Malicious code query method and system

Abstract

The invention discloses a malicious code query method and system, and the method comprises the following steps: carrying out the word segmentation of a to-be-detected sample, so as to obtain a word segmentation result of the to-be-detected sample; searching a preset data set for a similar set matched with the word segmentation results of the sample to be detected, the preset data set storing a plurality of word segmentation results in one-to-one correspondence with the plurality of malicious samples; comparing the fuzzy hash value of the sample to be detected with the fuzzy hash value of eachmalicious sample in the queried similar set; and when the similarity is greater than a preset threshold value, determining that the malicious sample in the similarity set is a malicious sample similarto the to-be-detected sample. According to the method, the word segmentation result of the sample to be detected is matched to obtain the similar set, so that the query time is effectively shortened,the calculation is simplified, and the query efficiency and applicability of malicious codes are effectively improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious code query method and system. Background technique [0002] Related technologies realize malicious code query by matching and comparing hash values ​​in massive data. [0003] However, once the amount of data is too large, the fuzzy hash value algorithm of the related technology will have the problems of long time consumption and cumbersome calculation, resulting in low detection efficiency, which is not suitable for large-scale calculation comparison. In the era, the fuzzy hash algorithm of related technologies has limited improvement space and poor applicability. Contents of the invention [0004] The present invention aims to solve one of the technical problems in the related art at least to a certain extent. [0005] Therefore, an object of the present invention is to propose a malicious code query method, which effectively shortens the query time, si...

AI Technical Summary

Problems solved by technology

[0003] However, once the amount of data is too large, the fuzzy hash value algorithm of the related technology will have the problems of long time consumption and cumbersome calculation, resulting in low detection efficiency, which is not suitable for large-scale calculation comparison. In the current era, the fuzzy hash algorithm of related technologies has limited improvement space and poor applicability

Images