the same information.

[0025] Furthermore, the specific indication method can also be any existing indication method, such as, but not limited to, the above-mentioned indication methods and their various combinations. Specific details of various indication methods can be found in existing technologies, and will not be elaborated upon here. As described above, for example, when multiple pieces of information of the same type need to be indicated, the indication methods for different pieces of information may differ. In specific implementation, the required indication method can be selected according to specific needs. This embodiment of the invention does not limit the selected indication method; therefore, the indication methods involved in this embodiment of the invention should be understood to cover various methods that enable the party to be indicated to obtain the information to be indicated.

[0026] It should be understood that the information to be indicated can be sent as a whole or divided into multiple sub-information messages sent separately, and the sending period and / or timing of these sub-information messages can be the same or different. The specific sending method is not limited in this embodiment of the invention. The sending period and / or timing of these sub-information messages can be predefined, for example, according to a protocol, or configured by the sending device by sending configuration information to the receiving device.

[0027] "Predefined" or "pre-configured" can be achieved by pre-saving corresponding codes, tables, or other means that can be used to indicate relevant information in the device. This embodiment of the invention does not limit the specific implementation method. "Saving" can refer to saving in one or more memories. These memories can be separate installations or integrated into the encoder, decoder, processor, or electronic device. Alternatively, some memories can be separately installed, while others are integrated into the decoder, processor, or electronic device. The type of memory can be any form of storage medium, and this embodiment of the invention does not limit this.

[0028] In the embodiments of this invention, "protocol" may refer to a protocol family in the field of communication, a standard protocol with a similar protocol family frame structure, or a related protocol applied to a future virus detection method system for open-source HarmonyOS. The embodiments of this invention do not specifically limit this.

[0029] In this embodiment of the invention, descriptions such as "when," "under the circumstances," "if," and "if" all refer to the device making corresponding processing under certain objective circumstances, and are not limited to a specific time. They do not require the device to make a judgment action during implementation, nor do they imply any other limitations.

[0030] In the description of the embodiments of the present invention, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can represent A or B. "And / or" in the embodiments of the present invention is merely a description of the relationship between the related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone, where A and B can be singular or plural. Furthermore, in the description of the embodiments of the present invention, unless otherwise stated, "multiple" refers to two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple. Additionally, to facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish identical or similar items with essentially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or order of execution, and that "first," "second," etc., are not necessarily different. Furthermore, in the embodiments of this invention, words such as "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this invention should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner for ease of understanding.

[0031] The network architecture and business scenarios described in the embodiments of this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0032] The data flow management method provided in this embodiment is mainly applied to intelligent terminal devices (such as main control terminals, edge gateways, or heterogeneous IoT nodes) equipped with the open-source HarmonyOS distributed soft bus ecosystem in specific industrial applications. Its core data flow pipeline runs through the entire lifecycle of real-time interception of underlying network data, memory reorganization, feature dimensionality reduction comparison, and dynamic link control.

[0033] Please see Figures 1-4 This virus detection method for the open-source HarmonyOS can be applied to the aforementioned main control device terminal.

[0034] A virus detection method for the open-source HarmonyOS operating system, the method comprising: Acquire a target file data stream, which is generated by the sending device when transmitting a file via a distributed soft bus; The intercepted initial file data stream is divided into multiple consecutive data blocks of a preset size, and a streaming sliding window mechanism is introduced to splice adjacent data blocks to construct a cross-block detection stream containing redundant boundary data. Sliding feature extraction is performed on the cross-block detection stream to generate a dynamic feature data stream corresponding to the time series of the current data stream; The dynamic feature data stream is input into the locally configured abnormal feature index library for real-time comparison to obtain the streaming detection status of the corresponding data block; If the streaming detection status meets the preset anomaly judgment conditions, then the link control signaling is triggered, and the current transmission link of the file data stream is forcibly cut off through the underlying communication protocol, and subsequent data blocks in the transmission buffer are discarded. When the preset collaborative triggering conditions are met, the streaming comparison stage also includes a distributed collaborative control step: The cross-block detection stream is divided into multiple continuous streaming feature segments, and a unique identifier is assigned to each streaming feature segment to obtain a set containing multiple identified feature segments; Through the broadcast capability of the distributed soft bus, each identified feature fragment in the set is sent to multiple collaborative detection nodes in the network to trigger the collaborative detection nodes to perform parallel matching detection based on the locally stored abnormal feature index. The system receives collaborative feedback information returned by the multiple collaborative detection nodes. The collaborative feedback information includes the unique identifier of the corresponding identifiable feature fragment and the corresponding local flow detection result.

[0035] In this embodiment, the execution entity of the data flow control method based on the distributed soft bus is a control device deployed at the network data flow transmission end.

[0036] First, the execution stream interception phase. When the sending device and the receiving device establish an underlying communication link (for example, by establishing a cross-device session through the underlying trans_service module of the open-source HarmonyOS system) and transmit file data streams, the system intercepts the initial file data stream in real time at the underlying network interface.

[0037] Specifically, in this embodiment, a high-priority monitoring hook function is injected at the boundary between the underlying network socket reading and data decryption / unpacking in the trans_service module and the triggering of the onBytesReceived data reception callback function by the upper-layer business application. When the initial file data stream flows through this communication boundary, the monitoring hook function uses zero-copy technology of physical memory or the efficient copy function memcpy to synchronously or asynchronously intercept the data from the original receive buffer to a pre-allocated independent streaming buffer. This operation does not change the data flow direction of the original communication link, and the time taken for a single copy is controlled in the microsecond range, which is beneficial to maintaining the low latency characteristics of network transmission.

[0038] Secondly, during the stream reassembly phase, the system divides the captured initial file data stream into multiple consecutive data blocks of a preset size, and introduces a streaming sliding window mechanism to splice adjacent data blocks, constructing a cross-block detection stream containing redundant boundary data. The purpose of partitioning is to adapt to the throughput step size of the underlying streaming scanning engine, while the industrial purpose of splicing is to completely eliminate the blind spots caused by virus features or abnormal code being precisely truncated by physical block boundaries.

[0039] Following the feature extraction phase, the recombined cross-block detection stream is input into the feature extraction engine to perform sliding feature extraction (such as streaming sliding hash calculation), thereby reducing the dimensionality of the massive original content stream and transforming it into a dynamic feature data stream corresponding to the time series of the current data stream.

[0040] Then, the streaming comparison stage is performed, in which the dynamic feature data stream is input into the locally configured abnormal feature index library in real time for feature matching, thereby obtaining the streaming detection status of the current corresponding data block in real time.

[0041] Finally, during the link control phase, if the streaming detection status meets the preset anomaly judgment conditions, the underlying link control signaling is immediately triggered. An interrupt command is sent directly to the underlying communication protocol stack via the control channel of the distributed soft bus, forcibly cutting off the current transmission link of the file data stream and immediately discarding or clearing all subsequent data blocks in the transmission buffer and asynchronous queue, achieving instantaneous streaming blocking with "no data left on the ground." If the streaming detection status remains normal, the file data stream is successfully allowed to pass after all data blocks have been processed.

[0042] The introduction of a streaming sliding window mechanism to concatenate adjacent data blocks and construct a cross-block detection stream containing redundant boundary data includes: Construct a streaming sliding window buffer, the window width of which is determined by the sum of the preset size of the data block and the byte length of the largest feature code in the local anomaly feature index library, minus one byte unit; When a new target data block is appended to the streaming sliding window buffer, a data segment is extracted from the end of the previous data block and whose length is one byte less than the byte length of the maximum feature code. The extracted data fragments are then concatenated with the current target data block at the physical memory level to obtain a cross-block concatenation feature flow that eliminates feature truncation blind spots.

[0043] To enable those skilled in the art to better understand the technical essence of cross-block splicing, this embodiment provides a method for physical memory reorganization of a streaming sliding window buffer.

[0044] The system maintains a streaming sliding window buffer with a width of W in memory. Assume the preset size of a single independent data block is B (bytes), and the byte length of the largest feature in the local anomaly feature index is... (bytes), then the window width W of the streaming sliding window buffer strictly satisfies the following mathematical logic relationship: When the i-th new target data block in the sequence When a data block is captured and appended to the streaming sliding window buffer, if the buffer space reaches its limit, the entire window slides to the right by a step size B. At this time, the system performs a memory concatenation operation to extract the previous data block. Tail and length strictly defined The data segment (i.e., one byte less than the byte length of the maximum signature).

[0045] Subsequently, the extracted tail data fragment is combined with the target data block that is now entering the window through pointer cascading or memory concatenation. Physical reorganization is performed to construct a cross-block connected feature flow. Its mathematical expression model is as follows: In the formula, Indicates from data block A specific length segment is extracted from the tail. This connection feature flow is utilized. Any length not exceeding The abnormal signature, even if it is cut off by block boundaries during physical transmission, will inevitably be exposed explicitly and continuously in its entirety. Within the region, this ensures the completeness of feature retrieval.

[0046] After generating the dynamic feature data stream, the following is also included: Calculate the rate of change between adjacent feature segments in the feature data stream to generate dynamic flow parameters that reflect the data fluctuation characteristics; The dynamic flow parameters are compared with a locally preset library of known abnormal structure patterns to generate a file header and footer data structure consistency anomaly flag. The inconsistency markers of the file header and footer data structures are used as real-time context attributes of the file data stream and introduced into the subsequent link control decision process.

[0047] The streaming detection status includes accurate feature hit markers and abnormal behavior trend markers; after obtaining the streaming detection status, it also includes: The number of currently intercepted streaming data includes a first number of data containing the precise feature hit markers and a second number of data containing the behavioral trend anomaly markers. Obtain a preset scoring model that assigns different risk weights to the first quantity and the second quantity; substitute the first quantity and the second quantity into the preset scoring model for weighted summation calculation to generate a real-time risk score for the current file data stream; If the real-time risk score exceeds the preset score threshold, the blocking decision will be confirmed as the direct blocking state in the anomaly determination condition.

[0048] If the real-time risk score does not reach the preset score threshold, and the proportion of abnormal behavior trend markers exceeds the preset verification threshold, then the blocking decision will be confirmed as a deep verification state. In the deep verification state, the intercepted file data stream is asynchronously bypassed to a locally built isolated security sandbox for full file deep parsing; Based on the deep analysis results output by the isolated security sandbox, the blocking decision is updated in real time until all file data streams are processed or the direct blocking state is triggered.

[0049] In the streaming comparison phase, to balance detection accuracy and computational resource consumption, this embodiment performs a hierarchical reconstruction of the anomaly feature index library. The anomaly feature index library includes a "precise feature library" and a "behavioral trend anomaly library." Correspondingly, the streaming detection status output after comparison includes precise feature hit markers and behavioral trend anomaly markers.

[0050] During streaming scanning, the system performs real-time dynamic scoring on the currently intercepted streaming data. The system counts the first number of precise feature hits (denoted as ). ) and the second number of behavioral trend anomaly markers (denoted as ) Subsequently, a locally preset risk scoring model is invoked to perform multi-dimensional weighted summation, calculating the real-time risk score (Score) for the current file data stream. The mathematical weighting model is as follows: In the formula, The preset risk weight corresponds to the k-th feature dimension. To enable instantaneous response to high-risk behaviors at the industrial level, this embodiment adopts the following non-equal weighting rule: Assign higher weights to accurate feature hit labels (e.g.) ), assigning weights to behavioral trend anomaly markers (e.g. ), assigning lower weights to ordinary abnormal behaviors (e.g. ).

[0051] The system triggers adaptive tiered response control logic based on the calculated real-time risk score: Direct blocking state: If the current feature stream directly hits a high-risk and accurate feature, or if the accumulated real-time risk score exceeds or equals the preset blocking threshold, the system immediately determines that the current condition meets the highest level of abnormality. Without waiting for the transmission of subsequent data blocks, the system instantly issues a blocking signal to close the soft bus transmission channel and discards the cached data.

[0052] Deep verification status: If the current real-time risk score has not yet crossed the score blocking threshold, but the proportion of abnormal behavior trend markers exceeds the preset verification threshold (indicating that the data stream is suspected of being obfuscated or deceptive by unknown variants), the system will confirm the current blocking decision as a deep verification status.

[0053] In this state, the system initiates bypass protection: without interrupting the original soft bus stream, the intercepted file data stream is asynchronously mirrored and bypassed in real time to a locally constructed isolated security sandbox, where a full-file heuristic deep parsing engine is invoked for virtual behavior auditing. During this period, if the sandbox outputs a conclusive malicious conclusion, the blocking decision is immediately updated to a direct blocking state, severing the main link; if there are no anomalies during parsing until the end of the file stream, the process is allowed to proceed.

[0054] Furthermore, after feature generation, the system simultaneously calculates the rate of change between adjacent feature segments in the feature data stream, generating dynamic flow parameters that reflect data fluctuation characteristics. By comparing these dynamic flow parameters with a locally preset library of known abnormal structure patterns (such as file header-to-tail inconsistency patterns), anomaly markers for file header-to-tail data structure consistency are generated and superimposed as real-time context attributes into the calculation process of the aforementioned scoring model. This is beneficial for identifying malicious variant streams that utilize file header-to-tail camouflage techniques.

[0055] Before capturing the initial file data stream in real time, it also includes: Obtain the peer device trust score table maintained at the underlying layer by the distributed soft bus. The trust score table includes the peer device's historical behavior reputation, current device capability status, and network link quality. Extract the trust score of the peer device currently transmitting data with this end, and adaptively adjust the strategy configuration in the streaming comparison stage according to the level of the trust score. The strategy configuration includes the sliding step size of the streaming sliding window buffer, the retrieval depth of feature comparison, or the real-time risk score threshold for triggering blocking.

[0056] To further optimize the allocation of terminal computing power in a heterogeneous IoT device environment, the data flow management method in this embodiment also establishes an adaptive adjustment mechanism based on topology trust.

[0057] Before the initial file data stream is intercepted in real time at the underlying layer, the control device actively reads or retrieves the peer device trust score table, which is maintained and dynamically updated in real time by the distributed soft bus at the underlying protocol stack (such as the device discovery and authentication layer). The trust score table is constructed through a multi-dimensional evaluation matrix, specifically including the peer device's historical behavior reputation score, the device's current remaining computing power status, and the current transmission quality of the cross-device network link (such as packet loss rate and bandwidth).

[0058] The control device extracts the specific trust score of the peer device currently interacting with it in real time, and adaptively and dynamically adjusts the local real-time sliding comparison strategy configuration based on the score. If the peer device is a high-trust device (such as a high-reputation historical whitelist device and a secure link), the control device will automatically adjust the policy configuration to "lightweight mode". This will significantly reduce the CPU computing power consumed locally by increasing the sliding step size of the streaming sliding window buffer, reducing the retrieval depth of feature comparison, or raising the real-time risk score threshold for triggering blocking.

[0059] If the peer device is a newly connected device or a device with a low trust score, the control device will automatically switch to "high-strength defense mode", reduce the sliding step size to the smallest byte unit, enable full feature comparison depth, and lower the scoring blocking threshold, thereby ensuring zero security blind spots.

[0060] The step of sending each identified feature fragment in the set to multiple collaborative detection nodes in the network includes: Obtain a device trust score table that includes the device's historical behavior reputation, current device capability status, and network link quality; Devices with a trust score exceeding a preset threshold are selected from the candidate devices in the network as the collaborative detection nodes; Each identifiable feature fragment in the set is distributed to the selected cooperative detection nodes via an encrypted channel.

[0061] The receiving of collaborative feedback information returned by the multiple collaborative detection nodes includes: The system receives feedback information with digital signatures generated by the collaborative detection node after completing heuristic trend analysis locally, and uses the digital signatures to verify the integrity of each feedback information to obtain a set of reliable detection results to update the current streaming detection status.

[0062] In order to build a comprehensive defense system in the face of limited local computing power or large-scale unknown threats, this embodiment retains distributed collaborative control as a backup defense path.

[0063] When the system detects that the preset collaborative triggering conditions are met (for example, the local multi-core processor load rate exceeds the set computing power threshold, causing the streaming interception speed to be unable to keep up with the soft bus transmission speed; or the local sandbox cannot give a clear security conclusion on suspicious segments), the control device automatically activates the distributed collaborative control steps.

[0064] First, the device divides the currently reconstructed cross-block detection stream locally into multiple continuous streaming feature segments according to a specific hash step size, and assigns a unique identifier (UUID) to each feature segment within the current network lifetime, forming a set containing multiple identifiable feature segments.

[0065] Secondly, the control device extracts the peer device trust score table maintained at the underlying level, and selects several healthy heterogeneous devices from all candidate active devices in the network topology that have a trust score exceeding the preset security threshold as collaborative detection nodes for this round.

[0066] Subsequently, the control device utilizes the broadcast communication capability of the distributed soft bus to distribute each identifiable feature fragment in the aforementioned set to the selected collaborative detection nodes via a temporarily negotiated encrypted channel. Upon receiving their respective identifiable feature fragments, the collaborative detection nodes invoke their locally stored lightweight malicious feature index for parallel matching and retrieval.

[0067] Finally, within a set timeout window, the control device receives collaborative feedback information from each collaborative detection node. To prevent malicious nodes from tampering with or forging the features midway, after completing the analysis locally, each collaborative detection node uses its private key within its Hardware Security Expansion (TEE) to digitally sign the feedback data packet containing the unique identifier and the local flow detection result. The control device uses its corresponding public key to verify the integrity of the digital signature. After confirming that it has not been tampered with, it obtains a trusted detection result set and uses this result set to directly overwrite or update the current local flow detection state, thereby utilizing the network's surplus topology computing power to achieve cluster defense.

[0068] In another embodiment, a data flow control device based on a distributed soft bus is further included, characterized in that it includes: The streaming interception module is used to intercept the initial file data stream in real time at the underlying network interface during the process of establishing an underlying communication link and transmitting file data streams between the sending and receiving devices. The streaming reassembly module is used to divide the intercepted initial file data stream into multiple consecutive data blocks according to a preset size, and introduces a streaming sliding window mechanism to splice adjacent data blocks to construct a cross-block detection stream containing redundant boundary data. The feature extraction module is used to perform sliding feature extraction on the cross-block detection stream to generate a dynamic feature data stream corresponding to the time series of the current data stream; The streaming comparison module is used to input the dynamic feature data stream into a locally configured abnormal feature index library for real-time comparison and obtain the streaming detection status of the corresponding data block. The link control module is used to trigger link control signaling when the streaming detection state meets the preset abnormal judgment conditions, and to forcibly cut off the current transmission link of the file data stream through the underlying communication protocol and discard subsequent data blocks in the transmission buffer.

[0069] The electronic device provided in this embodiment of the invention, exemplarily, can be a network device, or a chip (system) or other component or assembly that can be disposed in a network device. The electronic device may include a processor. Optionally, the electronic device may also include a memory and / or a transceiver. The processor is coupled to the memory and transceiver, for example, by means of a communication bus connection.

[0070] In the several embodiments provided in this invention, it should be understood that the disclosed systems and methods can also be implemented in other ways. The system and method embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0071] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0072] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, an electronic device, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0073] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A virus detection method for the open-source HarmonyOS operating system, applied to a main control device terminal, characterized in that, The method includes: Acquire a target file data stream, which is generated by the sending device when transmitting a file via a distributed soft bus; The intercepted initial file data stream is divided into multiple consecutive data blocks of a preset size, and a streaming sliding window mechanism is introduced to splice adjacent data blocks to construct a cross-block detection stream containing redundant boundary data. Sliding feature extraction is performed on the cross-block detection stream to generate a dynamic feature data stream corresponding to the time series of the current data stream; The dynamic feature data stream is input into the locally configured abnormal feature index library for real-time comparison to obtain the streaming detection status of the corresponding data block; If the streaming detection status meets the preset anomaly judgment conditions, a link control signaling is triggered to forcibly cut off the current transmission link of the file data stream through the underlying communication protocol and discard subsequent data blocks in the transmission buffer.

2. The virus detection method for open-source HarmonyOS according to claim 1, characterized in that, The introduction of a streaming sliding window mechanism to concatenate adjacent data blocks and construct a cross-block detection stream containing redundant boundary data includes: Construct a streaming sliding window buffer, the window width of which is determined by the sum of the preset size of the data block and the byte length of the largest feature code in the local anomaly feature index library, minus one byte unit; When a new target data block is appended to the streaming sliding window buffer, a data segment is extracted from the end of the previous data block and whose length is one byte less than the byte length of the maximum feature code. The extracted data fragments are then concatenated with the current target data block at the physical memory level to obtain a cross-block concatenation feature flow that eliminates feature truncation blind spots.

3. The virus detection method for open-source HarmonyOS according to claim 1, characterized in that, After generating the dynamic feature data stream, the following is also included: Calculate the rate of change between adjacent feature segments in the feature data stream to generate dynamic flow parameters that reflect the data fluctuation characteristics; The dynamic flow parameters are compared with a locally preset library of known abnormal structure patterns to generate a file header and footer data structure consistency anomaly flag. The inconsistency markers of the file header and footer data structures are used as real-time context attributes of the file data stream and introduced into the subsequent link control decision process.

4. The virus detection method for open-source HarmonyOS according to claim 1, characterized in that, The streaming detection status includes accurate feature hit markers and abnormal behavior trend markers; After obtaining the streaming detection status, the process also includes: The number of currently intercepted streaming data includes a first number of data containing the precise feature hit markers and a second number of data containing the behavioral trend anomaly markers. Obtain a preset scoring model that assigns different risk weights to the first quantity and the second quantity; substitute the first quantity and the second quantity into the preset scoring model for weighted summation calculation to generate a real-time risk score for the current file data stream; If the real-time risk score exceeds the preset score threshold, the blocking decision will be confirmed as the direct blocking state in the anomaly determination condition.

5. The virus detection method for open-source HarmonyOS according to claim 4, characterized in that, Also includes: If the real-time risk score does not reach the preset score threshold, and the proportion of abnormal behavior trend markers exceeds the preset verification threshold, then the blocking decision will be confirmed as a deep verification state. In the deep verification state, the intercepted file data stream is asynchronously bypassed to a locally built isolated security sandbox for full file deep parsing; Based on the deep analysis results output by the isolated security sandbox, the blocking decision is updated in real time until all file data streams are processed or the direct blocking state is triggered.

6. The virus detection method for open-source HarmonyOS according to claim 1, characterized in that, Before capturing the initial file data stream in real time, it also includes: Obtain the peer device trust score table maintained at the underlying layer by the distributed soft bus. The trust score table includes the peer device's historical behavior reputation, current device capability status, and network link quality. Extract the trust score of the peer device currently transmitting data with this end, and adaptively adjust the strategy configuration in the streaming comparison stage according to the level of the trust score. The strategy configuration includes the sliding step size of the streaming sliding window buffer, the retrieval depth of feature comparison, or the real-time risk score threshold for triggering blocking.

7. The virus detection method for open-source HarmonyOS according to claim 1, characterized in that, When the preset collaborative triggering conditions are met, the streaming comparison stage also includes a distributed collaborative control step: The cross-block detection stream is divided into multiple continuous streaming feature segments, and a unique identifier is assigned to each streaming feature segment to obtain a set containing multiple identified feature segments; Through the broadcast capability of the distributed soft bus, each identified feature fragment in the set is sent to multiple collaborative detection nodes in the network to trigger the collaborative detection nodes to perform parallel matching detection based on the locally stored abnormal feature index. The system receives collaborative feedback information returned by the multiple collaborative detection nodes. The collaborative feedback information includes the unique identifier of the corresponding identifiable feature fragment and the corresponding local flow detection result.

8. The virus detection method for open-source HarmonyOS according to claim 7, characterized in that, The step of sending each identified feature fragment in the set to multiple collaborative detection nodes in the network includes: Obtain a device trust score table that includes the device's historical behavior reputation, current device capability status, and network link quality; Devices with a trust score exceeding a preset threshold are selected from the candidate devices in the network as the collaborative detection nodes; Each identifiable feature fragment in the set is distributed to the selected cooperative detection nodes via an encrypted channel.

9. The virus detection method for open-source HarmonyOS according to claim 8, characterized in that, The receiving of collaborative feedback information returned by the multiple collaborative detection nodes includes: The system receives feedback information with digital signatures generated by the collaborative detection node after completing heuristic trend analysis locally, and uses the digital signatures to verify the integrity of each feedback information to obtain a set of reliable detection results to update the current streaming detection status.

10. A data flow control device based on a distributed soft bus, characterized in that, include: The streaming interception module is used to intercept the initial file data stream in real time at the underlying network interface during the process of establishing an underlying communication link and transmitting file data streams between the sending and receiving devices. The streaming reassembly module is used to divide the intercepted initial file data stream into multiple consecutive data blocks according to a preset size, and introduces a streaming sliding window mechanism to splice adjacent data blocks to construct a cross-block detection stream containing redundant boundary data. The feature extraction module is used to perform sliding feature extraction on the cross-block detection stream to generate a dynamic feature data stream corresponding to the time series of the current data stream; The streaming comparison module is used to input the dynamic feature data stream into a locally configured abnormal feature index library for real-time comparison and obtain the streaming detection status of the corresponding data block. The link control module is used to trigger link control signaling when the streaming detection state meets the preset abnormal judgment conditions, and to forcibly cut off the current transmission link of the file data stream through the underlying communication protocol and discard subsequent data blocks in the transmission buffer.

Images