Computer malicious file detection method based on ensemble learning, server and storage medium

Abstract

The application discloses a computer malicious file detection method based on integrated learning, a server and a storage medium. The method comprises the following steps: obtaining a to-be-detected file, performing homologous analysis processing on the to-be-detected file, and generating internal structure description information of the file; distributing the internal structure description information to a heterogeneous base learner set, independently generating individual prediction probability distribution, and collecting the individual prediction probability distribution into a group prediction probability distribution set; generating an adversarial suspicion intensity index based on the distribution divergence degree in the group, and simultaneously obtaining an integrated maliciousness comprehensive judgment through integrated decision fusion; comparing the adversarial suspicion intensity index with a dynamic adversarial suspicion benchmark, and identifying a file with an adversarial escape suspicion when the integrated judgment is malicious and the adversarial suspicion intensity exceeds the benchmark; and starting deep security analysis according to the file with the adversarial escape suspicion, obtaining runtime behavior records in an isolated execution environment, and comparing the runtime behavior records with a malicious behavior mode library. The method can effectively cope with adversarial escape attacks, and improves the robustness and accuracy of malicious file detection.

Description

Technical Field

[0001] This invention relates to the field of data processing, and in particular to a method, server, and storage medium for detecting malicious computer files based on ensemble learning. Background Technology

[0002] Malicious file detection refers to the process of determining whether a file possesses malicious attributes by analyzing its internal structure or behavioral characteristics. Currently, multiple base learners are typically used to independently judge file features, and then the judgment results of each base learner are integrated into a final detection conclusion through fusion strategies such as voting or weighted averaging, thereby improving the detection's generalization ability. However, the original intention of this ensemble detection method is to eliminate discrepancies between base learners to pursue consistent outputs. When faced with carefully constructed adversarial escape samples, the base learners may produce contradictory judgment tendencies. This contradictory information is often masked or smoothed during the fusion process, resulting in the ensemble detection conclusion still presenting a high-confidence malicious or safe judgment, failing to detect escape traces within the file, allowing adversarial escape files to bypass the detection system. Summary of the Invention

[0003] This invention provides a method, server, and storage medium for detecting malicious computer files based on ensemble learning.

[0004] In a first aspect, embodiments of the present invention provide a method for detecting malicious computer files based on ensemble learning, comprising: Obtain the file to be detected, perform source code parsing on the file to be detected, and generate internal structure description information of the file to be detected. The internal structure description information is distributed to a pre-configured set of heterogeneous base learners. Each heterogeneous base learner extracts a local structure description fragment from the internal structure description information according to its corresponding exclusive region of interest mapping rule, and performs a malice measurement on the local structure description fragment based on its own decision boundary to generate an individual prediction probability distribution. All individual prediction probability distributions are aggregated to obtain a set of group prediction probability distributions. Based on the degree of divergence between the prediction probability distributions of individuals in the set of group prediction probability distributions, an adversarial suspicion strength index is generated. At the same time, the set of group prediction probability distributions is used for integrated judgment and fusion to generate an integrated maliciousness comprehensive judgment. Obtain the dynamic adversarial suspicion benchmark, compare the adversarial suspicion strength index with the dynamic adversarial suspicion benchmark, and when the integrated malice judgment indicates malice and the adversarial suspicion strength index exceeds the dynamic adversarial suspicion benchmark, the file to be detected is identified as an adversarial escape suspected file. Based on the identification results of the anti-escape suspected file, a deep security analysis mechanism is initiated. The deep security analysis mechanism includes submitting the anti-escape suspected file to an isolated execution environment to obtain its runtime behavior record, and comparing the runtime behavior record with a malicious behavior pattern library.

[0005] Secondly, embodiments of the present invention provide a server, including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement the steps in the above method.

[0006] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method.

[0007] This invention utilizes a heterogeneous set of base learners to extract local fragments from the internal structural description information of the same file based on different dedicated region of interest mapping rules and independently measure malice. This makes it difficult for adversarial escape tampering to simultaneously disrupt the decision boundaries of all base learners, exposing abnormal divergence patterns in the group prediction probability distribution. An adversarial suspicion strength index is generated based on the degree of distribution divergence, transforming the inconsistency in predictions among base learners into an endogenous signal for detecting escape behavior. Escape intent can be identified synchronously during detection without relying on prior external adversarial samples. The dynamic adversarial suspicion benchmark adaptively adjusts the judgment tightness based on the cumulative accumulation of confirmed adversarial escape samples, preventing fixed thresholds from failing when facing evolving escape techniques. An integrated malice comprehensive judgment and adversarial suspicion strength index collaboratively trigger a deep security analysis mechanism, submitting adversarial escape-suspected files to an isolated execution environment for runtime behavior verification, achieving in-depth forensics and confirmation of highly concealed escape files. Attached Figure Description

[0008] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present invention and, together with the specification, serve to explain the technical solutions of the present invention.

[0009] Figure 1 This is a schematic diagram illustrating the implementation process of a computer malicious file detection method based on ensemble learning, provided in an embodiment of the present invention.

[0010] Figure 2 This is a schematic diagram illustrating the application logic of the method provided in the embodiments of the present invention.

[0011] Figure 3 This is a schematic diagram of a server hardware entity provided in an embodiment of the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on the present invention. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] This invention provides a method for detecting malicious computer files based on ensemble learning, which can be executed by a server's processor.

[0014] Please combine Figure 1 and Figure 2 Reference is a schematic diagram illustrating the implementation process of a computer malicious file detection method based on ensemble learning provided in an embodiment of the present invention. The method includes the following steps: Step S100: Obtain the file to be detected, perform source code parsing on the file to be detected, and generate internal structure description information of the file to be detected.

[0015] The file to be tested is a computer file entity whose security nature needs to be determined. Its form can be a portable executable file, a dynamic link library file, a script interpreted file, a compound document file with embedded macro code, or a firmware image file. Same-origin resolution refers to ignoring surface identifiers such as file extensions and, based on the mapping relationship between the file's binary byte stream and the file format technical specifications, starting from the outermost encapsulation structure, peeling away the format shell layer by layer, parsing structural members field by field, and recursively expanding nested substructures to restore all the implicit organizational units and their interrelationships within the file.

[0016] The internal structure description information is a data set that systematically depicts the overall internal structure of a file after being processed by same-source parsing. This information includes the type marker, starting offset address, ending offset address, attribute field set, and parent-child hierarchical relationship and order between structural units for each unit. In this embodiment, the execution path for generating the internal structure description information is as follows: read the binary byte stream of the file to be detected, extract a string of consecutive bytes from the beginning of the file as a file header identifier, and compare this file header identifier with various standard magic numbers recorded in the known file format specification library one by one. The standard magic number for portable executable file formats is two bytes at offset zero, with hexadecimal values ​​of 4D and 5A. If the comparison matches, the file is confirmed to belong to that format type, and the parsing state machine corresponding to that format type is then started.

[0017] A parsing state machine is a finite state automaton that pre-defines all the structure templates specified by the file format standard. Each structure template explicitly defines the set of fields contained in the structure, the data type of each field, the length of bytes occupied by each field, and the order relationship between the fields. The parsing state machine starts working from the zero offset address of the file to be tested, points the current read pointer to the beginning of the file, loads the top-level structure template, and reads bytes of the corresponding length from the byte stream one by one according to the order of the fields in the template. It performs byte order conversion and value decoding according to the data type of the field, and records each decoded field value into the attribute field set of that structure unit.

[0018] Once all fields of a structure template have been parsed, the parsing state machine assigns a type tag to that structure unit. This type tag categorizes the functional attributes of the structure unit. In the context of portable executable file formats, the parsable type tags include DOS header tags, NT header tags, file header tags, optional header tags, section table tags, import table tags, export table tags, resource segment tags, relocation section tags, code segment tags, and data segment tags. Simultaneously, the parsing state machine records the starting and ending offset addresses of the structure unit within the file. If the current structure template definition contains pointer fields or offset fields pointing to nested substructures, the parsing state machine uses the current structure unit as the parent node, jumps the read pointer to the starting offset address of the substructure indicated by the pointer field, and recursively executes the loading and parsing operations of the substructure template. After recursion returns, the parsing state machine continues processing the remaining fields in the parent structure template after the pointer field. When all fields of the top-level structure template have been processed and all recursive branches have returned, the same-source parsing process ends. The tree-like hierarchical structure constructed throughout the parsing process, along with the type marker, start and end offset range, and attribute field set of each node, together constitute the internal structural description information of the file to be detected.

[0019] Step S200: Distribute the internal structure description information to a pre-configured set of heterogeneous base learners. Each heterogeneous base learner extracts a local structure description fragment from the internal structure description information according to its corresponding exclusive region of interest mapping rule, and performs a malice measurement on the local structure description fragment based on its own decision boundary to generate an individual prediction probability distribution. The set of all individual prediction probability distributions is then collected to obtain a set of group prediction probability distributions.

[0020] In one implementation, step S200 may specifically include the following steps S210 to S260: Step S210: Extract the internal structure description information of each file sample from the pre-collected file sample set, traverse each internal structure description information one by one, serialize and arrange the structure tags in them, generate a structure tag sequence that reflects the internal organization order of the file, and generate an interval index mapping relationship based on the data interval covered by each structure tag.

[0021] The file sample set is a large-scale file dataset pre-collected during the system construction phase. This dataset contains both confirmed malicious file samples and confirmed safe file samples, and each file sample corresponds to a deterministic real attribute label. A structure tag is a symbolic identifier used to label the type of each structural unit in the internal structure description information; each structure tag uniquely corresponds to a structure type. The structure tag sequence is a sequence formed by linearly arranging all structure tags appearing in the internal structure description information according to their order of appearance in the file. The interval index mapping relationship is a bidirectional association index between each structure tag and the data interval it covers. Through this mapping relationship, the corresponding byte offset interval can be quickly located based on the structure tag, and the structure tag to which it belongs can be found in reverse based on any offset address. In this embodiment, for each file sample in the file sample set, its corresponding internal structure description information is first generated according to the same-origin resolution processing method described in step S100. Subsequently, a depth-first or breadth-first traversal is performed on the tree structure describing the internal structure information. According to the access order of the structural nodes during the traversal, the type tag of each node is extracted in turn and appended to form a linear sequence. The order of the tags in this sequence is consistent with the physical arrangement order or logical inclusion order of each structural unit in the byte stream, forming a structural tag sequence.

[0022] While generating the structure tag sequence, the traversal process records the start and end offset addresses of the structure node corresponding to each structure tag in the file, and constructs a key-value pair mapping structure, where the key is a tuple consisting of the structure tag and its position number in the sequence, and the value is the range from the start offset address to the end offset address covered by the structure tag. This mapping structure is the range index mapping relationship.

[0023] Step S220: Using the tag type in the structure tag sequence as the dimension, count the independent occurrence frequency of each tag type in the entire file sample set and the adjacent co-occurrence frequency with other tag types. Construct a tag type association network based on the independent occurrence frequency and the adjacent co-occurrence frequency. In the tag type association network, the association edges between nodes are based on the tag type and the adjacent co-occurrence frequency.

[0024] A tag type is a category attribute categorized after structural tags are classified. Structural tags of the same structural unit in different file samples belong to the same tag type. Independent occurrence frequency refers to the total number of times a certain tag type appears in the entire sequence of structural tags in the entire file sample set. Adjacent co-occurrence frequency refers to the total number of times two tag types appear in pairs in adjacent positions in the entire sequence of structural tags. A tag type association network is a graph structure network with tag types as basic nodes and adjacent co-occurrence frequencies between tag types as the edges connecting the nodes. In this network, the weight of a node depends on its independent occurrence frequency, and the strength of an edge depends on its adjacent co-occurrence frequency.

[0025] In this embodiment, the structural tag sequences of all file samples in the file sample set are first traversed, and an independent frequency statistics table is established with tag type as the key and cumulative counter as the value. Whenever a structural tag is read in any structural tag sequence, the corresponding counter is looked up in the statistics table according to the tag type of the structural tag, and the count value is incremented. At the same time, a co-occurrence frequency statistics table is established with tag type pairs as keys and cumulative counters as values. The structural tag pairs with consecutive adjacent positions in each structural tag sequence are traversed, and the tag types of the two tags in the structural tag pair are extracted. These two tag types are combined into an unordered or ordered type pair, and the counter in the co-occurrence frequency statistics table corresponding to the type pair is incremented. After completing the traversal and statistics of all structural tag sequences, each occurrence of tag type is taken as a node, and the independent occurrence frequency of the tag type is recorded in the basic attributes of the node. For each type pair with a count value greater than zero in the co-occurrence frequency statistics table, an association edge is established between the two nodes involved in the type pair, and the adjacent co-occurrence frequencies of the type pair are assigned as the initial connection strength of the association edge. All nodes and all association edges together constitute a tag type association network.

[0026] In one implementation, step S220 may specifically include the following steps S221 to S226: Step S221: Establish an independent counter for each structure tag type, traverse the structure tag sequence of all file samples, and whenever a structure tag is read in the structure tag sequence, find the independent counter corresponding to the tag type to which the structure tag belongs and increment it. After traversal, obtain the independent frequency set of each tag type.

[0027] In this embodiment, the independent counters are established by maintaining a hash map indexed by a tag type string. Each entry in the hash map stores a variable integer count value, initially set to zero. The traversal process sequentially reads the structure tag sequence of each file sample in the file sample set. For each structure tag in the sequence, the corresponding tag type string is extracted, and the corresponding counter entry in the hash map is located using this string as the key. The integer value in that entry is then incremented by 1. Once all structure tag sequences of all file samples in the file sample set have been traversed, the count values ​​recorded in the hash map represent the independent occurrence frequencies of the corresponding tag type. These independent occurrence frequencies constitute an independent occurrence frequency set.

[0028] Step S222: Establish a co-occurrence counter for each structural marker type and its possible adjacent marker types. Traverse the structural marker pairs in consecutive adjacent positions in each structural marker sequence, extract the marker types to which the two markers in the structural marker pair belong as type pairs, increment the co-occurrence counter corresponding to the type pair, and obtain the set of adjacent co-occurrence frequencies of all type pairs after traversal.

[0029] In this embodiment, the co-occurrence counter is established by maintaining a nested hash map table indexed by ordered or unordered type pairs. The key of the outer hash map is the first tag type, the key of the inner hash map is the second tag type, and the value of the inner hash map is an integer count value, initially set to 0. Each structure tag sequence is traversed. Starting from the first position of the sequence, the structure tags at positions 1 and 2 are taken to form the first adjacent structure tag pair, the structure tags at positions 2 and 3 are taken to form the second adjacent structure tag pair, and so on until the end of the sequence. For each adjacent structure tag pair, the tag type of the previous structure tag is extracted as the first type, and the tag type of the next structure tag is extracted as the second type. The first type is used as the outer key to locate the outer hash map table entry, and the second type is used as the inner key to locate the inner hash map table entry. The count value of this entry is incremented by 1. After all sequences have been traversed, all type pairs and their corresponding count values ​​constitute the set of adjacent co-occurrence frequencies.

[0030] Step S223: Using each structural tag type as a node, establish an initial connection edge between two nodes of the type pair with adjacent co-occurrence frequencies that are not zero, and assign the adjacent co-occurrence frequency as the initial connection strength of the initial connection edge.

[0031] In this embodiment, nodes are created based on all marker types registered in the independent occurrence frequency set. A graph node object is generated for each marker type, with the node object's identifier attribute being the marker type name and its weight attribute being the independent occurrence frequency of that marker type. Each type pair and its count value in the adjacent co-occurrence frequency set are traversed. For type pairs with a count value greater than 0, an initial connection edge is established between the graph nodes corresponding to the two marker types involved in the type pair. This initial connection edge can be an undirected edge or stored as a bidirectional edge, and its strength attribute is assigned the adjacent co-occurrence frequency value of the type pair. If a connection edge already exists between two nodes, it is not re-established.

[0032] Step S224: Perform correlation normalization on the initial connection strength of each initial connection edge and the independent occurrence frequency of the nodes at both ends of the edge. Divide the initial connection strength by the geometric mean of the independent occurrence frequencies of the nodes at both ends to obtain the normalized connection strength, so that the connection strength eliminates the metric imbalance caused by the different total occurrences of the label type.

[0033] In this embodiment, for each initial connection edge in the tag type association network, the two end nodes connected by the edge are obtained. The independent occurrence frequencies of the first node and the second node are read, and the geometric mean of these two independent occurrence frequencies is calculated, which is the square root of the product of the two frequency values. The initial connection strength value of the initial connection edge is divided by this geometric mean, and the quotient is the normalized connection strength of the edge. This process eliminates the phenomenon of artificially high connection strength caused by the natural high frequency of certain tag types in the file sample set, so that the value of connection strength only reflects the degree of adjacent co-occurrence between two tag types, and is no longer dominated by the overall occurrence frequency of a single tag type.

[0034] Step S225: For each node, retain the preset number of edges with the highest normalized connection strength connected to it, and prune the remaining connection edges. If the original number of edges of a node does not exceed the preset number, all edges are retained to obtain the set of pruned connection edges.

[0035] In this embodiment, the preset number is an integer parameter determined during the system design phase. This parameter controls the maximum number of adjacent edges that can be retained for each node in the label-type association network. The pruning process is as follows: traverse each node in the label-type association network, collect all neighboring nodes connected to that node by edges and the normalized connection strength corresponding to each edge, and sort these edges in descending order of normalized connection strength value. Select the first preset number of edges from the sorted results to retain. If the actual number of adjacent edges of a node is less than or equal to the preset number, then all adjacent edges of that node are retained. For the remaining connecting edges not within the retention range, remove them from the network. After performing this pruning operation on all nodes, the remaining edges in the network constitute the pruned set of connecting edges.

[0036] Step S226: Output a label type association network with all structure label types as nodes and the normalized connection strength of each edge in the pruned set of connection edges as the associated edges.

[0037] The tag type association network output consists of two parts: a node set and an edge set. Each node in the node set stores the name and independent frequency of its tag type in its attribute field. Each edge in the edge set stores the identifiers of the nodes at both ends of the edge and its normalized connection strength value in its attribute field. This network reflects the strength association topology between different structural tag types in the file sample set based on their adjacent co-occurrence relationships.

[0038] Step S230: Apply subgraph partitioning based on edge connectivity strength to the labeled type association network, merge nodes whose association edge strength is continuously higher than the partitioning threshold into the same structural component, until all nodes are assigned to a unique structural component, thereby obtaining the structural component partitioning result. Each structural component in the structural component partitioning result corresponds to a set of structural labels with functional association.

[0039] Subgraph partitioning based on edge connectivity strength is a graph clustering method that aggregates nodes into several compact subgroups based on the connection strength of edges in the network. Its basic operation logic is to find clusters of nodes tightly connected by edges with high connection strength and group these nodes into a structural component. The partitioning threshold is a strength threshold used to distinguish between strong and weak connections. This threshold can be determined during the system construction phase by analyzing the overall distribution characteristics of normalized connection strength. The structural component partitioning result is the output of the subgraph partitioning process, which contains several structural components. Each structural component is a set of structural label types. Label types belonging to the same structural component exhibit a high frequency of adjacent co-occurrence and functional coupling relationships in the file samples.

[0040] In this embodiment, the subgraph partitioning process follows this procedure: First, the normalized connection strength of each edge in the labeled association network is statistically analyzed to determine the partitioning threshold. The threshold is determined by sorting all edges by their normalized connection strength from low to high and taking the strength value at a certain percentile in the sorted sequence as the threshold. Then, a disjoint-set data structure equal to the number of nodes is created, with each node initially belonging to an independent set. All edges in the network with normalized connection strength greater than the partitioning threshold are traversed and processed sequentially in descending order of connection strength. For each processed edge, the sets of the nodes at both ends of the edge in the disjoint-set are merged, making them belong to the same structural component. After all edges satisfying the strength condition have been processed, each set in the disjoint-set that cannot be merged further constitutes a structural component. For isolated nodes in the network that may exist due to pruning and whose edge strength is consistently lower than the partitioning threshold and therefore not associated with any high-strength edges, each isolated node constitutes a separate structural component.

[0041] Based on this, all nodes are assigned to a unique structural component, resulting in a structural component partitioning result. Each structural component in the partitioning result is assigned a unique component identifier, and the component contains a set of functionally related structural tag types.

[0042] Step S240: For each heterogeneous base learner to be generated, a specified number of structural components are randomly selected from the structural component partitioning results in a non-repeating manner to form a component set, and the structural components in the component set are randomly arranged in order to generate a unique region of interest mapping rule defined by the structural component identifier sequence and the arrangement order.

[0043] Non-repeating random selection means that in a single extraction process, the same structural component will not be selected twice. Each time a structural component is extracted from the structural component partitioning results, it is removed from the candidate pool, and subsequent extractions are performed until a specified number is reached. The specified number is a parameter controlling the scale of components that each heterogeneous base learner focuses on. This parameter's value is less than or equal to the total number of components in the structural component partitioning results, and this specified number can be the same or different for different heterogeneous base learners. The component set is the set of selected structural components obtained after non-repeating random selection. Random ordering involves applying a random sorting operation to the structural components in the component set, generating an ordered arrangement.

[0044] The dedicated region of interest mapping rule is defined by two parts: first, a sequence of component identifiers corresponding to each structural component in the component set; and second, the order of components within this sequence determined by random arrangement. In this embodiment, the heterogeneous base learner generation process involves creating multiple base learner instances sequentially or in parallel. For each heterogeneous base learner to be generated, a list of component identifiers for all structural components in the structural component partitioning result is obtained. This list is then subjected to random sampling without replacement, with the sampling quantity being the specified number for the base learner. The sampled component identifiers form a temporary set of component identifiers. This set of component identifiers is then randomly scrambled, for example, by using a pseudo-random number generator to assign a random ranking value to each element in the set. The resulting ordered sequence of component identifiers is then sorted in ascending order according to the ranking values. This ordered sequence of component identifiers is packaged with the arrangement order instruction, which constitutes the dedicated region of interest mapping rule bound to the heterogeneous base learner. Since both non-repeating random selection and random permutation introduce randomness, the exclusive region of interest mapping rules obtained by different heterogeneous base learners differ in component composition and component order, thereby ensuring the diversity and independence of the field of interest of each heterogeneous base learner.

[0045] Step S250: Bind the generated dedicated region of interest mapping rule to a learner to be trained with an initial internal connection state. Use the dedicated region of interest mapping rule to extract structural descriptor subsequences that match the component identifier sequence and conform to the arrangement order from the internal structural description information of each file sample, forming a set of local structural description fragment samples. Use the set of local structural description fragment samples to perform targeted correction of the internal connection state of the learner to be trained, and obtain a heterogeneous base learner.

[0046] The learner to be trained is a machine learning model instance that has not yet been trained for the current region of interest. Before being bound to the region-of-interest mapping rule, it has an initial internal connectivity state, which can be randomly initialized connection weights or base weights loaded from a pre-trained model. The structural descriptor sequence is a sequence formed by concatenating structural component data extracted from the internal structural description information according to the region-of-interest mapping rule in an ordered manner. The local structural description fragment sample set is a training sample set consisting of the structural descriptor sequences corresponding to all file samples in the file sample set. Targeted correction refers to the supervised iterative adjustment of the internal connectivity weights of the learner to be trained using the local structural description fragment sample set, gradually optimizing its maliciousness measurement capability within the region of interest.

[0047] In this embodiment, the dedicated region of interest mapping rule generated in step S240 is first bound to a learner to be trained. The binding operation involves storing the dedicated region of interest mapping rule as a metadata attribute of the learner to be trained, so that the learner always executes according to this rule when extracting local structural description fragments in subsequent steps. Then, each file sample in the file sample set is traversed. For each file sample, according to the component identifier sequence and arrangement order defined in the bound dedicated region of interest mapping rule, the original byte data corresponding to each component is located and extracted from the internal structural description information of the file sample, and concatenated sequentially into a structural descriptor sequence. This structural descriptor sequence and the file sample's true attribute label together form a training sample. The training samples corresponding to all file samples are collected to form a local structural description fragment sample set. This local structural description fragment sample set is input into the learner to be trained, and multiple rounds of supervised training iterations are performed. In each iteration, local structural description fragments are fed batch by batch into the learner's progressive state transition chain for forward propagation. The predicted probability distribution is obtained at the output layer, the deviation between the predicted probability distribution and the true attribute label is calculated, and the deviation is propagated back along the network to update the connection weights of each layer. After a preset number of iterations or when the early stopping condition is met, training terminates. At this point, the connection state inside the learner to be trained has been optimized for the mapping rule of the specific region of interest, and it has the ability to identify malice from the specific structural fragment. The learner to be trained at this point is a heterogeneous base learner that has been trained.

[0048] In one implementation, step S250 may specifically include the following steps S251 to S256: Step S251: Based on the component identifier sequence defined in the exclusive region of interest mapping rule, find the start and end positions of the identifier of each structural component in the internal structure description information of the file sample, and use the interval index mapping relationship to convert the start and end positions into actual byte offset addresses.

[0049] Specifically, the component identifier sequence recorded in the dedicated region of interest mapping rules is read. This sequence contains component identifiers of multiple structural components. For each component identifier in the sequence, the structural component partitioning result generated in step S230 is obtained, and the set of structural tag types contained in the component identifier is queried from the partitioning result. In the tree structure of the internal structural description information of the file sample, a traversal operation is performed to filter out all structural nodes whose type tags belong to the set of structural tag types. These structural nodes are identified as the corresponding structural nodes of the structural component in the current file sample. For each located structural node, its start position and end position recorded in the internal structural description information are read. The start position is the start offset address of the structural unit represented by the node in the file, and the end position is the end offset address of the structural unit represented by the node in the file. The interval index mapping relationship generated in step S210 is called, and the corresponding actual byte offset address is retrieved using the start position and end position as the query key. This actual byte offset address is the precise boundary of the data interval corresponding to the structural component in the file. If a structural component corresponds to multiple discrete structural nodes in the current file sample, the actual byte offset address interval of each node is recorded separately.

[0050] Step S252: According to the arrangement order defined in the exclusive region of interest mapping rules, read the structural data within the byte offset address range of each structural component from the internal structural description information in sequence, and concatenate the read structural data end to end to form a continuous local structural description fragment.

[0051] In this embodiment, an ordering instruction is extracted from the dedicated region of interest mapping rules. This instruction specifies the order of each structural component within the local structural description fragment. Following this order, each structural component is processed sequentially: one or more actual byte offset address ranges determined in step S251 are obtained; from the original byte stream of the file sample, the starting offset address of each range is located using binary reading; all byte data within that range is read sequentially until the ending offset address of the range. If a structural component corresponds to multiple discrete ranges, the data of each range is read sequentially according to the natural order of their offset addresses in the file, from smallest to largest. After reading all range data for the current structural component, the read byte data is appended to an accumulation buffer. After processing all structural components according to the ordering instruction, the continuous byte sequence stored in the accumulation buffer is the concatenated local structural description fragment.

[0052] Step S253: Input the local structure description fragment into the learner to be trained, and perform state evolution processing byte by byte or structural unit by structural unit by the progressive state transition chain inside the learner to be trained until the end of the fragment is processed, and obtain the internal state snapshot at the termination time.

[0053] The progressive state transition chain is the core sequence processing component within the learner to be trained. Its function is to perform element-wise state evolution on the input variable-length byte sequence. At each processing time, it calculates a new internal state based on the current input element and the internal state at the previous time step, and finally outputs a fixed-dimensional snapshot of the internal state at the end of the sequence. This progressive state transition chain can be implemented using a gated recurrent unit network or a long short-term memory network as its architecture.

[0054] In this embodiment, the progressive state transition chain employs a gated recurrent unit network, which consists of three gating mechanisms: a reset gate, an update gate, and a candidate state calculation unit. Specifically, the execution process involves sequentially converting the value of each byte or structural unit in the local structural description fragment into a fixed-dimensional input embedding vector. The embedding vector is generated by mapping the byte value to a corresponding row of a trainable embedding matrix. The progressive state transition chain maintains a hidden state vector, which is initialized to an all-zero vector at the start of fragment processing. At each processing time step, the current input embedding vector and the previous hidden state vector are fed into the gate control loop unit: the reset gate compresses the linear transformation of the current input and the previous hidden state using a sigmoid growth curve activation function, outputting a gate vector between 0 and 1. This gate vector is then element-wise multiplied with the previous hidden state, selectively retaining information from the previous hidden state. The update gate also outputs a gate vector using a sigmoid growth curve activation function, used to control the interpolation ratio between the old and new states. The candidate state calculation unit performs a linear transformation between the previous hidden state (after being filtered by the reset gate) and the current input embedding vector, and then uses a hyperbolic tangent activation function to generate candidate hidden states. The new hidden state is obtained by the update gate performing an element-wise weighted average of the previous hidden state and the candidate hidden states. After processing each input element, the hidden state vector is updated once. When all elements in the local structure description segment have been processed sequentially, the hidden state vector at the last time step is the internal state snapshot at the termination time.

[0055] Step S254: Input the internal state snapshot into the classification projection layer of the learner to be trained. The classification projection layer maps the internal state snapshot to the probability distribution output on each category. The deviation between the probability distribution output and the true attributes of the file sample is calculated to obtain the current prediction loss.

[0056] The classification projection layer, located after the progressive state transition chain, maps the internal state snapshots output by the chain to the category probability space. This layer can be constructed by concatenating one or more fully connected layers with a flexible maximum transfer function (WPF) output layer. The classification projection layer contains a fully connected hidden layer and a WPF output layer. The fully connected hidden layer receives the internal state snapshot vector output by the progressive state transition chain, performs matrix multiplication with a weight matrix, adds a bias vector, and then performs a nonlinear transformation using a linear rectified activation function to obtain the hidden layer output vector. The WPF output layer receives the hidden layer output vector, multiplies it with a weight matrix, and adds a bias vector. The number of columns in the output layer's weight matrix equals the number of classification categories; in the binary classification scenario for malicious files, there are two categories, corresponding to the malicious and safe categories. The WPF performs an exponential operation on each element of the binary vector obtained from the output layer, then divides the exponent value of each element by the sum of all element exponent values ​​to obtain the probability values ​​for the malicious and safe categories. The sum of these two probabilities is normalized to the value 1. The two-element probability vector is the probability distribution output. Bias calculation uses the cross-entropy loss function, which is calculated by taking the natural logarithm of the probability value of the category corresponding to the true attribute label, multiplying it by -1 to obtain the current prediction loss. If the true attribute of the file sample is malicious, the negative natural logarithm of the malicious category probability value is used as the current prediction loss; if the true attribute of the file sample is safe, the negative natural logarithm of the safe category probability value is used as the current prediction loss.

[0057] Step S255: The current predicted loss is propagated backward along the classification projection layer of the learner to be trained to the progressive state transition chain. The sensitivity of the loss to each connection part inside the learner to be trained is calculated along the propagation path, and the strength parameters of the internal connection are adjusted according to the sensitivity to complete one directional correction iteration.

[0058] Sensitivity refers to the partial derivative of the loss function with respect to each connection weight, reflecting the direction and magnitude of the change in the loss value caused by a small change in that connection weight. In this embodiment, backpropagation uses an error backpropagation algorithm based on gradient descent. Specifically, starting from the current predicted loss value, the partial derivative of the loss with respect to each input node of the flexible maximum transfer function output layer in the classification projection layer is first calculated. This partial derivative is equal to the probability value of the corresponding class in the probability vector output by the flexible maximum transfer function minus the indication value of that class in the true label. This partial derivative signal is then passed forward to the fully connected hidden layer, and the partial derivative of the loss with respect to the weight matrix and bias vector of the fully connected hidden layer is calculated according to the chain rule. At the same time, the partial derivative of the loss with respect to the input of the linear rectified activation function is also calculated. This partial derivative is passed as is when the input is greater than 0, and is set to 0 when the input is less than or equal to 0. The partial derivative signal is then propagated forward to the progressive state transition chain. Following the backpropagation algorithm, the partial derivative signal is propagated backward along the time axis from the end of the sequence to the beginning, time-by-time. At each time step, the partial derivative of the loss with respect to the gating weight matrix, input weight matrix, and bias vector in the gated recurrent unit is calculated. These partial derivatives represent the sensitivity of the loss to each connection. After obtaining the partial derivatives for all connections, an adaptive moment estimation optimizer is used to adjust the connection strength parameters based on the sensitivity. The adjustment amount is determined by the ratio of the learning rate to the moving average of the partial derivatives. This optimizer maintains a first-moment estimate and a second-moment estimate for each parameter. The first-moment estimate is an exponentially weighted moving average of the historical gradients, and the second-moment estimate is an exponentially weighted moving average of the squares of the historical gradients. The parameter update amount is the sum of the learning rate multiplied by the first-moment estimate, divided by the square root of the second-moment estimate, and a minimal constant. After all connection strength parameters are updated according to their respective update amounts, one directional correction iteration is completed.

[0059] Step S256: Repeat the directed correction iteration. After each iteration batch, evaluate the central tendency of the deviation between the output of the current learner to be trained on all samples in the local structure description fragment sample set and the true attributes. When the central tendency does not decrease in multiple consecutive iteration batches, terminate the iteration and use the current internal connection state as the final heterogeneous base learner.

[0060] Central tendency refers to the average or median value of the current predicted loss of all samples in the local structure description fragment sample set within an iterative batch. In this embodiment, the directional correction iteration is performed in batches. Each batch extracts a batch of samples from the local structure description fragment sample set and performs forward propagation, loss calculation, and backpropagation parameter update as described in steps S253 to S255. After each iterative batch is completed, the learner to be trained under the current parameter state performs a complete forward propagation on all samples in the local structure description fragment sample set, calculates the predicted loss of each sample, and takes the average of these loss values ​​as the central tendency measure of the current iterative batch. The system maintains a window that records the central tendency of the most recent several rounds. Whenever a new central tendency value is added to the window, the current central tendency is compared with the central tendency of the previous rounds in the window. If the current central tendency is not less than the central tendency of the previous round in the window, and the number of consecutive rounds in which this situation occurs reaches a preset number of patient rounds, then it is determined that the central tendency has stopped decreasing, triggering the early stopping termination condition. When the iteration terminates, the current values ​​of all connection strength parameters inside the current learner to be trained are fixed as the final state. The learner to be trained in this state is the heterogeneous base learner trained for the bound exclusive region of interest mapping rules.

[0061] Step S260: Collect heterogeneous base learners generated by different exclusive region of interest mapping rules to form a heterogeneous base learner set. In the detection stage, the internal structure description information of the file to be detected is distributed in parallel to each heterogeneous base learner in the heterogeneous base learner set. Each heterogeneous base learner extracts local structure description fragments and generates individual prediction probability distributions. Finally, they are collected to form a group prediction probability distribution set.

[0062] In this embodiment, for the same structural component partitioning result, steps S240 to S256 are repeated. Each time, a unique set of exclusive region-of-interest mapping rules is generated for the learner to be trained through non-repeating random selection and random arrangement, and a heterogeneous base learner bound to this rule is obtained through a complete training process. All heterogeneous base learners generated in this way are gathered into a set, which constitutes the heterogeneous base learner set. In the detection phase, after generating internal structural description information for the file to be detected in step S100, the internal structural description information is simultaneously copied and distributed to each heterogeneous base learner in the heterogeneous base learner set. After receiving the internal structural description information, each heterogeneous base learner starts its own interception and forward propagation process: according to the component identifier sequence and arrangement order defined in its bound exclusive region-of-interest mapping rules, it locates the data interval of the corresponding component in the tree structure of the internal structural description information, reads the original bytes and splices them into a local structural description fragment, sends the fragment into its own progressive state transition chain for state evolution, and maps the internal state snapshot at the termination time into an individual prediction probability distribution through a classification projection layer. The above operations of each heterogeneous base learner are executed in parallel with the support of computing resources. After the prediction probability distributions of all individuals are generated, they are merged into a centralized distribution list, which is the set of population prediction probability distributions.

[0063] Step S300: Based on the degree of distribution divergence between the individual prediction probability distributions in the group prediction probability distribution set, generate an adversarial suspicion strength index, and at the same time use the group prediction probability distribution set to perform integrated judgment fusion to generate an integrated maliciousness comprehensive judgment.

[0064] In one implementation, step S300 may specifically include the following steps S310 to S360: Step S310: For each pair of different individuals in the group prediction probability distribution set, calculate the probability quality difference between them in the malicious category and the probability quality difference in the safe category, forming the category orientation difference between each pair of individuals, and collect all the category orientation difference between each pair of individuals to obtain the difference set.

[0065] The category orientation difference is a numerical value describing the difference in probability quality between two individual predicted probability distributions in a single category direction. For the malicious category direction, the difference is the absolute value of the difference between the malicious category probability values ​​in the two individual predicted probability distributions; for the safe category direction, the difference is the absolute value of the difference between the safe category probability values ​​in the two individual predicted probability distributions. In this embodiment, assuming the set of group predicted probability distributions contains K individual predicted probability distributions, two individual predicted probability distributions numbered i and j (where i is not equal to j) are randomly selected, and their malicious category probability values ​​and safe category probability values ​​are read respectively. The category orientation difference in the malicious category direction is calculated as the absolute value of the i-th malicious probability value minus the j-th malicious probability value; the category orientation difference in the safe category direction is calculated as the absolute value of the i-th safe probability value minus the j-th safe probability value. This calculation is performed for each pair of different individual predicted probability distributions, and all obtained malicious category orientation differences and safe category orientation differences are stored in a one-dimensional array, which is the difference set.

[0066] Step S320: Perform global scatter measurement processing on the set of discriminants, extract the concentrated distribution interval of the set of discriminants and the outlier discriminants that exceed the boundary of the concentrated distribution interval, aggregate the extent of all outlier discriminants exceeding the boundary of the concentrated distribution interval, and combine the aggregation result with the number of outlier discriminants to form the outlier divergence contribution with a single probability dimension.

[0067] Global scatter measurement is a process of statistically analyzing the distribution characteristics of all values ​​in the set of discriminants. Its purpose is to identify which discriminants belong to normal inter-basic learner prediction fluctuations and which belong to abnormally severe disagreements among basic learners. The concentration interval is the range within which most values ​​in the discriminant set converge. Outliers are those values ​​that exceed the upper and lower boundaries of the concentration interval. For example, first, the values ​​in the discriminant set are sorted in ascending order. The difference between the first and third quartile values ​​of the sorted sequence is the interquartile range (ICM). The lower boundary of the concentration interval is set as the first quartile value minus a preset multiple of the ICM, and the upper boundary is set as the third quartile value plus a preset multiple of the ICM. The discriminant set is then traversed, and discriminants with values ​​less than the lower boundary or greater than the upper boundary are marked as outliers. For each outlier, calculate the magnitude by which it exceeds the boundary of the concentrated distribution interval. If the outlier is greater than the upper boundary, the magnitude is the difference between the outlier and the upper boundary; if the outlier is less than the lower boundary, the magnitude is the difference between the lower boundary and the outlier. Sum the magnitudes of all outliers to obtain the total magnitude. Combine the total magnitude with the number of outliers by dividing the total magnitude by the number of outliers plus a correction value, then multiply by an adjustment coefficient. The resulting value is the outlier divergence contribution. The dimension of this outlier divergence contribution is consistent with the dimension of the probability value in the individual prediction probability distribution. A larger value indicates that some base learners in the group have abnormally drastic prediction deviations in a specific category direction.

[0068] Step S330: Decompose the set of group prediction probability distributions according to the probability distribution direction of malicious category and safe category. Obtain the extreme width and probability quality cluster position of the probability distribution of each base learner in each category direction. Quantize the separation gap between the probability quality cluster position in the malicious category direction and the probability quality cluster position in the safe category direction as the inter-category separation distance.

[0069] In one implementation, step S330 may specifically include the following steps S331 to S336: Step S331: Traverse the prediction probability distribution of each individual in the group prediction probability distribution set, extract the probability quality value corresponding to the malicious category in the prediction probability distribution of the individual as the malicious direction projection point, and extract the probability quality value corresponding to the safe category in the prediction probability distribution of the individual as the safe direction projection point, until the traversal ends and the malicious direction projection point set and the safe direction projection point set are formed respectively.

[0070] The traversal process sequentially visits each individual prediction probability distribution in the set of group prediction probability distributions. Each individual prediction probability distribution is a two-dimensional vector containing both malicious and safe class probability values. The first element is read as the malicious class probability value and added to the malicious direction projection point set as a malicious direction projection point; the second element is read as the safe class probability value and added to the safe direction projection point set as a safe direction projection point. After traversing all individual prediction probability distributions, the number of projection points in the malicious direction projection point set equals the total number of heterogeneous base learners, and the number of projection points in the safe direction projection point set also equals the total number of heterogeneous base learners.

[0071] Step S332: Arrange the projection points in the malicious direction projection point set in ascending order of values ​​to obtain an ordered malicious projection sequence. Calculate the numerical distance between two adjacent projection points in the ordered malicious projection sequence in turn. Mark the positions where the numerical distance exceeds a preset multiple of the overall average distance as the segmentation boundary. Use the segmentation boundary to divide the ordered malicious projection sequence into multiple malicious projection cluster segments.

[0072] The calculation process involves sorting all projection points in the malicious direction projection point set according to their numerical values ​​from smallest to largest, resulting in an ordered malicious projection sequence. The average numerical distance between all adjacent projection points in the ordered malicious projection sequence is calculated as the overall average distance. Starting from the second projection point in the sequence, scanning proceeds backward. At each new projection point, the numerical distance between that projection point and the previous projection point is calculated. If this numerical distance is greater than a preset multiple of the overall average distance, a segmentation boundary is marked between the two projection points. After all scans are completed, the ordered malicious projection sequence is divided into several continuous segments using each segmentation boundary as the dividing point. Each segment is a malicious projection cluster segment. Projection points within each malicious projection cluster segment are densely adjacent to each other, while the distance between different malicious projection cluster segments is relatively significant.

[0073] Step S333: Extract the minimum and maximum values ​​of the projection points within each malicious projection cluster segment, record the range between the minimum and maximum values ​​as the extreme width of the malicious projection cluster segment, and extract the projection point value that is in the middle position after sorting all projection points within the segment as the probability quality cluster position of the malicious projection cluster segment.

[0074] For a malicious projection cluster segment, since its internal projection points have naturally maintained ascending order in the ordered arrangement in step S332, the first projection point in this segment is the minimum value projection point, and the last projection point is the maximum value projection point. The difference between the maximum value and the minimum value is the extreme value width of the malicious projection cluster segment. The method for determining the probability quality cluster position is as follows: the number of projection points in this segment is judged as odd or even. If the number of projection points is odd, the middle position is the (number plus 1 divided by 2)th projection point after sorting, and the value of this projection point is the probability quality cluster position. If the number of projection points is even, the values ​​of the (number divided by 2)th and (number divided by 2 plus 1)th projection points after sorting are taken as the probability quality cluster position.

[0075] Step S334: Perform the same processing on the safe direction projection point set, arrange the projection points in the safe direction projection point set in ascending order of values ​​and divide them into multiple safe projection cluster segments based on the adjacent spacing, and extract the extreme value width and probability mass cluster position of each safe projection cluster segment.

[0076] The processing method is completely consistent with the processing of malicious direction projection point set in steps S332 and S333: sorting to obtain an ordered safe projection sequence, calculating the overall average spacing, dividing into safe projection cluster segments where the spacing exceeds the threshold, and calculating the extreme width and probability quality cluster position of each safe projection cluster segment.

[0077] Step S335: Among all probability mass clustering positions in the malicious direction, select the malicious probability mass clustering position with the largest value as the malicious boundary clustering position. Among all probability mass clustering positions in the safe direction, select the safe probability mass clustering position with the smallest value as the safe boundary clustering position. Obtain the numerical interval between the malicious boundary clustering position and the safe boundary clustering position.

[0078] The numerical interval is calculated as follows: From the probability quality clustering positions of each malicious projection clustering segment in the malicious direction, the position with the largest value is compared one by one and recorded as the malicious boundary clustering position. Similarly, from the probability quality clustering positions of each safe projection clustering segment in the safe direction, the position with the smallest value is compared one by one and recorded as the safe boundary clustering position. Subtracting the value of the malicious boundary clustering position from the value of the safe boundary clustering position yields the numerical interval. This numerical interval reflects the size of the gap between the leading clustering regions of the malicious and safe categories on the probability axis.

[0079] Step S336: Compare the numerical interval, the cumulative extreme width of all malicious projection clusters, and the cumulative extreme width of all safe projection clusters. If the sum of the cumulative extreme widths is greater than zero, divide the numerical interval by the sum of the cumulative extreme widths to obtain the relative separation ratio. Use this relative separation ratio as the separation distance between categories. Otherwise, set the separation distance between categories to the preset maximum separation distance.

[0080] The sum of the cumulative extreme widths is the sum of the extreme widths of all malicious projection clusters and all safe projection clusters. If this sum is greater than 0, the numerical interval obtained in step S335 is divided by this sum, and the quotient is the relative separation ratio, which is used as the inter-category separation distance. If the sum of the cumulative extreme widths is equal to zero, it indicates that the group prediction probability distribution is highly concentrated in the direction of the malicious category or the safe category. In this case, the inter-category separation distance is set to a large preset maximum separation distance value to express the saturation state of the inter-category separation degree.

[0081] Step S340: The degree of inconsistency between the distribution patterns of individual prediction probability distributions in the set of group prediction probability distributions is characterized by distribution pattern entropy. The number of dominant distribution pattern types in the group and the number of individual prediction probability distributions clustered under each distribution pattern type are counted to generate a morphological diversity measure.

[0082] Distribution morphology refers to the monotonicity and peak tendency of the numerical distribution pattern of a single individual's predicted probability distribution between the probability values ​​of the malicious and safe categories. Distribution morphology entropy is an indicator that measures the uniformity of morphological distribution within a set of group predicted probability distributions based on the concept of information entropy. Morphological diversity is a multi-dimensional measure that comprehensively reflects the richness of the morphological richness of the base learner's predicted outputs in the group. For example, first, the morphology of each individual's predicted probability distribution in the set of group predicted probability distributions is determined, and a monotonic morphological label is assigned based on the numerical relationship between its probability values ​​in the malicious and safe categories. Based on the monotonic morphological labels and the peak positions of the probability value sequences, the individual predicted probability distributions are divided into morphological groups. These morphological groups are then merged and simplified according to the dimensionality compactness profile to obtain the final morphological group division result. The distribution morphological entropy is calculated based on the proportion of individual predicted probability distributions included in each independent distribution morphological type in the final morphological group, and this, combined with the total number of morphological types and the number of individuals in each type, serves as a measure of morphological diversity.

[0083] In one implementation, step S340 may specifically include the following steps S341 to S346: Step S341: Traverse the prediction probability distribution of each individual in the set of predicted probability distributions of the population, extract the probability values ​​of the individual's prediction probability distribution in all category dimensions as a probability value sequence, perform monotonicity direction discrimination on the probability value sequence, mark the sequence with continuously non-increasing probability values ​​from the beginning to the end as monotonically decreasing, mark the sequence with continuously non-increasing probability values ​​from the beginning to the end as monotonically increasing, and mark the remaining sequences as fluctuating, thus obtaining the monotonicity morphology label of each individual's prediction probability distribution.

[0084] In the binary classification scenario for malicious files, the category dimension consists of two dimensions: malicious and safe. The probability value sequence is a two-element sequence with the malicious probability value first and the safe probability value second. The monotonicity direction is determined as follows: compare the values ​​of the first and second elements. If the first element is greater than the second element and the difference between them is greater than 0, the sequence is non-increasing and labeled as monotonically decreasing, indicating that the base learner has a higher confidence level in the malicious category than in the safe category. If the first element is less than the second element, the sequence is non-increasing and labeled as monotonically increasing, indicating that the base learner has a higher confidence level in the safe category than in the malicious category. If the two elements are equal, it is labeled as fluctuating. The monotonicity morphology labeling is completed by traversing the predicted probability distribution of all individuals.

[0085] Step S342: Classify the predicted probability distributions of all individuals carrying monotonically increasing labels into an increasing morphological group, classify the predicted probability distributions of all individuals carrying monotonically decreasing labels into a decreasing morphological group, and further divide the predicted probability distributions of all individuals carrying fluctuating labels according to the peak position of their probability value sequence. Those with peaks in the first half of the sequence are classified into the front peak fluctuation group, and those with peaks in the second half of the sequence are classified into the back peak fluctuation group, thus forming the preliminary morphological group classification results.

[0086] The peak position of the probability value sequence is determined by scanning each element in the sequence and locating the index position of the element with the largest value. If the index position is less than half of the total dimension, the peak is located in the first half of the sequence; if the index position is greater than or equal to half of the total dimension, the peak is located in the second half of the sequence. All individual predicted probability distributions are classified into one of four categories according to this rule: increasing morphological group, decreasing morphological group, first-peak fluctuation group, and second-peak fluctuation group, forming the preliminary morphological group classification results.

[0087] Step S343: For each morphological group in the preliminary morphological group division results, extract the probability values ​​of the predicted probability distribution of all individuals in the morphological group on each category dimension, calculate the dispersion range width of the probability values ​​on each category dimension, mark the category dimensions whose dispersion range width exceeds the preset shrinkage threshold as the loose dimension of the morphological group, and mark the category dimensions whose dispersion range width does not exceed the preset shrinkage threshold as the tight dimension of the morphological group, thus forming the dimensional compactness profile of each morphological group.

[0088] The dispersion range width is the difference between the maximum and minimum predicted probability values ​​of all individuals within a morphological group on a certain category dimension. For a morphological group, on the malicious category dimension, the malicious probability values ​​of the predicted probability distribution of all individuals within the group are collected, the maximum and minimum values ​​are found, and the difference between the two is calculated as the dispersion range width for that dimension; the same operation is performed on the safe category dimension. The dispersion range width of each dimension is compared with a preset shrinkage threshold, which is a threshold parameter that controls the determination of dimension tightness. If the dispersion range width is greater than the preset shrinkage threshold, the dimension is marked as a loose dimension; if the dispersion range width is less than or equal to the preset shrinkage threshold, the dimension is marked as a tight dimension. The dimension marking results for each morphological group constitute the dimension tightness profile of that morphological group.

[0089] Step S344: Select two different morphological groups, and compare the intersection of the set of compact dimensions in the dimensional compactness profile of one morphological group with the set of compact dimensions in the dimensional compactness profile of the other morphological group. If the proportion of the number of dimensions contained in the intersection in the number of compact dimensions in each of the two morphological groups exceeds the preset overlap tolerance ratio, then merge the two morphological groups into one morphological group, and update the merged morphological group with the dimensional compactness profile of the predicted probability distribution of all individuals in the merged group. Repeat this merging process until no two morphological groups meet the merging condition, and obtain the final morphological group division result.

[0090] The preset overlap tolerance ratio is a threshold parameter that controls the sensitivity of morphology group merging. The merging process is executed iteratively: Two different morphology groups are randomly selected from the current morphology group set. The compact dimension sets of the first and second morphology groups are read, and the number of their intersection dimensions is calculated. This intersection dimension number is divided by the number of elements in the compact dimension sets of the first and second morphology groups, respectively. If both ratios are greater than the preset overlap tolerance ratio, the predicted probability distributions of all individuals within these two morphology groups are merged into a new morphology group, and the original two morphology groups are removed. The dimensional compactness profile of the new morphology group is recalculated based on the predicted probability distributions of all individuals within the merged group according to step S343. This scanning and merging operation is repeated until all possible morphology group pairs fail to meet the merging conditions, at which point the loop terminates, and the currently retained morphology group set is the final morphology group partitioning result.

[0091] Step S345: Treat each morphological group in the final morphological group division result as an independent distribution morphological type, count the proportion of the number of individual predicted probability distributions contained in each independent distribution morphological type to the total number of the group predicted probability distribution set, input the proportion corresponding to each independent distribution morphological type into the morphological entropy encoding function for transformation, obtain the encoding component of each independent distribution morphological type, sum all the encoding components and take the opposite number to obtain the distribution morphological entropy, and use the distribution morphological entropy as a measure of morphological diversity.

[0092] The morphological entropy encoding function employs the self-information transformation method used in information entropy calculation. In this embodiment, it is assumed that the final morphological group division result contains M independently distributed morphological types. For the m-th independently distributed morphological type, the proportion obtained by dividing the number of individual predicted probability distributions it contains by the total number of population predicted probability distribution sets is used as the independent variable input to the morphological entropy encoding function. The output of the morphological entropy encoding function is the product of this proportion and its base-2 logarithmic value. The M encoded components are summed, and the summation result is multiplied by negative one to obtain the distribution morphological entropy. The larger the value of the distribution morphological entropy, the more uniform the morphological type distribution of the individual predicted probability distributions in the population predicted probability distribution set and the richer the morphological diversity.

[0093] Step S346: Output the distribution morphological entropy, the total number of independent distribution morphological types, and the number of individual predicted probability distributions contained in each independent distribution morphological type, which together constitute the morphological diversity measurement result.

[0094] The morphological diversity measurement result is a triplet data structure. The first field is the distribution morphological entropy value calculated in step S345, the second field is the total number of independent distribution morphological types in the final morphological group division result, i.e., the value of M, and the third field is a list that records the number of individual predicted probability distributions contained in each independent distribution morphological type in order.

[0095] Step S350: Map outlier contribution, inter-category separation distance and morphological diversity measure to a preset common value range, and perform weighted fusion on the mapped values ​​to generate an adversarial suspicion strength index.

[0096] The pre-defined common numerical range is a standardized numerical range, such as a closed interval from 0 to 1. The purpose of mapping is to transform three metrics with different dimensions and original value ranges to the same scale for meaningful weighted fusion. For example, specific mapping methods can be as follows: For outlier divergence contribution, its original value range is theoretically between 0 and 1, but actual values ​​are usually concentrated in the lower region. A quantile mapping method is used, that is, based on the empirical quantiles of historically accumulated outlier divergence contribution distributions, the current outlier divergence contribution value is mapped to its corresponding position in the common numerical range, so that the mapped value reflects the relative level of the current outlier divergence contribution in the historical distribution. For inter-category separation distance, its original value range is between 0 and 1, and a linear mapping is used to directly project it to the common numerical range. For the distribution morphological entropy in morphological diversity measurement, its theoretical upper limit is the base-2 logarithm of the total number of independent distribution morphological types. The distribution morphological entropy is divided by this theoretical upper limit to obtain a normalized value, which is then mapped to the common numerical range. After mapping, the three mapped values ​​are multiplied by preset weighting coefficients for outlier contribution, inter-category separation distance, and morphological diversity, respectively. The three weighted results are then summed to obtain the adversarial suspicion strength index. The sum of all weighting coefficients is a positive number.

[0097] Step S360: Obtain the consistency of judgments of each heterogeneous base learner with respect to known true attributes in historical detections. Based on the consistency of judgments, configure a decision contribution weight for each heterogeneous base learner. Use the decision contribution weight to perform distribution weighted fusion of the prediction probability distributions of each individual in the set of group prediction probability distributions to obtain an ensemble distribution. Extract the category with the highest probability quality in the ensemble distribution as the ensemble maliciousness comprehensive judgment.

[0098] Judgment consistency is an indicator reflecting the frequency with which a heterogeneous base learner's predicted output matches the final verified true attribute in past detection tasks. Decision contribution weight is a coefficient calculated based on judgment consistency, representing the heterogeneous base learner's influence in ensemble decision fusion. Distribution-weighted fusion is an operation that uses each decision contribution weight as a coefficient to perform a weighted average of the predicted probability distributions of each entity. In this embodiment, for each heterogeneous base learner in the set, its historical detection records are reviewed, and the total number of times it participated in detections and the number of times its predicted category matched the final verified true attribute are counted. The number of matches is divided by the total number of matches to obtain the judgment consistency of that base learner. If a base learner has no historical detection records, it is assigned a default neutral judgment consistency. The proportion of each base learner's judgment consistency in the sum of all base learner judgment consistency is used as the base learner's decision contribution weight, and the sum of all decision contribution weights is 1. During the fusion of integrated decisions, the predicted probability distribution of each individual in the set of group predicted probability distributions is multiplied by its corresponding decision contribution weight to obtain a weighted individual distribution. All weighted individual distributions are then summed along both the malicious category and safe category dimensions to obtain the integrated distribution, which is a two-dimensional vector. The first component represents the integrated probability quality of the malicious category, and the second component represents the integrated probability quality of the safe category. The values ​​of these two components are compared, and the category corresponding to the component with the larger value is extracted as the integrated maliciousness comprehensive judgment. If the integrated probability quality of the malicious category is greater than that of the safe category, the integrated maliciousness comprehensive judgment indicates maliciousness; otherwise, it indicates safety.

[0099] Step S400: Obtain the dynamic adversarial suspicion benchmark, compare the adversarial suspicion strength index with the dynamic adversarial suspicion benchmark, and when the integrated maliciousness comprehensive judgment indicates maliciousness and the adversarial suspicion strength index exceeds the dynamic adversarial suspicion benchmark, identify the file to be detected as an adversarial escape suspect file.

[0100] In one implementation, step S400 may specifically include the following steps S410 to S460: Step S410: When the baseline update event is triggered by each detection task, scan the confirmation timestamp of each record in the adversarial escape confirmation file record set, filter out the records whose confirmation timestamps fall within the preset time interval of retrospective from the current time, form a subset of recent adversarial records, and extract all adversarial suspicion intensity index values ​​from the subset of recent adversarial records.

[0101] The anti-escape confirmation file record set is a data storage structure continuously maintained by the system during operation. Each record corresponds to a sample that was previously identified as a suspected anti-escape file and whose anti-escape nature was confirmed after in-depth analysis or manual review. Record fields include file identifier, internal structure description summary, anti-escape strength index value, and confirmation timestamp. The preset time interval is a parameter controlling the historical data time span referenced for baseline updates. After a detection task is completed and an anti-escape strength index is generated, the system checks whether the time interval since the last baseline update reaches the preset update trigger interval. If it does, a baseline update event is triggered. In the baseline update event processing flow, the system uses the current system time as the endpoint and traces back the preset time interval length to obtain a time window. All records in the anti-escape confirmation file record set are scanned, and the confirmation timestamp field of each record is read. Records whose confirmation timestamps fall within this time window are selected as a subset of recent anti-escape records. The anti-escape strength index value stored in each record in the recent anti-escape record subset is extracted to form a numerical sequence.

[0102] Step S420: Sort all extracted suspected adversarial strength index values ​​in ascending order to obtain a recent index ranking sequence. Remove a preset proportion of index values ​​from the low end and a preset proportion of index values ​​from the high end of the recent index ranking sequence. Use the remaining middle segment index values ​​as the benchmark candidate value set.

[0103] In this embodiment, the preset ratio is a parameter that controls the truncation range at both ends. After sorting, the number of elements to be removed from the lower end is calculated as the total length of the recent index sorting sequence multiplied by the preset ratio and rounded down. Similarly, the number of elements to be removed from the upper end is also calculated as the total length multiplied by the preset ratio and rounded down. Starting from the lower end of the sorting sequence, the calculated number of elements is removed sequentially; starting from the upper end of the sorting sequence, the same number of elements are removed sequentially. After the removal operation is completed, the remaining elements in the middle of the sorting sequence constitute the baseline candidate value set. The purpose of this truncation process is to eliminate the interference of extreme values ​​of the suspected adversarial strength index that may exist in recent adversarial records on the baseline calculation.

[0104] Step S430: Calculate the cluster center of the baseline candidate numerical set, extract the median value and distribution density measure of the baseline candidate numerical set, and determine the stable representative value of the baseline candidate numerical set based on the median value and distribution density measure.

[0105] In one implementation, step S430 may specifically include the following steps S431 to S436: Step S431: Arrange the values ​​in the baseline candidate value set in ascending order to obtain an ordered baseline candidate sequence. Extract the value located at the first quantile position after sorting from the ordered baseline candidate sequence as the first quantile value, extract the value located at the third quantile position after sorting as the third quantile value, and use the difference between the third quantile value and the first quantile value as the initial distribution width.

[0106] The first quantile position refers to the element at the one-quarter length position in the sorted sequence, and the third quantile position refers to the element at the three-quarters length position in the sorted sequence. If the length multiplied by the corresponding proportion is not an integer, the quantile value is calculated from two adjacent sorted elements using linear interpolation. The initial distribution width is the result of subtracting the first quantile value from the third quantile value; this value reflects the distribution width of the middle half of the data in the baseline candidate value set.

[0107] Step S432: Perform a difference operation between each value in the ordered baseline candidate sequence and the first quantile value. Mark the values ​​in the difference operation result that exceed the preset multiple of the initial distribution width as the lower tail point and temporarily store them. At the same time, perform a difference operation between each value in the ordered baseline candidate sequence and the third quantile value. Mark the values ​​in the difference operation result that exceed the preset multiple of the initial distribution width as the upper tail point and temporarily store them.

[0108] During the determination of the lower tail point, each value in the ordered baseline candidate sequence is traversed, and the difference between the first quantile value and the lower tail point is calculated. If this difference is greater than the initial distribution width multiplied by a preset multiple, the value is marked as the lower tail point. During the determination of the upper tail point, each value in the ordered baseline candidate sequence is traversed, and the difference between the upper tail point and the third quantile value is calculated. If this difference is greater than the initial distribution width multiplied by a preset multiple, the value is marked as the upper tail point. The preset multiple is a parameter that controls the sensitivity of tail point determination.

[0109] Step S433: Remove the lower and upper tail points from the ordered baseline candidate sequence, take the remaining ordered numerical segments as the core dense segment, calculate the mean of all values ​​in the core dense segment, record the mean as the primary cluster center, and calculate the difference between the values ​​at the beginning and end of the core dense segment as the core dense width.

[0110] The core dense segment is a continuous ascending sequence of values ​​retained after removing the trailing points on both sides. The arithmetic mean of all values ​​within the core dense segment is used to obtain the primary cluster center. The first value within the core dense segment is the first value, and the last value is the last value. The difference between the last value and the first value is the core dense width.

[0111] Step S434: Construct an acceptance interval with the primary clustering center as the origin and a preset multiple of the core dense width as the acceptance radius. Reassemble the values ​​in the ordered baseline candidate sequence that fall within the acceptance interval into an absorptive value set. Calculate the absorptive mean and absorptive dense width of the absorptive value set. Use the absorptive mean as the new primary clustering center and the absorptive dense width as the new core dense width.

[0112] In one implementation, step S434 may specifically include the following steps S4341 to S4346: Step S4341: Using the primary cluster center as the positioning base point, backtrack along the ordered baseline candidate sequence in the direction of decreasing value, and include a predetermined number of values ​​that are closest to the primary cluster center point by point. The difference between the outermost value reached by the backtracking and the primary cluster center is taken as the left natural span. At the same time, explore forward in the direction of increasing value, and take the difference between the outermost value reached by the forward exploration and the primary cluster center as the right natural span.

[0113] The predetermined number is an integer parameter that controls the size of the local exploration range. The backtracking process starts from the position of the primary cluster center in the ordered baseline candidate sequence, moves in the direction of decreasing index, and sequentially includes the values ​​passed through until the predetermined number of values ​​have been included. The outermost value at this point is recorded, and the difference between the primary cluster center and this outermost value is calculated as the left natural span. The forward exploration process starts from the position of the primary cluster center and moves in the direction of increasing index, sequentially including the values ​​passed through until the predetermined number of values ​​have been included. The outermost value at this point is recorded, and the difference between the outermost value and the primary cluster center is calculated as the right natural span.

[0114] Step S4342: The position of the primary cluster center minus the left natural span is used as the left boundary of the acceptance interval, and the position of the primary cluster center plus the right natural span is used as the right boundary of the acceptance interval, thus forming an asymmetric acceptance interval.

[0115] The left and right boundaries of the acceptance interval are determined independently based on the natural distribution span of the data on the left and right sides, without being forced to be symmetrical, thus adapting to the asymmetry of the data distribution.

[0116] Step S4343: Select all values ​​from the ordered baseline candidate sequence that are greater than the left boundary of the acceptance interval and less than the right boundary of the acceptance interval. Temporarily store the selected values ​​as the initial screening value set. Count the total number of elements in the initial screening value set. If the total number of elements is lower than the preset minimum clustering base, expand the acceptance interval synchronously by subtracting the fixed expansion step from the left boundary and adding the fixed expansion step to the right boundary. Count the values ​​again until the total number of elements reaches the minimum clustering base, and obtain the expanded acceptance interval.

[0117] The preset minimum clustering cardinality is the minimum number of samples required to ensure the statistical significance of the included numerical set. The fixed scaling step is the adjustment range for each expansion interval. The expansion process is iterative: each time, the left boundary of the current acceptance interval is subtracted by one fixed scaling step, and the right boundary is added by one fixed scaling step. The expanded interval is used to re-select values ​​from the ordered baseline candidate sequence. The number of selected values ​​is counted. If the number is still less than the minimum clustering cardinality, expansion continues until the number meets the condition or the maximum number of expansions is reached. The acceptance interval that meets the condition is the expanded acceptance interval.

[0118] Step S4344: Divide all values ​​within the expanded acceptance range into equal-width grids according to the numerical direction to form multiple equal-width numerical grids connected end to end. Count the frequency of values ​​falling into each equal-width numerical grid and generate a numerical frequency along the grid sequence. Traverse the numerical frequency along the grid sequence to locate adjacent grid pairs where the frequency drops from the previous grid to the next grid by more than a preset steep drop threshold, and mark the boundary position of the adjacent grid pair as a density breakpoint.

[0119] Specifically, the maximum and minimum values ​​within the expanded acceptance interval are obtained. The range between the maximum and minimum values ​​is divided into several equal segments, each with the same width, forming a uniform-width numerical grid. All values ​​within the expanded acceptance interval are iterated over. For each value, it is determined which uniform-width numerical grid it falls into, and the frequency count of that grid is incremented by 1. After statistical analysis, a frequency sequence is obtained, where each element corresponds to the frequency of a uniform-width numerical grid. Starting from the second uniform-width numerical grid, the frequency of the previous grid is subtracted from the frequency of the current grid. If this difference exceeds a preset steep-descent threshold, the boundary value between the two grids is marked as a density breakpoint. The preset steep-descent threshold is a parameter that controls the sensitivity of density breakpoint identification.

[0120] Step S4345: Starting from the left boundary of the expanded acceptance region, scan in the direction of increasing values. When a marked density breakpoint is encountered for the first time, shrink the left boundary to the location of the density breakpoint. Starting from the right boundary of the expanded acceptance region, scan in the direction of decreasing values. When a marked density breakpoint is encountered for the first time, shrink the right boundary to the location of the density breakpoint, thus forming a compact acceptance region.

[0121] The scanning process causes both sides of the receiving interval to shrink inward until the data density drops sharply, eliminating any sparse trailing areas at the edges of the receiving interval and retaining the core area with continuous and concentrated density. The resulting interval after shrinkage is the compact receiving interval.

[0122] Step S4346: Extract all values ​​in the ordered baseline candidate sequence that are within the compact acceptance interval to form an absorptive value set. Then, perform deduplication on the values ​​in the absorptive value set and output the absorptive value set obtained after deduplication as the final absorptive value set.

[0123] The deduplication process retains only one copy of each identical value that appears repeatedly in the absorbed value set, avoiding the potential bias of duplicate values ​​in subsequent mean calculations. The deduplicated absorbed value set is the final output of this step.

[0124] Step S435: Repeat the process of constructing a new round of acceptance intervals with the new primary aggregation center as the origin and a preset multiple of the new core density width as the acceptance radius, and calculate the new round of absorption mean and absorption density width. When the variation of the absorption mean between two adjacent iterations is continuously lower than the variation convergence limit and the variation of the absorption density width is continuously lower than the width convergence limit, the iteration is terminated.

[0125] The variable convergence limit is a small threshold parameter used to determine whether the iterative process has reached a steady state. The width convergence limit is another small threshold parameter used to determine the stability of the dense width. After each step S434, the updated absorption mean and absorption dense width are obtained. The absolute values ​​of the differences between these values ​​and the absorption mean and absorption dense width obtained in the previous iteration are calculated. If the absolute value of the difference in absorption mean is less than the variable convergence limit, and the absolute value of the difference in absorption dense width is less than the width convergence limit, and this state is continuously satisfied in several consecutive iterations, then the iteration terminates. Otherwise, the absorption mean of this round is taken as the new primary cluster center, and the absorption dense width of this round is taken as the new core dense width, and the process returns to step S434 for the next iteration.

[0126] Step S436: Output the mean value absorbed at the end of the iteration as a stable representative value, and output the dense width absorbed at the end of the iteration as the final measure of the distribution density.

[0127] The stable representative value is the estimated center location of the core dense region of the baseline candidate value set obtained after multiple rounds of acceptance interval iterations and convergence. The density of distribution is measured by the width of this core dense region.

[0128] Step S440: Compare the stable representative value with the preset absolute security lower limit value, and take the larger of the stable representative value and the absolute security lower limit value as the dynamic anti-counterfeiting benchmark after this update, and use the dynamic anti-counterfeiting benchmark in subsequent detection.

[0129] The preset absolute safety lower limit is a protective threshold that ensures the dynamic adversarial suspicion benchmark will not fall to an excessively low level due to insufficient historical data or abnormal data fluctuations. The stable representative value output in step S436 is compared with the preset absolute safety lower limit. If the stable representative value is greater than the absolute safety lower limit, the dynamic adversarial suspicion benchmark adopts the stable representative value; if the stable representative value is less than or equal to the absolute safety lower limit, the dynamic adversarial suspicion benchmark adopts the absolute safety lower limit. This dynamic adversarial suspicion benchmark, after being updated, will replace the previous old benchmark value and will be used in the adversarial escape suspicion determination of all subsequent detection tasks until the next benchmark update event triggers another update.

[0130] Step S450: Compare the strength index of the suspected adversarial force corresponding to the file to be detected with the dynamic suspected adversarial force benchmark, and check the direction of the integrated maliciousness judgment. If the strength index of the suspected adversarial force is greater than the dynamic suspected adversarial force benchmark and the direction of the integrated maliciousness judgment is malicious, then generate a suspected adversarial escape judgment signal.

[0131] Specifically, the size comparison is a numerical comparison operation, comparing the adversarial suspicion strength index value generated in step S350 with the currently valid dynamic adversarial suspicion benchmark value maintained in step S440 to determine whether the former is greater than the latter. The indication direction check reads the value of the integrated maliciousness comprehensive judgment generated in step S360. If the adversarial suspicion strength index is greater than the dynamic adversarial suspicion benchmark (true), and the integrated maliciousness comprehensive judgment indication is also true (true), when both conditions are met simultaneously, an adversarial escape suspicion judgment signal is generated. This signal indicates that the file to be detected is identified as an adversarial escape suspect file.

[0132] Step S460: Based on the anti-escape suspicion determination signal, combine the file identifier, internal structure description information summary, and anti-escape suspicion strength index of the file to be detected into a new record, and store the new record in the anti-escape confirmation file record set for use in subsequent benchmark update events.

[0133] The file identifier is a unique identifier for the file to be detected, which can be a message digest algorithm 5 hash value or a secure hash algorithm 256 hash value. The digest of the internal structure description information is a compact representation extracted from the internal structure description information, which can be a message digest algorithm 5 hash value of all structure tag sequences in the internal structure description information, or a vectorized representation of the structure tag type count distribution. After generating the anti-escape suspicion determination signal in step S450, the file identifier of the file to be detected is extracted, the digest of its internal structure description information is calculated, and the three fields of file identifier, digest, and anti-escape suspicion strength index value are packaged into a new record, which is then appended to the anti-escape confirmation file record set.

[0134] Step S500: Based on the identification results of the anti-escape suspected file, start the deep security analysis mechanism. The deep security analysis mechanism includes submitting the anti-escape suspected file to the isolated execution environment to obtain its runtime behavior record, and comparing the runtime behavior record with the malicious behavior pattern library.

[0135] In one implementation, step S500 may specifically include the following steps S510-S560: Step S510: Encapsulate the suspected anti-escape file into an isolated execution task, assign it to an isolated execution environment instance that is in a ready state, start the execution of the file in the isolated execution environment instance according to the entry point specified by the internal structure description information of the suspected anti-escape file, and inject a behavior monitoring probe at the same time.

[0136] An isolated execution environment instance is a pre-created, lightweight virtual machine or operating system-level container in a standby state, equipped with an operating system environment compatible with the execution platform of the file to be monitored. A behavior monitoring probe is a dynamically plugged-in interception code module at the system service call interface, responsible for capturing every system service call request and its parameter information issued by the monitored process. The encapsulation process generates an isolated execution task description structure, which contains the complete binary content of the suspected escape file, its internal structure description information generated in step S100, and the entry point address. The entry point address is provided by the entry point address attribute field of the optional header structure node in the internal structure description information; this address indicates where the first instruction should be executed when the file is loaded and executed. The system selects an instance marked as ready from the isolated execution environment instance pool and transmits the isolated execution task description structure to that instance via network or shared storage. After receiving a task, the isolated execution environment instance loads the file's binary content into the corresponding address space of simulated memory according to its section mapping relationship, based on the internal structure description information. Once loading is complete, a behavior monitoring probe is injected into the process space to be created via kernel module or dynamic link library injection. This allows the probe to intercept all service requests initiated to the operating system kernel through system call interfaces during process execution. After probe injection, the isolated execution environment instance sets the instruction pointer to the entry point address and starts process execution.

[0137] Step S520: The behavior monitoring probe intercepts every system service call request generated during file execution, records the call time, request type identifier, and request input parameter set of the system service call request, forming a system service call request record sequence. The request input parameter set includes file path parameters, memory region parameters, and access permission parameters.

[0138] The request type identifier is a unique number or name that distinguishes different system service call functions. For example, in a Windows operating system environment, it could be NtCreateFile, NtWriteVirtualMemory, NtMapViewOfSection, etc., while in a Linux operating system environment, it could be open, mmap, mprotect, etc. The request input parameter set is a list of key-value pairs containing each parameter item and its value passed with the system service call request. File path parameters are parameters of file system path string type in the request input parameter set, indicating the path of the target file being operated on. Memory region parameters are parameters of memory address or memory range description type in the request input parameter set, indicating the starting address and size range of the target memory region being operated on. Access permission parameters are parameters of access control flag type in the request input parameter set, indicating the read, write, and execute permissions of this operation request. In this embodiment, the behavior monitoring probe captures the call number or call name as the request type identifier each time the process enters a system service call, reads the parameter passing convention in the call stack or registers to extract the value of each parameter, and for pointer type parameters, reads the string or data structure content pointed to by the pointer from the process memory space to completely reconstruct the request input parameter set. Meanwhile, the behavior monitoring probe records the current system timestamp as the call time. The three fields of call time, request type identifier, and request parameter set are packaged into a request record entry and appended to a linear sequence organized in chronological order. This sequence is the system service call request record sequence, which is continuously appended until the process finishes execution or the preset monitoring duration limit is reached.

[0139] Step S530: Sort the system service call request record sequence in ascending order of call time, extract the request type identifier of two adjacent system service call request records, generate request type identifier transfer pairs, count the occurrence frequency of each request type identifier transfer pair, and construct a system call transfer graph with request type identifier as node and transfer frequency as directed edge weight.

[0140] A system call transition graph is a directed graph structure where nodes represent different request type identifiers. Directed edges point from earlier-occurring request type identifiers to later-occurring request type identifiers, and the weight of each edge is the cumulative number of times these two request type identifiers appear in the system service call request record sequence in an adjacent order. In this embodiment, the system service call request record sequence is naturally sorted in ascending order of call time during generation; if necessary, it is further sorted by the call time field to ensure monotonically increasing time. Starting from the first record in the sequence, the request type identifier of the t-th record and the request type identifier of the t+1 record are sequentially taken to form a request type identifier transition pair, with the transition direction from the t-th identifier to the t+1 identifier. After traversing the entire sequence, the frequency of each request type identifier transition pair is counted. Using all occurrences of the request type identifiers as the node set, for each request type identifier transition pair with a frequency greater than zero, a directed edge is created between the source node and the target node, with the edge weight assigned to the frequency of the transition pair. All nodes and directed edges together constitute the system call transition graph.

[0141] Step S540: Perform subgraph isomorphic matching between the system call transfer graph and the pre-set malicious system call transfer graph template in the malicious behavior pattern library. When there is a connected subgraph in the system call transfer graph that corresponds one-to-one with all nodes and all directed edges in a malicious system call transfer graph template, record the system service call request record subsequence corresponding to the connected subgraph as a malicious behavior fragment.

[0142] The malicious behavior pattern library is a database storing various known malicious runtime behavior patterns. Each behavior pattern exists as a malicious system call transfer graph template. The template defines the set of system service call request type nodes necessary for the malicious behavior and the directed edge connections that must be satisfied between them. Subgraph isomorphic matching is a graph matching algorithm used to determine whether a given graph (system call transfer graph) contains a subgraph that completely matches the template graph in terms of topology and node type. In this embodiment, for each malicious system call transfer graph template in the malicious behavior pattern library, its node type set and edge type set are extracted. The VF2 subgraph isomorphic algorithm is used to search the system call transfer graph for a subset of nodes and its associated subset of edges, such that each node in the subset can be mapped one-to-one to a template node of the same type, and each directed edge can be mapped one-to-one to a template directed edge of the same direction. If a match is successful, all request type identifiers involved in the matching subgraph of the system call transition graph are extracted. This process is then traced back to the system service call request record sequence to locate those request type identifiers that belong to the matching subgraph node set and form continuous or nearest-neighbor subsequences that temporally conform to the template edge connection relationship. These subsequences are recorded as malicious behavior fragments. A system call transition graph may match multiple different malicious system call transition graph templates; in this case, multiple corresponding malicious behavior fragments are recorded respectively.

[0143] Step S550: Perform parameter source analysis on the request input parameter set corresponding to the malicious behavior fragment, extract the file path and memory region address that were operated on, and reverse locate these file paths and memory region addresses in the internal structure description information of the suspected file of the anti-escape, and mark the local structural region affected by the malicious operation during execution.

[0144] In one implementation, step S550 may specifically include the following steps S551 to S556: Step S551: Extract the set of request input parameters for each system service call request record from the malicious behavior fragment, filter out the parameters of file path type and memory address type in the set of request input parameters, and obtain the path parameter subset and address parameter subset.

[0145] For example, each parameter in the request input parameter set has a type label, which is determined based on the definition of the system service call when the behavior monitoring probe captures the parameters in step S520. The filtering operation traverses the request input parameter set, filtering out parameters with the type label of file path string and classifying them into the path parameter subset, and filtering out parameters with the type label of memory address or memory range description and classifying them into the address parameter subset.

[0146] Step S552: For each file path in the path parameter subset, remove the virtual path part related to the isolated execution environment from its path prefix, restore the logical path of the file path inside the original file to be detected, and obtain the internal file path set.

[0147] When executing a file, the isolated execution environment may place the file to be detected at a mount point or temporary directory in the virtual file system, causing the file paths intercepted by the behavior monitoring probe to have a path prefix from the virtual environment. In this embodiment, the system pre-records the root path prefix string used to store the file to be detected in the isolated execution environment instance. For each file path in the path parameter subset, it is checked whether it starts with the root path prefix string. If so, the prefix portion is removed from the file path string, and the remaining part is the logical path of that file path within the original file to be detected. If the file path does not start with the root path prefix, the original path is retained. All the restored logical paths constitute the internal file path set.

[0148] Step S553: ​​For each memory region address in the address parameter subset, query the address mapping table maintained by the isolated execution environment, convert the virtual address in the isolated execution environment into the static file offset address of the suspected escape file in the non-execution state, and obtain the set of static offset addresses.

[0149] The address mapping table is a data structure established by the isolated execution environment when loading a file, mapping virtual addresses to static file offset addresses. This table records the range of virtual memory addresses mapped to each section of the file and their corresponding intra-file offset ranges. In this embodiment, for each memory region address in the address parameter subset, the virtual address range into which the virtual address falls is searched in the address mapping table, and the corresponding intra-file offset address is calculated using a linear offset: the intra-file offset address equals the virtual address minus the mapping base address plus the section's initial intra-file offset. If the virtual address does not fall into any mapped range, it is marked as an invalid address and skipped. All successfully converted intra-file offset addresses constitute the static offset address set.

[0150] Step S554: Using the path string in the internal file path set as the search key, traverse the path attributes of each structural unit in the internal structural description information of the suspected escape file, locate the structural unit that exactly matches the path string, and record the start and end offset positions of the structural unit in the internal structural description information.

[0151] Traverse the tree structure describing the internal structure information, and check whether each structure node contains a path attribute in its attribute field. The path attribute can be a string representation of the path within the file corresponding to that structure node. If the path attribute of a structure node is exactly the same as a path string in the set of internal file paths, the match is successful, and the start offset address, end offset address, and type label of that structure node are recorded.

[0152] Step S555: Using the offset address in the static offset address set as the search key, search for the structural unit that covers the offset address in the internal structural description information of the suspected anti-escape file, and record the start and end offset positions and type label of the structural unit.

[0153] When searching for structural units that cover offset addresses, in the tree structure of the internal structural description information, check the starting offset address and ending offset address range of each structural node. If the value of an offset address in the static offset address set is greater than or equal to the starting offset address of the structural node and less than or equal to the ending offset address of the structural node, then the offset address falls within the coverage range of the structural node, and the starting offset address, ending offset address and type label of the structural node are recorded.

[0154] Step S556: Deduplicate and merge the start and end offset positions and type labels of all located structural units to obtain a set of identifiers of local structural regions affected by malicious operations, which will be used as the output of the parameter tracing analysis.

[0155] All structural unit information recorded in steps S554 and S555 is compiled into a list. If multiple records correspond to the same structural unit (i.e., the start and end offset addresses are exactly the same and the type label is the same), only one is retained. The deduplicated list is the set of identifiers of local structural regions affected by malicious operations. Each element in this set contains the start and end offset addresses and the type label of a structural unit, identifying which structural regions within the file were directly manipulated by malicious behavior during execution.

[0156] Step S560: Generate a deep analysis report containing malicious behavior fragments, identifiers of local structural regions affected by the malicious operation, and malicious behavior type tags matched by the malicious behavior, and output the deep analysis report to the analysis results repository.

[0157] The malicious behavior type label is the name of the malicious behavior type corresponding to the successfully matched malicious system call transfer graph template in step S540, such as "process injection behavior," "file tampering behavior," and "registry persistence behavior." The deep analysis report is a structured analysis result document, containing three main chapters: Chapter 1 details the malicious behavior fragments, listing the call time, request type identifier, and core parameter summary for each system service call request record in chronological order; Chapter 2 lists the set of identifiers for local structural regions affected by the malicious operation, listing the start and end offsets and type labels for each affected structural unit; Chapter 3 contains the malicious behavior type label and the corresponding malicious system call transfer graph template identifier. In this embodiment, the system integrates the above three items into a single deep analysis report and writes it to the analysis result repository. The analysis result repository can be a file storage directory on a local disk, a network-attached storage device, or a database table in a distributed storage cluster. Specifically, the report file is generated using a combination of file identifier and timestamp, and the report content is serialized using Structured Markup Language or Lightweight Data Interchange Format before being stored.

[0158] As one implementation method, after obtaining the subset of path parameters, the subset of address parameters, and the set of identifiers of local structural regions affected by malicious operations, the method further includes using their feedback to correct the set of heterogeneous base learners, which may specifically include the following steps S570~S5120: Step S570: Compare each type of label in the set of local structural regions affected by the malicious operation with the component label sequence in the exclusive interest region mapping rule bound to each heterogeneous base learner in the current set of heterogeneous base learners, and calculate the coverage degree of the interest region of each heterogeneous base learner on the local structural region.

[0159] Coverage is a metric that measures how many structural types from the set of local structural region identifiers affected by malicious operations are included in the set of structural components specified by the dedicated region of interest mapping rule of a heterogeneous base learner. In this embodiment, for each heterogeneous base learner, the component identifier sequence defined in its dedicated region of interest mapping rule is read, and the structural tag types corresponding to all component identifiers in the sequence are summarized to obtain the set of all structural tag types that the base learner is interested in. The set of type labels from the set of local structural region identifiers affected by malicious operations is used as a reference set. The number of intersection elements of the two sets is calculated, and the number of intersection elements is divided by the number of elements in the reference set. The resulting ratio is the coverage. The coverage value ranges from 0 to 1. A higher value indicates a higher degree of overlap between the base learner's field of interest and the types of the regions affected by the discovered malicious behavior.

[0160] Step S580: Select the heterogeneous base learner with the highest coverage as the base learner to be updated, and extract the original structural data corresponding to the local structural region in the internal structural description information of the adversarial escape suspect file to form an additional training segment.

[0161] The base learner to be updated is a heterogeneous base learner selected to perform incremental correction. The additional training segment is the original byte data corresponding to the local structural regions affected by malicious behavior in the suspected adversarial escape file; this data carries the structural feature information of the malicious behavior. In this embodiment, based on the start and end offset addresses of each structural unit in the set of identifiers of the local structural regions affected by malicious operations, all byte data within the corresponding interval is read from the original binary byte stream of the suspected adversarial escape file. These byte data are then concatenated sequentially according to their offset order in the file to form a continuous additional training segment. The true attribute label corresponding to the additional training segment is forcibly set to the malicious category.

[0162] Step S590: Use the additional training fragment to incrementally correct the internal discrimination boundary of the base learner to be updated. During the correction process, constrain the malicious output of the base learner to be updated to the malicious direction of the additional training fragment, and at the same time monitor whether the prediction output of the base learner to be updated to non-malicious file samples is flipped.

[0163] Incremental correction is the process of fine-tuning the parameters of a trained machine learning model using new samples without retraining from scratch. In this embodiment, incremental correction is performed using online learning: additional training segments are input into the progressive state transition chain of the base learner to be updated, and forward propagation, loss calculation, and backpropagation parameter updates are performed according to steps S253 to S255. However, the loss function used adds a directional constraint term to the standard cross-entropy loss. The directional constraint term penalizes the base learner to be updated if the probability value of the malicious category output for the additional training segment is lower than a preset high confidence threshold, thereby forcing the model to adjust its prediction output for the additional training segment in the malicious direction. During the parameter update process of incremental correction, a batch of non-malicious samples are simultaneously extracted from a pre-reserved non-malicious file sample verification set and input into the current base learner to be updated for forward propagation. The predicted category of its output is checked to see if it changes from safe to malicious. If such a reversal of the prediction output occurs, the fact that the reversal has occurred is recorded.

[0164] Step S5100: If the prediction output of the base learner to be updated for non-malicious file samples is flipped during the correction process, the incremental correction of the base learner to be updated is paused, the base learner to be updated is marked as saturated, and the heterogeneous base learner with the second highest coverage is selected to continue to try incremental correction.

[0165] An update saturation state refers to a situation where the heterogeneous base learner has reached its correction capacity limit in its current internal connection state, and further correction would cause unacceptable damage to the accuracy of non-malicious sample determination. In this embodiment, when it is detected that the predicted output of the base learner to be updated for any sample in the non-malicious file sample verification set has flipped from safe to malicious, the parameter update operation of the current incremental correction is immediately stopped, and the weight changes caused by this round of correction are rolled back to the state before correction. An update saturation state mark is added to the base learner set, and this base learner will no longer be selected as the object of incremental correction. From the remaining heterogeneous base learners that are not marked as update saturation state, the system sorts them according to their coverage, selects the one with the highest coverage as the new base learner to be updated, and repeats the incremental correction process of step S590.

[0166] Step S5110: After completing the incremental correction, the corrected heterogeneous base learner is added back to the heterogeneous base learner set, and the decision contribution weight of the heterogeneous base learner in the integrated decision fusion is adjusted simultaneously, so that the integrated decision fusion is more sensitive to the malicious behavior tendency of similar structural regions.

[0167] The adjustment method for the decision contribution weights involves assigning an incremental boosting coefficient to the heterogeneous base learner that has completed incremental correction, multiplying its original decision contribution weight by this incremental boosting coefficient, and then re-normalizing to obtain the new decision contribution weights. The value of the incremental boosting coefficient is greater than 1, which enhances the influence of the corrected base learner in the integrated decision fusion. In this embodiment, after the base learner to be updated successfully completes the incremental correction of the additional training segment and does not trigger the prediction output flipping termination condition, its internal connection state is fixed, and the base learner is returned to the heterogeneous base learner set to replace the version before correction. The system recalculates the decision contribution weights of all base learners in the heterogeneous base learner set: based on the original judgment consistency level, the judgment consistency level of the incrementally corrected base learner is multiplied by the incremental boosting coefficient, and then normalized to obtain the updated distribution of each decision contribution weight. Therefore, in subsequent detection tasks, the integrated decision fusion will exhibit higher sensitivity to malicious tendencies in structural component regions that are the same as or similar to the region affected by this malicious behavior.

[0168] Step S5120: Associate and store the file paths and offset addresses involved in the incremental correction process with the corresponding corrected internal discrimination boundary states to form boundary update records, which can be used for backtracking and querying when similar paths or address parameters are detected later.

[0169] A boundary update record is an audit data structure that records the scope of influence of incremental correction operations. It includes the timestamp of the correction, the file identifier of the suspected adversarial escape file targeted by the correction, the set of file path parameters and offset addresses corresponding to the additional training segments used for incremental correction, the version identifier of the base learner to be updated after correction, and the digest hash value of the internal discrimination boundary of the base learner. In this embodiment, after the incremental correction is completed and the base learner is confirmed to have been reinstated into the set, the system extracts the internal file path set and static offset address set involved in this correction, packages them together with the internal connection state digest of the corrected base learner into a boundary update record, and stores it in the boundary update record library. In subsequent detection tasks, when a file to be detected triggers file path or offset address features that are the same or highly similar to those in the historical records, this record library can be queried to trace the historical evolution of the discrimination boundary of the detection system.

[0170] This invention provides a server, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor executes the program, it implements some or all of the steps in the above-described method.

[0171] This invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements some or all of the steps in the above-described method. The computer-readable storage medium can be transient or non-transient.

[0172] This invention provides a computer program including computer-readable code, wherein when the computer-readable code is executed in a computer device, a processor in the computer device performs some or all of the steps in the above-described method.

[0173] This invention provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. When the computer program is read and executed by a computer, it implements some or all of the steps in the above-described method. This computer program product can be implemented specifically through hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium; in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0174] It should be noted that the descriptions of the various embodiments above tend to emphasize the differences between them, while their similarities or commonalities can be referred to interchangeably. The descriptions of the above embodiments of the device, storage medium, computer program, and computer program product are similar to the descriptions of the above method embodiments and have similar beneficial effects. For technical details not disclosed in the embodiments of the device, storage medium, computer program, and computer program product of the present invention, please refer to the descriptions of the method embodiments of the present invention for understanding.

[0175] Figure 3 A hardware entity diagram of a server provided in an embodiment of the present invention, such as... Figure 3 As shown, the hardware entity of the server 1000 includes a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can run on the processor 1001, and the processor 1001 executes the program to implement the steps in the method of any of the above embodiments.

[0176] The memory 1002 stores computer programs that can run on the processor. The memory 1002 is configured to store instructions and applications that can be executed by the processor 1001. It can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data, and video communication data) in the processor 1001 and various modules in the server 1000. It can be implemented by flash memory or random access memory (RAM).

[0177] When the processor 1001 executes the program, it implements the steps of the ensemble learning-based computer malicious file detection method described above. The processor 1001 typically controls the overall operation of the server 1000.

[0178] This invention provides a computer storage medium storing one or more programs that can be executed by one or more processors to implement the steps of the computer malicious file detection method based on ensemble learning as described in any of the above embodiments.

[0179] The above description is merely an embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting malicious computer files based on ensemble learning, characterized in that, include: Obtain the file to be detected, perform source code parsing on the file to be detected, and generate internal structure description information of the file to be detected; The internal structure description information is distributed to a pre-configured set of heterogeneous base learners. Each heterogeneous base learner extracts a local structure description fragment from the internal structure description information according to its corresponding exclusive region of interest mapping rule, and performs a malice measurement on the local structure description fragment based on its own decision boundary to generate an individual prediction probability distribution. All individual prediction probability distributions are aggregated to obtain a set of group prediction probability distributions. Based on the degree of distribution divergence between the individual prediction probability distributions in the group prediction probability distribution set, an adversarial suspicion strength index is generated. At the same time, the group prediction probability distribution set is used for integrated decision fusion to generate an integrated maliciousness comprehensive judgment. A dynamic adversarial suspicion benchmark is obtained, and the adversarial suspicion strength index is compared with the dynamic adversarial suspicion benchmark. When the integrated malice determination indicates malice and the adversarial suspicion strength index exceeds the dynamic adversarial suspicion benchmark, the file to be detected is identified as an adversarial escape suspect file. Based on the identification results of the suspected anti-escape file, a deep security analysis mechanism is initiated. The deep security analysis mechanism includes submitting the suspected anti-escape file to an isolated execution environment to obtain its runtime behavior record, and comparing the runtime behavior record with a malicious behavior pattern library.

2. The method according to claim 1, characterized in that, The process involves distributing the internal structure description information to a pre-configured set of heterogeneous base learners. Each heterogeneous base learner, based on its corresponding region of interest mapping rule, extracts a local structure description fragment from the internal structure description information and performs a malice measurement on the local structure description fragment based on its own decision boundary, generating an individual prediction probability distribution. The set of all individual prediction probability distributions is then aggregated to obtain a group prediction probability distribution set, including: Extract the internal structure description information of each file sample from the pre-collected file sample set, traverse each internal structure description information one by one, serialize and arrange the structure tags in them, generate a structure tag sequence that reflects the internal organization order of the file, and generate an interval index mapping relationship based on the data interval covered by each structure tag; Using the tag type in the structural tag sequence as the dimension, the independent occurrence frequency of each tag type and the adjacent co-occurrence frequency with other tag types in the entire file sample set are counted. Based on the independent occurrence frequency and the adjacent co-occurrence frequency, a tag type association network is constructed. In the tag type association network, the tag type is the node and the adjacent co-occurrence frequency is the association edge between the nodes. The subgraph partitioning process based on edge connectivity strength is applied to the labeled type association network. Nodes with association edge strength continuously higher than the partitioning threshold are merged into the same structural component until all nodes are assigned to a unique structural component, thereby obtaining the structural component partitioning result. Each structural component in the structural component partitioning result corresponds to a set of structural labels for a type of functional association. For each heterogeneous base learner to be generated, a specified number of structural components are randomly selected from the structural component partitioning results in a non-repeating manner to form a component set, and the structural components in the component set are randomly arranged in order to generate a unique region of interest mapping rule defined by the structural component identifier sequence and the arrangement order. The generated dedicated region of interest mapping rule is bound to a learner to be trained with an initial internal connection state. The dedicated region of interest mapping rule is used to extract the structural descriptor subsequence that matches the component identifier sequence and conforms to the arrangement order from the internal structural description information of each file sample, forming a set of local structural description fragment samples. The internal connection state of the learner to be trained is directionally corrected using the set of local structural description fragment samples to obtain a heterogeneous base learner. Heterogeneous base learners generated by different dedicated region of interest mapping rules are aggregated to form a heterogeneous base learner set. During the detection phase, the internal structure description information of the file to be detected is distributed in parallel to each heterogeneous base learner in the heterogeneous base learner set. Each heterogeneous base learner extracts a local structure description fragment and generates an individual prediction probability distribution. Finally, they are aggregated to form a group prediction probability distribution set.

3. The method according to claim 2, characterized in that, The method involves using the tag type in the structural tag sequence as a dimension to statistically analyze the independent occurrence frequency and adjacent co-occurrence frequency of each tag type in the entire file sample set, and constructing a tag type association network based on the independent occurrence frequency and adjacent co-occurrence frequency, including: An independent counter is established for each structure tag type. The structure tag sequence of all file samples is traversed. Whenever a structure tag is read in the structure tag sequence, the independent counter corresponding to the tag type to which the structure tag belongs is found and incremented. After the traversal is completed, the independent frequency set of each tag type is obtained. For each structural tag type, a co-occurrence counter is established corresponding to its possible adjacent tag types. The structural tag pairs in each structural tag sequence are traversed, and the tag types to which the two tags in the structural tag pair belong are extracted as type pairs. The co-occurrence counter corresponding to the type pair is incremented. After traversal, the set of adjacent co-occurrence frequencies of all type pairs is obtained. Using each structural tag type as a node, an initial connection edge is established between two nodes of the type that have adjacent co-occurrence frequencies that are not zero, and the adjacent co-occurrence frequency is assigned as the initial connection strength of the initial connection edge; The initial connection strength of each initial connection edge is correlated with the independent occurrence frequency of the nodes at both ends of the edge and normalized. The initial connection strength is divided by the geometric mean of the independent occurrence frequency of the nodes at both ends to obtain the normalized connection strength, so that the connection strength eliminates the metric imbalance caused by the different total occurrence of the label type. For each node, retain the preset number of edges with the highest normalized connection strength, and prune the remaining connection edges. If the original number of edges of a node does not exceed the preset number, all edges are retained, resulting in the pruned set of connection edges. Output a label-type association network with all structure label types as nodes and the normalized connection strength of each edge in the pruned set of connection edges as the associated edges.

4. The method according to claim 2, characterized in that, The process of extracting structural description subsequences that match the component identifier sequence and conform to the arrangement order from the internal structural description information of each file sample using the dedicated region of interest mapping rule, forming a set of local structural description fragment samples, and using this set of local structural description fragment samples to perform targeted correction of the internal connection state of the learner to be trained, includes: Based on the component identifier sequence defined in the exclusive attention region mapping rule, the start and end positions of the identifier of each structural component in the internal structure description information of the file sample are found, and the start and end positions are converted into actual byte offset addresses using the interval index mapping relationship. According to the arrangement order defined in the dedicated region of interest mapping rules, the structural data within the byte offset address range of each structural component is read sequentially from the internal structural description information, and the read structural data is spliced ​​together to form a continuous local structural description fragment. The local structure description fragment is input into the learner to be trained, and the progressive state transition chain inside the learner to be trained performs state evolution processing byte by byte or structural unit by structural unit until the end of the fragment is processed, and the internal state snapshot at the termination time is obtained. The internal state snapshot is input into the classification projection layer of the learner to be trained. The classification projection layer maps the internal state snapshot to the probability distribution output on each category. The deviation between the probability distribution output and the true attributes of the file sample is calculated to obtain the current prediction loss. The current predicted loss is propagated backward along the classification projection layer of the learner to be trained to the progressive state transition chain. The sensitivity of the loss to each connection part inside the learner to be trained is calculated along the propagation path, and the strength parameters of the internal connection are adjusted according to the sensitivity to complete one directional correction iteration. Repeatedly perform directional correction iterations. After each iteration batch, evaluate the central tendency of the deviation between the output of the current trainable learner for all samples in the local structure description fragment sample set and the true attributes. When the central tendency does not decrease in multiple consecutive iteration batches, terminate the iteration and use the current internal connection state as the final heterogeneous base learner.

5. The method according to claim 1, characterized in that, The process involves generating an adversarial suspicion strength index based on the degree of distribution divergence among the individual prediction probability distributions in the group prediction probability distribution set, and simultaneously using the group prediction probability distribution set for integrated decision fusion to generate an integrated maliciousness comprehensive judgment, including: For each pair of different individuals in the set of predicted probability distributions of the group, calculate the probability quality difference between them in the malicious category and the probability quality difference in the safe category to form the category orientation difference between each pair of individuals. Collect all the category orientation difference between each pair of individuals to obtain the difference set. The set of discrepancies is processed by global scatter measurement, and the concentrated distribution interval of the set of discrepancies and the outlier discrepancies that exceed the boundary of the concentrated distribution interval are extracted. The excess magnitude of all outlier discrepancies relative to the boundary of the concentrated distribution interval is aggregated, and the aggregation result is combined with the number of outlier discrepancies to form the outlier divergence contribution with a single probability dimension. The set of group prediction probability distributions is decomposed into probability distribution directions according to malicious and safe categories. The extreme width and probability quality clustering position of the probability distribution of each base learner are obtained in each category direction. The separation gap between the probability quality clustering position in the malicious category direction and the probability quality clustering position in the safe category direction is quantified as the inter-category separation distance. The degree of inconsistency between the distribution patterns of individual prediction probability distributions in the set of population prediction probability distributions is characterized by distribution pattern entropy. The number of dominant distribution pattern types in the population and the number of individual prediction probability distributions clustered under each distribution pattern type are counted to generate a morphological diversity measure. The outlier divergence contribution, inter-category separation distance, and morphological diversity measure are each mapped to a preset common value range. The mapped values ​​are then weighted and fused to generate an adversarial suspicion strength index. The consistency of each heterogeneous base learner's judgment with respect to known true attributes in historical detection is obtained. Based on this consistency, a decision contribution weight is assigned to each heterogeneous base learner. The decision contribution weight is used to perform distribution weighted fusion of the prediction probability distributions of each individual in the set of group prediction probability distributions to obtain the ensemble distribution. The category with the highest probability quality in the ensemble distribution is extracted as the ensemble maliciousness comprehensive judgment.

6. The method according to claim 5, characterized in that, The process of decomposing the group prediction probability distribution set according to the probability distribution direction of malicious and safe categories, obtaining the extreme width and probability quality clustering position of the probability distribution of each base learner in each category direction, and quantifying the separation gap between the probability quality clustering positions in the malicious category direction and the probability quality clustering positions in the safe category direction as the inter-category separation distance includes: Traverse the prediction probability distribution of each individual in the group prediction probability distribution set, extract the probability quality value corresponding to the malicious category in the prediction probability distribution of the individual as the malicious direction projection point, and extract the probability quality value corresponding to the safe category in the prediction probability distribution of the individual as the safe direction projection point, until the traversal ends and the malicious direction projection point set and the safe direction projection point set are formed respectively. Arrange the projection points in the malicious direction projection point set in ascending order of values ​​to obtain an ordered malicious projection sequence. Calculate the numerical distance between two adjacent projection points in the ordered malicious projection sequence in turn. Mark the positions where the numerical distance exceeds a preset multiple of the overall average distance as the segmentation boundary. Use the segmentation boundary to divide the ordered malicious projection sequence into multiple malicious projection cluster segments. Extract the minimum and maximum values ​​of the projection points within each malicious projection cluster segment, record the range between the minimum and maximum values ​​as the extreme width of the malicious projection cluster segment, and extract the projection point value that is in the middle position after sorting all projection points within the segment as the probability quality cluster position of the malicious projection cluster segment. The same processing is performed on the safe direction projection point set. The projection points in the safe direction projection point set are arranged in ascending order of value and divided into multiple safe projection cluster segments based on the adjacent spacing. The extreme value width and probability mass cluster position of each safe projection cluster segment are extracted. Among all probability mass clustering locations in the malicious direction, the malicious probability mass clustering location with the largest value is selected as the malicious boundary clustering location. Among all probability mass clustering locations in the safe direction, the safe probability mass clustering location with the smallest value is selected as the safe boundary clustering location. The numerical interval between the malicious boundary clustering location and the safe boundary clustering location is obtained. The numerical interval, the cumulative extreme width of all malicious projection clusters, and the cumulative extreme width of all safe projection clusters are compared. If the sum of the cumulative extreme widths is greater than zero, the numerical interval is divided by the sum of the cumulative extreme widths to obtain the relative separation ratio. This relative separation ratio is used as the separation distance between categories. Otherwise, the separation distance between categories is set to the preset maximum separation distance.

7. The method according to claim 5, characterized in that, The degree of inconsistency between the distribution patterns of individual prediction probability distributions in the set of population prediction probability distributions is characterized by distribution pattern entropy. This involves statistically analyzing the number of dominant distribution pattern types in the population and the number of individual prediction probability distributions clustered under each distribution pattern type to generate a morphological diversity measure, including: Traverse the prediction probability distribution of each individual in the set of predicted probability distributions of the population, extract the probability values ​​of the individual's prediction probability distribution across all category dimensions as a probability value sequence, perform monotonicity direction discrimination on the probability value sequence, mark the sequence with continuously non-increasing probability values ​​from the beginning to the end as monotonically decreasing, mark the sequence with continuously non-increasing probability values ​​from the beginning to the end as monotonically increasing, and mark the remaining sequences as fluctuating, thus obtaining the monotonicity morphology label of each individual's prediction probability distribution; The predicted probability distributions of all individuals with monotonically increasing labels are classified into an increasing morphological group, the predicted probability distributions of all individuals with monotonically decreasing labels are classified into a decreasing morphological group, and the predicted probability distributions of all individuals with fluctuating labels are further divided according to the peak position of their probability value sequence. Those with peaks in the first half of the sequence are classified into the front peak fluctuating group, and those with peaks in the second half of the sequence are classified into the back peak fluctuating group, thus forming the preliminary morphological group classification results. For each morphological group in the preliminary morphological group division results, extract the probability values ​​of the predicted probability distribution of all individuals in the morphological group on each category dimension, calculate the dispersion range width of the probability values ​​on each category dimension, mark the category dimensions whose dispersion range width exceeds the preset shrinkage threshold as the loose dimension of the morphological group, and mark the category dimensions whose dispersion range width does not exceed the preset shrinkage threshold as the tight dimension of the morphological group, thus forming the dimensional compactness profile of each morphological group. Two different morphological groups are selected. The set of compact dimensions in the dimensional compactness profile of one morphological group is compared with the set of compact dimensions in the dimensional compactness profile of the other morphological group. If the proportion of the number of dimensions contained in the intersection in the number of compact dimensions in each of the two morphological groups exceeds the preset overlap tolerance ratio, the two morphological groups are merged into one morphological group. The merged morphological group is updated with the dimensional compactness profile of the predicted probability distribution of all individuals in the merged group. This merging process is repeated until no two morphological groups meet the merging condition, and the final morphological group division result is obtained. Each morphological group in the final morphological group division result is taken as an independent distribution morphological type. The proportion of the number of individual predicted probability distributions contained in each independent distribution morphological type to the total number of the group predicted probability distribution set is counted. The proportion corresponding to each independent distribution morphological type is input into the morphological entropy encoding function for transformation to obtain the encoding component of each independent distribution morphological type. The distribution morphological entropy is obtained by summing all the encoding components and taking the opposite number. The distribution morphological entropy is used as a measure of morphological diversity. The output distribution morphological entropy, the total number of independent distribution morphological types, and the number of individual predicted probability distributions contained in each independent distribution morphological type together constitute the morphological diversity measurement result.

8. The method according to claim 1, characterized in that, The process of obtaining a dynamic adversarial suspicion benchmark involves comparing the adversarial suspicion strength index with the dynamic adversarial suspicion benchmark. When the integrated malice assessment indicates malice and the adversarial suspicion strength index exceeds the dynamic adversarial suspicion benchmark, the file to be detected is identified as an adversarial escape suspect file, including: When each detection task triggers a baseline update event, the confirmation timestamps of each record in the adversarial escape confirmation file record set are scanned, and records whose confirmation timestamps fall within a preset time interval that is traced back from the current time are selected to form a subset of recent adversarial records. All adversarial suspicion intensity index values ​​are extracted from the subset of recent adversarial records. All extracted suspected adversarial strength index values ​​are sorted from low to high to obtain a recent index ranking sequence. A preset proportion of index values ​​are removed from the low end and a preset proportion of index values ​​are removed from the high end of the recent index ranking sequence. The remaining middle segment index values ​​are used as the benchmark candidate value set. Cluster centers are calculated for the baseline candidate numerical set, and the median value and distribution density measure of the baseline candidate numerical set are extracted. The stable representative value of the baseline candidate numerical set is determined based on the median value and distribution density measure. The stable representative value is compared with the preset absolute security lower limit value. The larger of the stable representative value and the absolute security lower limit value is taken as the dynamic anti-countermeasure benchmark after this update, and the dynamic anti-countermeasure benchmark is used in subsequent detection. The strength index of the suspected adversarial action corresponding to the file to be detected is compared with the dynamic suspected adversarial action benchmark. At the same time, the direction of the integrated maliciousness judgment is checked. If the strength index of the suspected adversarial action is greater than the dynamic suspected adversarial action benchmark and the direction of the integrated maliciousness judgment is malicious, then an adversarial escape suspected judgment signal is generated. Based on the anti-escape suspicion determination signal, the file identifier, internal structure description information summary and anti-escape suspicion strength index of the file to be detected are combined into a new record, and the new record is stored in the anti-escape confirmation file record set. The step of calculating cluster centers for the benchmark candidate numerical set, extracting the median value and distribution density measure of the benchmark candidate numerical set, and determining a stable representative value for the benchmark candidate numerical set based on the median value and distribution density measure includes: Arrange the values ​​in the baseline candidate value set in ascending order to obtain an ordered baseline candidate sequence. Extract the value located at the first quantile position after sorting from the ordered baseline candidate sequence as the first quantile value, extract the value located at the third quantile position after sorting as the third quantile value, and use the difference between the third quantile value and the first quantile value as the initial distribution width. Perform a difference operation between each value in the ordered baseline candidate sequence and the first quantile value. Mark the values ​​in the difference operation result that exceed the preset multiple of the initial distribution width as the lower tail point and store them temporarily. At the same time, perform a difference operation between each value in the ordered baseline candidate sequence and the third quantile value. Mark the values ​​in the difference operation result that exceed the preset multiple of the initial distribution width as the upper tail point and store them temporarily. Remove the lower and upper tail points from the ordered baseline candidate sequence, and take the remaining ordered numerical segments as the core dense segment. Calculate the mean of all values ​​in the core dense segment, record the mean as the primary cluster center, and calculate the difference between the first and last values ​​in the core dense segment as the core dense width. An acceptance interval is constructed with the primary clustering center as the origin and a preset multiple of the core dense width as the acceptance radius. The values ​​that fall into the acceptance interval in the ordered baseline candidate sequence are re-aggregated into an absorptive value set. The absorptive mean and absorptive dense width of the absorptive value set are calculated. The absorptive mean is used as the new primary clustering center and the absorptive dense width is used as the new core dense width. Repeatedly construct a new round of acceptance interval with the new primary clustering center as the origin and a preset multiple of the new core dense width as the acceptance radius, and calculate the new round of absorption mean and absorption dense width. The iteration is terminated when the variation of the absorption mean between two adjacent iterations is continuously lower than the variation convergence limit and the variation of the absorption dense width is continuously lower than the width convergence limit. The mean value absorbed at the end of the iteration is output as a stable representative value, and the density width absorbed at the end of the iteration is output as the final measure of the distribution density.

9. A server comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program performs the steps of the method according to any one of claims 1 to 8.

Images