Virus sample clustering method and device, electronic equipment and storage medium

Abstract

The invention discloses a virus sample clustering method, a virus sample clustering device, electronic equipment and a storage medium, which are used for clustering attacked viruses so as to process the attacked viruses and improve the safety. The clustering method comprises the following steps: acquiring behavior characteristics of a virus sample to be clustered; on the basis of a preset reference behavior feature set, generating a behavior identification group for the behavior features of the virus sample, wherein each reference behavior feature in the preset reference behavior feature set has a unique behavior identification; based on the behavior identification group of the virus sample, generating a group characteristic value for indicating a virus family to which the virus sample belongs; based on the group characteristic value of the virus sample, generating a family characteristic value used for indicating a virus family to which the virus sample belongs, each virus family comprising at least one virus family; and clustering the virus samples based on the group feature values and the ethnic group feature values of the virus samples.

Description

technical field [0001] The present disclosure relates to the field of computer technology, and more particularly, to a clustering method, apparatus, electronic device and storage medium for virus samples. Background technique [0002] With the rise of the Internet era, the types and quantities of computer viruses have exploded. Security vendors receive thousands of virus samples every day. In order to deal with the security threats brought by these virus samples as soon as possible, security vendors need to quickly and accurately extract commonalities from these virus samples and family them, so as to provide virus families as a unit. solution. One of the existing solutions is a virus family clustering method based on relational data, which finds the same virus samples through the association between nodes, that is, virus samples belonging to the same virus family, for example, if different virus samples access a common IP or domain name. , it is considered that these diff...

AI Technical Summary

Problems solved by technology

However, this situation is easy to generate interference data. For example, when a browser visits a virus domain name, the browser program will be divided into a certain virus family, resulting in inaccurate or unstable clustering results.

Images