Sample correlation detection method and system and electronic equipment

Abstract

The invention provides a sample correlation detection method and system and electronic equipment. The method comprises the following steps: acquiring a sample set, calculating the characteristics and correlation degree of the sample set in each dimension, taking the samples and sample characteristics as nodes, and surrounding connecting lines of samples with the correlation degree and the nodes to construct a correlation network diagram; and acquiring characteristics of to-be-detected samples, embedding the characteristics of the to-be-detected samples into the correlation network diagram, calculating a product of correlation degree values of the to-be-detected samples in a novel correlation network diagram and samples on each connecting line, and outputting the samples on corresponding connecting lines if the product is greater than a second preset value. According to the method disclosed by the invention, more information can be judged by utilizing codes and sample attributes, the correlation is more accurate, and the instructiveness is higher. The samples with correlation can be effectively output, and the method can be widely applied to the fields of malicious code detection, malicious code analysis and the like.

Description

[0001] Cross References to Related Applications [0002] This application claims the priority of the Chinese patent application number "201511015286.1" submitted by Wuhan Antiy Information Technology Co., Ltd. on December 31, 2015, the title of the invention is "a sample correlation detection method and system based on tag propagation". right. technical field [0003] The present invention relates to the field of information technology, in particular to a sample correlation detection method, system and electronic equipment. Background technique [0004] At present, the detection of sample relevance is mostly analyzed at the code level, but the heuristic at the code level is more effective in scenarios with functional or code development homology. , with the increase of advanced targeted threats, more and more malicious codes deliberately adopt targeted development strategies to avoid correlation detection at the code level in order to better bypass detection and countermeas...

AI Technical Summary

Problems solved by technology

Through a lot of analysis of existing technologies, we found that although malicious codes are developed in different ways, external deception techniques, camouflage techniques, and behavioral aspects of non-code features or human-perceivable parts are well correlated Therefore, it is necessary to study a new sample correlation detection technology to improve the deficiencies of existing technologies

Images