Malicious feature extraction method and device and storage media

Abstract

The invention discloses a malicious feature extraction method and device and storage media. The method comprises the steps that black file sets used for extracting features and white file sets corresponding to the black file sets in number are selected; black files in the black file sets and white files in the white file sets are converted into multi-dimensional vectors; dimension combing and screening are conducted on the vectors of the black files in the black file sets and the white files in the white file sets, and the malicious features are extracted. Vector conversion is conducted on the known black file sets and the known white file sets, dimension combing and screening are conducted on the converted vectors, viruses and other malicious features can be automatically, timely, accurately and effectively extracted, a large number of analysis workers can be omitted, influence from human subjective factors is greatly reduced, and meanwhile reaction speed is greatly increased.

Description

technical field [0001] The present invention relates to the field of Internet technology, in particular to the field of security, in particular to a malicious feature extraction method, device and storage medium. Background technique [0002] With the development of Internet technology, the spread of viruses is also increasing. Viruses have caused great harm to the security of user information and user property. Therefore, the development of an antivirus engine that responds quickly, efficiently, and has a high rate of virus detection and accuracy has become the focus of today's Internet information security circles. [0003] The virus identification technology usually adopted by traditional antivirus engines is as follows: analysts analyze virus files, extract virus signatures, store virus signatures into the database, antivirus engines scan existing files according to the virus database, and report viruses if they encounter matching signatures. [0004] Existing technique...

AI Technical Summary

Problems solved by technology

[0006] 1. The professional skills of analysts are highly required, and the quality of extracted virus features determines the false alarm rate and reporting rate. On the one hand, the more common features extracted for a family of viruses (that is, viruses with basically the same behavior), The lower the possibility of false positives, but the lower the recognition rate for the variants of the family virus, that is, the lower the reporting rate; The higher the probability, that is, the higher the false positive rate; finding a balance point depends greatly on the experience of the analyst;

[0007] 2. The system responds slowly, and it takes time to analyze virus files and extract virus characteristics, resulting in some new viruses not being processed in time;

[0008] 3. Low efficiency. With the increase of virus database records, the time required to collide with each record will increase geometrically;

[0009] 4. The discovery of viruses is not timely. Compared with the massive new virus types, due to the limited processing ability of analysts, the processing of some viruses will only be discovered or taken seriously when the virus breaks out, and then processed. The virus has caused considerable damage

Images