Software security detection method, system and electronic device

Abstract

The present application relates to the field of machine learning technology and cloud computing security. Disclosed are a software security detection method, a system and an electronic device. The method comprises: monitoring an access operation executed on a storage device by software to be subjected to detection, and acquiring behavioral data generated during the process of said software executing the access operation; inputting the behavioral data into a security detection model for detection, so as to obtain a detection result, the security detection model being obtained by means of training at least using an abnormal behavior sample, and the abnormal behavior sample being data generated by a software sample under an abnormal access operation; in response to the detection result being that the behavioral data is identified as abnormal behavioral data, determining that said software is in an abnormal access state; and, in response to the detection result being that the behavioral data is identified as normal behavioral data, determining that said software is in a normal access state. The present application solves the technical problem of low accuracy of software security detection.

Description

[0001] Software Security Detection Method, System, and Electronic Device Cross-Reference This disclosure claims priority to Chinese patent application number 202410195034.4, filed with the Patent Office of China on February 21, 2024, entitled "Software Security Detection Method, System, and Electronic Device," the entire contents of which are incorporated herein by reference. Technical Field This disclosure relates to machine learning technology and cloud computing security, and more specifically, to a software security detection method, system, and electronic device. Background: Currently, in the field of cloud computing, cloud services have become a common interaction model for enterprises and individual users to process and store data. However, with the development of cloud services, the cloud platforms used to implement cloud services have also become a focus of hacker attacks. Due to the frequent hacker attacks on cloud platforms, the security protection of the cloud services they implement has become increasingly important. However, in the related art, the security protection of cloud services can rely on security components deployed on virtual machines to provide security protection for cloud services. However, current security components struggle to effectively detect all attacks against cloud platforms, making it even more difficult to effectively detect the access status of the software under test. Therefore, the technical problem of low software security detection accuracy still exists. Currently, no effective solution has been proposed to address this issue. SUMMARY OF THE INVENTION Embodiments of the present disclosure provide a software security detection method, system, and electronic device to at least address the technical problem of low software security detection accuracy. According to one aspect of the embodiments of the present disclosure, a software security detection method is provided. This method can be applied to a cloud platform deployed with storage devices. The method may include: monitoring access operations performed by software under test on the storage device to obtain behavior data generated during the access operations performed by the software under test; inputting the behavior data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated by software samples undergoing abnormal access operations; in response to the detection result identifying the behavior data as abnormal behavior data, determining that the software under test is in an abnormal access state; and in response to the detection result identifying the behavior data as normal behavior data, determining that the software under test is in a normal access state. According to another aspect of the embodiments of the present disclosure, a method for detecting ransomware is provided.This method can be applied to a cloud platform deployed with storage devices. The method may include: monitoring read or write operations performed by the software under test on the storage device, obtaining behavioral data generated by the software under test during the read or write operations; inputting the behavioral data into a security detection model for detection, and obtaining a detection result. The security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated when the software sample is subjected to abnormal read or write operations; determining that the software under test is ransomware in response to the detection result identifying the behavioral data as abnormal; and determining that the software under test is safe software in response to the detection result identifying the behavioral data as normal. According to another aspect of the embodiments of the present disclosure, another software security detection method is provided. This method can be applied to a cloud platform deployed with storage devices. The method may include: monitoring access operations performed by the software under test on the storage device by calling a first interface to obtain behavioral data generated during the access operations by the software under test, wherein the first interface includes a first parameter whose parameter value is the behavioral data; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated by software samples undergoing abnormal access operations; outputting the detection result by calling a second interface, wherein the second interface includes a second parameter whose parameter value is the detection result; determining that the software under test is in an abnormal access state in response to the detection result identifying the behavioral data as abnormal; and determining that the software under test is in a normal access state in response to the detection result identifying the behavioral data as normal. According to another aspect of an embodiment of the present disclosure, a software security detection system is provided. The system may include: a terminal device configured to trigger the software under test to perform an access operation on a storage device; a cloud platform deployed with a storage device, configured to monitor the access operation performed by the software under test on the storage device, and obtain behavior data generated during the access operation performed by the software under test; inputting the behavior data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample is subjected to an abnormal access operation; in response to the detection result identifying that the behavior data is abnormal behavior data, determining that the software under test is in an abnormal access state; in response to the detection result identifying that the behavior data is normal behavior data, determining that the software under test is in a normal access state.According to another aspect of an embodiment of the present disclosure, an electronic device is provided. The electronic device may include a memory and a processor: the memory is configured to store a computer-executable program, and the processor is configured to run the computer-executable program. When the computer-executable program is executed by the processor, it implements any of the aforementioned software security detection methods. According to another aspect of an embodiment of the present disclosure, a processor is provided. The processor is configured to run a program. When the program is executed, any of the aforementioned software security detection methods is executed. According to another aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program. When the program is executed, the device containing the storage medium is controlled to execute any of the aforementioned software security detection methods. According to another aspect of an embodiment of the present disclosure, a computer program product is provided. The computer program, when executed by the processor, implements any of the aforementioned software security detection methods. According to another aspect of an embodiment of the present disclosure, a computer program product is provided. The computer program, when executed by the processor, implements any of the aforementioned software security detection methods. According to another aspect of an embodiment of the present disclosure, a computer program, when executed by the processor, implements any of the aforementioned software security detection methods. The present disclosure also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program causes the processor to perform the steps of any of the above methods. In this embodiment, when software accesses a storage device, the access operations performed by the software under test on the storage device are monitored, and behavioral data generated during the access operations performed by the software under test on the storage device are obtained. The generated behavioral data is then input into a security detection model pre-trained with abnormal behavior samples for detection to obtain a detection result. Based on the detection result, it is determined whether the behavioral data is abnormal or normal. If the detection result indicates that the behavioral data is abnormal, it is determined that the software under test is in an abnormal access state. If the detection result indicates that the behavioral data is normal, it is determined that the software under test is in a normal access state. This achieves the purpose of determining whether the storage device of the cloud platform is under attack, avoids the limitations of relying on security components deployed on virtual machines to protect the storage device, and achieves the technical effect of improving the accuracy of software security detection, thereby solving the technical problem of low accuracy of software security detection.It should be noted that the general description above and the detailed description that follows are merely examples and explanations of the present disclosure and do not constitute limitations on the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS The drawings described herein are intended to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The illustrative embodiments of the present disclosure and their descriptions are intended to explain the present disclosure and do not constitute undue limitations on the present disclosure. In the accompanying drawings: Figure 1 is a schematic diagram of an application scenario of a software security detection method according to an embodiment of the present disclosure; Figure 2 is a flow chart of a software security detection method according to an embodiment of the present disclosure; Figure 3 is a flow chart of a ransomware detection method according to an embodiment of the present disclosure; Figure 4 is a flow chart of another software security detection method according to an embodiment of the present disclosure; Figure 5 is a schematic diagram of a software security detection system according to an embodiment of the present disclosure; Figure 6 is a schematic diagram of a ransomware detection architecture according to an embodiment of the present disclosure; Figure 7 is a schematic diagram of a software security detection device according to an embodiment of the present disclosure; Figure 8 is a schematic diagram of a ransomware detection device according to an embodiment of the present disclosure; Figure 9 is a schematic diagram of another software security detection device according to an embodiment of the present disclosure; Figure 10 is a structural block diagram of a computer terminal according to an embodiment of the present disclosure; Figure 11 is a block diagram of an electronic device according to a software security detection method according to an embodiment of the present disclosure; Figure 12 is a hardware structural block diagram of a computer terminal (or mobile device) for implementing the software security detection method according to an embodiment of the present disclosure; Figure 13 is a structural block diagram of a computing environment according to a software security detection method according to an embodiment of the present disclosure. DETAILED DESCRIPTION To help those skilled in the art better understand the disclosed solutions, the following will provide a clear and complete description of the technical solutions in the disclosed embodiments, in conjunction with the accompanying drawings. It should be noted that the described embodiments represent only a portion of the disclosed embodiments, and are not exhaustive. Based on the disclosed embodiments, all other embodiments devised by persons of ordinary skill in the art without inventive effort should fall within the scope of protection of the disclosed embodiments. It should be noted that the terms "first," "second," and so on, in the specification and claims of the disclosed embodiments, and in the accompanying drawings, are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential sequence. It should be understood that such terms are interchangeable where appropriate, so that the disclosed embodiments described herein can be implemented in an order other than that illustrated or described herein.Furthermore, the terms "including," "comprising," and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units need not be limited to the steps or units explicitly listed and may include other steps or units not explicitly listed or inherent to the process, method, product, or apparatus. The technical solutions provided in this disclosure are primarily implemented using security detection model technology. The security detection model herein refers to a binary classification model implemented based on machine learning technology. Security detection models may also include decision tree models and distributed gradient boosting decision tree (XGBoost) models. Decision tree models can be used to perform preliminary testing on behavioral data generated during access operations on the software under test, thereby detecting software suspected of ransomware. XGBoost models can be used to retest detected software suspected of ransomware to detect actual ransomware within the software. It should be noted that in practical applications, pre-trained models can be fine-tuned using a small number of samples, allowing the security detection models to be applied to different tasks. For example, security detection models can be widely applied to fields such as cloud computing security, specifically in cloud computing security tasks such as network security protection, malicious code protection, and data loss and alteration. Therefore, the main application scenarios of security detection models include, but are not limited to, digital assistants, intelligent robots, search, online education, office software, e-commerce, intelligent design, data processing, and storage. In the embodiments of this disclosure, the example of using a security detection model to detect whether software accessing a storage device is ransomware in an access scenario is used for explanation. First, some terms or terms used in describing the embodiments of this disclosure are subject to the following interpretation: A block device is a storage device provided by block storage to a virtual machine. It can be used to store and read data, segmenting and managing data according to block size, making data read and write operations more efficient and flexible. In cloud platforms, block devices can also be used to implement functions such as data backup, data recovery, and data transmission. Ransomware is a type of malware that can encrypt user data in a computer, network system, or cloud platform, demanding a ransom to restore access to the data.

[0002] I / O access is an operation performed on data stored on a block device, either writing or reading. I / O access can provide efficient data read and write operations, enabling operating systems and applications to access data on block devices at high speeds. I / O access to block devices can also support random access, allowing users to quickly read or write any data block on a block device as needed. According to an embodiment of the present disclosure, a software security detection method is provided. It should be noted that the steps shown in the flowcharts of the accompanying figures can be executed in a computer system, such as a set of computer-executable instructions. Although the flowcharts illustrate a logical sequence, in some cases, the steps shown or described may be executed in a different order. Considering the large number of model parameters in the security detection model and the limited computing resources of mobile terminals, the software security detection method provided in the embodiments of the present disclosure can be applied to the application scenario shown in Figure 1, but is not limited thereto. In the application scenario shown in Figure 1, the security detection model is deployed on a server 10, which can be a cloud server. The server 10 can be connected to one or more client devices 20 via a local area network (LAN), a wide area network (WAN), the Internet, or other types of data networks. Client devices 20 herein may include, but are not limited to, smartphones, tablet computers, laptops, PDAs, personal computers, smart home devices, and in-vehicle devices. Together, these client devices constitute the client side of the server. A graphical user interface (GUI) on the client device can be deployed with an operation interface for obtaining original query information. This operation interface can be an interface for an e-commerce platform. The client device 20 can interact with the user via the GUI to invoke a security detection model, thereby implementing the software security detection method provided in the embodiments of the present disclosure. In the embodiments of the present disclosure, the system comprised of the client devices and the server can perform the following steps: When software accesses a storage device, the user can communicate data with the server via a network using a client device such as a mobile phone, desktop computer, or laptop.After receiving the monitoring instruction sent by the user via the client device, the server may execute step S102 to monitor the access operations performed by the software under test on the storage device and obtain behavioral data generated during the access operations. The server may also execute step S104 to input the behavioral data into a security detection model for detection to obtain detection results. The server may also execute step S106 to determine that the software under test is in an abnormal access state in response to the detection result identifying the behavioral data as abnormal. The server may also execute step S108 to determine that the software under test is in a normal access state in response to the detection result identifying the behavioral data as normal. The access status of the software under test may be output to the client device and displayed on the client device in the form of text, image, or audio information. During the above process, both the behavioral data and detection results obtained by the server may be transmitted to the client device via a network. The client device's user interface can display behavioral data and test results during the testing process. If the accuracy of the two types of information presented is insufficient, adjustments can be made on the user interface to ensure the accuracy of the final access status of the software under test. Alternatively, after the server determines the access status of the software under test, it can be transmitted to the corresponding client device via the network. After the client device receives the access status, the access status can be displayed. It should be noted that, if the client device's operating resources meet the deployment and operating conditions of the security detection model, the disclosed embodiments can be implemented within the client device. Under the aforementioned operating environment, the present disclosure provides a software security detection method as shown in FIG2 , wherein steps S202 to S208 correspond to steps S102 to S108 in FIG1 . It should be noted that the software security detection method of this embodiment can be executed by the mobile terminal of the embodiment shown in FIG1 . FIG2 is a flow chart of a software security detection method according to an embodiment of the present disclosure. As shown in FIG2 , the method may include the following steps: Step S202: monitoring access operations performed by the software under test on the storage device, and obtaining behavior data generated during the access operations performed by the software under test.In the technical solution provided in step S202 of the present disclosure, the storage device may be used to store different types of data, and may be at least one of the following devices: a block device, a cloud disk, etc., wherein the different types of data may include at least text files, images, audio, video, database files, etc.; the software under test may be used to represent software that accesses the storage device and whose security needs to be determined, and may be ransomware or non-ransomware; the access operation may be used to represent a specific operation performed by the software under test on the storage device, and may be an I / O operation; the behavioral data may be used to represent behavioral characteristics generated during the process of the software under test performing the access operation on the storage device, and may include at least one of the following data: a network address of the storage device accessed by the software under test, an operation type of the access operation performed by the software under test on the storage device, an access address in the storage device accessed by the software under test when performing the access operation on the storage device, a data access length in the storage device accessed by the software under test when performing the access operation on the storage device, a timestamp of the access operation performed by the software under test on the storage device, etc. This is merely an example and not a limitation. This embodiment monitors access operations performed by the software under test on a storage device and obtains behavioral data generated during the access operations. For example, on a cloud platform where a storage device is deployed, when software accesses the storage device, a monitoring component can monitor the access operations performed by the software under test on the storage device and obtain behavioral data generated during the access operations. In other words, behavioral characteristics generated by the software under test during the access operations on the storage device are obtained. For example, the storage device is a block device deployed on the cloud platform. When software accesses the block device, the monitoring component can monitor the access operations performed by the software under test on the block device and obtain behavioral data generated during the access operations. The storage device is merely an example and is not limited to block devices in the embodiments of this disclosure. For example, the storage device can also be a cloud disk, etc., and this is not a limitation. In step S204, the behavioral data is input into a security detection model for detection to obtain detection results. In the technical solution provided in step S204 of the present disclosure, after obtaining the behavior data generated during the access operation of the software under test, the behavior data can be used as input data of a security detection model. In the security detection model, the behavior data is detected to obtain a detection result of the behavior data.In this embodiment, the security detection model may be a model trained using abnormal behavior samples and normal behavior samples. The abnormal behavior samples may be data generated when a software sample is subjected to abnormal access operations. The software samples may include at least one of the following: a ransomware sample or a ransomware virus sample. The abnormal behavior samples may include at least one of the following data: a read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by the ransomware sample under abnormal access operations; a read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by the ransomware virus sample under abnormal access operations; The normal behavior samples may be data generated when a software sample is subjected to normal access operations, and may include at least one of the following data: a read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by a non-ransomware sample under normal access operations; a read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by a non-ransomware virus sample under normal access operations. This is merely an example and is not intended to be limiting. The security detection model in this embodiment can be obtained by inputting the aforementioned abnormal behavior samples and the aforementioned normal behavior samples into an initial detection model for training. The initial detection model can be implemented using a binary classification algorithm. Although there are numerous ransomware families and their propagation strategies vary significantly, they all share a common strategy for compromising data: encrypting the original data in segments and overwriting the encrypted data in its original location, rendering the original data unusable. Based on this commonality, inputting the I / O features of the cloud disk into the trained security detection model to identify ransomware can conveniently extract the ransomware's behavioral characteristics. Optionally, after monitoring the access operations performed by the software under test on the storage device and obtaining the behavioral data generated during the access operations, the behavioral data can be input into the security detection model for testing to obtain detection results. For example, by inputting the behavioral data generated during the access operation of the software under test into the security detection model for detection, a detection result can be obtained. That is, it can be determined whether the behavioral data generated during the access operation of the software under test is abnormal behavior data or normal behavior data, thereby achieving a technical effect of effectively improving the accuracy of ransomware detection results.For example, when the storage device is a block device, by inputting the behavioral data generated during the test software's access operations on the block device into a security detection model for detection, a detection result can be obtained. Specifically, it can be determined whether the behavioral data generated during the test software's access operations on the block device is abnormal or normal. The storage device is used for illustration only and is not limited to block devices in the embodiments of the present disclosure. For example, the storage device can also be a cloud disk, and no specific limitation is imposed herein. It should be noted that the above method for detecting behavioral data generated during the test software's access operations is merely illustrative and is not specifically limited herein. Any process and method that can utilize a trained security detection model to detect behavioral data generated during the test software's access operations is within the scope of the present embodiments. In step S206, in response to the detection result identifying the behavioral data as abnormal, it is determined that the test software is in an abnormal access state. In the technical solution provided in step S206 of the present disclosure, after inputting the behavior data into the security detection model for detection and obtaining a detection result, if the detection result identifies the behavior data as abnormal behavior data, then the software under test is determined to be in an abnormal access state during the access operation performed on the storage device. In this embodiment, the abnormal behavior data can be used to represent abnormal behavior characteristics generated during the process of the software under test performing the access operation on the storage device. Optionally, after inputting the behavior data into the security detection model for detection and obtaining a detection result, in response to the detection result identifying the behavior data as abnormal behavior data, then the software under test is determined to be in an abnormal access state. For example, if the detection result identifies the behavior data generated during the process of the software under test performing the access operation on the storage device as abnormal behavior data, then the software under test is determined to be in an abnormal access state, and thus the software under test is determined to be abnormal software (also known as ransomware), thereby achieving the technical effect of effectively improving the efficiency of software security detection. This is for illustrative purposes only and is not intended to be a specific limitation. For example, when the storage device is a block device, if the detection result is that the behavior characteristics generated during the process of the tested software performing an access operation on the block device are identified as abnormal behavior characteristics, it is determined that the tested software is in an abnormal access state, and thus the tested software is determined to be ransomware. The storage device here is only an example and is not limited to the storage device of the embodiment of the present disclosure being only a block device. For example, it can also be a cloud disk, etc., and no specific limitation is made here.Step S208: In response to the detection result identifying the behavior data as normal behavior data, it is determined that the software under test is in a normal access state. In the technical solution provided in step S208 of the present disclosure, after the behavior data is input into the security detection model for detection and a detection result is obtained, if the detection result identifies the behavior data as normal behavior data, it is determined that the software under test is in a normal access state for the access operation performed on the storage device. In this embodiment, the normal behavior data can be used to represent normal behavior characteristics generated during the process of the software under test performing the access operation on the storage device. Alternatively, after the behavior data is input into the security detection model for detection and a detection result is obtained, in response to the detection result identifying the behavior data as normal behavior data, it is determined that the software under test is in a normal access state. For example, if the detection result identifies that the behavior data generated during the test software's access operation to the storage device is normal behavior data, the test software is determined to be in a normal access state, and thus the test software is determined to be normal software (also referred to as non-ransomware), thereby achieving the technical effect of effectively improving the efficiency of software security detection. For example, if the storage device is a block device, and the detection result identifies that the behavior characteristics generated during the test software's access operation to the block device are normal behavior characteristics, the test software is determined to be in a normal access state, and thus the test software is determined to be non-ransomware. The storage device herein is merely an example and is not limited to block devices in embodiments of the present disclosure. For example, the storage device may also be a cloud disk, and no specific limitation is imposed herein.Through steps S202 to S208 of the present disclosure, when software accesses a storage device, the access operations performed by the software under test on the storage device are monitored, and behavioral data generated during the access operations performed by the software under test on the storage device are obtained. The generated behavioral data is then input into a security detection model pre-trained with abnormal behavior samples for detection to obtain a detection result. Based on the detection result, it is determined whether the behavioral data is abnormal or normal. In response to the detection result indicating that the behavioral data is abnormal, it is determined that the software under test is in an abnormal access state. In response to the detection result indicating that the behavioral data is normal, it is determined that the software under test is in a normal access state. This achieves the purpose of determining whether the storage device of the cloud platform has been attacked, avoids the limitations of relying on security components deployed on virtual machines for storage device security protection, and thereby achieves the technical effect of improving the accuracy of software security detection, thereby solving the technical problem of low accuracy of software security detection. It should be noted that the low accuracy of the software security testing mentioned above may refer to the fact that, when security testing is performed at the software layer, malware can easily conflict with the ongoing security testing, resulting in missed detections in the software security testing. The above-mentioned method of this embodiment is further described below. As an optional implementation, step S204, inputting the behavior data into a security testing model for testing and obtaining a test result, includes: inputting the behavior data into the security testing model for prediction to obtain a probability that the behavior data is abnormal behavior data; and determining the test result based on the probability in the security testing model. In this embodiment, after monitoring access operations performed by the software under test on a storage device and obtaining behavior data generated during the access operations, the behavior data is input into the security testing model for prediction to obtain a probability that the behavior data is abnormal behavior data. The security testing model then determines the test result for the software under test based on the probability that the behavior data is abnormal behavior data. In this embodiment, the detection result may be identifying the behavior data as abnormal behavior data, or identifying the behavior data as normal behavior data. The probability that the behavior data is abnormal behavior data may be used to indicate the possibility that the storage device is subject to a ransomware attack by the software under test.For example, the probability that the behavior data is abnormal behavior data can be the probability that a block device is attacked by ransomware, or the probability that a cloud disk is attacked by ransomware. This is merely an example and is not intended to be limiting. Optionally, after monitoring access operations performed by the software under test on a storage device and obtaining behavior data generated during the access operations, the behavior data generated during the access operations performed by the software under test on the storage device can be input into a security detection model for prediction to obtain a probability that the behavior data is abnormal behavior data. In the security detection model, the obtained probability that the behavior data is abnormal behavior data can be used to determine the software's detection result. For example, by comparing the relationship between the probability that the behavior data is abnormal behavior data and a probability threshold, it can be determined whether the software's detection result identifies the behavior data as abnormal behavior data or as normal behavior data, thereby achieving the technical effect of effectively improving the accuracy of the detection results of the software under test. For example, when the storage device is a block device, by inputting the behavior data generated during the test software's access operations on the block device into a security detection model for prediction, the probability that the behavior data generated during the test software's access operations on the block device is abnormal can be obtained. In the security detection model, the software's detection result can be determined based on the obtained probability that the behavior data is abnormal. For example, by comparing the relationship between the probability that the behavior data is in an abnormal access state and a probability threshold, the software's detection result can be determined as identifying the behavior data as abnormal or normal. The storage device is used as an example only and is not limited to the embodiments of the present disclosure, and can also be a cloud disk, etc., without specific limitation. It should be noted that the above method for probabilistically predicting the behavior data generated during the test software's access operations is for illustrative purposes only and is not specifically limited here. Any process and method that can utilize a trained security detection model to probabilistically predict the behavior data generated during the test software's access operations is within the scope of protection of the embodiments of the present disclosure. As an optional implementation, inputting the behavior data into the security detection model for prediction to obtain the probability that the behavior data is abnormal behavior data includes: inputting the behavior data into the security detection model for classification prediction to obtain the probability that the behavior data is abnormal behavior data.In this embodiment, the classification prediction is used to predict the category to which the behavior data belongs. It can be a binary classification prediction for the behavior data generated during the access operations performed by the software under test. This binary classification prediction involves classifying the behavior data generated during the access operations performed by the software under test into two categories. Optionally, after monitoring the access operations performed by the software under test on the storage device and obtaining the behavior data generated during the access operations, the behavior data generated during the access operations performed by the software under test on the storage device can be input into a security detection model for classification prediction. This can determine the probability that the behavior data is abnormal behavior data, that is, the probability that the storage device has been subjected to a ransomware attack by the software under test, thereby achieving the technical effect of effectively improving the accuracy of abnormal access prediction. For example, when the storage device is a block device, by inputting the behavioral data generated during the test software's access operations on the block device into a security detection model for classification prediction, the probability that the behavioral data is abnormal can be obtained. In other words, the probability that the block device is subject to a ransomware attack by the test software can be obtained. The storage device is merely an example and is not limited to the embodiments of the present disclosure, and can also be a cloud disk. For example, this is not a specific limitation. It should be noted that the above-mentioned process and method for performing binary classification prediction on the behavioral data generated during the test software's access operations are merely illustrative and are not a specific limitation. For example, multi-classification prediction can also be performed on the behavioral data generated during the test software's access operations. As an optional embodiment, determining a detection result based on probability in the security detection model includes: if the probability is greater than a probability threshold, determining the detection result as identifying the behavioral data as abnormal; and if the probability is less than or equal to the probability threshold, determining the detection result as identifying the behavioral data as normal. In this embodiment, after inputting the behavior data into a security detection model for prediction and obtaining a probability that the behavior data is abnormal, the security detection model determines that the behavior data generated during the access operation performed by the software under test is abnormal if the probability is greater than a probability threshold. If the probability is less than or equal to the probability threshold, the security detection model determines that the behavior data generated during the access operation performed by the software under test is normal. In this embodiment, the probability threshold can be used to determine whether the behavior data generated during the access operation performed by the software under test on a storage device is abnormal or normal.Optionally, after the behavior data is input into the security detection model for prediction and the probability of the behavior data being abnormal behavior data is obtained, in the security detection model, by comparing the relationship between the probability of the behavior data being abnormal behavior data and the probability threshold, it can be determined whether the software's detection result is the identification of the behavior data as abnormal behavior data or the identification of the behavior data as normal behavior data. If the compared probability of the behavior data being abnormal behavior data is greater than the probability threshold, the detection result is determined to be the identification of the behavior data as abnormal behavior data. If the compared probability of the behavior data being abnormal behavior data is less than or equal to the probability threshold, the detection result is determined to be the identification of the behavior data as normal behavior data, thereby achieving the technical effect of effectively improving the accuracy of ransomware detection results. For example, if the probability that the behavior data is abnormal behavior data is 95% and the probability threshold is 85%, in the security detection model, by comparing the relationship between the 95% probability that the behavior data is abnormal behavior data and the 85% probability threshold, it can be determined that the 95% probability that the behavior data is abnormal behavior data is greater than the 85% probability threshold. Therefore, the detection result is determined to be identification of the behavior data as abnormal behavior data. The values ​​of the probability and the probability threshold are merely illustrative and are not specifically limited herein. For another example, if the probability that the behavior data is abnormal behavior data is 84% ​​and the probability threshold is 85%, in the security detection model, by comparing the relationship between the 84% probability that the behavior data is abnormal behavior data and the 85% probability threshold, it can be determined that the 84% probability that the behavior data is abnormal behavior data is less than or equal to the 85% probability threshold. Therefore, the detection result is determined to be identification of the behavior data as normal behavior data. The values ​​of the probability and the probability threshold are merely illustrative and are not specifically limited herein. As an optional implementation, the method further includes: determining a storage scenario in which the storage device is located; and determining a probability threshold that matches an attribute of the storage scenario.In this embodiment, the above-mentioned storage scenarios may also be referred to as usage scenarios. The above-mentioned storage scenarios may include at least one of the following scenarios: a virtualization scenario, a large-scale computing scenario, a scientific computing scenario, a multimedia processing scenario, etc. Among them, the virtualization scenario may be a scenario in which a physical server is divided into multiple virtual servers using virtualization technology, the large-scale computing scenario may be a scenario requiring a large amount of computing resources, the scientific computing scenario may be a scenario used for scientific research and engineering calculations, and the multimedia processing scenario may be a scenario requiring the processing of multimedia data such as audio, video, and images. The attributes of the above-mentioned storage scenarios may include at least one of the following attributes: data security, data read and write speed, data response time, and the upper limit of storage capacity expansion. Optionally, the storage scenario of the storage device is determined, and a probability threshold matching the attributes of the storage scenario is determined. For example, the usage scenario of the storage device is determined. Based on the determined usage scenario, a probability threshold matching the attributes of the usage scenario is set according to the determined usage scenario. For example, the probability threshold matching at least one of the storage scenario attributes, such as data security, data read / write speed, data response time, and storage capacity expansion limit, is set, thereby achieving the technical effect of ensuring the usability of the probability threshold. Optionally, if the storage scenario currently in which the storage device is located is consistent with the default storage scenario, the default probability threshold matching the attributes of the default storage scenario is directly set as the probability threshold. If the storage scenario currently in which the storage device is located is inconsistent with the default storage scenario, the default probability threshold matching the attributes of the default storage scenario is adjusted to a probability threshold matching the attributes of the storage scenario currently in which the storage device is located. For example, if the storage scenario currently used by the storage device is a virtualization scenario and the default storage scenario is also a virtualization scenario, a default probability threshold that matches the attributes of the virtualization scenario is directly set as the probability threshold. For example, a default probability threshold that matches at least one of the attributes of the virtualization scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit, is directly set as the probability threshold. The storage scenario and the default storage scenario are merely examples and are not specifically limited. For another example, if the storage scenario currently used by the storage device is a large-scale computing scenario and the default storage scenario is a virtualization scenario, the default probability threshold that matches the attributes of the default storage scenario is adjusted to a probability threshold that matches the attributes of the storage scenario currently used by the storage device.For example, the default probability threshold matching at least one of the following attributes in a virtualization scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit, is adjusted to a probability threshold matching at least one of the following attributes in a large-scale computing scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit. The storage scenario and the default storage scenario are provided for illustrative purposes only and are not intended to be limiting. As an optional implementation, determining the probability threshold matching the attributes of the storage scenario includes: determining a performance indicator of a security detection model in the storage scenario; and determining the probability threshold matching the attributes of the storage scenario using the performance indicator. In this embodiment, after determining the storage scenario in which the storage device resides, the performance indicator of the security detection model in the storage scenario is determined, and then the determined performance indicator is used to determine the probability threshold matching the attributes of the storage scenario. In this embodiment, the aforementioned performance indicators can be used to characterize the performance required to be met by the security detection model. For example, the aforementioned performance indicators may include at least the precision and recall of the security detection model in the storage scenario. This is provided for illustrative purposes only and is not intended to be limiting. Optionally, after determining the storage scenario in which the storage device resides, the performance indicators of the security detection model in the storage scenario are determined. Using the determined performance indicators of the security detection model in the storage scenario, a probability threshold matching the attributes of the storage scenario can be determined. For example, a probability threshold matching at least one of the attributes of the storage scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit, can be determined, thereby achieving the technical effect of ensuring the usability of the probability threshold. For example, when the storage scenario is a virtualization scenario, the prec is ion and rec a 1 of the security detection model in the virtualization scenario are determined. Using the prec is ion and rec a 1 of the security detection model in the virtualization scenario, a probability threshold matching attributes of the virtualization scenario can be determined. For example, a probability threshold matching at least one of attributes of the virtualization scenario, such as data security, data read and write speed, data response time, and an upper limit on storage capacity expansion, can be determined. The storage scenario herein is merely an example and is not a specific limitation.For another example, when the storage scenario is a virtualization scenario and the default storage scenario is also a virtualization scenario, the prec is ion and rec all of the security detection model in the virtualization scenario are directly determined. Using the prec is ion and rec all of the security detection model in the virtualization scenario, a probability threshold that matches the attributes of the virtualization scenario can be determined. For example, a default probability threshold that matches at least one of the attributes of the virtualization scenario, such as data security, data read and write speed, data response time, and an upper limit on storage capacity expansion, can be directly set as the probability threshold. The storage scenario and the default storage scenario are used herein for illustration only and are not specifically limited. For another example, if the storage scenario is a large-scale computing scenario and the default storage scenario is a virtualization scenario, the precise and recall of the security detection model in the large-scale computing scenario are determined. Using the precise and recall of the security detection model in the large-scale computing scenario, a probability threshold matching the attributes of the large-scale computing scenario can be determined. For example, a probability threshold matching at least one of the attributes of the large-scale computing scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit, can be determined. The default probability threshold matching at least one of the attributes of the virtualization scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit, can then be adjusted to a probability threshold matching at least one of the attributes of the large-scale computing scenario, such as data security, data read / write speed, data response time, and storage capacity expansion limit. The storage scenario and the default storage scenario are provided for illustration only and are not specifically limiting. As an optional implementation, the method further includes: performing machine learning training using abnormal behavior samples to obtain a security detection model. In this embodiment, the abnormal behavior sample may include at least one of the following: data such as the read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by the ransomware sample under abnormal access operations; data such as the read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by the ransomware sample under abnormal access operations. This is for illustration only and is not a specific limitation.Optionally, abnormal behavior samples may be used for machine learning training to obtain a security detection model. For example, data such as the read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by ransomware samples under abnormal access operations may be input into an initial model and then trained on the initial model using machine learning to obtain a security detection model. Alternatively, data such as the read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by ransomware samples under abnormal access operations may be input into the initial model and then trained on the initial model using machine learning to obtain a security detection model, thereby achieving the technical effect of improving the accuracy of the software security detection model. It should be noted that the initial model may be a detection model implemented based on a decision tree model or other classification model. This is for illustrative purposes only and is not a specific limitation. As an optional implementation, using abnormal behavior samples for machine learning training to obtain a security detection model includes: determining the category of the abnormal behavior samples; and using the abnormal behavior samples and the category of the abnormal behavior samples to perform machine learning training on a binary classification model to obtain the security detection model. In this embodiment, the abnormal behavior samples can be used to represent software samples subjected to abnormal access operations, and the category of the abnormal behavior samples can be used to represent the characteristic category of data generated by the software samples under abnormal access operations. Optionally, the category of the abnormal behavior samples can be determined, and the abnormal behavior samples and the category of the abnormal behavior samples can be used to perform machine learning training on a binary classification model to obtain the security detection model. For example, by classifying the data generated by the software samples under abnormal access operations, the characteristic category of the data generated by the software samples under abnormal access operations can be obtained. The software samples under abnormal access operations and the characteristic category of the data generated can then be input into an initial binary classification model to obtain model parameters for classification. The obtained model parameters can then be used to perform machine learning training on the initial binary classification model to obtain the security detection model, thereby achieving the technical effect of improving the accuracy of the software security detection model. It should be noted that the above method of performing machine learning training on a binary classification model is only an example and is not specifically limited here. As long as the training method can obtain a security detection model, it is within the scope of protection of the embodiments of the present disclosure.As an optional implementation, the access operation includes a read operation or a write operation, and determining the category of the abnormal behavior sample is used to indicate at least one of the following: the difference between the number of read operations performed by the software sample and the number of write operations performed by the software sample is less than a difference threshold; within a time period less than a first time period threshold, at least the number of read-after-write operations performed on logical addresses by the software sample is greater than a first number threshold, where the read-after-write operation indicates that the software sample performs a read operation followed by a write operation; within a time period less than a second time period threshold, at least the number of file addresses accessed by the software sample is greater than a second number threshold; and the frequency of the software sample accessing the header area of ​​the disk is greater than a frequency threshold. In this embodiment, the access operation may be an I / O operation, the difference threshold may be used to determine whether the software under test has an abnormal access operation, the first time period threshold may be used to determine whether the software under test has an abnormal access operation within a short period of time, the first quantity threshold may be used to determine whether the software under test has an abnormal access operation within a short period of time, the second time period threshold may be used to determine whether the software under test has accessed all files in the storage device within a short period of time, the second quantity threshold may be used to determine whether the software under test has accessed all files in the storage device within a short period of time, the frequency threshold may be used to determine whether the software under test has accessed the header area of ​​the disk, and the read-after-write operation may be used to indicate that the software sample performs a read operation followed by a write operation. Optionally, the access operation may be a write operation or a read operation on a block device, or a write operation or a read operation on a cloud disk. The read-after-write operation may be represented by a read-after-write I / O. This is for illustrative purposes only and is not a specific limitation. Optionally, when the difference between the number of read operations executed by the software sample and the number of write operations executed by the software sample is less than a difference threshold, the number of read operations executed by the software sample may be approximately equal to the number of write operations executed by the software sample. For example, the difference threshold may be set to 0.001, and the difference in the ratio of read and write I / Os is close to zero. The value of the difference threshold and the difference in the ratio of read and write I / Os are merely illustrative and are not specifically limited.Optionally, if the number of read-after-write operations performed on logical addresses by at least the software sample within a period less than a first time period threshold is greater than a first quantity threshold, this indicates that a large number of read-after-write I / Os occurred within a short period of time during the process of the tested software accessing a block device or cloud disk on the cloud platform. For example, the first time period threshold can be set to 2 seconds, and the first quantity threshold can be set to 10 seconds. The first time period threshold and the first quantity threshold are merely examples and are not specifically limited. Optionally, the category of the abnormal behavior sample indicates that the number of file addresses accessed by at least the software sample within a period less than a second time period threshold is greater than the second quantity threshold. This may indicate that a wide distribution of identical logical block addresses (LBAs) has occurred on the cloud platform. Optionally, the same logical address means that, during the process of the software under test accessing the block device or cloud disk, it attempts to access all files in the block device or cloud disk within a short period of time. Therefore, the same logical address can be used to continuously access various files in the block device or cloud disk within a short period of time. The second time period threshold can be set to 3.5 seconds, and the second quantity threshold can be set to 10 seconds. The second time period threshold and the second quantity threshold can be flexibly set according to different scenarios and are not specifically limited here. Optionally, if the frequency of the software sample accessing the header area of ​​the disk is greater than the frequency threshold, it means that on the cloud platform, during the process of the software under test accessing the block device or cloud disk, the header area of ​​the disk is also accessed, and the frequency of accessing the header area of ​​the disk is significantly greater than the frequency threshold for normal access. For example, the frequency threshold can be set to 10 times / second. The frequency threshold is provided here for example only and can be flexibly set according to different scenarios. It should be noted that the software security detection method disclosed herein detects ransomware by analyzing the I / O pattern of block devices or cloud disks, which does not place additional pressure on users' computing resources and respects users' data privacy. In addition, the six thresholds described above can be flexibly set according to different application scenarios. For example, if the application scenario is an e-commerce scenario, the difference threshold can be set to 0.001, the first time period threshold can be set to 2 seconds, the first quantity threshold can be set to 10, the second time period threshold can be set to 3.5 seconds, and the second quantity threshold can be set to 10. 7The frequency threshold can be set to 10 times / second. If the application scenario is an educational affairs system, the difference threshold can be set to 0.01, the first time period threshold can be set to 4 seconds, the first quantity threshold can be set to 10, the second time period threshold can be set to 3 seconds, and the second quantity threshold can be set to 10. The frequency threshold can be set to 10 times / second. This is merely an example and can be flexibly set according to different scenarios. As an optional implementation, the method further includes: simulating the software sample to perform different abnormal access operations under different test environments to obtain abnormal behavior samples. In this embodiment, the test environment can be used to represent different data environments in which the software sample resides. The test environment can include at least one of the following environments: a virtualization environment, a database environment, a multimedia processing environment, etc. The virtualization environment can be an environment that uses virtualization technology to divide a physical server into multiple virtual servers. The database environment can be an environment that stores, manages, and processes data. The multimedia processing environment can be an environment for processing multimedia data such as audio, video, and images. The abnormal access operation can include at least one of the following operations: data read and write operations, database operations, compressed file operations, video playback operations, and Excel operations. Optionally, the software sample can be simulated to perform different abnormal access operations in different test environments to obtain abnormal behavior samples. For example, the software sample can be simulated to perform abnormal access operations corresponding to the data environment in which it resides in different data environments to obtain data generated by the software sample under the corresponding abnormal access operations, i.e., to obtain abnormal behavior samples.For example, when the test environment is a database environment, the software sample is simulated to perform at least one of the following abnormal access operations corresponding to the database environment: abnormal data read / write operation, abnormal database operation, abnormal compressed file operation, abnormal video playback operation, and abnormal Excel operation, to obtain data generated by the software sample under the corresponding abnormal access operation, that is, to obtain abnormal behavior samples. For example, the software sample can be simulated to perform abnormal data read / write operation by inputting an incorrect file path or file name, or accessing all data in a storage device within a short period of time, thereby obtaining data generated by the software sample under abnormal data read / write operation. Alternatively, an abnormal database operation can be simulated by inputting incorrect database connection information, executing an incorrect database operation statement, or accessing all data in the database within a short period of time, thereby obtaining data generated by the software sample under abnormal database operation. Alternatively, an abnormal compressed file operation can be simulated by selecting an incorrect compressed file format, inputting an incorrect compression password, or continuously performing decompression operations within a short period of time, thereby obtaining data generated by the software sample under abnormal compressed file operation. Alternatively, an abnormal video playback operation can be simulated by selecting an unplayable video file format, inputting an incorrect video file path, or accessing all videos in a storage device within a short period of time. This method can be used to obtain data generated by the software sample under abnormal video playback operation. Furthermore, abnormal Excel operation can be simulated by selecting an Excel file that cannot be opened, entering an incorrect Excel file path, or accessing all Excel files in a storage device within a short period of time. This can also be used to obtain data generated by the software sample under abnormal Excel operation. The test environment and abnormal access operation described herein are merely illustrative and not intended to be limiting. As an optional implementation, different software samples may use the same operational strategy for performing access operations. This operational strategy indicates that the software sample encrypts the original data associated with the access operation and overwrites the encrypted original data to its original storage location. In this embodiment, different ransomware samples may use the same operational strategy for performing access operations. This operational strategy may indicate that the ransomware sample encrypts the original data associated with the access operation and overwrites the encrypted original data to its original storage location. The software samples described herein are merely illustrative and not intended to be limiting.Optionally, different ransomware samples may use the same operation strategy for executing access operations. The operation strategy may indicate that the ransomware sample encrypts the original data associated with the access operation and overwrites the encrypted original data at its original storage location. The software sample is provided for illustrative purposes only and is not a specific limitation. As an optional implementation, the abnormal behavior sample includes at least one of the following: identification information of the storage device accessed by the software sample; the operation type of the abnormal access operation; the access address corresponding to the abnormal access operation in the storage device accessed by the software sample; the data access length corresponding to the abnormal access operation in the storage device accessed by the software sample; and the timestamp of the abnormal access operation. In this embodiment, the identification information of the storage device accessed by the software sample may represent a cloud disk ID. The operation types of the abnormal access operation may include at least data read / write operations, database operations, compressed file operations, video playback operations, and Excel operations. The access address corresponding to the above-mentioned abnormal access operation in the storage device accessed by the software sample may be at least one of the following operations: the access address corresponding to data read and write operations, database operations, compressed file operations, video playback operations, and Excel operations in the block device accessed by the software sample. The access address corresponding to the above-mentioned abnormal access operation in the storage device accessed by the software sample may also be at least one of the following operations: the access address corresponding to data read and write operations, database operations, compressed file operations, video playback operations, and Excel operations in the cloud disk accessed by the software sample. The data access length corresponding to the above-mentioned abnormal access operation in the storage device accessed by the software sample may be at least one of the following operations: the data access length corresponding to data read and write operations, database operations, compressed file operations, video playback operations, and Excel operations in the block device accessed by the software sample. The data access length corresponding to the above-mentioned abnormal access operation in the storage device accessed by the software sample may also be at least one of the following operations: data read and write operations, database operations, compressed file operations, video playback operations, and Excel operations. The operation corresponds to the data access length in the cloud disk accessed by the software sample, and the timestamp of the execution of the above abnormal access operation can be represented by the I / O timestamp.The present disclosure also provides a method for detecting ransomware. FIG3 is a flowchart of a model determination method according to an embodiment of the present disclosure. As shown in FIG3 , the method may include the following steps: Step S302: Monitoring read or write operations performed by the software under test on a storage device, and obtaining behavioral data generated during the read or write operations performed by the software under test. In the technical solution provided in step S302 of the present disclosure, on a cloud platform where a storage device is deployed, when software accesses the storage device, a monitoring component can monitor the read or write operations performed by the software under test on the storage device, and obtain behavioral data generated during the read or write operations performed by the software under test on the storage device. In other words, behavioral characteristics generated by the software under test during the read or write operations performed on the storage device. Optionally, the storage device is a block device deployed on a cloud platform. When software reads from or writes to the block device, the monitoring component can monitor the read or write operations performed by the software under test on the block device, and obtain behavioral data generated during the read or write operations performed by the software under test on the block device. The storage device is used for illustration only and is not limited to block devices in the embodiments of the present disclosure. For example, the storage device can also be a cloud disk, etc., and no specific limitation is imposed here. Step S304: Input the behavioral data into a security detection model for detection to obtain a detection result. The security detection model is trained using at least abnormal behavior samples. In the technical solution provided in step S304 of the present disclosure, the abnormal behavior sample may be data generated when the software sample is subjected to an abnormal read operation or an abnormal write operation. The abnormal behavior sample may include at least one of the following: data such as the read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by a ransomware sample subjected to an abnormal read operation or an abnormal write operation; and data such as the read-after-write I / O ratio, I / O entropy, and read-write activity data at characteristic locations generated by a ransomware sample subjected to an abnormal read operation or an abnormal write operation. This is for illustrative purposes only and is not intended to be a specific limitation.Optionally, after monitoring read or write operations performed by the software under test on a storage device and obtaining behavioral data generated during the read or write operations, the behavioral data generated during the read or write operations by the software under test is input into a security detection model for detection. A detection result can be obtained. Specifically, it can be determined whether the behavioral data generated during the read or write operations by the software under test is abnormal or normal, thereby achieving the technical effect of effectively improving the accuracy of ransomware detection results. For example, when the storage device is a block device, the behavioral data generated during the read or write operations by the software under test on the block device is input into a security detection model for detection. A detection result can be obtained. Specifically, it can be determined whether the behavioral data generated during the read or write operations by the software under test on the block device is abnormal or normal. The storage device herein is merely an example and is not limited to block devices in the embodiments of the present disclosure. For example, the storage device may also be a cloud disk, etc., and this is not specifically limited here. In step S306, in response to the detection result identifying the behavior data as abnormal behavior data, the software under test is determined to be ransomware. In the technical solution provided in step S306 of the present disclosure, after inputting the behavior data into the security detection model for detection and obtaining a detection result, if the detection result identifies the behavior data generated during the read or write operation of the software under test on the storage device as abnormal behavior data, the software under test is determined to be in an abnormal access state, and thus determined to be ransomware. This effectively improves the efficiency of software security detection. This is for illustrative purposes only and is not intended to be a specific limitation. In step S308, in response to the detection result identifying the behavior data as normal behavior data, the software under test is determined to be safe software. In the technical solution provided in step S308 of the present disclosure, after the behavior data is input into the security detection model for detection and a detection result is obtained, if the detection result identifies that the behavior data generated during the read operation or write operation performed by the software under test on the storage device is normal behavior data, then it is determined that the software under test is in a normal access state, and thus the software under test is determined to be non-ransomware, thereby achieving a technical effect of effectively improving the efficiency of software security detection.Through steps S302 to S308 of the present disclosure, when software accesses a storage device, the read or write operations performed by the software under test on the storage device are monitored, and behavioral data generated during the read or write operations performed by the software under test on the storage device is obtained. The generated behavioral data is then input into a security detection model pre-trained with abnormal behavior samples for detection to obtain a detection result. Based on the detection result, it is determined whether the behavioral data is abnormal or normal. In response to the detection result indicating that the behavioral data is abnormal, it is determined that the software under test is in an abnormal access state. In response to the detection result indicating that the behavioral data is normal, it is determined that the software under test is in a normal access state. This achieves the purpose of determining whether the storage device of the cloud platform is under attack, avoids the limitations of relying on security components deployed on virtual machines for storage device security protection, and achieves the technical effect of improving the accuracy of software security detection, thereby solving the technical problem of low software security detection accuracy. The above method of this embodiment is further described below. As an optional implementation, the method further includes: in response to the software under test being ransomware, performing a defensive operation against the ransomware. In this embodiment, in response to the software under test being in an abnormal access state, it can be indicated that the software under test is ransomware, and a defensive operation is performed against the ransomware. The defensive operation may include at least the following operations: forcibly stopping the ransomware's access to the storage device, restoring data on the storage device before the ransomware accesses it, attacking and restricting the ransomware, etc. The disclosed embodiment also provides another software security detection method in a Software as a Service (SaaS) scenario. Figure 4 is a flowchart of another software security detection method according to an embodiment of the disclosed embodiment. As shown in Figure 4, the method may include the following steps: Step S402: Monitoring access operations performed by the software under test on the storage device by calling a first interface to obtain behavioral data generated during the access operations performed by the software under test. In the technical solution provided in step S402 of the present disclosure, the first interface may include a first parameter, and the parameter value of the first parameter may be behavior data. For example, the parameter value of the first parameter may be a value corresponding to a behavior feature generated during the process of the software under test performing an access operation on the storage device.Optionally, on a cloud platform deployed with a storage device, when software accesses the storage device, a first interface can be called to monitor the access operations performed by the software under test on the storage device, and behavioral data generated during the access operations can be obtained. That is, behavioral characteristics generated by the software under test during the access operations on the storage device. For example, the storage device is a block device deployed on the cloud platform. When software accesses the block device, the first interface can be called to monitor the access operations performed by the software under test on the block device, and behavioral data generated during the access operations can be obtained. The storage device is merely an example and is not limited to block devices in the embodiments of the present disclosure. For example, the storage device can also be a cloud disk, and no specific limitation is imposed here. Step S404: Input the behavioral data into a security detection model for detection to obtain a detection result. The security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated by software samples undergoing abnormal access operations. In the technical solution provided in step S404 of the present disclosure, after monitoring access operations performed by the software under test on the storage device by calling the first interface and obtaining behavioral data generated during the access operations, the behavioral data generated during the access operations is input into the security detection model for detection. A detection result is obtained, namely, whether the behavioral data generated during the access operations by the software under test is abnormal or normal, thereby effectively improving the accuracy of ransomware detection results. Step S406 outputs the detection result by calling the second interface. In response to the detection result identifying the behavioral data as abnormal, the software under test is determined to be in an abnormal access state; in response to the detection result identifying the behavioral data as normal, the software under test is determined to be in a normal access state. In the technical solution provided in step S406 of the present disclosure, the second interface may include a second parameter, and the parameter value of the second parameter may be a detection result. For example, the parameter value of the second parameter may be identifying the behavior data as abnormal behavior data, or the parameter value of the second parameter may be identifying the behavior data as normal behavior data. This is merely an example and is not a specific limitation.Optionally, after the behavior data is input into the security detection model for detection and the detection result is obtained, the detection result can be output by calling the second interface. When the detection result is that the behavior data generated during the access operation of the software to be tested to the storage device is identified as abnormal behavior data, it is determined that the software to be tested is in an abnormal access state, thereby determining that the software to be tested is abnormal software ransomware. When the detection result is that the behavior data generated during the access operation of the software to be tested to the storage device is identified as normal behavior data, it is determined that the software to be tested is in a normal access state, thereby determining that the software to be tested is not ransomware. Through steps S402 to S406 of the present disclosure, when software accesses a storage device, the first interface is called to monitor the access operations performed by the software under test on the storage device, obtain behavioral data generated during the access operations performed by the software under test on the storage device, and then input the generated behavioral data into a security detection model pre-trained with abnormal behavior samples for detection to obtain a detection result. Based on the detection result, it is determined whether the behavioral data is abnormal or normal. In response to the detection result indicating that the behavioral data is abnormal, it is determined that the software under test is in an abnormal access state. In response to the detection result indicating that the behavioral data is normal, it is determined that the software under test is in a normal access state. This achieves the purpose of determining whether the storage device of the cloud platform has been attacked, avoids the limitations of relying on security components deployed on virtual machines for storage device security protection, and thereby achieves the technical effect of improving the accuracy of software security detection, thereby solving the technical problem of low accuracy of software security detection. The present disclosure also provides a software security testing system. It should be noted that the software security testing system of this embodiment can be used to perform the aforementioned software security testing method. FIG. 5 is a schematic diagram of a software security testing system according to an embodiment of the present disclosure. As shown in FIG. 5 , the system may include a terminal device 502 configured to trigger the software under test to access a storage device.The cloud platform 504 is deployed with a storage device and is configured to monitor access operations performed by the software under test on the storage device, obtain behavioral data generated during the access operations performed by the software under test, input the behavioral data into a security detection model for detection, and obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample is subjected to abnormal access operations; in response to the detection result identifying that the behavioral data is abnormal behavior data, determine that the software under test is in an abnormal access state; in response to the detection result identifying that the behavioral data is normal behavior data, determine that the software under test is in a normal access state. In the technical solution provided by the security detection system for the software disclosed above, a terminal device can be used to trigger the software under test to perform an access operation on a storage device. Through a cloud platform deployed with storage devices, when software accesses the storage device, the access operation performed by the software under test on the storage device can be monitored, and behavior data generated during the process of the software under test performing the access operation on the storage device can be obtained. Then, by inputting the generated behavior data into a security detection model for detection, a detection result can be obtained, that is, whether the behavior data is abnormal behavior data or normal behavior data. By performing an identification operation on the obtained detection result, if the detection result is identified as abnormal behavior data, it is determined that the software under test is in an abnormal access state; if the detection result is identified as normal behavior data, it is determined that the software under test is in a normal access state. Optionally, on a cloud platform where a storage device is deployed, when software accesses the storage device, a monitoring component can monitor the access operations performed by the software under test on the storage device, obtaining behavioral data generated during the access operations performed by the software under test on the storage device. In other words, behavioral characteristics generated during the access operations performed by the software under test on the storage device can be obtained. Optionally, the behavioral data generated during the access operations performed by the software under test can be input into a security detection model for detection, thereby obtaining a detection result. In other words, it can be determined whether the behavioral data generated during the access operations performed by the software under test is abnormal or normal. Optionally, if the detection result indicates that the behavioral data generated during the access operations performed by the software under test on the storage device is abnormal, the software under test is determined to be in an abnormal access state, and thus, the software under test is determined to be ransomware. This is for illustration only and is not intended to be a specific limitation.Optionally, when the detection result is that the behavior data generated during the access operation of the software under test to the storage device is identified as normal behavior data, it is determined that the software under test is in a normal access state, thereby determining that the software under test is not ransomware. With the software security detection system disclosed above, a terminal device can trigger the software under test to access a storage device. Using a cloud platform deployed with storage devices, when software accesses the storage device, the system monitors the access operations performed by the software under test on the storage device, obtains behavioral data generated during the access operations, and then inputs the generated behavioral data into a security detection model pre-trained with abnormal behavior samples for detection to obtain a detection result. Based on the detection result, it is determined whether the behavioral data is abnormal or normal. If the detection result indicates that the behavioral data is abnormal, the software under test is determined to be in an abnormal access state. If the detection result indicates that the behavioral data is normal, the software under test is determined to be in a normal access state. This system can thereby determine whether the storage device on the cloud platform is under attack, avoids the limitations of relying on security components deployed on virtual machines for storage device security protection, and thereby achieves the technical effect of improving the accuracy of software security detection, thereby resolving the technical problem of low software security detection accuracy. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, storage, and display, etc.) referred to in this disclosure, such as data subject to verification, are all information and data authorized by the user or fully authorized by all parties. The collection, use, and processing of such data must comply with the relevant laws, regulations, and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or deny. In the field of cloud computing, cloud services have become a common interaction model for enterprises and individual users to process and store data. However, with the development of cloud services, the cloud platforms used to implement cloud services have also become a focus of hacker attacks. Due to the frequent hacker attacks on cloud platforms, the security protection of the cloud services they implement has become increasingly important. However, in the security protection process of cloud services in related technologies, security components deployed on virtual machines can be relied upon to provide security protection for cloud services. However, current security components have difficulty effectively detecting all attacks on cloud platforms, making it even more difficult to effectively detect all ransomware. Therefore, the technical problem of low accuracy of software security detection still exists.The present disclosure provides a block device-layer ransomware detection method based on I / O access patterns. This method addresses the technical issue of low software security detection accuracy. Unlike traditional solutions that cannot accurately determine whether a cloud platform is under attack, this method addresses the technical issue of low software security detection accuracy. In an embodiment of the present disclosure, ransomware generates specific behavioral characteristics when performing malicious actions on storage devices. These behavioral characteristics are used to construct a detection model. The behavioral characteristics of the software under test are then input into the detection model to identify whether the software under test is ransomware. This method can determine whether a cloud platform is under attack, thereby improving the accuracy of software security detection and addressing the technical issue of low software security detection accuracy. The above-mentioned method of this embodiment is further described below. In this embodiment, to address the technical issue of low software security detection accuracy, a ransomware detection architecture is proposed. Figure 6 is a schematic diagram of a ransomware detection architecture according to an embodiment of the present disclosure. As shown in Figure 6, the ransomware detection architecture may include a trained ransomware detection model. Optionally, as shown in FIG6 , both abnormal behavior I / O samples and normal behavior I / O samples are used as experimental samples. The obtained experimental samples are then split to obtain a training set for model training and a test set for model verification. Each sample in the training set is then input into an initial classification model to train the initial classification model. The classification results output by the initial classification model are then verified with the test set to determine whether the initial classification model needs to be optimized. Finally, the trained (also called optimized) ransomware detection model is applied to the software security detection method. The software security detection method can be used to detect whether software accessing a storage device is ransomware. The initial classification model can be at least one of the following models: a random forest model, a support vector machine model, an XGBoost model, etc.Optionally, before obtaining the ransomware detection architecture shown in FIG6 , a test environment can be constructed. For example, by creating a system instance in the Elastic Compute Service Console (ECS), mounting several Elastic Block Store (EBS) cloud disks, and writing different data to the cloud disks to simulate a user's daily environment, the test environment can be constructed and ransomware simulation can be performed using the constructed test environment. Optionally, the experimental sample shown in FIG6 can be obtained through data collection. The data collection process can include the following steps: Step 1: encrypting the original data in the virtual machine by running the ransomware. In this embodiment, after the original data in the virtual machine is encrypted, the encrypted original data is overwritten to its original storage location. Optionally, by running the ransomware, different user operations can be simulated on the virtual machine. For example, at least one of the following operations can be simulated: data read and write operations, database operations, compressed file operations, video playback operations, and Excel operations. This can recreate the I / O behavior of the ransomware on the storage device in different usage scenarios. After running the ransomware to encrypt the data in the virtual machine, the process proceeds to step 2, where I / O data corresponding to the cloud disk at a specific moment is collected using the cloud backend's operation and maintenance tools to obtain the experimental sample shown in Figure 6. In this embodiment, the I / O data may include at least the cloud disk ID, operation type, access address, access length, and I / O timestamp. This is provided for illustrative purposes only and is not intended to be limiting. After collecting I / O data corresponding to the cloud disk at a specific moment using the cloud backend's operation and maintenance tools, the process proceeds to step 3, where the encrypted original data is restored using the previously created snapshot. Optionally, before training the model shown in FIG6 , data features for detecting ransomware can be extracted by comparing the I / O behavior generated by the ransomware with the normal I / O behavior of the user. The data features for detecting ransomware may include at least the difference in the ratio of read and write I / Os, a read-then-write I / O pattern, changes in I / O entropy, and read and write frequencies at specific locations. The I / O entropy can be used to measure the degree of I / O discreteness, and the read and write activity data at characteristic locations can be used to represent read and write records in the front-end area of ​​the disk.It should be noted that in typical use of EBS block storage, to meet user storage needs, the number of write I / Os is typically much greater than the number of read I / Os. However, before encrypting user data, ransomware must first read the data before performing encryption and in-place copy operations. This results in a completely different read-write I / O ratio than in typical use. Furthermore, the read-then-write I / O pattern described above is also completely different from the read-then-write I / O pattern in typical use. It should also be noted that for normal users, cloud disk access patterns are often concentrated in a few fixed areas within a short period of time, typically involving access to specific files in the operating system. In contrast, ransomware attempts to access all files on the cloud disk within a short period of time, resulting in a wide range of LBA distributions. Therefore, I / O entropy can be used to distinguish between regular use and ransomware operations. Consequently, the changes in I / O entropy described above are completely different from those in regular use. It's also worth noting that the two most widely used disk partition formats today—the Master Boot Record (MBR) and the GUID Partition Table (GPT)—both store partition table information in the disk's header area. Under normal use, I / O activity in the disk's header space is relatively low, and may even be inaccessible for extended periods. However, when ransomware is active, the access frequency of the disk's header area, where sensitive data resides, increases significantly. Therefore, the read and write frequency of this specific location is completely different from that in normal use. Alternatively, the per-minute I / O characteristics of a cloud disk can be shown in Table 1 below: Table 1: Per-minute I / O Characteristics of Cloud Disks The I / O features in Table 1 above can be used to train the initial classification model shown in Figure 6. For example, each I / O feature in Table 1 above is input into the initial classification model to train the initial classification model. The classification results corresponding to each I / O feature output by the initial classification model are then verified with a test set to determine whether the initial classification model needs to be optimized. Finally, the trained ransomware detection model is applied to the software security detection method. Using this software security detection method, it is possible to detect whether the software accessing the storage device is ransomware. When software accesses an online cloud disk, the software's security detection method can obtain I / O information generated during the software's access operation. This information is then input into a trained ransomware detection model for detection. If the ransomware detection model detects that the acquired I / O information matches the characteristics of abnormal I / O information, for example, in response to the detection result identifying the I / O information as abnormal, the software is determined to be in an abnormal access state and is identified as ransomware. A message indicating that the ransomware is accessing the online cloud disk is displayed on a user interface, or the user is promptly notified via a messaging system to help prevent further risk spread. Furthermore, due to the advantages of EBS's Log-Structured Block Device (LSBD) architecture, users can also recover encrypted original data. Optionally, in practical applications, it's also necessary to consider at least two evaluation metrics: precision and recall. These metrics measure the ransomware detection model's false positive and false negative rates, respectively. The ransomware detection model we use (which can be, but is not limited to, a binary classification model) essentially predicts the probability that a given I / O sample has been subjected to a ransomware attack. Based on this, we can set a threshold based on different usage scenarios. When the probability predicted by the detection model exceeds the threshold, the system is considered to have been subjected to ransomware. If the consequences of false negatives are extremely severe (for example, the false negative rate is too high), the threshold can be appropriately lowered to reduce the false negative rate. Conversely, if the consequences of false positives are extremely severe (for example, the false positive rate is too high), the threshold can be appropriately raised to reduce the false positive rate and improve detection accuracy.In an embodiment of the present disclosure, each sample in the training set obtained by splitting for model training is input into an initial classification model to train the initial classification model. The classification results output by the initial classification model are then verified against the test set obtained by splitting for model validation to determine whether the initial classification model needs to be optimized. Ultimately, the trained ransomware detection model is applied to a software security detection method. Using this software security detection method, it is possible to detect whether software accessing storage devices is ransomware, thereby achieving the purpose of determining whether a cloud platform has been attacked. This improves the accuracy of software security detection and solves the technical problem of low software security detection accuracy. According to an embodiment of the present disclosure, a software security detection device is also provided for implementing the software security detection method shown in FIG. 2 . FIG. 7 is a schematic diagram of a software security detection device according to an embodiment of the present disclosure. As shown in FIG. 7 , the software security detection device 700 may include a first acquisition component 702, a first detection component 704, a first determination component 706, and a second determination component 708. A first acquisition component 702 is configured to monitor access operations performed by the software under test on the storage device and acquire behavioral data generated during the access operations. A first acquisition component 704 is configured to input the behavioral data into a security detection model for detection and obtain detection results. The security detection model is trained using at least abnormal behavior samples, where the abnormal behavior samples are data generated by the software sample under abnormal access operations. A first determination component 706 is configured to determine that the software under test is in an abnormal access state in response to the detection result that the behavioral data is abnormal. A second determination component 708 is configured to determine that the software under test is in a normal access state in response to the detection result that the behavioral data is normal. The first acquisition component 702, the first acquisition component 704, the first determination component 706, and the second determination component 708 correspond to steps S202 to S208 in Example 1. The examples and application scenarios implemented by these four units and the corresponding steps are the same, but are not limited to the content disclosed in Example 1.It should be noted that the above-mentioned components may be hardware components or software components stored in a memory (e.g., memory 1304) and processed by one or more processors (e.g., processors 1302a, 1302b, ..., 1302n). The above-mentioned components may also be executed as part of a device in the computer terminal 130 provided in Example 6. According to an embodiment of the present disclosure, a ransomware detection device for implementing the ransomware detection method shown in FIG. 3 is also provided. FIG. 8 is a schematic diagram of a ransomware detection device according to an embodiment of the present disclosure. As shown in FIG. 8 , the ransomware detection device 800 may include a second acquisition component 802, a second detection component 804, a third determination component 806, and a fourth determination component 808. The second acquisition component 802 is configured to monitor read or write operations performed by the software under test on a storage device and obtain behavioral data generated during the read or write operations performed by the software under test. The second detection component 804 is configured to input the behavior data into a security detection model for detection and obtain a detection result. The security detection model is trained using at least abnormal behavior samples, where abnormal behavior samples are data generated when the software sample undergoes abnormal read or write operations. The third determination component 806 is configured to, in response to the detection result identifying the behavior data as abnormal, determine that the software under test is ransomware. The fourth determination component 808 is configured to, in response to the detection result identifying the behavior data as normal, determine that the software under test is safe software. It should be noted that the second acquisition component 802, second detection component 804, third determination component 806, and fourth determination component 808 described above correspond to steps S302 to S308 in Example 1. The examples and application scenarios implemented by these four units and corresponding steps are the same, but are not limited to the content disclosed in Example 1. It should be noted that the above-mentioned components may be hardware components or software components stored in a memory (e.g., memory 1304) and processed by one or more processors (e.g., processors 1302a, 1302b, ..., 1302n). The above-mentioned components may also be part of a device and run in the computer terminal 130 provided in Example 6. According to an embodiment of the present disclosure, a software security detection device for implementing the software security detection method shown in FIG. 4 is also provided.FIG9 is a schematic diagram of another software security detection apparatus according to an embodiment of the present disclosure. As shown in FIG9 , the software security detection apparatus 900 may include a third acquisition component 902, a third detection component 904, and an output component 906. The third acquisition component 902 is configured to monitor access operations performed by the software under test on a storage device by calling a first interface, and to obtain behavioral data generated during the access operations performed by the software under test. The first interface includes a first parameter whose parameter value is the behavioral data. The third detection component 904 is configured to input the behavioral data into a security detection model for detection, and obtain detection results. The security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample undergoes abnormal access operations. The output component 906 is configured to output the detection result by calling a second interface, wherein the second interface includes a second parameter whose parameter value is the detection result. In response to the detection result identifying the behavior data as abnormal behavior data, the software under test is determined to be in an abnormal access state. In response to the detection result identifying the behavior data as normal behavior data, the software under test is determined to be in a normal access state. It should be noted that the third acquisition component 902, the third detection component 904, and the output component 906 correspond to steps S402 to S406 in Example 1. The examples and application scenarios implemented by these three components and the corresponding steps are the same, but are not limited to the content disclosed in Example 1. It should be noted that the above components can be hardware components or software components stored in a memory (e.g., memory 1304) and processed by one or more processors (e.g., processors 1302a, 1302b, ..., 1302n). The above components can also be part of an apparatus and run in the computer terminal 130 provided in Example 6.In this software security detection device, when software accesses a storage device, the device monitors the access operations performed by the software under test on the storage device, obtains behavioral data generated during the access operations, and then inputs the generated behavioral data into a security detection model pre-trained with abnormal behavior samples for detection to obtain a detection result. Based on the detection result, the device determines whether the behavioral data is abnormal or normal. If the detection result indicates that the behavioral data is abnormal, the device determines that the software under test is in an abnormal access state. If the detection result indicates that the behavioral data is normal, the device determines that the software under test is in a normal access state. This device can thereby determine whether the storage device of a cloud platform is under attack, avoids the limitations of relying on security components deployed on virtual machines for storage device security protection, and achieves the technical effect of improving the accuracy of software security detection, thereby resolving the technical problem of low software security detection accuracy. Embodiments of the present disclosure can provide a computer terminal, which can be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may be replaced with a terminal device such as a mobile terminal. Optionally, in this embodiment, the computer terminal may be located in at least one of multiple network devices in a computer network. In this embodiment, the computer terminal may execute program code for the following steps in the software security detection method: monitoring access operations performed by the software under test on a storage device to obtain behavioral data generated during the access operations performed by the software under test; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample is subjected to abnormal access operations; in response to the detection result identifying the behavioral data as abnormal behavior data, determining that the software under test is in an abnormal access state; and in response to the detection result identifying the behavioral data as normal behavior data, determining that the software under test is in a normal access state. Optionally, FIG10 is a structural block diagram of a computer terminal according to an embodiment of the present disclosure. As shown in FIG10 , the computer terminal A may include: one or more (only one is shown in the figure) processors 1002 , a memory 1004 and a transmission device 1006 .The memory can be configured to store software programs and modules, such as the program instructions / modules corresponding to the software security detection method and apparatus in the embodiments of the present disclosure. The processor executes the software programs and modules stored in the memory to perform various functional applications and data processing, thereby implementing the aforementioned software security detection method. The memory can include high-speed random access memory (RAM) and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory can further include memory remote from the processor, which can be connected to computer terminal A via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof. The processor can access the information and application programs stored in the memory via a transmission device to perform the following steps: inputting the behavior data into a security detection model for prediction to obtain a probability that the behavior data is abnormal; and determining a detection result within the security detection model based on the probability. Optionally, the processor can also execute program code for the following steps: inputting the behavior data into the security detection model for classification prediction to obtain a probability that the behavior data is abnormal. Optionally, the processor may further execute program code for the following steps: if the probability in the security detection model is greater than a probability threshold, determining that the detection result is identification of the behavior data as abnormal behavior data; and if the probability in the security detection model is less than or equal to the probability threshold, determining that the detection result is identification of the behavior data as normal behavior data. Optionally, the processor may further execute program code for the following steps: determining the storage scenario in which the storage device is located; and determining a probability threshold that matches the attributes of the storage scenario. Optionally, the processor may further execute program code for the following steps: determining a performance indicator of the security detection model in the storage scenario, wherein the performance indicator is used to represent the performance required of the security detection model; and determining a probability threshold that matches the attributes of the storage scenario using the performance indicator. Optionally, the processor may further execute program code for the following steps: performing machine learning training using abnormal behavior samples to obtain a security detection model. Optionally, the processor may further execute program code for the following steps: determining the category of the abnormal behavior samples; and performing machine learning training on a binary classification model using the abnormal behavior samples and the category of the abnormal behavior samples to obtain a security detection model. Optionally, the processor may further execute program code of the following steps: simulating the software sample to perform different abnormal access operations under different test environments to obtain abnormal behavior samples.Optionally, the processor may access information and applications stored in the memory via a transmission device to perform the following steps: monitoring read or write operations performed by the software under test on a storage device to obtain behavioral data generated during the read or write operations performed by the software under test; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample undergoes abnormal read or write operations; in response to the detection result identifying the behavioral data as abnormal behavior data, determining that the software under test is ransomware; in response to the detection result identifying the behavioral data as normal behavior data, determining that the software under test is safe software. Optionally, the processor may further execute program code for the following steps: in response to the software under test being ransomware, performing a defensive operation against the ransomware. Optionally, the processor may access information and applications stored in the memory through a transmission device to perform the following steps: monitoring access operations performed by the software under test on the storage device by calling a first interface to obtain behavioral data generated during the access operations by the software under test, wherein the first interface includes a first parameter whose parameter value is the behavioral data; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated by software samples undergoing abnormal access operations; outputting the detection result by calling a second interface, wherein the second interface includes a second parameter whose parameter value is the detection result; in response to the detection result identifying the behavioral data as abnormal behavior data, determining that the software under test is in an abnormal access state; and in response to the detection result identifying the behavioral data as normal behavior data, determining that the software under test is in a normal access state. Embodiments of the present disclosure provide a software security detection method.In an embodiment of the present disclosure, when software accesses a storage device, the access operations performed by the software under test on the storage device are monitored, and behavioral data generated during the access operations performed by the software under test on the storage device are obtained. The generated behavioral data is then input into a security detection model for detection to obtain a detection result. Based on the detection result, it is determined whether the behavioral data is abnormal or normal. If the detection result indicates that the behavioral data is abnormal, it is determined that the software under test is in an abnormal access state. If the detection result indicates that the behavioral data is normal, it is determined that the software under test is in a normal access state. This achieves the purpose of determining whether the storage device of the cloud platform has been attacked, avoids the limitations of relying on security components deployed on virtual machines to provide security protection for storage devices, and further achieves the technical effect of improving the accuracy of software security detection, thereby solving the technical problem of low accuracy of software security detection. Those skilled in the art will appreciate that the structure shown in FIG10 is merely illustrative. Computer terminal A may also be a smartphone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile internet device (MID), a PAD, or other terminal device. FIG10 does not limit the structure of the computer terminal A. For example, computer terminal A may include more or fewer components (such as a network interface, a display device, etc.) than those shown in FIG10 , or have a configuration different from that shown in FIG10 . Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments can be completed by a program instructing the hardware associated with the terminal device. The program may be stored in a computer-readable storage medium, which may include a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk. Embodiments of the present disclosure also provide a computer-readable storage medium. Optionally, in this embodiment, the computer-readable storage medium may be used to store program code executed by the software security detection method provided in the first embodiment. A computer-readable storage medium may also be referred to as a computer storage medium. It may include a data signal transmitted in a baseband or as part of a carrier wave, carrying readable program code.This propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable storage medium can transmit, propagate, or transfer a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. The program code contained in the computer-readable storage medium can be transmitted using any suitable medium, including but not limited to wireless, wired, optical cable, radio frequency, or any suitable combination thereof. Optionally, in this embodiment, the computer-readable storage medium can be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals. Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: monitoring access operations performed by the software under test on a storage device to obtain behavioral data generated during the access operations performed by the software under test; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated by software samples undergoing abnormal access operations; in response to the detection result identifying the behavioral data as abnormal behavior data, determining that the software under test is in an abnormal access state; in response to the detection result identifying the behavioral data as normal behavior data, determining that the software under test is in a normal access state. Optionally, the computer-readable storage medium may further execute program code for executing the following steps: inputting the behavioral data into the security detection model for prediction to obtain a probability that the behavioral data is abnormal behavior data; and determining a detection result in the security detection model based on the probability. Optionally, the computer-readable storage medium may further execute program code for executing the following steps: inputting the behavioral data into the security detection model for classification prediction to obtain a probability that the behavioral data is abnormal behavior data. Optionally, the computer-readable storage medium may further include program code that executes the following steps: if the probability in the security detection model is greater than a probability threshold, determining that the detection result is that the behavior data is identified as abnormal behavior data; if the probability in the security detection model is less than or equal to the probability threshold, determining that the detection result is that the behavior data is identified as normal behavior data. Optionally, the computer-readable storage medium may further include program code that executes the following steps: determining a storage scenario in which the storage device is located; and determining a probability threshold that matches the attributes of the storage scenario.Optionally, the computer-readable storage medium may further execute program code for the following steps: determining a performance indicator of a security detection model in a storage scenario, wherein the performance indicator is used to characterize the performance required of the security detection model; and using the performance indicator, determining a probability threshold that matches the attributes of the storage scenario. Optionally, the computer-readable storage medium may further execute program code for the following steps: performing machine learning training using abnormal behavior samples to obtain a security detection model. Optionally, the computer-readable storage medium may further execute program code for the following steps: determining the category of the abnormal behavior samples; and performing machine learning training on a binary classification model using the abnormal behavior samples and the categories of the abnormal behavior samples to obtain a security detection model. Optionally, the computer-readable storage medium may further execute program code for the following steps: simulating software samples to perform different abnormal access operations under different test environments to obtain abnormal behavior samples. As an optional example, a computer-readable storage medium is configured to store program code for performing the following steps: monitoring read or write operations performed by the software under test on a storage device to obtain behavioral data generated during the read or write operations performed by the software under test; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample undergoes abnormal read or write operations; in response to the detection result identifying the behavioral data as abnormal, determining that the software under test is ransomware; in response to the detection result identifying the behavioral data as normal, determining that the software under test is safe software. Optionally, the computer-readable storage medium may also store program code for performing the following steps: in response to the software under test being ransomware, performing a defensive operation against the ransomware.As an optional example, a computer-readable storage medium is configured to store program code for performing the following steps: monitoring access operations performed by software under test on a storage device by calling a first interface to obtain behavioral data generated during the access operations by the software under test, wherein the first interface includes a first parameter whose parameter value is the behavioral data; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated by software samples undergoing abnormal access operations; outputting the detection result by calling a second interface, wherein the second interface includes a second parameter whose parameter value is the detection result; in response to the detection result identifying the behavioral data as abnormal, determining that the software under test is in an abnormal access state; and in response to the detection result identifying the behavioral data as normal, determining that the software under test is in a normal access state. Embodiments of the present disclosure also provide a computer program product, including a computer program, which, when executed by a processor, implements any of the aforementioned software security detection methods. Embodiments of the present disclosure also provide a computer program product, including a non-volatile computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements any of the aforementioned software security detection methods. Embodiments of the present disclosure also provide a computer program. When executed by a processor, the computer program implements any of the aforementioned software security detection methods. Optionally, the computer program includes program code that implements the following steps when executed by a processor: monitoring access operations performed by software under test on a storage device to obtain behavior data generated during the access operations performed by the software under test; inputting the behavior data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated when a software sample undergoes an abnormal access operation; in response to the detection result identifying the behavior data as abnormal behavior data, determining that the software under test is in an abnormal access state; and in response to the detection result identifying the behavior data as normal behavior data, determining that the software under test is in a normal access state.Optionally, the computer program implements program code for the following steps when executed by a processor: monitoring read operations or write operations performed by the software under test on a storage device, obtaining behavioral data generated during the read operation or write operation performed by the software under test; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is obtained by training at least using abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample is subjected to abnormal read operations or abnormal write operations; in response to the detection result identifying that the behavioral data is abnormal behavior data, determining that the software under test is ransomware; in response to the detection result identifying that the behavioral data is normal behavior data, determining that the software under test is safe software. Optionally, the computer program described above, when executed by a processor, implements program code for the following steps: monitoring access operations performed by the software under test on a storage device by calling a first interface to obtain behavioral data generated during the access operations by the software under test, wherein the first interface includes a first parameter whose parameter value is the behavioral data; inputting the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, wherein the abnormal behavior samples are data generated by software samples undergoing abnormal access operations; outputting the detection result by calling a second interface, wherein the second interface includes a second parameter whose parameter value is the detection result; in response to the detection result identifying the behavioral data as abnormal, determining that the software under test is in an abnormal access state; and in response to the detection result identifying the behavioral data as normal, determining that the software under test is in a normal access state. Embodiments of the present disclosure may provide an electronic device that may include a memory and a processor. Figure 11 is a block diagram of an electronic device implementing a software security detection method according to an embodiment of the present disclosure. The term "electronic device" is intended to refer to various forms of digital computers, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The term "electronic device" may also refer to various forms of mobile devices, such as personal digital assistants (PDAs), cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided for example only and are not intended to limit implementations of the present disclosure as described and / or claimed herein.As shown in Figure 11, device 1100 includes a computing unit 1101, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 1102 or a computer program loaded from a storage unit 1108 into a random access memory (RAM) 1103. RAM 1103 may also store various programs and data required for the operation of device 1100. Computing unit 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to bus 1104. Multiple components within device 1100 are connected to an I / O interface 1105, including an input unit 1106, such as a keyboard and mouse; an output unit 1104, such as various types of displays and speakers; a storage unit 1108, such as a magnetic disk and optical disk; and a communication unit 1109, such as a network card, a modem, or a wireless communication transceiver. Communication unit 1109 allows device 1100 to exchange information / data with other devices via computer networks such as the Internet and / or various telecommunication networks. Computing unit 1101 can be any general-purpose or specialized processing component with processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 1101 executes the various methods and processes described above, such as the software security detection method. For example, in some embodiments, the software security detection method can be implemented as a computer software program that is tangibly embodied in a machine-readable medium, such as the storage unit 1108. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 1100 via the ROM 1102 and / or the communication unit 1109.When the computer program is loaded into RAM 1103 and executed by computing unit 1101, one or more steps of the software security detection method described above may be performed. Alternatively, in other embodiments, computing unit 1101 may be configured to execute the software security detection method in any other appropriate manner (e.g., via firmware). Various embodiments of the systems and techniques described above may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-a-chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementation in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be either a special-purpose or general-purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, at least one input device, and at least one output device. The program code used to implement the methods of the present disclosure can be written in any combination of one or more programming languages. This program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code can be executed entirely on the machine, partially on the machine, as a standalone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server. The method embodiment provided in Example 1 of the present disclosure can be executed on a mobile terminal, a computer terminal, or a similar computing device.FIG12 is a block diagram of the hardware structure of a computer terminal (or mobile device) for implementing a software security detection method according to an embodiment of the present disclosure. As shown in FIG12 , the computer terminal 120 (or mobile device) may include one or more processors 1202 (illustrated in the figure by 1202a, 1202b, ..., 1202n) (the processor 1202 may include, but is not limited to, a processing device such as a microprocessor (MCU) or a field programmable gate array (FPGA)), a memory 1204 for storing data, and a transmission device 1206 for communication functions. In addition, the computer terminal 120 (or mobile device) may also include a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS), a network interface, a power supply, and / or a camera. Those skilled in the art will appreciate that the structure shown in FIG12 is merely illustrative and does not limit the structure of the electronic device described above. For example, the computer terminal 120 may include more or fewer components than shown in FIG12 , or have a configuration different from that shown in FIG12 . The hardware structure block diagram shown in FIG12 can serve not only as an exemplary block diagram of the computer terminal 120 (or mobile device) described above, but also as an exemplary block diagram of the server described above. In an optional embodiment, FIG13 shows a block diagram of an embodiment using the computer terminal 130 (or mobile device) shown in FIG12 as a computing node in a computing environment 1301. FIG13 is a block diagram of the computing environment for a software security detection method according to an embodiment of the present disclosure. As shown in FIG13 , computing environment 1301 includes multiple computing nodes (e.g., servers) (illustrated as 1310-1 and 1310-2 in the figure) running on a distributed network. Each computing node includes local processing and memory resources, and an end user 1302 can remotely run applications or store data in computing environment 1301. The application can be provided as multiple services 1320-1, 1320-2, 1320-3 and 1320-4 in the computing environment 1301, representing services "A", "D", "E" and "H" respectively.End users 1302 can provision and access services through a web browser or other software application on a client. In some embodiments, end users 1302's offers and / or requests can be provided to an ingress gateway 1330. Ingress gateway 1330 can include a corresponding agent to handle offers and / or requests for services (one or more services provided in computing environment 1301). Services are provided or deployed based on various virtualization technologies supported by computing environment 1301. In some embodiments, services can be provided based on virtual machine (VM)-based virtualization, container-based virtualization, and / or similar approaches. VM-based virtualization can simulate a real computer by initializing a virtual machine, executing programs and applications without directly accessing any actual hardware resources. While VMs virtualize machines, container-based virtualization can launch containers to virtualize an entire operating system (OS), allowing multiple workloads to run on a single OS instance. In one embodiment based on container virtualization, several service containers can be assembled into a pod (e.g., a Kubernetes pod). For example, as shown in FIG13 . Pods 1340-1, 1340-2, and 1340-N (collectively referred to as Pods) may include a proxy 1345 and one or more containers 1342-1, 1342-2, and 1342-M (collectively referred to as containers). One or more containers in a Pod process requests related to one or more corresponding functions of a service. Proxy 1345 typically controls network functions related to the service, such as routing and load balancing. Other services may also be equipped with Pods similar to Pods. During operation, executing a user request from end user 1302 may require invoking one or more services in computing environment 1301, and executing one or more functions of one service may require invoking one or more functions of another service. As shown in Figure 13 , service "A" 1320-1 receives a user request from end user 1302 from ingress gateway 1330. Service "A" 1320-1 may call service "D" 1320-2, and service "D" 1320-2 may request service "E" 1320-3 to perform one or more functions. The aforementioned computing environment may be a cloud computing environment, where resource allocation is managed by the cloud service provider, allowing for the development of functions without having to consider implementing, adjusting, or scaling servers. This computing environment allows developers to execute code in response to events without building or maintaining complex infrastructure. Services can be partitioned to complete a set of functions that can be automatically and independently scaled, rather than scaling a single hardware device to handle potential load. In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by, or in conjunction with, an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.To provide user interaction, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD)) and a monitor for displaying information to the user; a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be configured to provide user interaction; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input). The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., a data server), a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser). A user can interact with implementations of the systems and techniques described herein through the graphical user interface or the web browser), or a computing system including any combination of such backend components, middleware components, or front-end components. The components of the system can be interconnected through any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet. A computer system can include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship is established by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, a server in a distributed system, or a server integrated with a blockchain. It should be noted that the serial numbers of the above-mentioned embodiments of the present disclosure are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments. In the above-mentioned embodiments of the present disclosure, the descriptions of each embodiment are given with emphasis. For portions not described in detail in a particular embodiment, reference can be made to the relevant descriptions of other embodiments. In the several embodiments provided in the present disclosure, it should be understood that the disclosed technical content, It can be achieved in other ways.The device embodiments described above are merely illustrative. For example, the division of units represents only one logical functional division. In actual implementation, other divisions may be employed. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be through interfaces, or indirect couplings or communication connections between units or modules, and may be electrical or other. Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of these units may be selected to achieve the objectives of the present embodiments as needed. Furthermore, the functional units in the various embodiments of the present disclosure may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. These integrated units may be implemented in either hardware or software functional units. If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present disclosure, or the portion that contributes to the existing technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product, stored in a storage medium, includes instructions for causing a computer device (such as a personal computer, server, or network device) to execute all or part of the steps of the various embodiments of the present disclosure. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory, random access memory, a mobile hard drive, a magnetic disk, or an optical disk. The above are merely preferred embodiments of the present disclosure. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present disclosure, and such improvements and modifications should also be considered within the scope of protection of this application.INDUSTRIAL APPLICABILITY The solution provided by the embodiments of the present disclosure can be applied to the software security testing process, monitoring the access operations performed by the software under test on the storage device, obtaining behavioral data generated during the access operations performed by the software under test; inputting the behavioral data into a security testing model for testing to obtain a test result, wherein the security testing model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample is subjected to abnormal access operations; in response to the test result identifying that the behavioral data is abnormal behavior data, determining that the software under test is in an abnormal access state; in response to the test result identifying that the behavioral data is normal behavior data, determining that the software under test is in a normal access state, thereby solving the technical problem of low accuracy in software security testing.

Claims

Claims 1. A software security detection method, applied to a cloud platform deployed with a storage device, comprising: monitoring access operations performed by the software under test on the storage device, and obtaining behavior data generated during the access operations performed by the software under test; The behavior data is input into a security detection model for detection to obtain a detection result, wherein the security detection model is obtained by training at least with abnormal behavior samples, and the abnormal behavior samples are data generated when a software sample is subjected to an abnormal access operation; in response to the detection result identifying that the behavior data is abnormal behavior data, determining that the software under test is in an abnormal access state; in response to the detection result identifying that the behavior data is normal behavior data, determining that the software under test is in a normal access state.

2. The method according to claim 1, wherein: Inputting the behavior data into a security detection model for detection to obtain a detection result includes: inputting the behavior data into the security detection model for prediction to obtain a probability that the behavior data belongs to the abnormal behavior data; and determining the detection result in the security detection model based on the probability.

3. The method according to claim 2, wherein: Inputting the behavior data into the security detection model for prediction to obtain a probability that the behavior data belongs to the abnormal behavior data includes: inputting the behavior data into the security detection model for classification prediction to obtain a probability that the behavior data belongs to the abnormal behavior data.

4. The method according to claim 2, wherein: In the security detection model, determining the detection result based on the probability includes: in the security detection model, if the probability is greater than a probability threshold, determining the detection result as identifying the behavior data as the abnormal behavior data; in the security detection model, if the probability is less than or equal to the probability threshold, determining the detection result as identifying the behavior data as the normal behavior data.

5. The method according to claim 4, wherein: The method further includes: determining a storage scenario in which the storage device is located; and determining the probability threshold that matches an attribute of the storage scenario.

6. The method according to claim 5, wherein: Determining the probability threshold that matches the attributes of the storage scenario includes: determining a performance indicator of the security detection model in the storage scenario, wherein the performance indicator is used to characterize performance that the security detection model needs to meet; and determining the probability threshold that matches the attributes of the storage scenario using the performance indicator. 38 7. The method according to claim 1, wherein: The method further includes: determining the category of the abnormal behavior sample; and performing machine learning training on a binary classification model using the abnormal behavior sample and the category of the abnormal behavior sample to obtain the security detection model.

8. The method according to claim 7, wherein: The access operation includes a read operation or a write operation, and determining the category of the abnormal behavior sample is used to indicate at least one of the following: a difference between the number of the read operations executed by the software sample and the number of the write operations executed by the software sample is less than a difference threshold; During a time period shorter than a first time period threshold, at least the number of read-after-write operations performed by the software sample on a logical address is greater than a first number threshold, where the read-after-write operation indicates that the software sample performs a read operation followed by a write operation. During a time period shorter than a second time period threshold, at least the number of addresses of files accessed by the software sample is greater than a second number threshold. The frequency with which the software sample accesses the header area of ​​the disk is greater than a frequency threshold.

9. The method according to any one of claims 1 to 8, wherein The method further includes: simulating the software sample to perform different abnormal access operations under different test environments to obtain the abnormal behavior samples.

10. The method according to any one of claims 1 to 8, wherein Different software samples have the same operation strategy for executing access operations, where the operation strategy indicates that the software samples encrypt original data associated with the access operation and overwrite the encrypted original data at the original storage location of the original data.

11. The method according to any one of claims 1 to 8, wherein: The abnormal behavior sample includes at least one of the following: identification information of the storage device accessed by the software sample; the operation type of the abnormal access operation; the access address corresponding to the abnormal access operation in the storage device accessed by the software sample; the data access length corresponding to the abnormal access operation in the storage device accessed by the software sample; and the timestamp of the execution of the abnormal access operation.

12. The method according to any one of claims 1 to 8, wherein The behavior data is used to represent behavior characteristics generated during the process of the software under test performing an access operation on the storage device.

13. A ransomware detection method, applied to a cloud platform deployed with a storage device, comprising: monitoring a read operation or a write operation performed by the software under test on the storage device, and obtaining behavior data generated during the process of the software under test performing the read operation or the write operation; The behavior data is input into the security detection model for detection to obtain the detection result, wherein: 39 The security detection model is obtained by training using at least abnormal behavior samples, where the abnormal behavior samples are data generated when a software sample is subjected to an abnormal read operation or an abnormal write operation; in response to the detection result identifying the behavior data as abnormal behavior data, determining that the software to be tested is ransomware; and in response to the detection result identifying the behavior data as normal behavior data, determining that the software to be tested is safe software.

14. The method according to claim 13, wherein: The method further includes: in response to the software to be tested being ransomware, performing a defense operation on the ransomware.

15. A software security detection method, applied to a cloud platform deployed with a storage device, comprising: The method includes monitoring access operations performed by the software under test on the storage device by calling a first interface, obtaining behavior data generated by the software under test during the access operation, wherein the first interface includes a first parameter, and a parameter value of the first parameter is the behavior data; inputting the behavior data into a security detection model for detection to obtain a detection result, wherein the security detection model is trained using at least abnormal behavior samples, and the abnormal behavior samples are data generated when a software sample is subjected to an abnormal access operation; outputting the detection result by calling a second interface, wherein the second interface includes a second parameter, and a parameter value of the second parameter is the detection result; in response to the detection result that the behavior data is identified as abnormal behavior data, determining that the software under test is in an abnormal access state; and in response to the detection result that the behavior data is identified as normal behavior data, determining that the software under test is in a normal access state.

16. A software security detection system, comprising: The terminal device is configured to trigger the software under test to perform an access operation on the storage device; A cloud platform is deployed with the storage device and is configured to monitor access operations performed by the software under test on the storage device, obtain behavioral data generated during the access operations performed by the software under test; input the behavioral data into a security detection model for detection to obtain a detection result, wherein the security detection model is obtained by training at least with abnormal behavior samples, and the abnormal behavior samples are data generated when the software sample is under abnormal access operations; in response to the detection result that the behavior data is identified as abnormal behavior data, determine that the software under test is in an abnormal access state; in response to the detection result that the behavior data is identified as normal behavior data, determine that the software under test is in a normal access state.

17. An electronic device, comprising: Memory, Executable programs are stored; A processor, configured to run the program, wherein the program executes the method according to any one of claims 1 to 15 when running. 40 18. A computer program product, wherein: The invention comprises a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 15.

19. A computer program product, wherein: The invention comprises a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 15 is implemented.

20. A computer program, wherein When the computer program is executed by a processor, the method according to any one of claims 1 to 15 is implemented.

Images