A data file detection method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application disclose a data file detection method and device, electronic equipment and storage medium, and relate to the technical field of computer network security, which can solve the problem that the detection logic of a traditional anti-virus manufacturer is limited by the number of layers to skip data file detection, or the data file is infinitely disassembled to fall into a dead loop, affecting the overall detection time and detection efficiency, and causing space waste. The data file detection method comprises obtaining a data file to be detected, disassembling the data file to be detected layer by layer to obtain a plurality of layers of derivative data, judging whether there is a data link cycle in the plurality of layers of derivative data, and if there is a data link cycle, determining that the data file is a malicious file. The present application is applicable to the detection scene of data files with derivative data, and can further improve the detection efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to a data file detection method, device, electronic equipment and storage medium. Background Art

[0002] Due to network bandwidth constraints, data transmission requires encryption, calculation, and packaging to form data files. These data files include, for example, compressed packages generated for social media applications or software application installation packages provided by software application platforms. After users receive these data files, they must undergo algorithmic decryption, calculation, and aggregation to generate new data, which is called derived data. Traditional antivirus vendors typically first disassemble the original data file layer by layer and perform malicious detection on the derived new data. If no maliciousness is found, the decomposition process continues until no new data can be derived or a malicious file is found. However, when malicious concealment and the malicious construction of the same derived data chain create loops, such as duplicate parent-child relationships within a maliciously constructed data chain, where the child data also derives data already existing in the same chain, the detection logic of traditional antivirus vendors either skips data file detection due to layer limitations or continues to decompose the data file indefinitely, falling into an endless loop. This impacts overall detection time and efficiency, and wastes space. Summary of the Invention

[0003] In view of this, an embodiment of the present invention provides a data file detection method, device, electronic device and storage medium to solve the problem that the detection logic of traditional anti-virus vendors either skips the data file detection due to layer restrictions, or infinitely disassembles the data file and falls into an infinite loop, affecting the overall detection time and detection efficiency, and causing space waste.

[0004] In a first aspect, an embodiment of the present invention provides a data file detection method, applied to an electronic device, comprising:

[0005] Obtain the data file to be tested;

[0006] Decomposing the data file to be detected layer by layer to obtain multiple layers of derivative data;

[0007] determining whether a data link loop exists in the multiple layers of derived data;

[0008] If so, it is determined that the data file to be detected is a malicious file.

[0009] According to a specific implementation of an embodiment of the present invention, after obtaining the data file to be detected, the method further includes:

[0010] The data file to be detected is pre-processed to check whether the data file to be detected can generate derivative data, and the pre-processing includes format recognition and shell recognition.

[0011] According to a specific implementation of an embodiment of the present invention, the step of disassembling the data file to be detected layer by layer to obtain multiple layers of derivative data includes:

[0012] At least one of unpacking, splitting and unpacking is performed on the data file to be detected to obtain multiple layers of derivative data.

[0013] According to a specific implementation of an embodiment of the present invention, determining whether a data link loop exists in the multi-layer derived data includes:

[0014] Calculate the hash value of each derived data after disassembly;

[0015] Mark the data chain corresponding to each layer of derived data;

[0016] Determine whether the hash values ​​corresponding to multiple layers of derived data in the same data chain are the same;

[0017] If so, it is determined that the same derivative data exists in the multiple layers of derivative data.

[0018] According to a specific implementation of an embodiment of the present invention, the tag-derived data corresponds to a data chain, including:

[0019] Marking starts from the data file to be detected, marking each layer of derived data and all parent layer data of each layer of derived data.

[0020] In a second aspect, an embodiment of the present invention provides a data file detection device, comprising:

[0021] An acquisition module is used to obtain the data file to be detected;

[0022] A disassembly module, configured to disassemble the data file to be detected layer by layer to obtain multiple layers of derivative data;

[0023] a determination module, configured to determine whether a data link loop exists in the multi-layer derivative data;

[0024] The determination module is configured to determine that the data file to be detected is a malicious file when identical derivative data exists in the multiple layers of derivative data.

[0025] According to a specific implementation of the embodiment of the present invention, the method further includes:

[0026] The preprocessing module is used to preprocess the data file to be detected to check whether the data file to be detected can generate derivative data. The preprocessing includes format recognition and shell recognition.

[0027] According to a specific implementation of the embodiment of the present invention, the method further includes:

[0028] The calculation module is used to calculate the hash value of each derived data after disassembly;

[0029] The marking module is used to mark the data chain corresponding to each layer of derived data;

[0030] The judgment module is further used to judge whether the hash values ​​corresponding to multiple layers of derived data in the same data chain are the same.

[0031] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the data file detection method described in any of the aforementioned implementation methods.

[0032] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data file detection method described in any of the aforementioned implementation methods.

[0033] The embodiments of the present invention provide a data file detection method, device, electronic device and storage medium. By obtaining a data file to be detected, the data file to be detected is disassembled layer by layer to obtain multiple layers of derivative data, and it is determined whether there is a data link loop in the multiple layers of derivative data. If a data link loop exists, the data file is determined to be a malicious file. This method can effectively solve the problems of dead loop detection timeout due to the logic of generating derivative data and space waste due to the continuous generation of derivative data, thereby improving detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 This is a flow chart of a data file detection method according to embodiment 1 of the present invention;

[0036] Figure 2 This is a flow chart of a data file detection method according to embodiment 2 of the present invention;

[0037] Figure 3 This is a functional structure diagram of a data file detection device according to embodiment 1 of the present invention;

[0038] Figure 4 The present invention provides a schematic structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following describes embodiments of the present invention in detail with reference to the accompanying drawings. It should be understood that the embodiments described are only some of the embodiments of the present invention, and not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0040] This embodiment provides a data file detection method to solve the problem that the detection logic of traditional anti-virus vendors either skips the data file detection due to layer restrictions, or infinitely disassembles the data file and falls into an infinite loop, affecting the overall detection time and detection efficiency, and causing space waste.

[0041] Figure 1 FIG. 1 is a flow chart of a data file detection method according to a first embodiment of the present invention. Figure 1 As shown, the data file detection method of this embodiment is applied to electronic equipment.

[0042] The data file detection method of this embodiment may include:

[0043] Step 101: Obtain the data file to be detected;

[0044] Step 102: Decompose the data file to be tested layer by layer to obtain multiple layers of derivative data;

[0045] Step 103: Determine whether there is a data link loop in the multi-layer derivative data;

[0046] In this embodiment, the data link loop in the multi-layer derived data may be a loop in all derived data nodes in the link, or a loop in some derived data nodes in the link.

[0047] Step 104: If yes, determine that the data file is a malicious file.

[0048] When traditional antivirus vendors detect derived data, they typically first disassemble the original data file layer by layer, then perform malicious checks on the derived new data. If no malware is found, the disassembly continues until no new data can be derived or a malicious file is found. However, when malicious data is hidden or loops are created within the same derived data chain—for example, if a maliciously constructed data chain contains duplicate parent-child relationships, and the child data also derives data from pre-existing data within the same chain—traditional antivirus vendors' detection logic either skips the data file due to layer limitations, or continues to disassemble the data file endlessly, falling into an endless loop. This impacts overall detection time and efficiency, and wastes space.

[0049] In this embodiment, by obtaining the data file to be detected, the data file to be detected is disassembled layer by layer to obtain multiple layers of derivative data, and it is determined whether there is a data link loop in the multiple layers of derivative data. If a data link loop exists, the data file is determined to be a malicious file. This can effectively solve the problems of dead loop detection timeout caused by the logic of generating derivative data and space waste caused by continuously generating derivative data, thereby improving detection efficiency.

[0050] Figure 2 This is a flow chart of a data file detection method according to the second embodiment of the present invention. Figure 2 As shown, the data file detection method of this embodiment may include:

[0051] Step 201: Obtain the data file to be detected;

[0052] In this embodiment, there is no limitation on the source of the data file to be detected, and those skilled in the art can select it according to actual needs.

[0053] Step 202: pre-process the data file to be tested to check whether the data file to be tested can generate derivative data. The pre-processing includes but is not limited to format recognition and shell recognition.

[0054] Through preprocessing, it is possible to check as early as possible whether the data file to be tested can generate derivative data, thereby improving detection efficiency.

[0055] Step 203: performing at least one of unpacking, splitting, and unpacking operations on the data file to be detected to obtain multiple layers of derivative data;

[0056] Step 204: Calculate the hash value of each decomposed derivative data;

[0057] Step 205: Mark the data chain corresponding to each layer of derived data;

[0058] In this embodiment, the tag derived data corresponds to a data chain, including:

[0059] Marking starts from the data file to be detected, marking each layer of derived data and all parent layer data of each layer of derived data.

[0060] For example, the data file to be tested is A. After the first layer of disassembly, file B and file C are obtained. The data chain of file B is marked as AB, and the data chain of file C is marked as AC; the second layer of disassembly of file B obtains file D, and the data chain of file D is marked as ABD, and so on.

[0061] Step 206: Determine whether the hash values ​​corresponding to the multiple layers of derived data in the same data chain are the same;

[0062] Step 207: If yes, determine that a data link loop exists in the same data link;

[0063] Step 208: When a data link loop exists in the same data link, the data file to be detected is determined to be a malicious file.

[0064] For example, the data file to be detected is A, and the hash value of A is calculated to be X. After one layer of disassembly, file B is obtained, and the data chain of file B is marked as AB, and the hash value of B is calculated to be Y; the second layer of disassembly of file B obtains file D, and the data chain of file D is marked as ABD, and the hash value of D is calculated to be Z; the third layer of disassembly of file D obtains file E, and the data chain of file E is marked as ABDE, and the hash value of E is calculated to be X, which is the same as the hash value of file A. Therefore, file A is judged to be a malicious file.

[0065] In some embodiments, when the detection result is a malicious file, an engine alarm is issued to prompt the user.

[0066] In this embodiment, while obtaining the derivative data, the hash value of the derivative data is calculated and the source data chain of the derivative data is marked. If duplicate samples appear on the same data chain, that is, the data hash values ​​are the same, it is regarded as a malicious structure, and subsequent detection is stopped. The sample file is regarded as a malicious file. For sample files with derivative data, a detection method for analyzing the repetitiveness of derivative data on the same data chain is added to the existing detection method. This not only improves the detection accuracy and efficiency of such files, but also effectively avoids timeout problems caused by malicious structures, and at the same time saves system space occupied by generating a large amount of duplicate derivative data.

[0067] pass Figure 1 、 Figure 2 The technical solution of the method embodiment shown in the present application is not only applicable to the sample file detection scenario with derivative data, but also can improve the efficiency of data file detection and reduce the occupied space.

[0068] Figure 3 This is a structural diagram of a data file detection device according to a first embodiment of the present invention. Figure 3As shown, the device of this embodiment may include:

[0069] An acquisition module 31 is used to acquire a data file to be detected;

[0070] A disassembly module 32 is used to disassemble the data file to be detected layer by layer to obtain multiple layers of derivative data;

[0071] A determination module 33 is used to determine whether there is a data link loop in the multi-layer derivative data;

[0072] The determination module 34 is configured to determine that a data file is a malicious file when identical derivative data exists in multiple layers of derivative data.

[0073] In some embodiments, the present invention further comprises:

[0074] The preprocessing module 35 is used to preprocess the data file to be detected to check whether the data file to be detected can generate derivative data. The preprocessing includes but is not limited to format recognition and shell recognition.

[0075] A calculation module 36 is used to calculate the hash value of each derived data after disassembly;

[0076] A marking module 37 is used to mark the data chain corresponding to each layer of derived data;

[0077] The judgment module 34 is further configured to judge whether the hash values ​​corresponding to the multiple layers of derived data in the same data chain are the same.

[0078] The device of this embodiment can be used to perform Figure 1 、 Figure 2 The technical solution of the method embodiment shown has similar implementation principles and technical effects, which will not be repeated here.

[0079] Figure 4 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention, which can realize the present invention. Figure 1 、 Figure 2 The process of the embodiment shown is as follows: Figure 4 As shown, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is placed inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program code; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, so as to execute the data file detection method described in any of the above-mentioned embodiments.

[0080] For details on the specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 by running the executable program code, please refer to the present invention. Figure 1 、 Figure 2 The description of the illustrated embodiment will not be repeated here.

[0081] This electronic device exists in many forms, including but not limited to:

[0082] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and are primarily designed to provide voice and data communications. These terminals include smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones.

[0083] (2) Mobile personal computer devices: These devices fall under the category of personal computers and have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0084] (3) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0085] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0086] (5) Other electronic devices with data interaction functions.

[0087] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data file detection method described in any of the aforementioned embodiments.

[0088] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0089] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0090] In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0091] For the convenience of description, the above device is described as being divided into various units / modules based on their functions. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0092] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0093] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A data file detection method, characterized in that: Applied to electronic equipment; the method comprises: Obtain the data file to be tested; Decomposing the data file to be detected layer by layer to obtain multiple layers of derivative data; determining whether a data link loop exists in the multiple layers of derived data; If so, determining that the data file to be detected is a malicious file; The determining whether there is a data link loop in the multiple layers of derivative data includes: calculating a hash value of each decomposed derivative data; Mark the data chain corresponding to each layer of derived data; Determine whether the hash values ​​corresponding to multiple layers of derived data in the same data chain are the same; If so, determine that the same derivative data exists in the multiple layers of derivative data; The tag-derived data corresponds to a data chain, including: Marking starts from the data file to be detected, marking each layer of derived data and all parent layer data of each layer of derived data.

2. The data file detection method according to claim 1, characterized in that: After obtaining the data file to be detected, the method further includes: The data file to be detected is pre-processed to check whether the data file to be detected can generate derivative data, and the pre-processing includes format recognition and shell recognition.

3. The data file detection method according to claim 1, characterized in that: Decomposing the data file to be detected layer by layer to obtain multiple layers of derivative data includes: At least one of unpacking, splitting and unpacking is performed on the data file to be detected to obtain multiple layers of derivative data.

4. A data file detection device, characterized in that: include: An acquisition module is used to obtain the data file to be detected; A disassembly module, configured to disassemble the data file to be detected layer by layer to obtain multiple layers of derivative data; a determination module, configured to determine whether a data link loop exists in the multi-layer derivative data; a determination module, configured to determine that the data file to be detected is a malicious file when identical derivative data exists in the multiple layers of derivative data; It also includes: a calculation module, used to calculate the hash value of each derived data after disassembly; The marking module is used to mark the data chain corresponding to each layer of derived data; The judgment module is further used to judge whether the hash values ​​corresponding to the multiple layers of derived data in the same data chain are the same; The marking module is specifically used to mark the data file to be detected, starting from the data file to be detected, marking each layer of derived data and all parent layer data of each layer of derived data.

5. The data file detection device according to claim 4, characterized in that: Also includes: The preprocessing module is used to preprocess the data file to be detected to check whether the data file to be detected can generate derivative data. The preprocessing includes format recognition and shell recognition.

6. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, and is used to execute the data file detection method described in any one of claims 1 to 3 above.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the data file detection method according to any one of claims 1 to 3.

Images