Abnormal file restoration method, device and equipment, and storage medium

Abstract

The invention discloses an abnormal file restoration method, device and equipment and a storage medium, and the method comprises the steps: obtaining the file structure information corresponding to a to-be-detected file, and searching a preset abnormal rule library for whether there is a target abnormal rule matched with the file structure information or not; and when the target exception rule exists, judging that the to-be-detected file is an exception file, obtaining a file repair algorithm corresponding to the target exception rule, and repairing the to-be-detected file according to the file repair algorithm. Compared with the existing mode of identifying or detecting the abnormal file through the feature code and repairing the file by searching the corresponding health file or the address information of the health file in the file database, the method, device and equipment have the advantages that whether the to-be-detected file triggers the abnormal rule or not is judged through the file structure information, and if yes, the to-be-detected file is judged to be abnormal; and the corresponding file repair algorithm is obtained according to the triggered exception rule to repair the file, so that the accuracy of exception identification is ensured, and the file repair rate is also improved.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method, device, equipment and storage medium for repairing abnormal files. Background technique [0002] Security analysis engineers use analysis tools to process some unknown files in their daily work, while some malware authors use analysis tools to analyze the logic of samples, intentionally modify files to create some exceptions, and cause analysis tools to fail to parse files, which makes analysts easy to misunderstand. Judging the file as an invalid file will seriously affect the efficiency and accuracy of analysts in judging unknown samples. [0003] At present, the mainstream abnormal file detection technology is mainly to identify through the abnormal feature code. That is, by collecting a batch of known abnormal files, classifying them, and extracting abnormal feature codes. Query and match the data of the target file in the signature database to determine whether...

AI Technical Summary

Problems solved by technology

[0005] The main purpose of the present invention is to provide a method, device, equipment and storage medium for repairing abnormal files, aiming to solve the problem of low adaptability and flexibility of detection and heavy reliance on abnormal files when detecting and repairing abnormal files in the prior art. Breadth of signature database, while technical issues with low fix rate

Images