Method and device for detecting malicious file

Abstract

The invention discloses a method and a device for detecting a malicious file. One specific embodiment of the method comprises the following steps of obtaining a URL (Uniform Resource Locator) for downloading a to-be-detected file; matching character strings included in the URL of the to-be-detected file and character strings in a preset model; and determining whether the to-be-detected file is the malicious file based on a longest character string matched in a preset model by the URL of the to-be-detected file. According to the embodiment, the efficiency for detecting the malicious file can be improved.

Description

technical field [0001] The present application relates to the field of computer technology, in particular to the field of network information security technology, and in particular to a method and device for detecting malicious files. Background technique [0002] When downloading files on the Internet, some download links are often disguised as pointing to malicious files. These malicious files (such as files containing viruses, worms or Trojan horse programs that can perform malicious tasks on the computer system) are downloaded to the user's computer, which may threaten the information security of the network user. [0003] At present, in the static detection method used by most antivirus applications, the attribute information or the contained content of the file to be downloaded is usually extracted first, and then these features are matched according to the pre-trained model to determine whether the file is a malicious file. These methods need to obtain the relevant c...

AI Technical Summary

Problems solved by technology

These methods need to obtain the relevant characteristics of the file first, and for files that do not contain obvious characteristics of malicious files, it is impossible to determine whether they are malicious files, and the identification efficiency is low

Images