Abnormality detection method and device for malicious code intelligent detection engine

Abstract

Embodiments of the present disclosure disclose an anomaly detection method and device for a malicious code intelligent detection engine. A specific implementation of the method includes: performing vulnerability scanning processing on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point site atlas; determining a perturbation cleaning model and a reinforced intelligent detection engine corresponding to the malicious code intelligent detection engine; constructing a heterogeneous model pool and a meta-classifier; based on the perturbation cleaning model, the reinforced intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point site atlas, performing detection processing on a to-be-detected code sample to generate a malicious code sample detection result; and in response to determining that the malicious code sample detection result satisfies a preset abnormal sample condition, sending the malicious code sample detection result to an alarm terminal for alarm processing. The implementation is related to the field of malicious code intelligent detection, can effectively identify attacks, and improve the defense capability of the malicious code intelligent detection engine.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of intelligent malicious code detection, specifically to anomaly detection methods and apparatus for intelligent malicious code detection engines. Background Technology

[0002] With the widespread application of deep learning in the critical security field of malware detection, adversarial attack methods against intelligent malware detection are constantly evolving. Current adversarial attacks mainly present three levels: first, input-layer adversarial sample attacks, which induce the model to output incorrect results by adding imperceptible perturbations or adversarial patches to the input data; second, model-layer supply chain poisoning attacks, where attackers tamper with pre-trained model parameters to implant hidden backdoors, causing the model to output results preset by the attacker under specific triggering conditions; and third, inference-layer escape attacks, where attackers construct mutated samples targeting the decision boundaries of the detection engine to bypass detection. Currently, anomaly detection against intelligent malware detection engines typically employs the following methods: during model training, adversarial training using FGSM (Fast Gradient Sign Method) and PGD (Projected Gradient Descent) is used, and Gaussian filtering or autoencoders are applied to the input samples for reconstruction; and model ensemble methods are combined with multiple independent models for anomaly detection.

[0003] However, the inventors discovered that when using the above method to perform anomaly detection on a malicious code intelligent detection engine, the following technical problems often occur:

[0004] First, adversarial training can only defend against known attack patterns and cannot deal with unknown variants.

[0005] Second, input purification methods rely on fixed filtering / reconstruction strategies, which are easily bypassed.

[0006] Third, while model ensemble methods can improve robustness, they lack collaborative defense mechanisms and are insufficient in protecting against systemic attacks.

[0007] Fourth, existing solutions also lack effective detection and defense methods against poisoning attacks on model layer parameters.

[0008] The information disclosed in this background section is only intended to enhance the understanding of the background of the inventive concept, and therefore may contain information that does not form prior art known to those skilled in the art. Summary of the Invention

[0009] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0010] Some embodiments of this disclosure propose anomaly detection methods, apparatuses, electronic devices, and computer-readable media for intelligent malware detection engines to address the technical problems mentioned in the background section above.

[0011] In a first aspect, some embodiments of this disclosure provide an anomaly detection method for a malicious code intelligent detection engine. The method includes: performing vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map; determining a perturbation cleanup model and a corresponding hardened intelligent detection engine based on the attack vulnerability matrix and the vulnerability parameter point map; constructing a heterogeneous model pool and a meta-classifier based on the hardened intelligent detection engine; performing detection processing on a code sample to be detected based on the perturbation cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map to generate a malicious code sample detection result; and, in response to determining that the malicious code sample detection result meets preset abnormal sample conditions, sending the malicious code sample detection result to an alarm terminal for alarm processing.

[0012] Secondly, some embodiments of this disclosure provide an anomaly detection device for a malicious code intelligent detection engine. The device includes: a vulnerability scanning unit configured to perform vulnerability scanning processing on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map; a determination unit configured to determine a perturbation cleanup model and a hardened intelligent detection engine corresponding to the malicious code intelligent detection engine based on the attack vulnerability matrix and the vulnerability parameter point map; a construction unit configured to construct a heterogeneous model pool and a meta-classifier based on the hardened intelligent detection engine; a detection unit configured to perform detection processing on a code sample to be detected based on the perturbation cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map to generate a malicious code sample detection result; and a sending unit configured to send the malicious code sample detection result to an alarm terminal for alarm processing in response to determining that the malicious code sample detection result meets preset abnormal sample conditions.

[0013] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0014] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0015] The above-described embodiments of this disclosure have the following beneficial effects: The anomaly detection methods for malicious code intelligent detection engines in some embodiments of this disclosure can effectively identify attacks and improve the defense capabilities of the malicious code intelligent detection engine. Specifically, the reasons for the difficulty in identifying attacks are: adversarial training can only defend against known attack patterns and cannot cope with unknown variants; input purification methods rely on fixed filtering / reconstruction strategies, which are easily bypassed; while model ensemble methods can improve robustness, they lack a collaborative defense mechanism and are insufficient in protecting against systemic attacks; existing solutions also lack effective detection and defense methods against model layer parameter poisoning attacks. Based on this, the anomaly detection methods for malicious code intelligent detection engines in some embodiments of this disclosure firstly adopt a multi-layered progressive defense: covering the three major attack surfaces of the input layer, model layer, and inference layer, achieving in-depth defense, as a single-point breakthrough cannot dismantle the overall system. Secondly, it actively strengthens the parameter space: for the first time, parameter poisoning defense is incorporated into a systematic adversarial defense framework, fundamentally blocking the implantation of backdoors in the supply chain through low-sensitivity area occupancy and dynamic masking. Next, heterogeneous redundancy collaboration is achieved: multi-architecture, multi-strategy model pools work together with optimized voting / fusion strategies to effectively address unknown attack variants. Then, continuous adaptive evolution is implemented: online learning and adversarial environment awareness enable the system to track the latest attack trends and continuously improve its defense capabilities. Therefore, attacks can be effectively identified, enhancing the defense capabilities of the malicious code intelligent detection engine. Attached Figure Description

[0016] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0017] Figure 1 This is a flowchart of some embodiments of the anomaly detection method for a malicious code intelligent detection engine according to the present disclosure;

[0018] Figure 2This is a schematic diagram illustrating a scenario for determining the malicious code sample category information corresponding to a code sample to be detected, based on some embodiments of the anomaly detection method for a malicious code intelligent detection engine disclosed herein.

[0019] Figure 3 Structural schematic diagrams of some embodiments of the anomaly detection device for a malicious code intelligent detection engine disclosed herein;

[0020] Figure 4 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0021] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0022] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0023] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0024] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0025] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0026] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0027] refer to Figure 1 The diagram illustrates a flow 100 of some embodiments of an anomaly detection method for a malicious code intelligent detection engine according to the present disclosure. This anomaly detection method for a malicious code intelligent detection engine includes the following steps:

[0028] Step 101: Perform vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map.

[0029] In some embodiments, the execution entity of the anomaly detection method targeting the malicious code intelligent detection engine can perform vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map. The malicious code intelligent detection engine can be a detection engine used to identify malicious code. In practice, firstly, the execution entity can use the ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) algorithm to perform vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix. Secondly, the execution entity can use the Gradient-Based Sensitivity Mapping algorithm to perform vulnerability scanning on the malicious code intelligent detection engine to generate a vulnerability parameter point map.

[0030] Optionally, the aforementioned execution entity can perform vulnerability scanning on the malicious code intelligent detection engine through the following steps to generate an attack vulnerability matrix and a vulnerability parameter point map:

[0031] The first step involves performing adversarial attack simulation processing on the malicious code intelligent detection engine to generate a set of adversarial samples. In practice, the aforementioned execution entity can use at least one preset adversarial attack simulation algorithm to perform adversarial attack simulation processing on the malicious code intelligent detection engine to generate a set of adversarial samples corresponding to a preset clean sample set. Here, the preset clean samples in the preset clean sample set can be pre-acquired samples representing clean code (clean code can be non-malicious code). The preset clean samples in the preset clean sample set can include: clean code and sample tags. The adversarial samples in the malicious code adversarial sample set can include: adversarial malicious code (adversarial malicious code can represent code after adding an attack to clean code) and attack type (attack type can represent a preset adversarial attack simulation algorithm). Here, the adversarial samples in the malicious code adversarial sample set can correspond to the preset clean samples in the preset clean sample set. The adversarial samples in the malicious code adversarial sample set can correspond to a preset adversarial attack simulation algorithm in at least one preset adversarial attack simulation algorithm. For example, the preset adversarial attack simulation algorithm in at least one preset adversarial attack simulation algorithm may be, but is not limited to: FGSM (Fast Gradient Sign Method), PGD (Projected Gradient Descent), C&W (Carlini & Wagner, an optimization-based adversarial sample generation method), and adversarial patch attack method.

[0032] As an example, the preset clean sample set can be obtained from the terminal device via a wired or wireless connection. The preset clean samples in the preset clean sample set may include: code representing "clean code a" and sample labels representing the "clean code" category. Here, the terminal device can be a device used to store the preset clean sample set.

[0033] It should be noted that the aforementioned wireless connection methods may include, but are not limited to, 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other currently known or future wireless connection methods.

[0034] The second step is to determine the attack vulnerability matrix corresponding to the aforementioned set of adversarial malware samples. In practice, firstly, the executing entity can partition the aforementioned set of adversarial malware samples to generate a set of adversarial malware partitioned samples. Specifically, the executing entity can identify each adversarial malware sample in the set that corresponds to the same preset adversarial attack simulation algorithm as a set of adversarial malware partitioned samples, thus obtaining a set of adversarial malware partitioned samples. Secondly, the executing entity can input each adversarial malware partitioned sample in the set of adversarial malware partitioned samples into the aforementioned intelligent malware detection engine to generate adversarial malware output results, thus obtaining a set of adversarial malware output results. The adversarial malware output results in the set of adversarial malware output results may include: adversarial output information and confidence level. Next, for each adversarial malware output result group in the set of adversarial malware output results, the executing entity can perform the following steps: First, identify each adversarial malware output result that meets the preset error conditions as a set of malicious code error output results. The pre-defined error conditions can be: the adversarial output information included in the malicious code adversarial output results is inconsistent with the sample labels included in the pre-defined clean samples corresponding to the malicious code adversarial output results. Second, the ratio of the number of malicious code erroneous output results in the malicious code erroneous output result group to the number of malicious code adversarial output results in the malicious code adversarial output result group is determined as the attack success rate. Third, using the Euclidean distance algorithm, the perturbation difference value between the adversarial malicious code included in the malicious code adversarial sample corresponding to each malicious code erroneous output result in the above-mentioned malicious code erroneous output result group and the clean code included in the pre-defined clean samples corresponding to the malicious code erroneous output results is determined, resulting in a perturbation difference value group. Fourth, the average value of each perturbation difference value in the perturbation difference value group is determined as the average perturbation difference value. Fifth, the average confidence level of each malicious code erroneous output result included in the malicious code erroneous output result group is determined as the average error prediction confidence level. Then, the aforementioned execution entity can construct an attack vulnerability matrix based on the attack success rates, average perturbation difference values, and average error prediction confidence levels determined by the above-mentioned at least one pre-defined adversarial attack simulation algorithm. In practice, the aforementioned execution entity can construct an attack vulnerability matrix by taking at least one preset adversarial attack simulation algorithm as each of the at least one preset adversarial attack simulation algorithms as rows, and attack success rate, average perturbation difference value, and average false prediction confidence as columns.

[0035] As an example, the malicious code adversarial output results in the malicious code adversarial output result set may include: adversarial output information representing the category of "malicious code a", and confidence level indicating that the output is of the category of "malicious code a".

[0036] The third step is to perform parameter vulnerability detection processing on the aforementioned malicious code intelligent detection engine to generate a vulnerability parameter location map.

[0037] Optionally, the aforementioned execution entity can perform parameter vulnerability detection processing on the aforementioned malicious code intelligent detection engine through the following steps to generate a vulnerability parameter location map:

[0038] The first step involves modularizing the aforementioned intelligent malware detection engine to generate a set of modular units. These modular units include a set of module parameter spaces. In practice, the execution entity can functionally decompose the intelligent malware detection engine into modular units such as attention mechanism layers, feedforward network layers, and normalization layers, resulting in a set of modular units. The module parameter space within the modular unit set represents the set of configurable parameters within each modular unit.

[0039] The second step is to determine the sensitivity corresponding to each module parameter space included in each modular unit of the aforementioned modular unit set, thus obtaining a sensitivity set. In practice, firstly, the executing entity can determine the average value of each initial sensitivity corresponding to each module parameter space included in each modular unit of the aforementioned modular unit set as the sensitivity. Secondly, the executing entity can define the determined sensitivities as a sensitivity set. Here, the initial sensitivity among the initial sensitivities corresponding to each module parameter space can be determined by the following formula:

[0040] ,

[0041] in, Indicates the modular unit number, Indicates the parameter number. Represents the modular unit set of the first In the modular unit, the first The initial sensitivity of each initial sensitivity corresponding to the parameter space of each module. Represents the modular unit set of the first In the modular unit, the first The parameters represented by the parameter space of each module. It represents the complete set of model parameters (the parameters represented by the parameter space of each module included in the modular unit set). This indicates that only the parameters will be used. Replace with The complete set of model parameters, This indicates a small perturbation. This indicates the adversarial malware included in the adversarial malware sample set. express Corresponding sample labels This represents the confidence level (the confidence level included in the malware adversarial output obtained by inputting the malware adversarial sample into the aforementioned malware intelligent detection engine). This represents the perturbation confidence level (the confidence level included in the output of the malware adversarial sample obtained by inputting the malware adversarial sample into the malware intelligent detection engine after adding a small perturbation). This represents the KL (Kullback-Leibler Divergence, relative entropy) divergence.

[0042] Here, each initial sensitivity can correspond to a malicious code adversarial sample in the malicious code adversarial sample set.

[0043] The third step involves defining the sensitivities that satisfy the preset low-sensitivity condition within the aforementioned sensitivity set, along with their corresponding module parameter spaces, as low-sensitivity regions, thus obtaining a low-sensitivity region set. The preset low-sensitivity condition can be that the sensitivity is less than the product of the average sensitivity value and a preset sensitivity threshold. The average sensitivity value can be the average of all sensitivities within the aforementioned sensitivity set. For example, the preset sensitivity threshold could be 20%.

[0044] The fourth step is to determine the vulnerable parameter location map based on the aforementioned low-sensitivity region set. In practice, firstly, the executing entity can use a preset perturbation algorithm to perturb the aforementioned low-sensitivity region set to generate a perturbation parameter set. The preset perturbation algorithm can be: randomly generating multiple parameter perturbation combinations on the low-sensitivity region set according to a preset perturbation amplitude (e.g., the preset perturbation amplitude could be weight ±5%, bias ±0.1). Here, the perturbation parameter set in the perturbation parameter set corresponds to a set of parameter perturbation combinations. The perturbation parameter set in the perturbation parameter set corresponds to the low-sensitivity region set. The perturbation parameters included in the perturbation parameter set in the perturbation parameter set correspond to the low-sensitivity regions included in the low-sensitivity region set. Secondly, the executing entity can use a preset perturbation parameter filtering algorithm to filter the aforementioned perturbation parameter set to generate a filtered perturbation parameter set. For example, the preset perturbation parameter screening algorithm could be: using the Monte Carlo Tree Search (MCTS) algorithm to select a group of perturbation parameters that reduce the accuracy of the model (the malicious code detection engine after adding perturbation) by no more than 10% (accuracy can be the ratio of the number of correctly identified samples by the malicious code detection engine after adding perturbation to the total number of adversarial malicious code samples). Then, the aforementioned execution entity can construct an initial parameter point map using the parameters represented by the parameter space of each module included in the modular unit set as nodes and the relationships between parameters as edges. Next, the aforementioned execution entity can label the aforementioned perturbation parameter screening group set onto the initial parameter point map to obtain a vulnerable parameter point map. As an example, different colors and shapes can be used to distinguish different levels of vulnerable parameters (such as high vulnerability, medium vulnerability, and low vulnerability), and information such as the perturbation amplitude and anomaly type that triggers the anomaly can also be labeled, and the perturbation parameter screening group set can be labeled onto the nodes of the initial parameter point map.

[0045] Step 102: Based on the attack vulnerability matrix and vulnerability parameter point map, determine the hardening intelligent detection engine corresponding to the perturbation cleanup model and the malicious code intelligent detection engine.

[0046] In some embodiments, the execution entity can determine the hardened intelligent detection engine corresponding to the perturbation cleanup model and the malicious code intelligent detection engine based on the attack vulnerability matrix and the vulnerability parameter point map. The perturbation cleanup model can be a model used to perturb and clean up adversarial malicious code to obtain perturbation cleanup code.

[0047] In practice, firstly, the aforementioned executing entity can determine the pre-defined perturbation cleaning algorithm as the perturbation cleaning model. Secondly, the aforementioned executing entity can use a pre-defined hardening algorithm to harden the aforementioned malicious code intelligent detection engine to generate a hardened intelligent detection engine. For example, the pre-defined perturbation cleaning algorithm may include, but is not limited to, at least one of the following: SonarQube (code quality inspection tool), CodeMaid (automatic code formatting), and AST-based refactoring (refactoring based on abstract syntax trees). The pre-defined hardening algorithm may include, but is not limited to, at least one of the following: knowledge distillation algorithm, and injecting controllable random noise into the input or feature layer of the malicious code intelligent detection engine.

[0048] Optionally, the aforementioned execution entity can determine the hardening intelligent detection engine corresponding to the perturbation cleanup model and the aforementioned malicious code intelligent detection engine based on the aforementioned attack vulnerability matrix and the aforementioned vulnerability parameter point map through the following steps:

[0049] The first step involves fine-tuning a pre-determined initial malicious code pre-trained model set to generate a malicious code replacement model set. This pre-determined initial malicious code pre-trained model set is based on the aforementioned attack vulnerability matrix. Here, the attack vulnerability matrix characterizes the sensitivity of the malicious code intelligent detection engine to different attacks (sensitivity can be the average of attack success rate, average perturbation difference value, and average false prediction confidence). As an example, the pre-determined initial malicious code pre-trained model set is determined through the following steps: In response to the attack vulnerability matrix characterizing the malicious code intelligent detection engine's sensitivity to different attacks from high to low as follows: adversarial patch attack methods, PGD, C&W, and FGSM, pre-trained ResNet (Residual Network) models, pre-trained ViT (VisionTransformer, a visual deep learning model) models, and pre-trained DenseNet (Densely Connected Convolutional Networks) models are selected as the initial malicious code pre-trained models, resulting in the initial malicious code pre-trained model set. In practice, the aforementioned execution entity can use a pre-defined model fine-tuning algorithm to fine-tune each initial malicious code pre-trained model in a predetermined initial malicious code pre-trained model set to generate a malicious code replacement model, thus obtaining a malicious code replacement model set. For example, the pre-defined model fine-tuning algorithm can be, but is not limited to, a full parameter fine-tuning algorithm or a parameter-efficient fine-tuning algorithm.

[0050] The second step involves performing adversarial attack simulation processing on the aforementioned malicious code substitution model set to generate a diverse set of adversarial samples. In practice, firstly, the executing entity can use at least one preset adversarial attack simulation algorithm to perform adversarial attack simulation processing on each malicious code substitution model in the malicious code substitution model set to generate diverse adversarial samples corresponding to a preset clean sample set. Then, the resulting diverse adversarial samples are defined as a diverse set of adversarial samples. The diverse adversarial samples in the diverse set of adversarial samples can correspond to preset clean samples in the preset clean sample set. The diverse adversarial samples in the diverse set of adversarial samples can include: adversarial malicious code and attack types.

[0051] The third step is to determine the perturbation cleanup model based on the aforementioned diverse adversarial sample set. In practice, the aforementioned execution entity can train the initial perturbation cleanup model based on the diverse adversarial sample set to obtain the perturbation cleanup model. Here, the initial perturbation cleanup model can be a model that takes the adversarial malicious code included in the diverse adversarial samples as input and the initial perturbation cleanup code as output. For example, the initial perturbation cleanup model can be: DnCNN (Denoising Convolutional Neural Network). The loss function of the initial perturbation cleanup model during training is:

[0052] .

[0053] in, Indicates the difference value. This indicates the clean code included in the preset clean samples corresponding to the diverse adversarial examples in the diverse adversarial example set. This indicates the adversarial malicious code included in the diverse adversarial sample set. This represents the initial perturbation cleanup code output after inputting the adversarial malicious code included in the diverse adversarial sample set into the initial perturbation cleanup model. Indicates L1 normal form, Indicates weight, , This represents the perceptual loss (VGG (Visual Geometry Group Network) feature).

[0054] In practice, the training objective of the initial perturbation cleanup model is to minimize the difference in feature space between the cleaned code after initial perturbation cleanup and the clean code included in the preset clean samples.

[0055] The fourth step is to strengthen the above-mentioned malicious code intelligent detection engine based on the vulnerability parameter point map to generate a strengthened intelligent detection engine.

[0056] Optionally, the aforementioned execution entity can perform the following steps to harden the aforementioned malicious code intelligent detection engine based on the aforementioned vulnerability parameter point map, in order to generate a hardened intelligent detection engine:

[0057] The first step is to perform pseudo-quantization node insertion processing on the aforementioned vulnerability parameter point map to generate a pseudo-quantization detection engine. In practice, the aforementioned execution entity can insert pseudo-quantization nodes in the low-sensitivity areas represented in the aforementioned vulnerability parameter point map to obtain a pseudo-quantization detection engine.

[0058] The second step involves determining the security zone information corresponding to the aforementioned pseudo-quantization detection engine based on a pre-determined malware information matrix. In practice, firstly, the executing entity can define the security zones as the diagonal elements of the malware information matrix that are below the product of the historical average and a preset parameter threshold, along with the corresponding module parameter space of the pseudo-quantization detection engine. Secondly, each obtained security zone is defined as security zone information. For example, the malware information matrix can be a Fisher matrix. The preset parameter threshold can be 20%. The historical average can be the average value of each diagonal element of the Fisher matrix corresponding to the malware intelligent detection engine.

[0059] The third step involves updating the weights of the pseudo-quantization detection engine based on the aforementioned security zone information and a pre-defined dynamic masking network for malicious code, thereby generating a reinforced intelligent detection engine. Here, the dynamic masking network for malicious code can be a network used to freeze the parameters representing the security zone information by setting their binary masks to 0. In practice, the executing entity can use the dynamic masking network to set the binary masks of the parameters corresponding to the security zone information in the pseudo-quantization detection engine to 0, thus generating the reinforced intelligent detection engine.

[0060] Therefore, the parameters of the already occupied safe zone can be permanently frozen to prevent the adversarial training process from overwriting these parameters.

[0061] Step 103: Based on the reinforced intelligent detection engine, construct a heterogeneous model pool and a meta-classifier.

[0062] In some embodiments, the aforementioned execution entity can construct a heterogeneous model pool and a meta-classifier based on the aforementioned hardened intelligent detection engine. In practice, firstly, the execution entity can construct various heterogeneous models with the same input and output as the aforementioned hardened intelligent detection engine, based on mixed samples, as a heterogeneous model pool. Here, the heterogeneous models in the heterogeneous model pool can be models that take code input samples as input and malicious code output results as output. Code input samples can represent code samples. Malicious code output results can include: malicious code category (as an example, malicious code category can represent "malicious code a". Malicious code category can also represent "malicious code b". Malicious code category can also represent "clean code"). Secondly, the execution entity can construct a meta-classifier based on the heterogeneous model pool and mixed samples. Here, the meta-classifier can be a classifier that takes the various malicious code output results from the heterogeneous model pool as input and malicious code sample category information as output. Malicious code sample category information can be: malicious code category and malicious code sample confidence. The meta-classifier can be used to: fuse the various malicious code output results. As an example, the heterogeneous models in the heterogeneous model pool can be, but are not limited to: pre-trained ResNet, pre-trained EfficientNet (an efficient deep learning convolutional neural network model), pre-trained DenseNet, pre-trained ViT, and pre-trained Swin Transformer (a visual transformer). The meta-classifier can be: a pre-trained MLP (multilayer perceptron). In practice, the training samples for the heterogeneous model pool and the meta-classifier can be: mixed samples. Here, mixed samples can include: the aforementioned pre-defined clean sample set and a diverse set of adversarial examples.

[0063] Step 104: Based on the perturbation cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map, the code sample to be detected is processed to generate malicious code sample detection results.

[0064] In some embodiments, the execution entity may perform detection processing on the code sample to be detected based on the aforementioned perturbation cleanup model, the aforementioned hardened intelligent detection engine, the aforementioned heterogeneous model pool, the aforementioned meta-classifier, and the aforementioned vulnerability parameter point map, to generate malicious code sample detection results. The code sample to be detected may include code that needs to be detected to resist perturbations (malicious code).

[0065] Optionally, the aforementioned execution entity can perform detection processing on the code sample to be detected based on the aforementioned perturbation cleanup model, the aforementioned hardened intelligent detection engine, the aforementioned heterogeneous model pool, the aforementioned meta-classifier, and the aforementioned vulnerability parameter point map through the following steps to generate malicious code sample detection results:

[0066] The first step, based on the aforementioned reinforced intelligent detection engine, is to determine the code sample feature distance between the code sample to be detected and its corresponding clean sample of the same type. The clean sample of the same type can be: clean code with an undisturbed representation obtained from a terminal device via a wired or wireless connection, whose characteristics match those of the code sample to be detected. In practice, the executing entity can determine the code sample feature distance between the code sample to be detected and its corresponding clean sample of the same type using a preset feature distance algorithm. For example, the preset feature distance algorithm could be: calculating the L2 (Euclidean distance) distance between the code sample to be detected and the clean sample of the same type in the feature space.

[0067] The second step is to determine the malicious code sample category information corresponding to the above-mentioned perturbation cleanup model, the above-mentioned heterogeneous model pool and the above-mentioned meta-classifier based on the above-mentioned code sample to be detected. The above-mentioned malicious code sample category information includes: malicious code sample confidence.

[0068] The third step involves determining the low-sensitivity area parameter set based on the aforementioned hardening intelligent detection engine and the vulnerability parameter location map. In practice, the executing entity can determine the low-sensitivity area parameter set by matching the parameters in the hardening intelligent detection engine that represent the low-sensitivity areas in the vulnerability parameter location map.

[0069] The fourth step is to determine the original parameter set corresponding to the aforementioned low-sensitivity region parameter set, and the distance set between the original parameter set and the corresponding low-sensitivity region parameter set. The original parameter set can be the parameters included in the malicious code intelligent detection engine that correspond to the low-sensitivity region parameters in the low-sensitivity region parameter set. The original parameters in the original parameter set can correspond to the low-sensitivity region parameters in the low-sensitivity region parameter set. In practice, the executing entity can use a preset parameter distance algorithm to determine the distance between each low-sensitivity region parameter in the aforementioned low-sensitivity region parameter set and the original parameter corresponding to that low-sensitivity region parameter, thus obtaining the low-sensitivity region parameter distance set. For example, the preset parameter distance algorithm could be the Hamming distance algorithm.

[0070] The fifth step involves a weighted fusion of the aforementioned code sample feature distances, the malware sample confidence scores included in the malware sample category information, and the aforementioned low-sensitivity region parameter distance set to generate an adversarial risk score. In practice, firstly, the executing entity can determine the average of the distances of each low-sensitivity region parameter in the aforementioned low-sensitivity region parameter distance set as the mean low-sensitivity region distance. Secondly, the executing entity can perform a weighted summation of the aforementioned code sample feature distances, the malware sample confidence scores included in the malware sample category information, and the aforementioned mean low-sensitivity region distance to generate an adversarial risk score.

[0071] Step 6: In response to the determination that the aforementioned adversarial risk score is greater than a preset risk score, an enhanced defense mode is activated based on the aforementioned code sample to be detected. For example, the preset risk score could be 0.7.

[0072] Step 7: In response to determining that the aforementioned adversarial risk score is less than or equal to the aforementioned preset risk score, and in response to determining that the aforementioned code sample feature distance, the aforementioned malicious code sample confidence level included in the malicious code sample category information, and the aforementioned low-sensitivity area parameter distance set satisfy preset adversarial anomaly conditions, the aforementioned code sample to be detected is identified as a target malicious code adversarial sample, and the preset adversarial information corresponding to the aforementioned target malicious code adversarial sample is identified as the malicious code sample detection result. The preset adversarial anomaly conditions may be: the code sample feature distance is greater than a preset feature distance threshold, the malicious code sample confidence level is less than a preset confidence level, or there is a low-sensitivity area parameter distance greater than a preset parameter distance threshold in the low-sensitivity area parameter distance set. For example, the preset feature distance threshold may be 6. The preset confidence level may be 0.8. The preset parameter distance threshold may be 5%. The preset adversarial information may be information representing "the current code sample to be detected is risky".

[0073] Optionally, the aforementioned execution entity can determine the malicious code sample category information corresponding to the aforementioned code sample to be detected based on the aforementioned perturbation cleanup model, the aforementioned heterogeneous model pool, and the aforementioned meta-classifier through the following steps:

[0074] The first step is to input the code sample to be detected into the perturbation cleanup model to obtain the code perturbation cleanup sample.

[0075] The second step involves filtering the heterogeneous model pool to generate a target heterogeneous model set. In practice, the executing entity can use a preset filtering algorithm to select various heterogeneous models from the pool as the target heterogeneous model set. This preset filtering algorithm can be as follows: First, randomly select a heterogeneous model from the pool as the first target heterogeneous model. Second, using a Euclidean distance algorithm, determine the model distance value between each heterogeneous model in the pool (excluding the first target model) and the first target model, obtaining a set of model distance values. Next, determine the heterogeneous model corresponding to the largest model distance value in the set as the second target heterogeneous model. Then, determine all heterogeneous models in the pool (excluding the first and second target models) as a transit heterogeneous model set. Finally, for each transit heterogeneous model in the transit heterogeneous model set, determine the minimum transit distance value. Here, the minimum transit distance value can be the smallest of the Euclidean distances between the transit heterogeneous model and the first target heterogeneous model, and between the transit heterogeneous model and the second target heterogeneous model. Next, the transit heterogeneous model corresponding to the largest minimum transit distance value among the determined minimum transit distance values ​​is identified as the third target heterogeneous model. Finally, the first target heterogeneous model, the second target heterogeneous model, and the third target heterogeneous model are identified as the target heterogeneous model set.

[0076] The third step involves inputting the aforementioned code perturbation cleanup samples into the aforementioned target heterogeneous model set to obtain a malicious code sample output result set. In practice, the aforementioned execution entity can input the aforementioned code perturbation cleanup samples into each target heterogeneous model in the aforementioned target heterogeneous model set to generate malicious code sample output results, thus obtaining a malicious code sample output result set.

[0077] The fourth step involves performing a weighted voting process on the output set of the malicious code samples to generate weighted information about the malicious code samples. In practice, the executing entity can use a weighted voting algorithm to perform this process on the output set of the malicious code samples to generate weighted information about the malicious code samples. This weighted information can be:

[0078] ,

[0079] in, This indicates the weighted information of the malicious code sample. Indicates the category of malicious code. Indicates the model number. This indicates the number of malicious code sample outputs in the malicious code sample output set. Indicates the indicator function (when the target heterogeneous model set is set to the first...) The target heterogeneous model predicts the following categories: The value is 1 if it is true, and 0 otherwise. Represents the model weights. In the target heterogeneous model set, the first The classification accuracy of the heterogeneous target models on a clean, uninterrupted sample set. In the target heterogeneous model set, the first The classification accuracy of the heterogeneous model targeting a diverse set of adversarial examples. As an example, the malicious code category can represent "malicious code a". The malicious code category can also represent "malicious code b". The malicious code category can also represent "clean code".

[0080] The fifth step involves performing target detection processing on the aforementioned malicious code sample output set to generate malicious code sample detection information. In practice, firstly, the executing entity can fuse the output results of each malicious code sample in the malicious code sample output set to generate a malicious code sample fusion information set (in practice, the union of all model output boxes is taken, and all candidate boxes are retained). Secondly, the executing entity can perform non-maximum suppression processing on the malicious code sample fusion information set to generate a malicious code sample suppression information set. The IoU threshold is set to 0.5 (the malicious code sample fusion information set (candidate boxes) is sorted according to confidence level from high to low; for each malicious code sample fusion information, its IoU value with the remaining unprocessed malicious code sample fusion information is calculated; if it is greater than 0.5, it is deleted). Then, the malicious code sample suppression information set undergoes low-confidence filtering processing to generate malicious code sample detection information. In practice, the executing entity can identify each malicious code sample suppression information in the malicious code sample suppression information set with a confidence level greater than the preset confidence threshold as malicious code sample detection information. For example, the preset confidence threshold could be 0.3.

[0081] Step 6: In response to determining that the aforementioned malicious code sample weighting information and the aforementioned malicious code sample detection information satisfy a preset divergence condition, malicious code sample category information is determined based on the aforementioned malicious code sample weighting information, the aforementioned malicious code sample detection information, and the aforementioned meta-classifier. The malicious code sample weighting information may include: malicious code category and confidence level. The aforementioned malicious code sample detection information may include at least one set of malicious code categories and confidence levels.

[0082] In practice, firstly, the aforementioned executing entity can fuse the weighted information of the malicious code samples and the detection information of the malicious code samples to generate a set of malicious code category confidence information. The malicious code category confidence information in the set can include: a fused malicious code category and a fused confidence level. Secondly, the executing entity can determine the weighted information of the malicious code samples as the malicious code category confidence information. Thirdly, it can determine the malicious code category and confidence level from at least one set of malicious code categories and confidence levels included in the malicious code sample detection information as the malicious code category confidence information, thus obtaining at least one set of malicious code category confidence information. Fourthly, it can determine the obtained malicious code category confidence information as a set of malicious code category confidence information. Next, in response to determining that the set of malicious code category confidence information satisfies a preset divergence condition, the set of malicious code category confidence information is input into the aforementioned meta-classifier to obtain malicious code sample category information. The preset divergence condition can be: the difference between the maximum category prediction proportions corresponding to the category prediction proportion set corresponding to the malicious code category confidence information set is less than or equal to a preset difference. For example, the preset difference can be 70%. The maximum difference in category prediction percentages corresponding to the category prediction percentage set can be the difference between the largest category prediction percentage and the smallest category prediction percentage in the category prediction percentage set. The category prediction percentage set corresponding to the malware category confidence information set can be generated through the following steps: First, classify the malware category confidence information set using a preset classification algorithm to generate a malware category confidence classification information set. For example, the preset classification algorithm could be: grouping malware category confidence information sets containing malware with the same fusion category into a single group. Second, for each malware category confidence classification information group in the malware category confidence classification information set, determine the category prediction percentage by the ratio of the number of malware category confidence classification information in the malware category confidence classification information group to the total number of malware category confidence classification information in the malware category confidence classification information set. Third, define the determined category prediction percentages as the category prediction percentage set.

[0083] As an example, an application scenario diagram for determining the malware sample category information corresponding to the above-mentioned code sample to be detected, based on the above-mentioned perturbation cleanup model, heterogeneous model pool, and meta-classifier, can be found here. Figure 2 , Figure 2 This illustration shows a scenario illustrating the determination of malware sample category information corresponding to a code sample to be detected, based on some embodiments of the anomaly detection method for a malware intelligent detection engine according to this disclosure. For example... Figure 2As shown, firstly, the code sample representing [code to be detected a] is input into the perturbation cleanup model to obtain [perturbation cleanup code a]. Secondly, [perturbation cleanup code a] is input into heterogeneous model 1, heterogeneous model 2, and heterogeneous model 3 respectively to obtain ["malicious code a", 0.8], ["malicious code a", 0.6], and ["malicious code b", 0.7]. Next, ["malicious code a", 0.8; "malicious code a", 0.6; "malicious code b", 0.7] undergoes weighted voting processing to obtain ["malicious code a", 0.7], and ["malicious code a", 0.8; "malicious code a", 0.6; "malicious code b", 0.7] undergoes target detection processing to obtain ["malicious code a", 0.7; "malicious code b", 0.7]. Then, ["malicious code a", 0.7] and ["malicious code a", 0.7; "malicious code b", 0.7] are input into the meta-classifier to obtain the malicious code sample category information representing ["malicious code a", 0.7].

[0084] Optionally, the aforementioned executing entity can initiate an enhanced defense mode based on the aforementioned code sample to be detected through the following steps:

[0085] The first step is to identify the code samples to be detected as high-risk samples, and to determine the corresponding preset high-risk information as the malicious code sample detection result. For example, the preset high-risk information could be information indicating that "the code sample to be detected is high-risk".

[0086] The second step is to add the high-risk adversarial samples mentioned above to the diverse adversarial sample set corresponding to the attack vulnerability matrix.

[0087] The third step involves updating the perturbation cleanup model and the meta-classifier in response to the determination that the added diverse adversarial sample set meets the preset quantity condition. The preset quantity condition can be that the number of diverse adversarial samples in the set is greater than or equal to a preset sample number. For example, the preset sample number could be 1000. In practice, in response to the determination that the added diverse adversarial sample set meets the preset quantity condition, the executing entity can use the added diverse adversarial sample set as the diverse adversarial sample set, and based on the target learning rate fine-tuning algorithm, re-execute the above steps to determine the perturbation cleanup model based on the diverse adversarial sample set, and to construct the meta-classifier based on the heterogeneous model pool and mixed samples, in order to update the perturbation cleanup model and the meta-classifier. Here, the target learning rate fine-tuning algorithm can be: performing 1-2 rounds of fine-tuning with a small learning rate (the small learning rate can be one-tenth of the base learning rate).

[0088] Step 105: In response to determining that the malicious code sample detection result meets the preset abnormal sample conditions, the malicious code sample detection result is sent to the alarm terminal for alarm processing.

[0089] In some embodiments, the execution entity may, in response to determining that the detection result of the malicious code sample meets preset abnormal sample conditions, send the detection result of the malicious code sample to an alarm terminal for alarm processing. The preset abnormal sample conditions may be: the malicious code sample detection result represents preset adversarial information or preset high-risk information. The alarm terminal may be a terminal that performs alarm processing on abnormal code samples to be detected. Here, alarm processing may involve displaying warning text or emitting warning sounds.

[0090] Optionally, the aforementioned implementing entity may also perform the following steps:

[0091] The first step is to obtain the historical attack cluster groups and historical cluster center weight reassemblies for the aforementioned malicious code intelligent detection engine. The historical attack cluster groups correspond to the historical cluster center weights in the aforementioned historical cluster center weight reassemblies. In practice, the executing entity can obtain the historical attack cluster groups and historical cluster center weight reassemblies for the aforementioned malicious code intelligent detection engine from the terminal device via wired or wireless connection. The historical attack cluster groups can include at least one historical attacker behavior fingerprint. Here, the historical attack cluster groups can characterize the adversarial attack behaviors suffered by the historical malicious code intelligent detection engine. The similarity between each historical attacker behavior fingerprint included in the historical attack cluster groups and the cluster center is greater than or equal to a preset similarity threshold. For example, the preset similarity threshold can be 0.8. For example, the similarity between each historical attacker behavior fingerprint included in the historical attack cluster groups and the cluster center can be determined by a preset similarity algorithm. For example, the preset similarity algorithm can be a cosine similarity algorithm.

[0092] The second step involves identifying and processing the aforementioned vulnerability matrix to generate a perturbation distribution fingerprint. In practice, the executing entity can use a preset fingerprint recognition algorithm to identify and process the vulnerability matrix to generate a perturbation distribution fingerprint. For example, the preset fingerprint recognition algorithm could be Neural Activation Fingerprinting. As an example, the executing entity can extract the element values ​​corresponding to the high-risk adversarial samples in the vulnerability matrix as the perturbation distribution fingerprint.

[0093] The third step involves traversing the vulnerable parameter point map based on the aforementioned high-risk samples to generate parameter perturbation information. In practice, the executing entity can use a preset parameter traversal algorithm to traverse the vulnerable parameter point map based on the high-risk samples to generate parameter perturbation information. For example, the preset parameter traversal algorithm could be: First, determine the parameter gradient difference for each parameter included in the vulnerable parameter point map. The gradient difference can be the difference between the gradient of the high-risk sample and the gradient of the corresponding clean sample. Second, determine the parameters corresponding to the parameter gradient differences that satisfy the preset parameter gradient conditions as parameter perturbation information. For example, the preset parameter gradient conditions could be: the five parameter gradient differences with the highest gradient differences.

[0094] The fourth step is to determine the above-mentioned perturbation distribution fingerprint, the above-mentioned parameter perturbation information, the above-mentioned code sample feature distance, the above-mentioned malicious code sample category information including the malicious code sample confidence level, and the above-mentioned low-sensitivity area parameter distance set as the attacker behavior fingerprint.

[0095] The fifth step is to determine the fingerprint similarity between the attacker's behavior fingerprint and the historical attack cluster corresponding to the largest historical cluster center weight in the historical cluster center weight reorganization. In practice, the executing entity can use the aforementioned preset similarity algorithm to determine the fingerprint similarity between the attacker's behavior fingerprint and the historical attack cluster corresponding to the largest historical cluster center weight in the historical cluster center weight reorganization, and the cluster centers of the clusters.

[0096] Step 6: In response to determining that the fingerprint similarity is greater than a preset similarity, the attacker's behavior fingerprint is added to the historical attack cluster group corresponding to the fingerprint similarity, resulting in a target attack cluster group. A first update process is then performed on the historical cluster center weight reorganization to generate a new cluster center weight reorganization. For example, the preset similarity can be 0.8. In practice, performing the first update process on the historical cluster center weight reorganization to generate a new cluster center weight reorganization can be as follows: First, in response to determining that the sum of the historical cluster center weights corresponding to the fingerprint similarity in the historical cluster center weight reorganization and a preset weight threshold is less than or equal to a preset total weight threshold, the sum of the historical cluster center weights corresponding to the fingerprint similarity in the historical cluster center weight reorganization and the preset weight threshold is determined as the cluster center update weight. A first update process is then performed on the historical cluster center weight reorganization to generate a new cluster center weight reorganization. For example, the preset weight threshold can be 0.1. The preset total weight threshold can be 1. Secondly, in response to the determination that the sum of the historical cluster center weights corresponding to the fingerprint similarity in the above-mentioned historical cluster center weight reorganization and the preset weight threshold is greater than the preset total weight threshold, the historical cluster center weight reorganization is determined as the cluster center update weight reorganization.

[0097] Step 7: In response to determining that the fingerprint similarity is less than or equal to the preset similarity, based on the attacker's behavior fingerprint, the historical attack cluster group is updated to generate the target attack cluster group, and the historical cluster center weight reorganization is updated a second time to generate a cluster center update weight reorganization. In practice, in response to determining that the fingerprint similarity is less than or equal to the preset similarity, firstly, the executing entity can add the attacker's behavior fingerprint to the attack cluster. Secondly, the executing entity can add the attack cluster to the historical attack cluster group to obtain the target attack cluster group. The attack cluster is initially empty. Then, the executing entity can determine the preset weight as the cluster center weight corresponding to the attack cluster, and add the cluster center weight to the historical cluster center weight reorganization to obtain the cluster center update weight reorganization. For example, the preset weight can be 0.5.

[0098] Step 8: In response to determining that the target attack clusters in the aforementioned target attack cluster group meet the preset forgetting condition, the weights of the aforementioned cluster center update weight reorganization are modified to generate target cluster center weight reorganizations, and the aforementioned target cluster center weight reorganizations and the aforementioned target attack cluster groups are stored in the attack database. The preset forgetting condition may be that the target attack clusters and their corresponding cluster center update weights have not been updated within a preset time period. For example, the preset time period may be 30 days. In practice, firstly, in response to determining that the target attack clusters in the aforementioned target attack cluster group meet the preset forgetting condition, the executing entity can determine the target cluster center weight by multiplying the preset forgetting weight and the cluster center update weight corresponding to the target attack cluster in the aforementioned cluster center update weight reorganization, thereby modifying the weights of the aforementioned cluster center update weight reorganizations to generate target cluster center weight reorganizations. Secondly, the executing entity can store the aforementioned target cluster center weight reorganizations and the aforementioned target attack cluster groups in the attack database. Here, the attack database can be a database used to store the target cluster center weight reorganization and the target attack cluster groups. For example, the preset forgetting weight can be 60%.

[0099] Therefore, firstly, immutable behavioral evidence can be stored through targeted attack clustering: each cluster contains a set of all attack fingerprint nodes belonging to the attacker's identity, preserving all original behavioral feature data and meeting the requirements for attack attribution. Secondly, a unique decision basis can be provided through target cluster center weight reorganization: the weight of the target cluster center directly determines the attribution of a new attack fingerprint, selecting the cluster center with the highest current weight instead of the traditional geometric distance decision. Furthermore, the weight of outdated attackers is gradually reduced, achieving automatic forgetting. Also, matching is only performed when the similarity is greater than 0.8 and the weight is the highest, preventing attackers from contaminating decisions by constructing nearest-neighbor forged fingerprints, thus improving anti-attack capabilities. Therefore, completely separating static behavioral evidence from dynamic decision logic ensures both the immutability and auditability of attack evidence and the adaptive evolution of identity recognition with attack behavior, balancing security, compliance, and efficiency, and solving the core problems of traditional clustering being easily forged and unable to automatically eliminate outdated identities.

[0100] Further reference Figure 3 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of an anomaly detection device for a malicious code intelligent detection engine. These device embodiments are similar to... Figure 1 Corresponding to the method embodiments shown, this anomaly detection device for a malicious code intelligent detection engine can be specifically applied to various electronic devices.

[0101] like Figure 3As shown, the anomaly detection device 300 for a malicious code intelligent detection engine in some embodiments includes: a vulnerability unit 301, a determination unit 302, a construction unit 303, a detection unit 304, and a sending unit 305. The vulnerability scanning unit 301 is configured to perform vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map; the determination unit 302 is configured to determine the perturbation cleanup model and the corresponding hardened intelligent detection engine based on the attack vulnerability matrix and the vulnerability parameter point map; the construction unit 303 is configured to construct a heterogeneous model pool and a meta-classifier based on the hardened intelligent detection engine; the detection unit 304 is configured to perform detection processing on the code sample to be detected based on the perturbation cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map to generate a malicious code sample detection result; and the sending unit 305 is configured to send the malicious code sample detection result to the alarm terminal for alarm processing in response to determining that the malicious code sample detection result meets the preset abnormal sample conditions.

[0102] It is understandable that the units described in the anomaly detection device 300 for the intelligent malicious code detection engine are related to the reference... Figure 1 The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the anomaly detection device 300 and its constituent units for the malicious code intelligent detection engine, and will not be repeated here.

[0103] The following is for reference. Figure 4 It shows a schematic diagram of the structure of an electronic device (e.g., a computing device) 400 suitable for implementing some embodiments of the present disclosure. Figure 4 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0104] like Figure 4 As shown, the electronic device 400 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory 402 or a program loaded from a storage device 408 into a random access memory 403. The random access memory 403 also stores various programs and data required for the operation of the electronic device 400. The processing unit 401, the read-only memory 402, and the random access memory 403 are interconnected via a bus 404. An input / output interface 405 is also connected to the bus 404.

[0105] Typically, the following devices can be connected to the input / output interface 405: input devices 406 including, for example, a touchscreen, touchpad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; output devices 407 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 408 including, for example, magnetic tape, hard disk, etc.; and communication devices 409. Communication device 409 allows electronic device 400 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 4 An electronic device 400 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 4 Each box shown can represent a device or multiple devices as needed.

[0106] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 409, or installed from a storage device 408, or installed from a read-only memory 402. When the computer program is executed by the processing device 401, it performs the functions defined in the methods of some embodiments of this disclosure.

[0107] It should be noted that, in some embodiments of this disclosure, the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0108] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0109] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: perform vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map; based on the attack vulnerability matrix and the vulnerability parameter point map, determine the perturbation cleanup model and the corresponding hardened intelligent detection engine for the aforementioned malicious code intelligent detection engine; based on the hardened intelligent detection engine, construct a heterogeneous model pool and a meta-classifier; based on the perturbation cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map, perform detection processing on the code sample to be detected to generate a malicious code sample detection result; and in response to determining that the malicious code sample detection result meets preset abnormal sample conditions, send the malicious code sample detection result to an alarm terminal for alarm processing.

[0110] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0111] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0112] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0113] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. An anomaly detection method for a malicious code intelligent detection engine, characterized in that, include: The malicious code intelligent detection engine is subjected to vulnerability scanning to generate an attack vulnerability matrix and a vulnerability parameter point map; Based on the attack vulnerability matrix and the vulnerability parameter point map, determine the hardening intelligent detection engine corresponding to the perturbation cleanup model and the malicious code intelligent detection engine; Based on the aforementioned reinforced intelligent detection engine, a heterogeneous model pool and a meta-classifier are constructed. Based on the disturbance cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map, the code sample to be detected is processed to generate malicious code sample detection results. In response to determining that the detection result of the malicious code sample meets the preset abnormal sample conditions, the detection result of the malicious code sample is sent to the alarm terminal for alarm processing.

2. The anomaly detection method for a malicious code intelligent detection engine according to claim 1, characterized in that, The vulnerability scanning process performed on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map includes: The malicious code intelligent detection engine is subjected to adversarial attack simulation processing to generate a set of adversarial samples of malicious code; Determine the attack vulnerability matrix corresponding to the set of malicious code adversarial samples; The malicious code intelligent detection engine is subjected to parameter vulnerability detection processing to generate a vulnerability parameter location map.

3. The anomaly detection method for a malicious code intelligent detection engine according to claim 2, characterized in that, The step of performing parameter vulnerability detection processing on the malicious code intelligent detection engine to generate a vulnerability parameter location map includes: The malicious code intelligent detection engine is modularly deconstructed to generate a modular unit set, wherein the modular units in the modular unit set include: a module parameter space set; Determine the sensitivity corresponding to each module parameter space included in each modular unit of the modular unit set to obtain a sensitivity set; The sensitivity that satisfies the preset low sensitivity condition in the sensitivity group set and the corresponding module parameter space are determined as low sensitivity regions, thus obtaining a low sensitivity region set; Based on the set of low-sensitivity regions, a vulnerability parameter point map is determined.

4. The anomaly detection method for a malicious code intelligent detection engine according to claim 1, characterized in that, The step of determining the hardening intelligent detection engine corresponding to the perturbation cleanup model and the malicious code intelligent detection engine based on the attack vulnerability matrix and the vulnerability parameter point map includes: A predetermined initial malicious code pre-trained model set is fine-tuned to generate a malicious code replacement model set, wherein the predetermined initial malicious code pre-trained model set is determined based on the attack vulnerability matrix; The malicious code substitution model set is subjected to adversarial attack simulation processing to generate a diverse set of adversarial samples; Based on the diverse set of adversarial samples, a perturbation cleanup model is determined; Based on the vulnerability parameter point map, the malicious code intelligent detection engine is hardened to generate a hardened intelligent detection engine.

5. The anomaly detection method for a malicious code intelligent detection engine according to claim 4, characterized in that, The process of hardening the malicious code intelligent detection engine based on the vulnerability parameter point map to generate a hardened intelligent detection engine includes: Based on the vulnerability parameter point map, the malicious code intelligent detection engine is subjected to pseudo-quantization node insertion processing to generate a pseudo-quantization detection engine. Based on a pre-determined malicious code information matrix, the security zone information corresponding to the pseudo-quantization detection engine is determined; Based on the security zone information and a pre-determined dynamic masking network for malicious code, the pseudo-quantization detection engine is subjected to weight update processing to generate a reinforced intelligent detection engine.

6. The anomaly detection method for an intelligent malicious code detection engine according to claim 1, characterized in that, The process of detecting and processing the code sample to be detected based on the perturbation cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier, and the vulnerability parameter point map to generate malicious code sample detection results includes: Based on the reinforced intelligent detection engine, the code sample feature distance between the code sample to be detected and the corresponding clean sample of the same type is determined. Based on the perturbation cleanup model, the heterogeneous model pool, and the meta-classifier, the malicious code sample category information corresponding to the code sample to be detected is determined, wherein the malicious code sample category information includes: malicious code sample confidence. Based on the reinforced intelligent detection engine and the vulnerability parameter location map, the parameter set of low-sensitivity areas is determined; Determine the original parameter set corresponding to the low-sensitivity region parameter set and the low-sensitivity region parameter distance set corresponding to the low-sensitivity region parameter set; The code sample feature distance, the malicious code sample confidence level included in the malicious code sample category information, and the low-sensitivity area parameter distance set are weighted and fused to generate an adversarial risk score. In response to determining that the adversarial risk score is greater than a preset risk score, an enhanced defense mode is activated based on the code sample to be detected; In response to determining that the adversarial risk score is less than or equal to the preset risk score, and in response to determining that the code sample feature distance, the malicious code sample confidence included in the malicious code sample category information, and the low-sensitivity area parameter distance set satisfy the preset adversarial anomaly condition, the code sample to be detected is identified as a target malicious code adversarial sample, and the preset adversarial information corresponding to the target malicious code adversarial sample is identified as the malicious code sample detection result.

7. The anomaly detection method for a malicious code intelligent detection engine according to claim 6, characterized in that, The step of determining the malicious code sample category information corresponding to the code sample to be detected based on the perturbation cleanup model, the heterogeneous model pool, and the meta-classifier includes: The code sample to be detected is input into the perturbation cleanup model to obtain the code perturbation cleanup sample; The heterogeneous model pool is filtered to generate a target heterogeneous model set; The code perturbation cleanup sample is input into the target heterogeneous model set to obtain a malicious code sample output result set; The malicious code sample output result set is subjected to weighted voting processing to generate malicious code sample weighted information; The malicious code sample output result set is subjected to target detection processing to generate malicious code sample detection information; In response to determining that the weighted information of the malicious code sample and the detection information of the malicious code sample satisfy a preset divergence condition, the category information of the malicious code sample is determined based on the weighted information of the malicious code sample, the detection information of the malicious code sample, and the meta-classifier.

8. The anomaly detection method for a malicious code intelligent detection engine according to claim 6, characterized in that, The step of activating the enhanced defense mode based on the code sample to be detected includes: The code sample to be detected is identified as a high-risk sample, and the preset high-risk information corresponding to the high-risk sample is identified as the malicious code sample detection result. The high-risk adversarial samples are added to the diverse adversarial sample set corresponding to the attack vulnerability matrix; In response to the determination that the added diverse adversarial sample set meets the preset quantity condition, the perturbation cleanup model and the meta-classifier are updated.

9. An anomaly detection device for an intelligent malicious code detection engine, characterized in that, include: The vulnerability scanning unit is configured to perform vulnerability scanning on the malicious code intelligent detection engine to generate an attack vulnerability matrix and a vulnerability parameter point map. The determining unit is configured to determine the perturbation cleanup model and the hardening intelligent detection engine corresponding to the malicious code intelligent detection engine based on the attack vulnerability matrix and the vulnerability parameter point map; The building unit is configured to build a heterogeneous model pool and a meta-classifier based on the reinforced intelligent detection engine; The detection unit is configured to perform detection processing on the code sample to be detected based on the disturbance cleanup model, the hardened intelligent detection engine, the heterogeneous model pool, the meta-classifier and the vulnerability parameter point map, so as to generate malicious code sample detection results; The sending unit is configured to send the malicious code sample detection result to the alarm terminal for alarm processing in response to determining that the malicious code sample detection result meets the preset abnormal sample conditions.

10. An electronic device, characterized in that, include: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 8.

Images