A method and system for uniformly naming malicious code based on file fingerprints

Abstract

The present invention relates to the field of information security technology, in particular to a method and system for uniformly naming malicious codes based on file fingerprints, which collects file fingerprints for antivirus software, and returns malicious codes to the antivirus software when the antivirus software finds malicious codes. The characteristic value of the malicious code; name the malicious code, receive the malicious code with the characteristic value, and generate a unified naming of the malicious code according to the agreed rules: establish a mapping relationship between the unified naming of the malicious code and the independent naming of the original factory, and receive The preset parameters of the malicious code store the mapping relationship as a data line on the database implementing the mapper, provide the interface to view the corresponding relationship between the unified naming and the original factory naming, and return the original factory naming of the manufacturer as the result output. The invention can be commonly used among various manufacturers without affecting the internal naming rules of the manufacturers, solves the uniformity of names of malicious codes, provides guidance for administrators to work, and improves notification and disposal efficiency.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method and system for uniformly naming malicious codes based on file fingerprints. Background technique [0002] In the existing technology, the naming of malicious code is a relatively mature technology. Currently, the more common naming rules in the market are: <prefix>.<name>.<suffix>, where: prefix generally indicates the operation of the malicious code Platform or type, the operating platform generally includes: DOS, Win32, Win64, MacOS, Linux, etc., and the types generally include: infection type, macro virus, Trojan horse, backdoor program, worm, adware, etc.; the name generally indicates the family characteristics of malicious code , For example, the family names of the famous CIH viruses are all unified "CIH"; the suffix generally refers to the variant characteristics of a malicious code, and is used to distinguish a specific variant of a...

AI Technical Summary

Problems solved by technology

[0009] In order to overcome the deficiencies in the prior art, the present invention provides a malicious code naming method and its system that can be commonly used among various manufacturers. Using the method and its system, without affecting the internal naming rules of each manufacturer, It can solve the problem of the uniformity of malicious code names, so as to firstly analyze the overall situation objectively under the overall statistics of the virus epidemic situation; secondly, provide guidance for administrators to improve the notification rate and disposal efficiency

Images