Sample analysis method and device

Abstract

The invention relates to a sample analyzing method and device and a storage medium. The method comprises the following steps: receiving uploaded samples and filtering the samples; classifying the filtered samples; and analyzing the classified samples according to corresponding classes. According to the method, through filtering the uploaded samples, similar samples are gathered and generalized; in sample analysis, a predetermined number of samples are randomly selected from each class of samples to be analyzed according to the corresponding class; as the similar samples are not analyzed repeatedly, the analytical workload of an analysis engineer is greatly reduced, and sample analyzing efficiency is improved; and as the computing power does not need to be increased or expanded to meet the requirement of a large amount of sample analysis, system cost is reduced.

Description

technical field [0001] The invention relates to the technical field of Internet and information security, in particular to a large-scale sample analysis method and device based on clustering operation. Background technique [0002] With the development of Internet technology, in order to ensure the security of network information, it is necessary to analyze a large number of malicious samples, and discover new malicious attack techniques from the analysis of massive samples, so as to take corresponding anti-malicious attack measures. [0003] On the instant messaging network management platform, users need to upload tens of thousands of samples every day, which is extremely challenging for the analysis engineers in the background. Moreover, many samples are very similar, and although the malicious behavior is the same, the samples are not completely identical, so that analysts often have to repeat the analysis. [0004] At present, the inefficiency of manual analysis of sam...

AI Technical Summary

Problems solved by technology

[0010] From Table 1 above, it can be seen that the current analysis method with the most efficient multi-server analysis cluster has a daily processing capacity of about 1 million samples, while the current daily uploaded samples on the network management platform have reached 10 million level, and will continue to grow rapidly. Therefore, it is no longer feasible to simply build an analysis cluster with multiple servers and continue to stack servers to increase analysis capabilities.

Images