Method, device and program product for detecting malicious code based on swarm control

Abstract

The application discloses a malicious code detection method, device and program product based on swarm control, and the method comprises the following steps: a swarm detection model is constructed, a hired bee analyzes the risk of known features of each to-be-detected sample to obtain a risk analysis fitness, and the initial pheromone concentration of nodes in a threat pheromone field is calculated according to the risk analysis fitness; a follower bee calculates a pheromone probability according to the initial pheromone concentration of each node, filters high-value sample nodes for secondary verification processing according to the pheromone probability, and obtains a secondary verification result; an investigation bee performs deep behavior feature analysis on abnormal sample nodes to obtain a feature investigation result; the pheromone concentration of each node is updated according to the secondary verification result or the feature investigation result to obtain calibrated pheromone concentration; and a malicious code detection result is output according to the calibrated pheromone concentration. The application realizes efficient and high-accuracy malicious code detection with self-adaptive optimization capability.

Description

Technical Field

[0001] This invention relates to the field of computer malware detection technology, and in particular to malware detection methods, devices and program products based on swarm control. Background Technology

[0002] Malicious code detection is a crucial component of cybersecurity protection. With the rapid increase in the amount of malicious code, traditional detection methods face severe challenges. Malicious code authors are constantly employing new obfuscation techniques and evasion methods, making detection increasingly difficult.

[0003] To address this technical problem, current solutions include: First, signature-based malware detection methods. This method extracts malware signatures to build a signature database for matching and detection. However, the signature database is outdated, making it difficult to detect new types of malware and limiting its ability to detect variant malware. Second, machine learning-based malware detection methods. This method uses machine learning algorithms to classify and identify malware. However, it requires a large number of labeled samples, resulting in high model training costs and insufficient generalization ability for new types of malware. Third, behavior analysis-based malware detection methods. This method runs suspicious programs in a sandbox environment and monitors their behavioral characteristics. However, the sandbox environment differs from the real environment, making it easy to be bypassed by anti-sandbox technologies and resulting in low analysis efficiency.

[0004] In summary, existing detection methods lack adaptive optimization capabilities and struggle to cope with ever-changing malware threats. Distributed detection systems also lack effective collaboration mechanisms, resulting in low detection efficiency and insufficient resource utilization.

[0005] Therefore, there is an urgent need to invent a new method for detecting malicious code to solve the problems of existing technologies, such as lack of adaptive optimization capabilities and low detection efficiency. Summary of the Invention

[0006] In view of this, embodiments of the present invention provide a malicious code detection method, device and program product based on swarm control, which at least partially solves the problems existing in the prior art.

[0007] Other features and advantages of the invention will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0008] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0009] According to a first aspect of the present invention, a malicious code detection method based on swarm control is provided, the method comprising:

[0010] Construct a bee colony detection model, which includes mercenary bees, follower bees, and scout bees;

[0011] The hired bees perform risk analysis on the known characteristics of each sample to be tested to obtain the risk analysis fitness, and calculate the initial pheromone concentration of the sample node corresponding to the sample to be tested in the threat pheromone field based on the risk analysis fitness.

[0012] The following bee calculates the pheromone probability of each sample node based on the initial pheromone concentration of each sample node in the threat pheromone field, selects high-value sample nodes based on the pheromone probability, and performs secondary verification on the high-value sample nodes to obtain the secondary verification result.

[0013] The reconnaissance bee performs in-depth behavioral feature analysis on abnormal sample nodes other than high-value sample nodes to obtain feature reconnaissance results;

[0014] Based on the secondary verification result or the feature detection result, the pheromone concentration of the corresponding sample node in the threat pheromone field is updated to obtain the calibration pheromone concentration;

[0015] Based on the calibrated pheromone concentration and the detection threshold adaptively adjusted according to the pheromone distribution, the malicious code detection result is output.

[0016] Furthermore, the known features include static features, behavioral features, and environmental features;

[0017] The static features include hash, PE / ELF segment information, import table, string, opcode n-gram, shell / compression tag, and entropy value;

[0018] The behavioral characteristics include API / system call sequences, process creation, file read / write, registry / configuration item modification, network domain name / IP / port access, privilege escalation, and persistence behavior;

[0019] The environmental characteristics include execution path, device type, time window, and handling feedback.

[0020] Furthermore, risk analysis is performed on the known characteristics of each sample to be tested to obtain the risk analysis fitness, including:

[0021] Among the hired bees, for the sample to be tested The known features are used for risk analysis to obtain risk analysis results. The risk analysis process includes risk rule matching, similarity calculation, and risk scoring. The risk analysis results include rule hit confidence. Feature similarity Behavioral risks Attack phase weights and resource costs ;

[0022] The risk analysis fitness of the sample to be tested is calculated based on the risk analysis results. The calculation formula is: Where a, b, c, d, and e are preset weight coefficients, and norm is a normalization function.

[0023] Furthermore, the threat pheromone field is a weighted graph structure G=(V,E,τ), where node v includes sample nodes, feature nodes, detector nodes, and processing feedback nodes corresponding to the sample to be detected, and edge E represents the association relationship between the nodes. This represents the pheromone concentration of node v or edge E.

[0024] Furthermore, based on the initial pheromone concentration of each sample node in the threat pheromone field, the pheromone probability corresponding to each sample node is calculated. High-value sample nodes are then selected based on the pheromone probabilities, and secondary verification is performed on the high-value sample nodes to obtain the secondary verification results, including:

[0025] Based on the initial pheromone concentration of each sample node in the threat pheromone field, the pheromone probability corresponding to each sample node is calculated using the following formula: ,in, Let be the pheromone probability corresponding to the i-th sample node. Let be the initial pheromone concentration of the i-th sample node. This represents the total pheromone concentration of all sample nodes in the set of sample nodes for which the current detection cycle has not yet ended. To prevent the elimination of zero factors;

[0026] High-value sample nodes are selected based on the pheromone probability of each sample node and a preset probability threshold.

[0027] The high-value sample nodes are subjected to secondary verification based on preset secondary verification rules to obtain secondary verification results. The preset secondary verification rules include static rules, behavioral models, or multi-engine detectors.

[0028] Furthermore, deep behavioral feature analysis is performed on anomalous sample nodes other than high-value sample nodes to obtain feature detection results, including:

[0029] For abnormal sample nodes other than high-value sample nodes, extract the abnormal behavior data of the sample to be detected corresponding to the abnormal sample node to generate exploration seeds;

[0030] The exploration seed is subjected to random perturbation, feature combination expansion, neighbor sample clustering, and sandbox behavior replay processing to generate deep behavioral features;

[0031] The novelty score of the deep behavioral features is obtained by comparing them with a known threat feature database.

[0032] If the novelty score of the sample to be tested is greater than the preset novelty threshold, and the behavioral risk corresponding to the sample to be tested is... If the risk exceeds a preset behavioral risk threshold, a new feature node corresponding to the deep behavioral feature is created in the threat pheromone field, and the pheromone concentration is initialized.

[0033] If the novelty score of the sample to be tested is less than or equal to the preset novelty threshold, or if the behavioral risk of the sample to be tested is... If the risk threshold is less than or equal to the preset risk threshold, the current deep exploration will be terminated and the sample to be tested will be transferred to the low pheromone monitoring queue. The evidence summary will be retained and a suspected alarm will be output when the risk is still high.

[0034] Further, based on the secondary verification result or the feature detection result, the pheromone concentration of the corresponding sample node in the threat pheromone field is updated to obtain the calibrated pheromone concentration, including:

[0035] Based on the secondary verification result or the feature detection result, update the pheromone concentration of the node corresponding to the sample to be detected in the threat pheromone field. The formula for calculating the pheromone concentration is as follows: ,in, This represents the pheromone concentration of the i-th node at time t+1. This indicates the confidence level of the second-order validation. This indicates the weight of the attack stage corresponding to the sample of the node. This indicates feedback on historical isolation, containment, or release procedures that have been confirmed before the start of the current testing cycle. To preset the impact factor weights, This is the preset evaporation coefficient.

[0036] Furthermore, the calculation formula for the detection threshold based on adaptive adjustment of pheromone distribution is as follows: ,in, , To preset the initial threshold, The normalized entropy represents the pheromone distribution. This indicates the false alarm rate for the current detection cycle. These are the preset distribution entropy coefficient, preset false alarm rate coefficient, and preset concentration coefficient, respectively.

[0037] According to a second aspect of the present invention, a malicious code detection device based on swarm control is provided, the device comprising: a processor and a memory;

[0038] The memory is used to store one or more program instructions;

[0039] The processor is configured to run one or more program instructions to perform the steps of the swarm-based malicious code detection method as described in any of the preceding embodiments.

[0040] According to a third aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to implement the steps of the swarm control-based malicious code detection method as described in any of the preceding claims.

[0041] The present invention provides a method, device, and program product for malware detection based on swarm control. The method includes: constructing a swarm detection model; employing bees to perform risk analysis on known features of each sample to be detected, obtaining risk analysis fitness, and calculating the initial pheromone concentration of nodes in the threat pheromone field based on the risk analysis fitness; employing follower bees to calculate pheromone probabilities based on the initial pheromone concentration of each node, and selecting high-value sample nodes for secondary verification based on the pheromone probabilities to obtain secondary verification results; employing scout bees to perform deep behavioral feature analysis on abnormal sample nodes to obtain feature detection results; updating the pheromone concentration of each node based on the secondary verification results or feature detection results to obtain a calibration pheromone concentration; and outputting malware detection results based on the calibration pheromone concentration. This invention achieves highly efficient and accurate malware detection with adaptive optimization capabilities. Attached Figure Description

[0042] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0043] Figure 1 This is a flowchart illustrating the malicious code detection method based on bee colony control provided in an embodiment of the present invention. Detailed Implementation

[0044] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0045] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0046] Figure 1 A flowchart of a malicious code detection method based on swarm control according to an embodiment of the present invention is shown.

[0047] like Figure 1 As shown, the malicious code detection method based on swarm control according to an embodiment of the present invention may include steps S100, S200, S300, S400, S500 and S600.

[0048] In step S100, a bee colony detection model is constructed, which includes hired bees, follower bees, and scout bees.

[0049] Specifically, hired bees are used for rapid verification of known families, follower bees are used for probability verification of high pheromone strategies, and scout bees are used for exploration and discovery in unknown spaces.

[0050] In this invention, the terms "hired bee," "follower bee," and "scout bee" all refer to logical detection task roles. The swarm detection model is a hybrid control model composed of an artificial swarm role division mechanism and a threat pheromone field mechanism. Pheromones concentration is used to characterize the threat level of a sample, the reliability of the detector, or the effectiveness of the handling strategy. During initialization, a BeeNode data structure is established for each sample to be detected, recording at least the sample identifier, feature vector, behavioral event index, current pheromone concentration, processing status, assigned role, number of retries, and evidence chain reference. All samples first enter the hired bee queue. After the hired bees output their fitness and initial pheromone, high-value samples are placed in a pending review state and assigned to the follower bee queue. Samples with low pheromone but anomaly reaching the scout threshold are placed in a pending scout state and assigned to the scout bee queue. The remaining samples are placed in a low-risk pending output state. The number of instances for each role is dynamically allocated based on the number of available detectors, queue length, and the resource budget for the current cycle. After a task times out, it is retried once; samples that are still incomplete are entered into the suspected alarm queue.

[0051] Bee colony control (BCC) is an intelligent optimization algorithm that simulates the behavior of bee colonies. It features self-organization, adaptability, and robustness, and has been widely applied in combinatorial optimization, path planning, and data mining. Applying BCC to malware detection enables adaptive optimization of detection strategies and collaborative operation of multiple detectors.

[0052] Next, in step S200, the hired bees perform risk analysis on the known characteristics of each sample to be detected, obtain the risk analysis fitness, and calculate the initial pheromone concentration of the sample node corresponding to the sample to be detected in the threat pheromone field based on the risk analysis fitness.

[0053] Specifically, the above steps include:

[0054] Among the hired bees, the samples to be tested The known features are used for risk analysis to obtain risk analysis results. Risk analysis includes risk rule matching, similarity calculation, and risk scoring. The risk analysis results include rule hit confidence. Feature similarity Behavioral risks Attack phase weights and resource costs .

[0055] The risk analysis fitness of the sample to be tested is calculated based on the risk analysis results. The calculation formula is: Where a, b, c, d, and e are preset weight coefficients, and norm is a normalization function.

[0056] If the rule is hit but the behavioral risk is low, the fitness is adjusted by feature similarity and attack phase weights; if the behavioral risk is high but the static features are unknown, the fitness can still be adjusted. and Maintain a high value to support the discovery of unknown threats.

[0057] Known features include static features, behavioral features, and environmental features; static features include hashes, PE / ELF section information, import tables, strings, opcode n-grams, shell / compression tags, and entropy values; behavioral features include API / system call sequences, process creation, file read / write, registry / configuration item modification, network domain name / IP / port access, privilege escalation, and persistence behavior; environmental features include execution path, device type, time window, and handling feedback.

[0058] The rule hit confidence C_i is the highest confidence of the hit rule; the feature similarity S_i is the similarity between the sample and the most similar object in the known threat feature library; the behavioral risk B_i is the malicious probability output by the behavioral detection model; the attack stage weight A_i is obtained according to the preset attack stage severity mapping table; and the resource cost Cost_i is obtained by weighting the expected detection time, memory usage, and sandbox usage. All variables are normalized to 0 to 1. In fitness, a, b, c, d, and e are all non-negative weights, and the sum of their weights is 1. The initial pheromone concentration is mapped according to τ_i^0 = τ_min + (τ_max - τ_min)·F_i, where F_i is the normalized risk analysis fitness, 0 ≤ τ_min < τ_max ≤ 1. The handling feedback in the environmental features only uses historical feedback that has been confirmed before the start of the current detection cycle. The handling results generated in the current cycle are used for the next cycle update to avoid using the results of this round for the current round's judgment prematurely.

[0059] In step S300, the following bee calculates the pheromone probability corresponding to each sample node based on the initial pheromone concentration of each sample node in the threat pheromone field, selects high-value sample nodes based on the pheromone probability, performs secondary verification on the high-value sample nodes, and obtains the secondary verification result.

[0060] Specifically, the above steps include:

[0061] Based on the initial pheromone concentration of each sample node in the threat pheromone field, the pheromone probability corresponding to each sample node is calculated using the following formula: ,in, Let be the pheromone probability corresponding to the i-th sample node. Let be the initial pheromone concentration of the i-th sample node. This represents the total pheromone concentration of all sample nodes in the set of sample nodes for which the current detection cycle has not yet ended. To prevent the elimination of zero factors.

[0062] High-value sample nodes are selected based on the pheromone probability of each sample node and a preset probability threshold.

[0063] High-value sample nodes are subjected to secondary verification based on preset secondary verification rules to obtain secondary verification results. The preset secondary verification rules include static rules, behavioral models, or multi-engine detectors.

[0064] Follower bees select only from the set of sample nodes that have not yet terminated in the current cycle, and select samples that do not exceed the upper limit of verification resources according to the pheromone probability from high to low. When the total pheromone is zero, uniform probability is used. When the sample probabilities are the same, they are sorted in order of behavioral risk, attack phase weight, and arrival time. At least one effective secondary detector is called for the selected sample. Each detector outputs a confidence level between 0 and 1, and the samples are weighted and fused according to the accuracy of the detectors on a fixed validation set. If all detectors time out or do not return valid results, the sample is transferred to the reconnaissance bee queue or the suspected alarm queue, and no benign conclusion is directly output.

[0065] The aforementioned threat pheromone field is a weighted graph structure G=(V,E,τ), where node v includes the sample node, feature node, detector node, and action feedback node corresponding to the sample to be detected, and edge E represents the association relationship between the nodes. This represents the pheromone concentration of node v or edge E. During construction, static and dynamic features are first extracted from the samples and normalized. Then, τ is initialized based on hit confidence, similarity, attack phase weights, time decay, and disposal feedback. Subsequently, the pheromone concentration is diffused and decayed between adjacent nodes according to edge weights, so that similar samples, relevant behavioral evidence, and effective detectors share threat intensity.

[0066] In the threat pheromone field, sample nodes record the state of the sample to be detected, feature nodes record static or behavioral features, detector nodes record rules, behavioral models, or multi-engine detectors, and action feedback nodes record confirmed action results. Node pheromones are denoted as τ_i, and edge weights w_ij represent the strength of sample similarity, feature co-occurrence, detection calls, or action associations. Node pheromones and edge weights use different symbols. The pheromone gradient between adjacent nodes is calculated based on the node pheromone difference and edge weights. Follower bees prioritize regions with high pheromones and large gradients, while reconnaissance bees prioritize regions with low pheromones but high pre-detection anomaly levels.

[0067] The calculation of pheromone concentration is based on factors including: detector hit confidence, similarity to homologous samples, integrity of the behavioral chain, severity of the attack phase, sample appearance time, treatment success rate, and false alarm feedback. The update steps are as follows: collect detection evidence, calculate fitness, decay old pheromones according to the evaporation coefficient, superimpose the confirmation signal and treatment feedback from the current round, reduce the concentration for inefficient or false alarm strategies, and provide high-concentration areas to follower bees and scout bees as a basis for selecting the next round of detection strategies.

[0068] In step S400, the reconnaissance bee performs in-depth behavioral feature analysis on abnormal sample nodes other than high-value sample nodes to obtain feature detection results.

[0069] Specifically, the above steps include:

[0070] For anomalous sample nodes other than high-value sample nodes, the anomalous behavior data of the sample to be detected corresponding to the anomalous sample nodes are extracted to generate exploration seeds. The aforementioned anomalous sample nodes are based on low pheromone regions, unknown file types, anomalous behavior fragments, newly emerging network connections, and high-risk samples with low similarity.

[0071] The exploration seeds are subjected to random perturbation, feature combination expansion, neighbor sample clustering, and sandbox behavior replay processing to generate deep behavioral features.

[0072] By comparing deep behavioral features with a known threat feature database, a novelty score for the deep behavioral features is obtained.

[0073] For samples not selected by follower bees, a pre-detection anomaly score is calculated based on behavioral risk, low similarity, and outlier degree within the current window. When a sample's pheromone probability is below the high-value threshold and the pre-detection anomaly score reaches the detection threshold, the sample is assigned to a scout bee. The exploration seed includes at least the sample identifier, behavioral event sequence, process graph, network connectivity, and execution environment snapshot. Random perturbations only apply masking, reweighting, or time window shifting to extracted non-critical features, and the random seed and perturbation count are recorded without modifying the original evidence. The novelty score is calculated by normalizing the complement of the highest similarity between the tested deep behavioral feature and the known threat feature library; when the known threat feature library is empty, the novelty score is 1.

[0074] If the novelty score of the sample to be tested is greater than the preset novelty threshold, and the behavioral risk corresponding to the sample to be tested is... If the risk exceeds the preset behavioral risk threshold, a new feature node corresponding to the deep behavioral feature is created in the threat pheromone field, and the pheromone concentration is initialized.

[0075] If the novelty score of the sample to be tested is less than or equal to the preset novelty threshold, or if the behavioral risk of the sample to be tested is... If the risk threshold is less than or equal to the preset risk threshold, the current deep exploration will be terminated and the sample to be tested will be transferred to the low pheromone monitoring queue. The evidence summary will be retained and a suspected alarm will be output when the risk is still high.

[0076] The reconnaissance mission terminates when a new feature meeting the novelty and behavioral risk conditions is discovered, the maximum number of perturbations or replays is reached, or the mission time limit or resource budget is exceeded. Samples that do not create new feature nodes are returned to the low pheromone monitoring queue and their evidence summaries are retained. Samples that still cannot be determined and are of high risk are flagged as potentially problematic and are not directly released as benign samples. When the sandbox is unavailable or behavioral replay fails, the exploration seed and the reason for failure are saved, and the reconnaissance mission is reassigned in the next detection cycle after resources are restored.

[0077] This invention selects detection strategies based on pheromone gradients. According to the concentration of pheromone distribution, gradient strength, and relationships between adjacent feature clusters, it determines the detection strategy of prioritizing verification by follower bees and the feature regions that prioritize exploration by reconnaissance bees. High gradient regions indicate concentrated threat evidence, suitable for rapid verification and handling; low pheromone but high anomaly levels indicate potential unknown threats, suitable for exploration by reconnaissance bees. This achieves a dynamic balance between known threat verification, similar variant expansion, and unknown threat discovery.

[0078] In step S500, based on the secondary verification results or feature detection results, the pheromone concentration of the corresponding sample node in the threat pheromone field is updated to obtain the calibration pheromone concentration.

[0079] Specifically, the above steps include:

[0080] Based on the secondary verification results or feature detection results, update the pheromone concentration of the corresponding node of the sample to be detected in the threat pheromone field. The formula for calculating the pheromone concentration is as follows: ,in, This represents the pheromone concentration of the i-th node at time t+1. This indicates the confidence level of the second-order validation. This indicates the weight of the attack stage corresponding to the sample of the node. This indicates feedback on historical isolation, containment, or release procedures that have been confirmed before the start of the current testing cycle. To preset the impact factor weights, This is the preset evaporation coefficient.

[0081] If the same node generates false alarms consecutively, then Negative values ​​are taken and the corresponding pheromone levels are reduced; if both the follow-bee review and the handling results confirm malicious activity, the pheromone levels of the node and its adjacent feature edges are increased. Through the above multi-factor updates, the pheromone field can simultaneously reflect the detection hit rate, timeliness, attack stage, and handling effectiveness, rather than just the number of hits of a single rule.

[0082] This invention converts the handling results (isolation, blocking, release, manual confirmation, or false alarm marking) into Feedback_i, which is then used to update pheromones and detector weights in the next detection cycle. Policies that confirm malicious activity and are successfully handled are enhanced in the next cycle, while policies that result in false alarms or failed handling are suppressed. Through this feedback loop, the detection strategy can continuously adjust detector weights, thresholds, and role assignments based on the actual handling effects, while avoiding the premature use of handling results not yet generated in the current cycle for the current cycle's judgment.

[0083] After pheromone updates, node pheromone levels are limited to between a preset minimum and maximum pheromone level. When the same node's pheromone level falls below the elimination threshold for multiple consecutive periods and no valid evidence is generated, the task allocation weight of the corresponding detector is reduced, and the sample is returned to the reconnaissance candidate set. When all samples enter a malicious, benign, or suspected alarm termination state, the maximum change in pheromone level is less than the convergence threshold for multiple consecutive periods, the maximum number of iterations is reached, or the resource budget for this period is exhausted, the detection result output step is initiated; otherwise, the process returns to the follower bee stage, and the follower bees and reconnaissance bees are redistributed using the updated pheromone field. The isolation, blocking, release, and manual confirmation results generated in the current period are collected after output and used for pheromone and detector weight updates in the next detection period.

[0084] Finally, in step S600, the malicious code detection result is output based on the calibrated pheromone concentration and the detection threshold adaptively adjusted based on the pheromone distribution.

[0085] Specifically, the calculation formula for the detection threshold based on adaptive adjustment of pheromone distribution is as follows: ,in, This indicates the concentration of high-value threat clusters. A higher G indicates more concentrated evidence, and the threshold can be appropriately lowered to improve response speed. To preset the initial threshold, The normalized entropy represents the pheromone distribution. A higher threshold indicates a more dispersed pheromone distribution and higher detection uncertainty; therefore, the threshold should be increased. This indicates the false alarm rate for the current detection cycle. The higher the threshold, the more it is raised to suppress false alarms. These are the preset distribution entropy coefficient, preset false alarm rate coefficient, and preset concentration coefficient, respectively.

[0086] The dynamic detection threshold is limited to between a preset minimum threshold and a preset maximum threshold. When the number of current valid sample nodes is less than or equal to 1, the normalized entropy is set to 0. When there are insufficient manually confirmed samples or the denominator of the false alarm rate is 0, the previous valid false alarm rate is used; if there is no previous valid value, it is set to 0. When there is no valid feedback in the current period, the preset initial threshold is used. When the confidence level of malicious judgment is greater than or equal to the dynamic detection threshold and the key evidence chain is complete, a malicious conclusion is output. When it is lower than the low-risk threshold and there is no mandatory high-risk rule, a benign conclusion is output. In other cases, a suspected alarm is output and manual review is initiated.

[0087] Preferably, the confidence level of malicious intent is calculated using the normalized calibration pheromone concentration, the hit score of known features of hired bees, the verification score of follower bees, the verification score of follower bees, the unknown threat exploration score of scout bees, and the feedback from handling or manual verification. It is then determined whether the confidence level of malicious intent is greater than the detection threshold adaptively adjusted based on the pheromone distribution. If it is greater than the detection threshold and the key evidence chain is complete, a malicious intent judgment is output. When only some evidence meets the conditions, a suspected alarm is output and the verification process begins.

[0088] The aforementioned malware detection results are structured alert records, including malware type, suspected malware family, threat level, overall confidence level, triggering role, hit characteristics, pheromone concentration, threshold version, and handling recommendations. If the evidence chain meets the integrity requirements, blocking, isolation, or removal recommendations are output; if the evidence is insufficient but the risk is high, a review alert is output, and the sample hash, behavior log, detector number, and role processing trajectory are retained to facilitate subsequent manual review, model updates, and patent enforcement evidence collection.

[0089] When outputting alarms, this invention not only provides a malicious or non-malicious conclusion, but also records the characteristics of the hired bee hit, the verification path of the follower bee, the exploration characteristics of the scout bee, changes in pheromone concentration, dynamic thresholds, and handling feedback. This evidence is aggregated according to sample identifiers, feature clusters, detector nodes, and role processing timelines to form a verifiable alarm evidence chain, thereby supporting subsequent source tracing analysis, manual verification, and product-side evidence collection.

[0090] In a non-limiting embodiment, a detection cycle is defined as 5 minutes, with a=0.20, b=0.20, c=0.30, d=0.20, e=0.10, τ_min=0.05, and τ_max=1. For a sample, C_i=0.8, S_i=0.3, Bi=0.9, A_i=0.8, and Cost_i=0.4. According to the fitness formula, F_i=0.61, and the initial pheromone concentration is 0.6295. The system assigns samples with pheromone probabilities in the top 10% to follower bees for verification, and samples not in the top 10% but with a pre-detection anomaly score not lower than 0.65 to reconnaissance bees. The maximum number of iterations is 5, the convergence threshold is 0.01, and the system terminates when the convergence condition is met for two consecutive iterations. The above values ​​are used to illustrate the calculation process and can be adjusted according to a fixed validation set; they do not constitute a limitation on the scope of protection.

[0091] In addition, this embodiment of the invention also provides a malicious code detection device based on swarm control, the device comprising: a processor and a memory; the memory for storing one or more program instructions; the processor for running one or more program instructions to perform the steps of the malicious code detection method based on swarm control as described above.

[0092] In addition, embodiments of the present invention also provide a computer program product, which includes computer program instructions that, when executed by a processor, implement the steps of the malicious code detection method based on swarm control as described above.

[0093] To address the shortcomings of existing technologies, this invention employs a bee colony control algorithm to simulate bee foraging behavior, achieving adaptive optimization of feature search; this invention designs a pheromone concentration update mechanism to dynamically adjust the detection strategy based on detection results; this invention constructs a bee colony collaborative detection framework, realizing collaborative work and resource sharing among multiple detectors.

[0094] Previous literature has covered artificial bee colony algorithms, SVM feature optimization, DDoS detection, and swarm intelligence malicious device detection. This invention is not merely "using bee colony algorithms for classification," but rather: maps malicious code samples, behavioral evidence, detector nodes, and handling strategies into a threat pheromone field; hired bees, follower bees, and reconnaissance bees correspond to known family verification, similar sample expansion, and unknown threat exploration, respectively; pheromone concentration is updated jointly by hit confidence, time decay, attack stage, and handling feedback, forming a detection-verification-handling closed loop.

[0095] Compared with existing technologies, the present invention has the following technical advantages:

[0096] This invention shifts from general manual bee colony optimization to a collaborative approach involving malicious code threat pheromone fields and closed-loop detection. The reconnaissance bee role actively explores low-similarity but high-risk samples, increasing the chances of unknown threats being further analyzed and discovered. Multi-role bee colony collaboration aggregates evidence, reducing duplicate alerts and lowering alert noise. Feedback from actions participates in pheromone updates, allowing the detection strategy to adjust as the threat evolves, achieving adaptive strategy. This invention reduces manual review, improves detection task convergence efficiency within resource budget, and increases the chances of discovering unknown threat families.

[0097] In this embodiment of the invention, the processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in this embodiment of the invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in this embodiment of the invention can be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software modules can be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The processor reads information from the storage medium and, in conjunction with its hardware, completes the steps of the above methods. The storage medium can be memory, for example, volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM).The storage media described in the embodiments of this invention are intended to include, but are not limited to, these and any other suitable types of memory. Those skilled in the art will recognize that the functions described in the above examples can be implemented using a combination of hardware and software. When applied software, the corresponding functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of computer programs from one place to another. Storage media can be any available medium accessible to general-purpose or special-purpose computers. Although the invention has been described in detail above with general description and specific embodiments, modifications or improvements can be made to it, which will be apparent to those skilled in the art. Therefore, such modifications or improvements made without departing from the spirit of the invention are all within the scope of protection claimed by the invention.

[0098] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications, equivalent changes, or alterations made by those skilled in the art using the disclosed technical content shall fall within the protection scope of the present invention.

Claims

1. A malicious code detection method based on bee colony control, characterized in that, The method includes: Construct a bee colony detection model, which includes mercenary bees, follower bees, and scout bees; The hired bees perform risk analysis on the known characteristics of each sample to be tested to obtain the risk analysis fitness, and calculate the initial pheromone concentration of the sample node corresponding to the sample to be tested in the threat pheromone field based on the risk analysis fitness. The following bee calculates the pheromone probability of each sample node based on the initial pheromone concentration of each sample node in the threat pheromone field, selects high-value sample nodes based on the pheromone probability, and performs secondary verification on the high-value sample nodes to obtain the secondary verification result. The reconnaissance bee performs in-depth behavioral feature analysis on abnormal sample nodes other than high-value sample nodes to obtain feature reconnaissance results; Based on the secondary verification result or the feature detection result, the pheromone concentration of the corresponding sample node in the threat pheromone field is updated to obtain the calibration pheromone concentration; Based on the calibrated pheromone concentration and the detection threshold adaptively adjusted according to the pheromone distribution, the malicious code detection result is output.

2. The malicious code detection method based on swarm control according to claim 1, characterized in that, The known features include static features, behavioral features, and environmental features; The static features include hash, PE / ELF segment information, import table, string, opcode n-gram, shell / compression tag, and entropy value; The behavioral characteristics include API / system call sequences, process creation, file read / write, registry / configuration item modification, network domain name / IP / port access, privilege escalation, and persistence behavior; The environmental characteristics include execution path, device type, time window, and handling feedback.

3. The malicious code detection method based on swarm control according to claim 1, characterized in that, Risk analysis is performed on the known characteristics of each sample to be tested to obtain the fitness of the risk analysis, including: Among the hired bees, for the sample to be tested The known features are used for risk analysis to obtain risk analysis results. The risk analysis process includes risk rule matching, similarity calculation, and risk scoring. The risk analysis results include rule hit confidence. Feature similarity Behavioral risks Attack phase weights and resource costs ; The risk analysis fitness of the sample to be tested is calculated based on the risk analysis results. The calculation formula is: Where a, b, c, d, and e are preset weight coefficients, and norm is a normalization function.

4. The malicious code detection method based on bee colony control according to claim 3, characterized in that, The threat pheromone field is a weighted graph structure G=(V,E,τ), where node v includes the sample node, feature node, detector node, and processing feedback node corresponding to the sample to be detected, and edge E represents the association relationship between the nodes. This represents the pheromone concentration of node v or edge E.

5. The malicious code detection method based on bee colony control according to claim 4, characterized in that, Based on the initial pheromone concentration of each sample node in the threat pheromone field, the pheromone probability corresponding to each sample node is calculated. High-value sample nodes are then selected based on these pheromone probabilities, and secondary verification is performed on these high-value sample nodes to obtain the secondary verification results, including: Based on the initial pheromone concentration of each sample node in the threat pheromone field, the pheromone probability corresponding to each sample node is calculated using the following formula: ,in, Let be the pheromone probability corresponding to the i-th sample node. Let be the initial pheromone concentration of the i-th sample node. This represents the total pheromone concentration of all sample nodes in the set of sample nodes for which the current detection cycle has not yet ended. To prevent the elimination of zero factors; High-value sample nodes are selected based on the pheromone probability of each sample node and a preset probability threshold. The high-value sample nodes are subjected to secondary verification based on preset secondary verification rules to obtain secondary verification results. The preset secondary verification rules include static rules, behavioral models, or multi-engine detectors.

6. The malicious code detection method based on bee colony control according to claim 5, characterized in that, Deep behavioral feature analysis was performed on anomalous sample nodes other than high-value sample nodes to obtain feature detection results, including: For abnormal sample nodes other than high-value sample nodes, extract the abnormal behavior data of the sample to be detected corresponding to the abnormal sample node to generate exploration seeds; The exploration seed is subjected to random perturbation, feature combination expansion, neighbor sample clustering, and sandbox behavior replay processing to generate deep behavioral features; The novelty score of the deep behavioral features is obtained by comparing them with a known threat feature database. If the novelty score of the sample to be tested is greater than the preset novelty threshold, and the behavioral risk corresponding to the sample to be tested is... If the risk exceeds a preset behavioral risk threshold, a new feature node corresponding to the deep behavioral feature is created in the threat pheromone field, and the pheromone concentration is initialized. If the novelty score of the sample to be tested is less than or equal to the preset novelty threshold, or if the behavioral risk of the sample to be tested is... If the risk threshold is less than or equal to the preset risk threshold, the current deep exploration will be terminated and the sample to be tested will be transferred to the low pheromone monitoring queue. The evidence summary will be retained and a suspected alarm will be output when the risk is still high.

7. The malicious code detection method based on bee colony control according to claim 6, characterized in that, Based on the secondary verification result or the feature detection result, the pheromone concentration of the corresponding sample node in the threat pheromone field is updated to obtain the calibrated pheromone concentration, including: Based on the secondary verification result or the feature detection result, update the pheromone concentration of the node corresponding to the sample to be detected in the threat pheromone field. The formula for calculating the pheromone concentration is as follows: ,in, This represents the pheromone concentration of the i-th node at time t+1. This indicates the confidence level of the second-order validation. This indicates the weight of the attack stage corresponding to the sample of the node. This indicates feedback on historical isolation, containment, or release procedures that have been confirmed before the start of the current testing cycle. To preset the impact factor weights, This is the preset evaporation coefficient.

8. The malicious code detection method based on bee colony control according to claim 7, characterized in that, The calculation formula for the detection threshold based on adaptive adjustment of pheromone distribution is as follows: ,in, , To preset the initial threshold, The normalized entropy represents the pheromone distribution. This indicates the false alarm rate for the current detection cycle. These are the preset distribution entropy coefficient, preset false alarm rate coefficient, and preset concentration coefficient, respectively.

9. A malicious code detection device based on swarm control, characterized in that, The device includes: a processor and a memory; The memory is used to store one or more program instructions; The processor is configured to run one or more program instructions to perform the steps of the swarm-based malicious code detection method as described in any one of claims 1 to 8.

10. A computer program product, characterized in that, The computer program product includes computer program instructions that, when executed by a processor, implement the steps of the swarm-based malicious code detection method as described in any one of claims 1 to 8.

Images