Identification method and system of malicious sample type on the basis of characteristics

Abstract

The invention belongs to the field of the information security technology, and particularly relates to an identification method and system of a malicious sample type on the basis of characteristics. The method comprises the following steps: firstly, identifying the format of a sample to identity a PE (Portable Executable) sample, an OFFICE document sample or an EML (Equal Matrix Language) mail sample; then, extracting the homology characteristics of the sample, comparing the homology characteristics with a homology characteristic library, and if characteristics are matched, updating the MD5 (Message Digest 5) value of the sample to the homology characteristic library; and if the characteristics are not matched, after the characteristics of the sample and the MD5 value are subjected to whitelist filtering, adding the characteristics and the MD5 value of the sample into the homology characteristic library. The method prevents the samples from being isolated, and the samples have the homology. In addition, after the samples have the homology, the common attack event of the samples with the homologous attribute can be conveniently found. Meanwhile, homology characteristic analysis assists in detecting unknown malicious codes.

Description

Technical field [0001] The invention belongs to the technical field of information security, and specifically relates to a method and system for identifying malicious sample types based on characteristics. Background technique [0002] With the rapid development of information technology, the amount of computer malicious code captured is increasing, and there are more and more targeted and organized attacks. At present, security vendors only use virus names to mark malicious code, but samples are all Without specific classification, it is impossible to judge the relationship between the samples, resulting in each sample being only a single data without forming a horizontal correlation. Summary of the invention [0003] In order to solve the above problems, the present invention discloses a method for identifying the type of malicious samples based on characteristics. The method makes the samples no longer isolated and has the same homology attribute. [0004] The purpose of the pre...

AI Technical Summary

Problems solved by technology

[0002] With the rapid development of information technology, more and more computer malicious codes are captured, and there are more and more targeted and organized attacks. At present, all security vendors only use virus names to mark malicious codes, but the samples are all Without specific classification, it is impossible to judge the relationship between samples, resulting in each sample being only a single data, without forming a horizontal correlation

Images