A terminal malicious program dynamic interception method and system based on behavior characteristics

Abstract

The application discloses a terminal malicious program dynamic interception method and system based on behavior characteristics, comprising: collecting terminal process runtime behavior data; performing time sequence aggregation on the collected behavior data according to a preset sliding time window to obtain a behavior event set; establishing a parent-child derivative correlation relationship for each behavior event in the behavior event set; and splicing the event set corresponding to the processes with the parent-child derivative correlation relationship in time sequence to obtain a behavior sequence. Multidimensional behavior characteristics are extracted from the behavior sequence and a feature vector is constructed; the feature vector is input into a first random forest anomaly discrimination model and a second isolated forest anomaly discrimination model, and classification probability and anomaly scores are output; the classification probability and the anomaly scores are weighted to obtain a final evaluation score; the final evaluation score is compared with a dynamic threshold to obtain a judgment result; and if the behavior is malicious, an interception action rule is generated. Through the method, the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] This application belongs to the field of computer security technology, specifically relating to a method and system for dynamically intercepting terminal malware based on behavioral characteristics. Background Technology

[0002] As application functionality continues to increase in complexity and advanced evasion techniques evolve, endpoint security faces increasingly severe challenges. Traditional static code analysis and dynamic behavior detection techniques based on preset signatures are no longer effective in dealing with new and complex threats. The industry is gradually turning its attention to detection methods based on machine learning and dynamic behavior modeling, aiming to discover unknown anomalies by learning normal behavior patterns and improve the ability to identify zero-day attacks and variant malware.

[0003] Chinese patent CN122241698A proposes a "Method, System, and Electronic Device for Detecting Application Behavior," which achieves full-stack monitoring of application behavior by simultaneously collecting system call request contexts in user mode and actual execution data in kernel mode. Subsequently, for the collected system call data, basic statistical features representing the statistical regularity of calls (such as call frequency, proportion of risky calls, and parameter value distribution) and deep sequence features representing the correlation between calls (such as frequent itemset mining, sequence entropy value, and parameter correlation degree) are extracted to form a system call feature set. Then, the system call feature set is input into a behavior detection model trained based on a normal behavior feature library for analysis, and the system calls the model outputs judgment results, anomaly types, and a quantitative measurement report containing a comprehensive risk value to support security operation decisions.

[0004] However, existing technologies rely solely on behavior detection models trained on a single normal behavior feature library. This training lacks supervised learning of known malicious behavior patterns, resulting in limited accuracy in detecting known threats. Furthermore, it struggles to effectively distinguish between "rare normal behavior" and "genuine abnormal behavior," leading to a high false positive rate. Existing technologies can only perform system call sequence analysis and parameter correlation within a single process. For complex attacks involving multiple processes working together (such as the injection of a legitimate program into a malicious child process, cross-process memory operations, etc.), they cannot reconstruct the complete attack chain, resulting in significant blind spots in detection. Summary of the Invention

[0005] This application provides a method and system for dynamically intercepting terminal malware based on behavioral characteristics, aiming to solve the problem of high false positive rates in existing technologies.

[0006] Firstly, a method for dynamically intercepting terminal malware based on behavioral characteristics, the method comprising:

[0007] Collect behavioral data of terminal processes during runtime; the behavioral data is captured by a lightweight probe deployed at the system call layer between the terminal operating system kernel mode and application mode;

[0008] The collected behavioral data is time-series aggregated according to a preset sliding time window to obtain a set of behavioral events within the sliding time window; based on process identifiers, session identifiers, and thread identifiers, each behavioral event in the set of behavioral events is assigned to the event set of the corresponding process and thread; based on the process identifier, a parent-child derivation relationship is established; the event sets corresponding to the processes with the parent-child derivation relationship are concatenated in chronological order to obtain a behavioral sequence, so as to reconstruct a complete attack path;

[0009] Multi-dimensional behavioral features are extracted from the behavioral sequence and a feature vector is constructed; the multi-dimensional features are window period statistical values ​​calculated based on the established parent-child derivation relationship and the behavioral sequence arranged in chronological order.

[0010] The feature vector is input into a pre-built first random forest anomaly detection model, which outputs a classification probability; the feature vector is also input into a pre-built second isolated forest anomaly detection model, which outputs an anomaly score; the classification probability and the anomaly score are weighted and scored to obtain a fusion score.

[0011] The fusion score is compared with a dynamic threshold generated based on preset rules to obtain a judgment result; if the judgment result is malicious behavior, an interception action rule is generated.

[0012] Optionally, in the above scheme, after extracting multi-dimensional behavioral features from the behavioral log sequence and constructing a feature vector, the scheme further includes:

[0013] In the eigenvectors, the eigenvectors of the same dimension are normalized using the following formula:

[0014]

[0015] in, For the j-th dimension feature of the i-th process, For the first Minimum value of dimensional features

[0016] Let be the maximum value of the j-dimensional feature.

[0017] Optionally, in the above scheme, the dynamic threshold generated based on preset rules includes:

[0018]

[0019] in, For the past The average final evaluation score within each time window; The standard deviation of the final evaluation score over the past N time windows; This is the sensitivity factor.

[0020] Optionally, in the above scheme, the classification probability and the anomaly score are weighted and scored to obtain a fusion score, including:

[0021]

[0022] in, To integrate the weighting coefficients, This is the output classification probability in the first random forest anomaly detection model; The anomaly score is the output of the second isolated forest discrimination model.

[0023] Optionally, in the above scheme, the construction of the first random forest anomaly detection model and the second isolated forest anomaly detection model includes:

[0024] A behavior sample set is constructed, which includes positive samples and negative samples; wherein, the positive samples are feature vectors extracted from historical attack events and malicious program behavior data, and the negative samples are normal feature vectors extracted from long-term behavior baseline data of the terminal's normal business environment.

[0025] Information gain is evaluated for each feature vector in the behavioral sample set, the information gain value of each dimension feature is calculated, and feature dimensions with information gain values ​​higher than a preset threshold are selected.

[0026] Principal component analysis is performed on the selected feature vectors to reduce dimensionality. The principal component projection matrix is ​​calculated, and the principal components with a cumulative contribution rate reaching a preset ratio are retained to obtain the dimensionality-reduced training sample set.

[0027] Based on the positive and negative samples in the dimensionality-reduced training sample set, the first random forest anomaly detection model and the second isolated forest anomaly detection model are trained respectively.

[0028] Optionally, in the above scheme, the construction of the first random forest anomaly detection model and the second isolated forest anomaly detection model further includes:

[0029] New behavioral sample sets are continuously collected; the first random forest anomaly detection model and the second isolated forest anomaly detection model are trained based on the new behavioral sample sets to optimize the first random forest anomaly detection model and the second isolated forest anomaly detection model.

[0030] In the above scheme, optionally, if the determination result is malicious behavior, the specific actions to generate the interception action include:

[0031] Call the pre-stored dimension deviation baseline library to calculate the deviation of each dimension of the feature vector from the normal behavior baseline:

[0032] Based on the degree of exceeding the limits of the fusion score and the deviation of each dimension, the attack type of the current malicious behavior is identified and mapped to the corresponding risk level, and graded interception actions are executed:

[0033] When the deviation of a single dimension is greater than a preset deviation threshold, and the single dimension with a deviation greater than the preset deviation threshold does not belong to the preset set of destructive behavior dimensions, it is judged as low risk, an alarm is executed and a log is recorded.

[0034] When the deviation of at least two dimensions is greater than the preset deviation threshold at the same time, and the deviation of each dimension in the preset set of destructive behavior dimensions is not greater than the preset deviation threshold, it is judged as medium risk and network access is restricted.

[0035] If the deviation of at least one dimension in the preset set of destructive behavior dimensions is greater than the preset deviation threshold, it is determined to be high risk and the process is forcibly terminated.

[0036] When the preset combination of lateral propagation dimensions or the preset privilege escalation dimension conditions are met, it is judged as a serious risk and the terminal is isolated.

[0037] Secondly, a dynamic interception system for terminal malware based on behavioral characteristics, the system comprising:

[0038] Behavioral data acquisition module: used to collect behavioral data of terminal processes during runtime; the behavioral data is intercepted by a lightweight probe deployed at the system call layer between the terminal operating system kernel mode and application mode;

[0039] Behavioral data processing module: This module performs time-series aggregation on collected behavioral data according to a preset sliding time window to obtain a set of behavioral events within the sliding time window; it assigns each behavioral event in the behavioral event set to the event set of the corresponding process and thread based on process identifiers, session identifiers, and thread identifiers; it establishes parent-child derivation relationships based on the process identifiers; and it concatenates the event sets corresponding to processes with the parent-child derivation relationships in chronological order to obtain a behavioral sequence, thereby reconstructing a complete attack path.

[0040] Feature vector construction module: used to extract multi-dimensional behavioral features from the behavior log sequence and construct feature vectors;

[0041] The fusion score calculation module is used to input the feature vector into a pre-built first random forest anomaly detection model and output the classification probability; and input the feature vector into a pre-built second isolated forest anomaly detection model and output the anomaly score; and to perform a weighted score on the classification probability and the anomaly score to obtain the fusion score.

[0042] Interception Action Generation Module: This module compares the fusion score with a dynamic threshold generated based on preset rules to obtain a judgment result; if the judgment result indicates malicious behavior, it generates an interception action.

[0043] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the terminal malware dynamic interception method based on behavioral characteristics as described in the first aspect above.

[0044] Fourthly, a computer program product is provided, including a computer program / instruction that, when executed by a processor, implements the steps of the dynamic interception method for terminal malicious programs based on behavioral characteristics described in the first aspect.

[0045] Compared with the prior art, this application has at least the following beneficial effects:

[0046] This application collects terminal process behavior data by deploying a lightweight probe between kernel mode and application mode, and performs time-series aggregation based on a sliding time window. Behavioral events are assigned to the event sets of the corresponding processes and threads based on process identifiers, session identifiers, and thread identifiers. Parent-child derivation relationships are established between processes based on process identifiers, and the event sets corresponding to processes with parent-child derivation relationships are concatenated into a behavioral sequence in chronological order. This reconstructs the complete attack path, including cross-process derivation and system resource access, solving the blind spot problem of existing technologies that can only analyze within a single process and cannot detect cross-process coordinated attacks. By analyzing the behavioral sequence... Multi-dimensional behavioral features are extracted from the columns and feature vectors are constructed. These feature vectors are then input into a first random forest anomaly detection model and a second isolated forest anomaly detection model. The classification probability output by the first random forest anomaly detection model and the anomaly score output by the second isolated forest anomaly detection model are weighted and fused according to preset weights to obtain an anomaly score. This achieves dual identification of known threats and unknown anomalies, overcoming the problem of insufficient generalization ability of a single model. By comparing the anomaly score with a dynamic threshold, the problem of false alarms or over-response caused by a fixed threshold is solved. Thus, through the above technical features, the accuracy of anomaly detection is improved. Attached Figure Description

[0047] Figure 1A flowchart illustrating a method for dynamically intercepting terminal malware based on behavioral characteristics, provided in one embodiment of this application;

[0048] Figure 2 This is another flowchart illustrating a method for dynamically intercepting terminal malware based on behavioral characteristics, provided as an embodiment of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments.

[0050] In one embodiment, such as Figure 1 As shown, a method for dynamically intercepting terminal malware based on behavioral characteristics is provided, the method comprising:

[0051] Step S1: Collect behavioral data of the terminal process during runtime; the behavioral data is captured by a lightweight probe deployed at the system call layer between the kernel state and application state of the terminal operating system.

[0052] In step S1, a lightweight probe is deployed between the operating system kernel mode and the application mode to collect terminal process behavior in a fine-grained and low-intrusive manner.

[0053] The monitored data includes: (1) Process-level monitoring: recording the PID, PPID, and executable file path of each process; (2) Thread-level monitoring: monitoring remote thread injection; (3) API call monitoring: hooking key system call interfaces, including but not limited to: File: CreateFile (create / open file), WriteFile (write file), Registry: RegSetValueEx (modify registry value), Network: connect (establish connection), sendto (send data);

[0054] Data collection methods: (1) Windows platform: ETW (Event Tracing for Windows) + Minifilter driver; (2) Linux platform: eBPF (extended Berkeley Packet Filter) technology; (3) MacOS platform: Endpoint Security Framework.

[0055] Step S2: Perform time-series aggregation on the collected behavioral data according to a preset sliding time window to obtain a set of behavioral events within the sliding time window; based on the process identifier, session identifier, and thread identifier, assign each behavioral event in the set of behavioral events to the event set of the corresponding process and thread; establish a parent-child derivation relationship based on the process identifier; concatenate the event sets corresponding to the processes with the parent-child derivation relationship in chronological order to obtain a behavioral sequence, so as to restore the complete attack path.

[0056] In step S2, a sliding time window mechanism is introduced to avoid transient jitter interference:

[0057]

[0058] in: For a single behavioral event, The window length is preferably set to 30s to 60s. Scattered events are concatenated into a behavioral sequence using process ID, session ID, and thread ID. The complete attack path was clearly defined as "parent process A → spawned child process B → modified registry C → connected IP D".

[0059] Step S3: Extract multi-dimensional behavioral features from the behavioral sequence and construct a feature vector; the multi-dimensional features are window period statistics calculated based on the established parent-child derivation relationship and the behavioral sequence arranged in chronological order.

[0060] In step S3, the unstructured behavioral logs are mapped into high-dimensional numerical feature vectors, which are then used as model inputs.

[0061] The feature dimension division is shown in Table 1:

[0062] Table 1

[0063]

[0064] Eigenvector definition: Define the first The feature vectors of each process are:

[0065]

[0066] Each dimension represents a statistical value within the window period (such as mean, peak value, or percentage). Write frequency, Encryption behavior, Number of times auto-start item is written; Concurrent connections Number of abnormal forkings of the parent process.

[0067] Step S4: Input the feature vector into a pre-built first random forest anomaly detection model and output the classification probability; input the feature vector into a pre-built second isolated forest anomaly detection model and output the anomaly score; weight the classification probability and the anomaly score to obtain a fusion score.

[0068] Step S5: Compare the fusion score with the dynamic threshold generated based on preset rules to obtain the judgment result; if the judgment result is malicious behavior, generate the interception action rule.

[0069] In this embodiment, such as Figure 2 The diagram illustrates the implementation flow of the core method of this invention. The steps include:

[0070] (1) Start terminal behavior monitoring; (2) Capture process system calls; (3) Extract multi-dimensional feature vectors; (4) Input into a hybrid machine learning model for scoring; (5) Determine whether the score exceeds the dynamic threshold; (6) If it does not exceed the threshold, allow the process and record the baseline; if it exceeds the threshold, proceed to step 7 to execute the interception action; (7) Generate dynamic rules and feed them back to the cloud. This figure intuitively shows the closed-loop control process from the occurrence of the behavior to the completion of the interception.

[0071] The aforementioned method for dynamically intercepting terminal malware based on behavioral characteristics involves deploying lightweight probes between kernel and application states to collect terminal process behavior data. This data is then aggregated temporally using a sliding time window. Behavioral events are assigned to the event sets of the corresponding processes and threads based on process identifiers, session identifiers, and thread identifiers. Parent-child derivation relationships are established between processes based on process identifiers. Event sets corresponding to processes with parent-child derivation relationships are then concatenated into a behavioral sequence in chronological order. This reconstructs the complete attack path, including cross-process derivation and system resource access, solving the problem that existing technologies can only analyze attacks within a single process and cannot detect cross-process coordinated attacks. The problem of blind spots is addressed by extracting multi-dimensional behavioral features from behavioral sequences and constructing feature vectors. These feature vectors are then input into a first random forest anomaly detection model and a second isolated forest anomaly detection model. The classification probability output by the first random forest anomaly detection model and the anomaly score output by the second isolated forest anomaly detection model are weighted and fused according to preset weights to obtain an anomaly score. This achieves dual identification of known threats and unknown anomalies, overcoming the problem of insufficient generalization ability of a single model. By comparing the anomaly score with a dynamic threshold, the problem of false alarms or over-response caused by a fixed threshold is solved. Thus, through the above technical features, the accuracy of anomaly detection is improved.

[0072] In one embodiment, after extracting multi-dimensional behavioral features from the behavioral log sequence and constructing a feature vector, the method further includes:

[0073] In the eigenvectors, to eliminate differences in dimensions, Min-Max normalization is used, which normalizes the eigenvectors of the same dimension using the following formula:

[0074]

[0075] in, For the first The first process Dimensional features, For the first Minimum value of dimensional features

[0076] The maximum value of the j-dimensional feature is such that after normalization, all feature values ​​fall within the interval [0,1], which meets the input requirements of the model.

[0077] In one embodiment, to adapt to different business environments and attack scenarios, an adaptive dynamic threshold is adopted. The dynamic threshold generated based on preset rules includes:

[0078]

[0079] in, For the past The average final evaluation score within each time window; The standard deviation of the final evaluation score over the past N time windows; Sensitivity factor.

[0080] The judgment criteria are:

[0081] .

[0082] In one embodiment, to combine the advantages of the two types of models, a fusion anomaly scoring function is constructed, which weights the classification probability and the anomaly score to obtain the final evaluation score, including:

[0083]

[0084] in, To optimize the fusion weighting coefficients, the optimal values ​​are selected. ; This is the output classification probability in the first random forest anomaly detection model; The anomaly score is the output of the second isolated forest discrimination model; this fusion mechanism takes into account both accurate matching ability (supervised) and anomaly detection ability (unsupervised).

[0085] In this invention, S(X) is not the posterior probability in a strictly probabilistic sense, but is defined as a heuristic threat confidence level. Random forest provides the matching degree of known malicious patterns, while isolation forest provides a measure of behavioral outlierness; both reflect two orthogonal dimensions of risk. Compressing two-dimensional evidence into a one-dimensional decision quantity through linear weighting is a common technique in the field of multi-source information fusion.

[0086] In one embodiment, the construction of the first random forest anomaly detection model and the second isolated forest anomaly detection model includes:

[0087] A behavior sample set is constructed, which includes positive samples and negative samples; wherein, the positive samples are feature vectors extracted from historical attack events and malicious program behavior data, and the negative samples are normal feature vectors extracted from long-term behavior baseline data of the terminal's normal business environment.

[0088] Information gain is evaluated for each feature vector in the behavioral sample set, the information gain value of each dimension feature is calculated, and feature dimensions with information gain values ​​higher than a preset threshold are selected.

[0089] Principal component analysis is performed on the selected feature vectors to reduce dimensionality. The principal component projection matrix is ​​calculated, and the principal components with a cumulative contribution rate reaching a preset ratio are retained to obtain the dimensionality-reduced training sample set.

[0090] Based on the positive and negative samples in the dimensionality-reduced training sample set, the first random forest anomaly detection model and the second isolated forest anomaly detection model are trained respectively.

[0091] In this embodiment, the overall model construction process is as follows: sample construction → feature selection → model training → dual-mode fusion → dynamic determination → online update; specifically including the following steps:

[0092] 1. Construction of behavioral sample set:

[0093] (1) Sample sources: Positive samples (malicious behavior): from historical APT attack events, ransomware behavior logs, and red team exercise data; and negative samples (normal behavior): from long-term behavior baselines of office terminals, servers, and development environments.

[0094] (2) Sample label definition: Let the sample set be:

[0095]

[0096] in: For the first Behavioral feature vectors of each process; : Tag (0 indicates normal, 1 indicates malicious).

[0097] 2. Feature selection and dimensionality reduction: To improve model efficiency and stability, a feature selection mechanism is introduced before training.

[0098] (1) Information gain evaluation: Calculate the information gain for the j-th dimension feature:

[0099]

[0100] in, Information entropy of sample labels; In features Conditional entropy under certain conditions; The larger the value, the greater the contribution of this feature to classification.

[0101] (2) PCA dimensionality reduction: Principal component analysis is performed on high-dimensional features:

[0102]

[0103] in Principal component projection matrices are used to retain principal components with a cumulative contribution rate of ≥95%, thereby reducing computational overhead while preserving discriminative information.

[0104] 3. Main Model: Random Forest Model

[0105] (1) Model structure: Random forest is composed of The decision tree consists of:

[0106]

[0107] Each tree is trained on self-sampled data and random feature subsets.

[0108] (2) Classification probability output: For the input vector Random forest outputs the probability of malice:

[0109]

[0110] in, : Indicator function, returns 1 if the condition is true, otherwise returns 0; , which represents the probability that the sample is malicious.

[0111] 4. Auxiliary Model: Isolation Forest Model

[0112] (1) Construction principle: Isolation forests make outliers “isolate” faster by randomly dividing the feature space.

[0113] Sample points in a single tree The path length is:

[0114]

[0115] in: The number of edges from the root node to the leaf node; Adjustment factor, used for path length normalization.

[0116] (2) Calculation of outlier scores:

[0117]

[0118] in, : The average path length of the sample across multiple trees; The larger the value, the higher the degree of abnormality.

[0119] In one embodiment, the construction of the first random forest anomaly detection model and the second isolated forest anomaly detection model further includes:

[0120] New behavioral sample sets are continuously collected; the first random forest anomaly detection model and the second isolated forest anomaly detection model are trained based on the new behavioral sample sets in order to optimize the first random forest anomaly detection model and the second isolated forest anomaly detection model.

[0121] In this embodiment, to address the continuous changes in attack methods, an incremental update mechanism is introduced to mitigate the concept drift problem:

[0122]

[0123] in, For the current model; For models trained based on newly labeled samples; These are the historical model weighting coefficients. This mechanism ensures that the model remains effective in the face of new types of attacks.

[0124] In one embodiment, if the determination result is malicious behavior, the specific actions to generate an interception action include:

[0125] Call the pre-stored dimension deviation baseline library to calculate the deviation of each dimension of the feature vector from the normal behavior baseline:

[0126] Based on the degree of exceeding the limits of the fusion score and the deviation of each dimension, the attack type of the current malicious behavior is identified and mapped to the corresponding risk level, and graded interception actions are executed:

[0127] When the deviation of a single dimension is greater than a preset deviation threshold, and the single dimension with a deviation greater than the preset deviation threshold does not belong to the preset set of destructive behavior dimensions, it is judged as low risk, an alarm is executed and a log is recorded.

[0128] When the deviation of at least two dimensions is greater than the preset deviation threshold at the same time, and the deviation of each dimension in the preset set of destructive behavior dimensions is not greater than the preset deviation threshold, it is judged as medium risk and network access is restricted.

[0129] If the deviation of at least one dimension in the preset set of destructive behavior dimensions is greater than the preset deviation threshold, it is determined to be high risk and the process is forcibly terminated.

[0130] When the preset combination of lateral propagation dimensions or the preset privilege escalation dimension conditions are met, it is judged as a serious risk and the terminal is isolated.

[0131] In this embodiment, outlier calculation is divided into two stages: the training phase (baseline statistics) and the detection phase (deviation calculation).

[0132] (1) Baseline statistics (training phase):

[0133] On the normal sample set, calculate the statistical baseline for each dimension j separately:

[0134] mean μ j : Typical values ​​for normal behavior in this dimension.

[0135] Standard deviation σ j : The range of fluctuations in normal behavior within this dimension.

[0136] Example: Assuming the "write frequency" dimension (j=1), the average number of write operations per second in a normal process is...

[0137] Second, standard deviation The normal range is approximately [3, 7] times / second.

[0138] (2) Deviation calculation (detection stage):

[0139] For the j-th eigenvalue x of the process to be detected ij Calculate the degree to which it deviates from the normal baseline:

[0140] ;

[0141] Example: Write frequency of a certain process times / second ,but Far exceeding the normal range (usually) This is considered an anomaly.

[0142] (3) Normalization mapping: Mapping the deviation to The interval should be adjusted to match the input format of subsequent models.

[0143]

[0144] Where x j,min and x j,max Let be the minimum and maximum values ​​of the j-th dimension in the training set.

[0145] After normalization, each eigenvalue falls within The interval can be directly used as input for random forests and isolated forests.

[0146] (4) Comprehensive Judgment (Multi-dimensional Fusion): After the outliers of each dimension are calculated, the final risk level is determined according to the preset multi-dimensional judgment rules. Dynamic thresholds have already been defined above:

[0147]

[0148] The abnormal scores of each dimension are fused using a dual-mode method and compared with the dynamic threshold to arrive at a judgment conclusion.

[0149] This application defines the following dimension-attack mode mapping relationship:

[0150] Dimension Number: ; Dimension name: File write frequency; Symbol: f_write; Corresponding attack behavior: Ransomware encryption;

[0151] Dimension Number: Dimension Name: Frequency of File Encryption Behavior; Symbol: f_encrypt; Corresponding Attack Behavior: Ransomware Encryption;

[0152] Dimension Number: ; Dimension name: Batch deletion frequency; Symbol: f_delete; Corresponding attack behavior: Ransomware encryption;

[0153] Dimension Number: ; Dimension name: Number of writes to the startup item; Symbol: f_startup; Corresponding attack behavior: Persistence;

[0154] Dimension Number: Dimension name: Concurrent connections; Symbol: n_conn; Corresponding attack behavior: C2 communication / Lateral propagation;

[0155] Dimension Number: Dimension name: Percentage of connections to unusual ports; Symbol: p_unusual_port; Corresponding attack behavior: Lateral propagation;

[0156] Dimension Number: Dimension Name: Number of Abnormal Derivations from Parent Process; Symbol: P_child; Corresponding Attack Behavior: Privilege Escalation;

[0157] The specific rules for determining the risk level are as follows:

[0158] Rule 1 (Low Risk):

[0159] condition: Explanation: Only a single dimension is abnormal, and this dimension is not related to destructive behavior;

[0160] Judgment: Low risk → Action: Alarm + Log recording.

[0161] Rule 2 (Medium Risk):

[0162] condition: ;

[0163] Explanation: There are multiple anomalies, but none of the file behavior dimensions (write / encryption / deletion) have reached the anomaly threshold;

[0164] Assessment: Medium risk → Action: Restrict network access.

[0165] Rule 3 (High Risk – Corresponding to “Malicious Characteristics” in the Original Text):

[0166] condition: ;

[0167] Explanation: Significant anomalies were observed in file behavior (sudden increase in write frequency / encryption behavior / batch deletion);

[0168] Judgment: High risk → Action: Forcefully terminate the process.

[0169] Rule 4 (Serious Risk – Corresponding to the original text's "Lateral Propagation Marker or Privilege Enhancement Marker"):

[0170] condition: And satisfy any of the following:

[0171]

[0172] Explanation: Both the network behavior dimension and the process relationship dimension are abnormal, and the overall score exceeds the threshold.

[0173] Judgment: Severe risk → Action: Isolate the terminal.

[0174] This application achieves closed-loop security control of "detection-response-evolution".

[0175] (1) The interception action classification is shown in Table 2:

[0176] Table 2

[0177] Dynamic rule generation: When malicious behavior is detected, the system automatically generates rules.

[0178]

[0179] : Rule validity period (e.g., 24h); PID process identifier, the unique identifier ID of the target process that triggered the interception; Path executable file path, the complete path of the executable file corresponding to the process that triggered the interception; Action interception action level, four levels of handling actions: 1- Alarm + logging, 2- Restrict network access, 3- Force process termination, 4- Isolate terminal.

[0180] (3) Distributed feedback mechanism: Local terminal: takes effect immediately; Management center: reports behavior fingerprint (feature hash); All terminals: issues temporary rules to achieve homologous immunity.

[0181] Feature hashing here is a summary calculation of the behavioral pattern feature vector. It belongs to the identification at the behavioral feature level and is equal to the fixed-length summary value obtained by encoding and hashing the normalized n-dimensional behavioral feature vector Xi.

[0182] Specific generation steps:

[0183] a. Quantization: Quantizing the normalized feature vectors... The values ​​of each dimension are quantized with a fixed precision (e.g., 4 decimal places);

[0184] b. Concatenation: Concatenate the quantified values ​​of each dimension into a string in a fixed order;

[0185] c. Hash: Calculate the hash value (such as SHA256) of the concatenated string to obtain the behavioral fingerprint.

[0186] (4) Feedback closed-loop formula: To avoid long-term mishandling of legitimate business, the rule confidence decays exponentially over time:

[0187]

[0188] in, Initial confidence level, : Attenuation coefficient; when (Preset threshold) The rule will automatically become invalid to prevent accidental invalidation.

[0189] In one embodiment, a terminal malware dynamic interception system based on behavioral characteristics includes:

[0190] Behavioral data acquisition module: used to collect behavioral data of terminal processes during runtime; the behavioral data is intercepted by a lightweight probe deployed at the system call layer between the terminal operating system kernel mode and application mode;

[0191] Behavioral data processing module: This module performs time-series aggregation on collected behavioral data according to a preset sliding time window to obtain a set of behavioral events within the sliding time window; it assigns each behavioral event in the behavioral event set to the event set of the corresponding process and thread based on process identifiers, session identifiers, and thread identifiers; it establishes parent-child derivation relationships based on the process identifiers; and it concatenates the event sets corresponding to processes with the parent-child derivation relationships in chronological order to obtain a behavioral sequence, thereby reconstructing a complete attack path.

[0192] Feature vector construction module: used to extract multi-dimensional behavioral features from the behavior log sequence and construct feature vectors;

[0193] The fusion score calculation module is used to input the feature vector into a pre-built first random forest anomaly detection model and output the classification probability; and input the feature vector into a pre-built second isolated forest anomaly detection model and output the anomaly score; and to perform a weighted score on the classification probability and the anomaly score to obtain the fusion score.

[0194] Interception Action Generation Module: This module compares the fusion score with a dynamic threshold generated based on preset rules to obtain a judgment result; if the judgment result indicates malicious behavior, it generates an interception action.

[0195] This invention, by constructing a dynamic interception system based on behavioral characteristics, completely breaks away from the passive defense mode of traditional antivirus software that relies on signature database updates, achieving a qualitative leap in endpoint security protection capabilities. Compared to existing technologies, the specific advantages and implementation principles of this invention are as follows:

[0196] First, this invention achieves highly efficient interception of unknown viruses and variants, solving the fundamental problem of existing technologies that "can only detect old viruses, not new ones." Traditional solutions rely on comparing static hash values ​​or string features; once malicious programs modify their code through packing, obfuscation, or polymorphic transformation techniques, they can easily bypass detection. This invention no longer focuses on the "appearance" of the file itself, but instead analyzes its behavioral "intent." By collecting multi-dimensional behaviors such as process file reading and writing, registry modifications, and network connections, a dynamic feature vector is constructed. Even if virus code changes constantly, its core behavioral patterns of attempting to encrypt files and establish remote control connections are difficult to completely hide. Therefore, this invention can effectively identify and intercept zero-day attacks and variant viruses that have not yet been included in the feature database.

[0197] Secondly, this invention significantly reduces the false positive rate, overcoming the high false positive rate of traditional heuristic scanning. Existing technologies typically rely on a single rule (such as "prohibit any program from modifying startup items") for interception, easily leading to the false positives of legitimate system update programs or software. This invention introduces a multi-dimensional weighted evaluation model based on machine learning, comprehensively judging individual behaviors within the overall behavioral context. For example, a system update program modifying startup items is a normal behavior, but it is only identified as ransomware when accompanied by high-frequency encrypted writes and high-risk IP connections. This judgment logic based on probability and correlation analysis makes interception decisions more accurate and intelligent.

[0198] Furthermore, this invention boasts the advantages of being lightweight and requiring minimal upgrades, significantly reducing terminal resource consumption. Traditional antivirus software needs to download massive virus databases and perform full system scans daily, consuming substantial amounts of CPU, memory, and bandwidth. The device of this invention runs only a lightweight behavior acquisition probe and inference engine on the terminal side. The core model is relatively stable and does not require frequent updates to massive feature data. Most calculations are performed through efficient vector computation and decision tree inference, resulting in minimal impact on terminal performance. This makes it particularly suitable for low-configuration personal terminals or large-scale enterprise office environments.

[0199] Finally, this invention constructs a dynamic defense closed loop of "one-time detection, network-wide immunity," improving overall response speed. Traditional solutions, after discovering a new virus, require multiple steps such as sample submission, analysis, database entry, and distribution, resulting in a lengthy process. This invention, upon detecting abnormal behavior on a terminal and confirming interception, can automatically extract the current behavioral pattern to generate temporary dynamic interception rules, which are then synchronized to other terminals within the network via the management center within seconds. This behavior-based rule feedback mechanism transforms security defense from "post-event remediation" to "real-time collaborative defense," effectively curbing the lateral spread of viruses within the enterprise intranet.

[0200] In one embodiment, a computer device is also provided, the processor of which provides computing and control capabilities, and the computer device loads and runs a computer program to implement the above-described method for dynamic interception of terminal malware based on behavioral characteristics.

[0201] In one embodiment, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement the steps of the methods described in the embodiments above.

[0202] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A method for dynamically intercepting terminal malware based on behavioral characteristics, characterized in that, The method includes: Collect behavioral data of terminal processes during runtime; the behavioral data is captured by a lightweight probe deployed at the system call layer between the terminal operating system kernel mode and application mode; The collected behavioral data is aggregated sequentially according to a preset sliding time window to obtain a set of behavioral events within the sliding time window. Based on the process identifier, session identifier, and thread identifier, each behavioral event in the set of behavioral events is assigned to the event set of the corresponding process and thread. Based on the process identifier, a parent-child derivation relationship is established. The event sets corresponding to the processes with the parent-child derivation relationship are concatenated in chronological order to obtain a behavioral sequence, so as to restore the complete attack path. Multi-dimensional behavioral features are extracted from the behavioral sequence and a feature vector is constructed; the multi-dimensional features are window period statistical values ​​calculated based on the established parent-child derivation relationship and the behavioral sequence arranged in chronological order. The feature vector is input into a pre-built first random forest anomaly detection model, which outputs a classification probability; the feature vector is also input into a pre-built second isolated forest anomaly detection model, which outputs an anomaly score; the classification probability and the anomaly score are weighted and scored to obtain a fusion score. The fusion score is compared with a dynamic threshold generated based on preset rules to obtain a judgment result; if the judgment result is malicious behavior, an interception action rule is generated.

2. The method for dynamically intercepting terminal malware based on behavioral characteristics according to claim 1, characterized in that, After extracting multi-dimensional behavioral features from the behavioral log sequence and constructing feature vectors, the process also includes: In the eigenvectors, the eigenvectors of the same dimension are normalized using the following formula: ； in, For the j-th dimension feature of the i-th process, For the first Minimum value of dimensional features Let be the maximum value of the j-dimensional feature.

3. The method for dynamically intercepting terminal malware based on behavioral characteristics according to claim 1, characterized in that, The dynamic threshold generated based on preset rules includes: ； in, For the past The average final evaluation score within each time window; The standard deviation of the final evaluation score over the past N time windows; This is the sensitivity factor.

4. The method for dynamically intercepting terminal malware based on behavioral characteristics according to claim 1, characterized in that, The classification probability and the anomaly score are weighted and scored to obtain a fusion score, which includes: ； in, To integrate the weighting coefficients, This is the output classification probability in the first random forest anomaly detection model; The anomaly score is the output of the second isolated forest discrimination model.

5. The method for dynamically intercepting terminal malware based on behavioral characteristics according to claim 1, characterized in that, The construction of the first random forest anomaly detection model and the second isolated forest anomaly detection model includes: A behavior sample set is constructed, which includes positive samples and negative samples; wherein, the positive samples are feature vectors extracted from historical attack events and malicious program behavior data, and the negative samples are normal feature vectors extracted from long-term behavior baseline data of the terminal's normal business environment. Information gain is evaluated for each feature vector in the behavioral sample set, the information gain value of each dimension feature is calculated, and feature dimensions with information gain values ​​higher than a preset threshold are selected. Principal component analysis is performed on the selected feature vectors to reduce dimensionality. The principal component projection matrix is ​​calculated, and the principal components with a cumulative contribution rate reaching a preset ratio are retained to obtain the dimensionality-reduced training sample set. Based on the positive and negative samples in the dimensionality-reduced training sample set, the first random forest anomaly detection model and the second isolated forest anomaly detection model are trained respectively.

6. The method for dynamically intercepting terminal malware based on behavioral characteristics according to claim 5, characterized in that, The construction of the first random forest anomaly detection model and the second isolated forest anomaly detection model also includes: New behavioral sample sets are continuously collected; the first random forest anomaly detection model and the second isolated forest anomaly detection model are trained based on the new behavioral sample sets to optimize the first random forest anomaly detection model and the second isolated forest anomaly detection model.

7. The method for dynamically intercepting terminal malware based on behavioral characteristics according to claim 1, characterized in that, If the determination result is malicious behavior, the specific blocking actions generated include: Call the pre-stored dimension deviation baseline library to calculate the deviation of each dimension of the feature vector from the normal behavior baseline: Based on the degree of exceeding the limits of the fusion score and the deviation of each dimension, the attack type of the current malicious behavior is identified and mapped to the corresponding risk level, and graded interception actions are executed: When the deviation of a single dimension is greater than a preset deviation threshold, and the single dimension with a deviation greater than the preset deviation threshold does not belong to the preset set of destructive behavior dimensions, it is judged as low risk, an alarm is executed and a log is recorded. When the deviation of at least two dimensions is greater than the preset deviation threshold at the same time, and the deviation of each dimension in the preset set of destructive behavior dimensions is not greater than the preset deviation threshold, it is judged as medium risk and network access is restricted. If the deviation of at least one dimension in the preset set of destructive behavior dimensions is greater than the preset deviation threshold, it is determined to be high risk and the process is forcibly terminated. When the preset combination of lateral propagation dimensions or the preset privilege escalation dimension conditions are met, it is judged as a serious risk and the terminal is isolated.

8. A dynamic interception system for terminal malware based on behavioral characteristics, characterized in that, The system includes: Behavioral data acquisition module: used to collect behavioral data of terminal processes during runtime; the behavioral data is intercepted by a lightweight probe deployed at the system call layer between the terminal operating system kernel mode and application mode; Behavioral data processing module: This module performs time-series aggregation on collected behavioral data according to a preset sliding time window to obtain a set of behavioral events within the sliding time window; it assigns each behavioral event in the behavioral event set to the event set of the corresponding process and thread based on process identifiers, session identifiers, and thread identifiers; it establishes parent-child derivation relationships based on the process identifiers; and it concatenates the event sets corresponding to processes with the parent-child derivation relationships in chronological order to obtain a behavioral sequence, thereby reconstructing a complete attack path. Feature vector construction module: used to extract multi-dimensional behavioral features from the behavior log sequence and construct feature vectors; The fusion score calculation module is used to input the feature vector into a pre-built first random forest anomaly detection model and output the classification probability; and input the feature vector into a pre-built second isolated forest anomaly detection model and output the anomaly score; and to perform a weighted score on the classification probability and the anomaly score to obtain the fusion score. Interception Action Generation Module: This module compares the fusion score with a dynamic threshold generated based on preset rules to obtain a judgment result; if the judgment result indicates malicious behavior, it generates an interception action.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to claims 1-7.

10. A computer program product, comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in claims 1-7.

Images