Malicious file detection method, system and device and readable storage medium

Abstract

The invention discloses a malicious file detection method. The method comprises the steps: matching static parameters with a local threat information library; judging whether the to-be-detected file is a malicious file or not; if not, making the to-be-detected file to run in the sandbox, and obtaining dynamic parameters generated in the running process; and matching the dynamic parameters with alocal threat information library, and judging whether the to-be-detected file is a malicious file or not according to an obtained second matching result. According to the method, the to-be-detected file runs in the sandbox; as long as the to-be-detected file generates suspicious dynamic parameters in the running process, the to-be-detected file is marked as a malicious file, the problem that in the prior art, an unknown and newly-occurring malicious file cannot be defended immediately is solved, the missing report rate of malicious file detection is reduced, and the timeliness of network defense is improved. The invention furthermore provides a malicious file detection system and device, and a readable storage medium, which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of malicious file detection, in particular to a method, system, device and readable storage medium for malicious file detection. Background technique [0002] With the continuous growth of new threats and attacks such as targeted threat attacks, malicious mining, and ransomware viruses, network threats are rapidly evolving viciously, and the diversification of attack methods and attack channels poses more challenges to the analysis and processing capabilities of network security personnel. high demands. In the process of preventing external attacks, enterprises and organizations increasingly need to rely on sufficient, efficient, and accurate security threat intelligence as a support to help them better discover and respond to these new threats. [0003] At present, there are roughly two methods of malicious file detection: one is a static detection method based on a virus signature database, and the other ...

AI Technical Summary

Problems solved by technology

[0003] At present, there are roughly two methods of malicious file detection: one is a static detection method based on a virus signature database, and the other is a detection method that uses a sandbox to run a file and analyze the dynamic behavior of the file during operation. However, the two methods Unable to immediately defend against unknown and emerging malicious files, resulting in a high rate of false positives in malicious file detection

Images