Malicious file identification method, device and storage medium

Abstract

The invention discloses a malicious file identification method, a device and a storage medium. The method comprises the steps of adopting a preset learning set consisting of a malicious file and a normal file to generate a machine learning model; reading a file to be detected other than the learning set; converting the file to be detected to a vector; and performing the malicious file identification on the file to be detected which is converted to the vector through the machine learning model. The machine learning model is generated by the preset learning set consisting of the malicious file and the normal file, and the generated machine learning model is used for performing the malicious file identification on the file to be detected except the learning set, so that the virus characteristics can be timely, accurately and efficiently extracted, any discovered malicious file can be immediately processed, and the detection efficiency of the malicious file can be greatly improved.

Description

technical field [0001] The present invention relates to the field of Internet technology, in particular to the field of security, in particular to a malicious file identification method, device and storage medium. Background technique [0002] With the development of Internet technology, the spread of viruses is also increasing. Viruses have caused great harm to the security of user information and user property. Therefore, the development of an antivirus engine that responds quickly, efficiently, and has a high rate of virus detection and accuracy has become the focus of today's Internet information security circles. [0003] The virus identification technology usually adopted by traditional antivirus engines is as follows: analysts analyze virus files, extract virus signatures, store virus signatures into the database, antivirus engines scan existing files according to the virus database, and report viruses if they encounter matching signatures. [0004] Traditional virus...

AI Technical Summary

Problems solved by technology

[0005] 1. The professional skills of analysts are highly required, and the quality of virus feature extraction determines the false alarm rate and report rate;

[0006] 2. It is time-consuming to analyze virus files and extract virus characteristics;

[0007] 3. Low efficiency. With the increase of virus database records, the time required to collide with each record will increase geometrically;

[0008] 4. The discovery of viruses is not timely. Compared with the massive new virus types, due to the limited processing ability of analysts, the processing of some viruses will only be discovered or taken seriously when the virus breaks out, and then processed. The virus has caused considerable damage

Images