File type identification method and server

Abstract

The invention provides a file type identification method and a server. The method comprises the following steps that: dividing a training sample into a training sample for at least one type of viruses and a training sample for normal files; carrying out feature extraction on the training sample to independently obtain the feature set of each training sample; utilizing the feature set of each training sample to determine the feature information library of each type of viruses in at least one type of viruses, and determining the feature information library of the normal files; and on the basis of the feature information library of each type of viruses and the feature information library of the normal files, determining a classification model used for identifying the at least one type of viruses and the normal files.

Description

technical field [0001] The invention relates to information identification technology in the field of information processing, in particular to a file type identification method and server. Background technique [0002] The existing technical solutions for detecting virus files are as follows: analysts analyze virus files, extract virus signatures, store virus signatures into the database, antivirus engines scan existing files according to the virus database, and report viruses if they encounter matching signatures. However, the above-mentioned processing method mainly relies on manually extracting signatures and formulating corresponding identification rules. This detection method requires virus analysts to manually analyze existing samples to find out the corresponding characteristics, which heavily depends on the ability of virus analysts. Therefore, a large number of experienced personnel are needed to meet the needs of solving the problem. Due to the complexity of the te...

AI Technical Summary

Problems solved by technology

However, the above-mentioned processing methods mainly rely on manual extraction of signatures and formulating corresponding identification rules. This detection method requires virus analysts to manually analyze existing samples to find out the corresponding characteristics, which heavily depends on the ability of virus analysts. Therefore, a large number of experienced personnel are required to meet the needs of solving problems. Due to the complexity of the technology, the identification efficiency is relatively low

Moreover, the use of artificially summarized signatures can generally only deal with known viruses, and cannot prevent possible problems, so it has a certain lag

[0003] At present, in the existing technology, there are also machine learning methods to classify samples, but such schemes only divide training samples into virus and non-virus. On the one hand, due to the diversity and uneven distribution of viruses, this The model trained by a machine classification method that only distinguishes between viruses and non-viruses is not highly targeted, resulting in low accuracy, and it is easy to lose some characteristics of niche viruses, resulting in many false positives. On the other hand, the granularity of recognition can only be It is virus / non-virus, but not precise to the type of virus

Images