Malicious file detection method and device and storage medium

Abstract

The malicious file detection method comprises the steps of enabling detection equipment to run a test file in a virtual running environment to obtain running data of the test file, wherein the running data comprises incremental memory data or parameter data, the incremental memory data is data stored in a memory space applied by the test file in the running process, the parameter data comprises data corresponding to each parameter in a first calling parameter set, and the first calling parameter set comprises parameters adopted when the test file calls the target function for one or more times in the running process; and performing static detection on at least one reconstruction file generated according to the running data, and judging whether the test file is a malicious file or not according to a static detection result. According to the technical scheme, the reconstruction file is generated based on the operation data of the test file in the virtual operation environment, whether the test file is the malicious file or not is judged based on the static detection result of the reconstruction file, and therefore the problem that the detection effect on the confused malicious file is poor is effectively solved.

Description

technical field [0001] The invention relates to the technical field of computers, in particular to a method, device and storage medium for detecting malicious files. Background technique [0002] A malicious file refers to a file containing a program written by a program designer for the purpose of attacking. A malicious file is usually an executable file, such as a virus, worm, or Trojan horse program that performs malicious tasks on a computer system. Malicious files exploit computer system vulnerabilities to perform malicious tasks such as steal confidential information, destroy stored data, etc. Static detection technology is a common technology for detecting malicious files. Static detection technology refers to the method of program analysis without running the computer program. Static detection technology performs feature matching on the test file based on the feature library, such as analyzing the source code, assembly, syntax, structure, process or interface of th...

AI Technical Summary

Problems solved by technology

[0004] The embodiment of the present application provides a detection method for malicious files, which can solve the problem that the traditional static detection method cannot effectively detect packed and encrypted files

Images