Malware family identification method and device and electronic equipment

Abstract

The invention provides a malware family identification method and device and electronic equipment, and the method comprises the steps: carrying out the perception Hash processing of a binary program to be identified, and obtaining a plurality of perceptible Hash character strings, wherein the perceptual hash processing comprises dynamic sandbox operation, gray level image conversion and discrete cosine transformation; searching and matching each malicious software family in the malicious software database by taking each perceptible Hash character string as a search word to obtain a matching degree between each malicious software family and the binary program, wherein each malicious software family comprises a plurality of perceptible hash word string sequences obtained through perceptive hash processing; and taking the name of the malware family corresponding to the maximum matching degree in the matching degrees exceeding the preset matching degree threshold value as an identificationresult corresponding to the binary program. According to the invention, when the dynamic malware detection engine detects malware, the accurate name of the malware family to which the malware belongscan be given.

Description

technical field [0001] The present invention relates to the technical field of malware identification, in particular to a malware family identification method, device and electronic equipment. Background technique [0002] When the existing static antivirus software detects malware, it usually only detects a certain software as malware, prompts that there is a risk of virus intrusion or deletes it directly. Virus Scanner gives real accurate malware family names. Contents of the invention [0003] The object of the present invention is to provide a malware family identification method, device and electronic equipment, which can enable the dynamic malware detection engine to give the accurate name of the malware family to which the malware belongs when detecting malware. [0004] The present invention provides a kind of malicious software family identification method, and described method is applied to ES search server, and described method comprises: [0005] Obtain the b...

AI Technical Summary

Problems solved by technology

[0002] When the existing static antivirus software detects malware, it usually only detects a certain software as malware, pr

Images