Script virus detection method and system, electronic equipment and storage medium

Abstract

The invention discloses a script virus detection method and a system, electronic equipment and a readable storage medium. The method comprises the steps of obtaining a to-be-detected script file; performing lexical analysis on an execution statement in the to-be-detected script file to obtain a target word sequence string; querying whether a virus record matched with the target word sequence string exists in a script virus feature library or not; wherein the script virus feature library is used for storing word sequence strings of known script virus file function calling features; and if the virus record matched with the target word sequence string is queried, judging the script file to be detected as a script virus file. According to the method, the lightweight virus feature library stored in a sequence string form is constructed according to the function call features, so that the maintenance cost of the virus library is effectively reduced, a character string matching mode is not adopted any more during virus detection, the function call features in the file are mainly extracted, the false alarm rate of viruses is reduced, and the efficiency of an antivirus engine is improved.

Description

Technical field[0001]This application relates to the field of computer technology, and more specifically, to a script virus detection method and system, an electronic device, and a computer-readable storage medium.Background technique[0002]Script language is a computer programming language created to shorten the traditional compile-compile-link-run process. Early scripting languages ​​are often called batch processing languages ​​or job control languages. The script language has simple grammar and lexical rules with clear delimiters.[0003]Script virus is a computer virus designed mainly by script language. Due to the ease of use of scripting languages, and script files occupy an important position in current application systems, especially Internet applications, script viruses have gradually become the most harmful and widespread network virus among Internet viruses, especially when they are combined with some traditional Internet viruses. When malignant viruses such as CIH are comb...

AI Technical Summary

Problems solved by technology

However, this method needs to manually remove the interference of irrelevant factors in the file, and if matching a large text file, it often requires a large time and space cost

In addition, because the string matching method cannot effectively eliminate the interference of factors such as upper and lower case in the string and variable name replacement, if the same type of virus adopts the operation of modifying the string case and changing the variable name, it will cause false positives. For the same type of virus The variant recognition ability of

In order to reduce the rate of false positives, it is necessary to increase the characteristic string records of false negative files in the virus database. For virus types with a large number of variants, the records cannot be effectively merged, resulting in a rapid increase in the number of virus database records, which increases the maintenance of the virus database. costs while reducing the efficiency of antivirus engines

Images