Malicious script detection method and device and storage medium

Abstract

Embodiments of the invention disclose a malicious script detection method and device, and a storage medium. The method comprises the step: obtaining a to-be-detected file; performing text recognitionon the to-be-detected file to obtain a to-be-detected text; detecting whether the to-be-detected text has at least one specific behavior feature or not; if the at least one specific behavior characteristic exists, carrying out association rule mining processing on the at least one specific behavior characteristic, wherein an association behavior characteristic combination meeting preset conditionsis determined, and the preset conditions are the minimum support degree and the minimum credibility of the behavior characteristic combination; obtaining a scoring result corresponding to the associated behavior feature combination; judging whether the to-be-detected file is a malicious script or not based on the scoring result. According to the method, text recognition is carried out on the to-be-detected file, the behavior that a malicious script falsifies a suffix is eradicated, association analysis is carried out on the behavior characteristics of the to-be-detected file, judgment of themalicious script has better interpretability, and the technical effect of false alarm is reduced.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a malicious script detection method, device and storage medium. Background technique [0002] As the current anti-virus technology matures, traditional PE viruses are increasingly difficult to penetrate into the host network, and are often blocked by gateway security devices such as AF and WAF. Therefore, more and more network attacks begin to use malicious scripts to bypass (bypass), because most security products do not have the ability to detect plain text files, and often adopt a release strategy to achieve the goal of invading user hosts. Effect. [0003] The existing technology mainly adopts the following methods to prevent such attacks: [0004] 1. Deploy firewalls, virus gateways, sandboxes and other devices at the network egress to monitor and kill incoming traffic. [0005] 2. Install anti-virus software on the terminal machine for overall monitoring and kil...

AI Technical Summary

Problems solved by technology

[0008] 2. Most malicious scripts have forged suffixes, which makes it difficult to identify file formats, and sandboxes and other devices cannot effectively identify them

[0009] 3. Most downloader malicious scripts will pull Internet viruses and execute them in memory, and the virus parent will not be saved on the victim's disk, so even if anti-virus software is installed, it cannot be detected and killed correctly (that is, a typical fileless attack)

Images