Feature acquisition method for file virus detection and file virus detection method

Abstract

The present invention provides a feature acquisition method for file virus detection and a file virus detection method. The feature acquisition method for file virus detection includes: extracting multiple first sub-features at a set position of a sample file, the multiple A first sub-feature forms a first feature vector; according to the position information of a plurality of second sub-features, the plurality of first sub-features are recombined to obtain a second feature vector; if not found in the first feature library For the sub-features included in the second feature vector, add the second feature vector as the identification feature of the sample file into the second feature library. Obtain the file feature by the feature acquisition method of file virus detection, if the file feature is not in the first feature library, then add the file feature as the identification feature of the file into the second feature library, realize the continuous update of the second feature library, avoid Unknown files are falsely reported, reducing the false positive rate of files.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a feature acquisition method for file virus detection and a file virus detection method and device. Background technique [0002] With the rapid development and popularization of computer technology, a large number of malicious files (viruses) also breed thereupon, thereby seriously affecting the safe application of computer technology and causing serious computer security risks. At present, the detection of malicious files and the reduction of false positives for non-malicious files mostly use the MD5 whitelist technology. This technology generates an MD5 value for each non-malicious file as an identifier, and prevents the engine from detecting the files in the whitelist through this identifier. The file makes malicious file virus detection results, so as to achieve the purpose of reducing false positives. The inventors found that because the MD5 whitelist compares the...

AI Technical Summary

Problems solved by technology

The inventors found that because the MD5 whitelist compares the files with the identifier one-to-one, it cannot identify a batch of similar files by the same feature. With the diversification of file features, the MD5 whitelist is bloated and huge. The MD5 whitelist cannot include the identification of all files, so it is impossible to prevent unknown files from being falsely reported

Images