File detection method and device, nonvolatile storage medium and processor

Abstract

The application discloses a file detection method and device, a nonvolatile storage medium and a processor. The method comprises the following steps: acquiring an update file set in a preset time period, wherein the update file set comprises a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by performing a binning operation on files in the update file set, and each to-be-detected box comprises update files in a preset time length range; identifying a file update amount of each to-be-detected box, and determining a box score of each to-be-detected box; extracting to-be-detected files from each to-be-detected box according to a preset extraction ratio to perform abnormality detection, and determining an abnormal file quantity of each to-be-detected box; and determining an abnormal box based on the box score and the abnormal file quantity of each to-be-detected box, wherein the update files recorded in the abnormal box are abnormal files. The application solves the technical problem that a conventional detection method cannot quickly and accurately detect and identify abnormal files.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security, in particular to a file detection method and device, a nonvolatile storage medium and a processor. BACKGROUND

[0002] In recent years, with the development of computer technology and the wide application of intelligent terminals and Internet technology, "paperless" has penetrated into every corner of various industries, and more and more files are stored on personal terminals, enterprise servers and other devices. How to ensure the security of stored files has always been a concern for enterprises. Currently, various forms of malicious software such as ransomware, Trojan horses, viruses and malicious mining programs are constantly emerging. In order to evade detection, malicious software authors use methods such as shell, variant, polymorphism, etc., which bring high challenge to the accuracy of detection and identification. Attackers use various means to put abnormal malicious files into enterprise or personal terminals and other devices, thereby further penetrating the devices to achieve their own purposes.

[0003] The general method also monitors the file update amount under the specified directory, and alarms if the file update amount exceeds the preset threshold. Although this method improves efficiency, it reduces accuracy and increases false positives to some extent.

[0004] In the traditional method, the specified directory is monitored, and files with updates or new files are put into the detection queue. The file content is detected by feature code or sandbox technology, and an alarm is given if the file is abnormal. However, the file update amount may be large at times, and checking the content one by one is inefficient and costly. At the same time, attackers generally use methods such as variant and shell to avoid detection, so the traditional method has low efficiency and accuracy in identifying abnormal files.

[0005] In view of the problem that the above-mentioned traditional detection method cannot quickly and accurately detect and identify abnormal files, no effective solution has been proposed so far.

[0006] SUMMARY

[0007] The embodiments of the present application provide a file detection method and device, a nonvolatile storage medium and a processor to at least solve the technical problem that the traditional detection method cannot quickly and accurately detect and identify abnormal files.

[0008] According to an aspect of the embodiments of the present application, a file detection method is provided, including: obtaining an update file set in a preset time period, wherein the update file set includes a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by binning operation on files in the update file set, and each to-be-detected box includes update files in a preset time length range; identifying a file update amount of each to-be-detected box, and determining a box score of each to-be-detected box, wherein the file update amount is used to represent a number of the update files recorded in each to-be-detected box, and the box score is determined by the file update amount; extracting to-be-detected files from each to-be-detected box according to a preset extraction ratio for abnormality detection, and determining an abnormal file number of each to-be-detected box, wherein the preset extraction ratio is determined according to the box score; and determining an abnormal box based on the box score and the abnormal file number of each to-be-detected box, wherein update files recorded in the abnormal box are the abnormal files.

[0009] Optionally, obtaining the update file set in the preset time period includes: obtaining a first data set of the preset time period and a second data set of a historical time period, wherein the historical time period is a previous period of the preset time period, the first data set is a file created in the preset time period, and the second data set is a file created in the historical time period; binning the first data set according to the preset time length to determine a first box set, wherein the first box set includes a plurality of first binning boxes obtained by binning the first data set; binning the second data set according to the preset time length to determine a second box set, wherein the second box set includes a plurality of second binning boxes obtained by binning the second data set; comparing differences between the first binning boxes and the second binning boxes one by one to determine a difference file that exists in the first binning boxes and does not exist in the second binning boxes; and determining the difference file in the preset time period as the update file set.

[0010] Optionally, the file update amount of each of the to-be-detected file boxes is identified, and determining the box score of each of the to-be-detected file boxes comprises: identifying the file update amount of each of the to-be-detected file boxes in the preset time period; determining the total file update amount of each of the to-be-detected file boxes in the preset time period and a historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update amount is the sum of the file update amount of the to-be-detected file box in the preset time period and the file update amount of the to-be-detected file box in the historical time period; determining the ratio of the file update amount to the total file update amount of each of the to-be-detected file boxes as an update ratio; determining the average update ratio of a plurality of the to-be-detected file boxes in the preset time period, wherein the average update ratio is the average of the update ratios of the plurality of the to-be-detected file boxes in the preset time period; determining the average update amount of a plurality of the to-be-detected file boxes in the preset time period, wherein the average update amount is the average of the file update amounts of the plurality of the to-be-detected file boxes in the preset time period; determining the product of the update ratio and the file update amount of each of the to-be-detected file boxes as a first parameter; determining the product of the average update ratio and the average update amount as a second parameter; determining the sum of the file update amount and the average update amount of each of the to-be-detected file boxes as a third parameter; and determining the box score according to the sum of the first parameter and the second parameter and the ratio of the third parameter.

[0011] Optionally, the to-be-detected files are extracted from each of the to-be-detected file boxes according to a preset extraction ratio for abnormality detection, and determining the number of abnormal files of each of the to-be-detected file boxes comprises: determining the preset extraction ratio according to the box score of each of the to-be-detected file boxes; extracting the update files from the to-be-detected file boxes as the to-be-detected files according to the preset extraction ratio; performing abnormality detection on the to-be-detected files to determine abnormal files; and counting the number of the extracted abnormal files in each of the to-be-detected file boxes to obtain the number of abnormal files.

[0012] Optionally, determining the preset extraction ratio according to the box score of each of the to-be-detected file boxes comprises: determining whether the box score of each of the to-be-detected file boxes is higher than a first score threshold; in the case that the box score is higher than the first score threshold, determining the preset extraction ratio as a first extraction ratio; in the case that the box score is not higher than the first score threshold, determining whether the box score is higher than a second score threshold, wherein the second score threshold is lower than the first score threshold; in the case that the box score is higher than the second score threshold, determining the preset extraction ratio as a second extraction ratio, wherein the second extraction ratio is higher than the first extraction ratio; and in the case that the box score is not higher than the second score threshold, determining the preset extraction ratio as a third extraction ratio, wherein the third extraction ratio is higher than the second extraction ratio.

[0013] Optionally, the abnormal detection on the to-be-detected files comprises: reading byte entropy of each to-be-detected file; generating a feature set of each to-be-detected file based on the byte entropy; and determining whether the to-be-detected file is the abnormal file based on the feature set.

[0014] Optionally, the determination of the abnormal box based on the box score and the number of abnormal files of each to-be-detected box comprises: determining that the to-be-detected box with the box score greater than a first score threshold is the abnormal box; and determining that the to-be-detected box with the box score greater than a second score threshold and the proportion of the number of abnormal files higher than a preset proportion threshold is the abnormal box, wherein the second score threshold is lower than the first score threshold.

[0015] According to another aspect of the embodiments of the present application, a file detection device is further provided, comprising: an acquisition module configured to acquire an updated file set in a preset time period, wherein the updated file set comprises a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by performing a binning operation on files in the updated file set, and each to-be-detected box comprises updated files in a preset time length range; a first determination module configured to identify a file update amount of each to-be-detected box and determine a box score of each to-be-detected box, wherein the file update amount is used to represent the number of updated files recorded in each to-be-detected box, and the box score is determined by the file update amount; a second determination module configured to perform abnormal detection on to-be-detected files extracted from each to-be-detected box according to a preset extraction proportion to determine a number of abnormal files of each to-be-detected box, wherein the preset extraction proportion is determined according to the box score; and a third determination module configured to determine an abnormal box based on the box score and the number of abnormal files of each to-be-detected box, wherein the updated files recorded in the abnormal box are the abnormal files.

[0016] According to another aspect of the embodiments of the present application, a non-volatile storage medium is further provided, wherein the non-volatile storage medium stores a program, and the non-volatile storage medium controls a device in which the non-volatile storage medium is located to perform the file detection method when the program runs.

[0017] According to another aspect of the embodiments of the present application, a processor is further provided, wherein the processor is used to run a program, and the processor performs the file detection method when the program runs.

[0018] In the embodiment of the present application, a set of update files in a preset time period is acquired, wherein the set of update files includes a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by a binning operation on files in the set of update files, and each to-be-detected box includes update files in a preset time length range; a file update amount of each to-be-detected box is identified, a box score of each to-be-detected box is determined, wherein the file update amount is used to represent the number of update files recorded in each to-be-detected box, and the box score is determined by the file update amount; to-be-detected files are extracted from each to-be-detected box according to a preset extraction ratio for abnormality detection, and an abnormal file number of each to-be-detected box is determined, wherein the preset extraction ratio is determined according to the box score; and an abnormal box is determined based on the box score and the abnormal file number of each to-be-detected box, wherein the update files recorded in the abnormal box are abnormal files, so that by binning the set of update files, the plurality of to-be-detected boxes are determined, and the abnormal box is selected from the plurality of to-be-detected boxes, it is determined that all the update files in the to-be-detected box belong to abnormal files, the number of files subjected to abnormality inspection can be reduced, the detection efficiency is improved, and the accuracy of the detection result can be ensured, thereby achieving the technical effects of improving the abnormal file detection efficiency and ensuring the accuracy of the detection result, and further solving the technical problem that the traditional detection means cannot quickly and accurately detect and identify abnormal files. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are included to provide a further understanding of the present application, constitute a part of the present application and illustrate the illustrative embodiments of the present application and their description serve to explain the present application, but do not constitute improper limitations on the present application. In the drawings:

[0020] Figure 1 is a flowchart of a file detection method according to an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of an abnormal file detection scheme based on a binning technique and information entropy according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of a file detection device according to an embodiment of the present application;

[0023] Figure 4 is a structural block diagram of a computer terminal according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the personnel in the technical field better understand the scheme of the present application, the technical scheme in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the person skilled in the art without creative labor should belong to the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0026] According to an embodiment of the present application, a file detection method embodiment is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0027] Figure 1 is a flowchart of a file detection method according to an embodiment of the present application, as shown in Figure 1 the method comprises the following steps:

[0028] Step S102, acquiring an updated file set within a preset time period, wherein the updated file set includes a plurality of to-be-detected bins, the plurality of to-be-detected bins are obtained by binning operation on files in the updated file set, and each to-be-detected bin includes updated files of a preset time length range;

[0029] Step S104, identifying the file update amount of each to-be-detected bin and determining the bin score of each to-be-detected bin, wherein the file update amount is used to represent the number of updated files recorded in each to-be-detected bin, and the bin score is determined by the file update amount;

[0030] Step S106, extracting to-be-detected files from each to-be-detected bin according to a preset extraction ratio for abnormality detection, and determining the number of abnormal files in each to-be-detected bin, wherein the preset extraction ratio is determined according to the bin score.

[0031] In step S108, an abnormal box is determined based on the box score and the number of abnormal files of each to-be-detected box, wherein the update files recorded in the abnormal box are abnormal files.

[0032] In the above embodiments of the present application, the update file set in a preset time period is obtained, wherein the update file set includes a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by performing a binning operation on the files in the update file set, and each to-be-detected box includes update files in a preset time length range; the file update amount of each to-be-detected box is identified, and the box score of each to-be-detected box is determined, wherein the file update amount is used to represent the number of update files recorded in each to-be-detected box, and the box score is determined by the file update amount; to-be-detected files are extracted from each to-be-detected box according to a preset extraction ratio for abnormal detection, and the number of abnormal files of each to-be-detected box is determined, wherein the preset extraction ratio is determined according to the box score; and an abnormal box is determined based on the box score and the number of abnormal files of each to-be-detected box, wherein the update files recorded in the abnormal box are abnormal files. Thus, by performing binning on the update file set, a plurality of to-be-detected boxes are determined, and an abnormal box is selected from the plurality of to-be-detected boxes, so that it is determined that all update files in the to-be-detected box belong to abnormal files, the number of files subjected to abnormality detection can be reduced, the detection efficiency is improved, and the accuracy of the detection result can be ensured, thereby achieving the technical effects of improving the abnormal file detection efficiency and ensuring the accuracy of the detection result, and further solving the technical problem that the conventional detection means cannot quickly and accurately detect and identify abnormal files.

[0033] In the above step S104, the greater the file update amount, the higher the box score.

[0034] In the above step S106, the higher the box score, the higher the preset extraction ratio.

[0035] In the above step S108, in a case where the to-be-detected box is determined to be an abnormal box, the update files in the abnormal box are all identified as abnormal files; and in a case where the to-be-detected box cannot be determined to be an abnormal box, the update files in the to-be-detected box need to be subjected to abnormal detection one by one.

[0036] As an optional embodiment, the acquiring the update file set in the preset time period comprises: acquiring a first data set of the preset time period and a second data set of a historical time period, wherein the historical time period is a previous period of the preset time period, the first data set is a file created in the preset time period, and the second data set is a file created in the historical time period; binning the first data set according to a preset time length to determine a first bin set, wherein the first bin set comprises a plurality of first binned bins obtained by binning the first data set; binning the second data set according to the preset time length to determine a second bin set, wherein the second bin set comprises a plurality of second binned bins obtained by binning the second data set; comparing the first binned bins and the second binned bins one by one to determine a file that exists in the first bin and does not exist in the second binned bin as a difference file; and determining the difference file in the preset time period as the update file set.

[0037] In the above embodiment of the application, the update file refers to a file that exists in the preset time period and does not exist in the previous historical time period of the preset time period. By comparing the first data set of the preset time period and the second data set of the historical time period after binning, the update file of each to-be-detected bin can be determined, and then the update files of the plurality of to-be-detected bins in the preset time period are the update file set, so that the determination and binning of the update file set are realized.

[0038] As an optional embodiment, the identifying the file update amount of each to-be-detected bin and determining the bin score of each to-be-detected bin comprises: identifying the file update amount of each to-be-detected bin in the preset time period; determining the total file update amount of each to-be-detected bin in the preset time period and the historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update amount is the sum of the file update amount of the same to-be-detected bin in the preset time period and the file update amount in the historical time period; determining the ratio of the file update amount to the total file update amount of each to-be-detected bin as an update ratio; determining the average update ratio of the plurality of to-be-detected bins in the preset time period, wherein the average update ratio is the average of the update ratios of the plurality of to-be-detected bins in the preset time period; determining the average update amount of the plurality of to-be-detected bins in the preset time period, wherein the average update amount is the average of the file update amounts of the plurality of to-be-detected bins in the preset time period; determining the product of the update ratio and the file update amount of each to-be-detected bin as a first parameter; determining the product of the average update ratio and the average update amount as a second parameter; determining the sum of the file update amount and the average update amount of each to-be-detected bin as a third parameter; and determining the bin score according to the ratio of the sum of the first parameter and the second parameter to the third parameter.

[0039] Optionally, the file update amount is bin1_cnt, the total file update amount is bin_sum, and the update ratio is: The average update ratio is: n is the number of to-be-detected boxes in a preset time period, and the average update amount is The box score score is:

[0040]

[0041] In the above embodiments of the present application, the box score of each to-be-detected box is calculated according to the file update amount of each to-be-detected box in a preset time period and a historical time period, so that the box score of the to-be-detected box can increase with the increase of the file update amount. The box score can be used to evaluate whether the to-be-detected box has a sudden increase in the file update amount, thereby achieving the purpose of evaluating whether the to-be-detected box is an abnormal box according to the file update amount.

[0042] As an optional embodiment, the to-be-detected files are extracted from each to-be-detected box according to a preset extraction ratio for abnormal detection, and the number of abnormal files of each to-be-detected box is determined by: determining the preset extraction ratio according to the box score of each to-be-detected box; extracting the update files from the to-be-detected box as to-be-detected files according to the preset extraction ratio; performing abnormal detection on the to-be-detected files to determine abnormal files; and counting the number of extracted abnormal files in each to-be-detected box to obtain the number of abnormal files.

[0043] In the above embodiments of the present application, the preset extraction ratio of each to-be-detected box is determined according to the to-be-detected box score, and part of the update files in the to-be-detected box can be extracted as to-be-detected files to evaluate whether the to-be-detected box is an abnormal box, thereby achieving proportional sampling detection of the to-be-detected box.

[0044] As an optional embodiment, determining the preset extraction ratio according to the box score of each to-be-detected box includes: judging whether the box score of each to-be-detected box is higher than a first score threshold; in the case that the box score is higher than the first score threshold, determining that the preset extraction ratio is a first extraction ratio; in the case that the box score is not higher than the first score threshold, judging whether the box score is higher than a second score threshold, wherein the second score threshold is lower than the first score threshold; in the case that the box score is higher than the second score threshold, determining that the preset extraction ratio is a second extraction ratio, wherein the second extraction ratio is higher than the first extraction ratio; and in the case that the box score is not higher than the second score threshold, determining that the preset extraction ratio is a third extraction ratio, wherein the third extraction ratio is higher than the second extraction ratio.

[0045] For example, the box score is greater than the extreme outlier threshold value (i.e., the first score threshold value), the extraction weight (i.e., the preset extraction ratio) is set to 0.1, the box score is greater than the preset mild outlier threshold value (i.e., the second score threshold value), the extraction weight (i.e., the preset extraction ratio) is set to 0.2, and the rest of the to-be-detected box is marked as 0, and the extraction weight (i.e., the preset extraction ratio) is set to 1.

[0046] In the above embodiment of the present application, the higher the box score of the to-be-detected box, the higher the file update quantity of the to-be-detected box, and the lower the preset extraction ratio allocated to it, which can ensure that the number of to-be-detected files extracted from each to-be-detected box is approximately equal.

[0047] Optionally, the first score threshold value is a set highest score threshold value, and in the case that the box score of the to-be-detected box is higher than the first score threshold value, it indicates that the file update quantity of the to-be-detected box is particularly high, and it can be determined that the to-be-detected box has a high probability of being an abnormal box.

[0048] As an optional embodiment, the abnormal detection of the to-be-detected file includes: reading the byte entropy of each to-be-detected file; generating a feature set of each to-be-detected file based on the byte entropy; and determining whether the to-be-detected file is an abnormal file based on the feature set.

[0049] In the above embodiment of the present application, the byte entropy corresponding to each to-be-detected file is calculated, and the feature set of each to-be-detected file is generated based on the byte entropy, so that the abnormal score of each to-be-detected file can be calculated based on the feature set of the to-be-detected file, and it is determined whether the to-be-detected file belongs to an abnormal file, thereby realizing the abnormal detection of the to-be-detected file.

[0050] As an optional embodiment, the determination of the abnormal box based on the box score and the number of abnormal files of each to-be-detected box includes: determining the to-be-detected box with a box score greater than the first score threshold value as an abnormal box; and determining the to-be-detected box with a box score greater than the second score threshold value and a proportion of the number of abnormal files higher than a preset proportion threshold value as an abnormal box, wherein the second score threshold value is lower than the first score threshold value.

[0051] In the above embodiment of the present application, the box score is used to represent the file update quantity of the to-be-detected box, and the box score greater than the first score threshold value indicates that the update file of the to-be-detected box has experienced explosive growth, and it can be proved that the to-be-detected box has a high probability of being an abnormal box; and if the box score is greater than the second score threshold value and the proportion of the number of abnormal files is higher than the preset proportion threshold value, it indicates that most of the update files of the to-be-detected box have been subjected to abnormal detection, and most of the detected files are abnormal files, and it can be proved that the to-be-detected box has a high probability of being an abnormal box.

[0052] As an optional embodiment, the method further comprises: determining that the box score is greater than the second score threshold, and the proportion of the number of abnormal files is not higher than the preset proportion threshold, and the to-be-detected box is a neutral box; performing abnormal detection on the update files in the neutral box that are not extracted, and determining the abnormal files.

[0053] In the above embodiments of the application, when the box score is greater than the second score threshold, and the proportion of the number of abnormal files is not higher than the preset proportion threshold, the detection result of the to-be-detected files in the to-be-detected box cannot represent the general situation of the to-be-detected box, and therefore it is necessary to perform abnormal detection on the update files in the to-be-detected box one by one to determine the abnormal files, thereby achieving accurate detection of the abnormal files.

[0054] The application also provides an optional embodiment, which provides an abnormal file detection method based on a box division technique and information entropy.

[0055] Figure 2 is a schematic diagram of an abnormal file detection scheme based on a box division technique and information entropy according to an embodiment of the application, as shown in Figure 2 includes the following steps:

[0056] Step 1: Collecting data (i.e., obtaining an update file set).

[0057] Step 2: Box scoring based on the collected data (i.e., dividing the update file set into a plurality of to-be-detected boxes, and determining a box score of each to-be-detected box).

[0058] Step 3: Extracting to-be-detected files according to the box score score obtained in step 2.

[0059] Step 4: Reading the file content of the file data set data3 in step 3 one by one (i.e., reading the to-be-detected files one by one), and then calculating the byte entropy corresponding to each to-be-detected file, and generating a feature set featuer of each file based on the byte entropy.

[0060] Step 5: Taking the feature set featuer obtained in step 4 as the features of each to-be-detected file, calculating the abnormal score of each to-be-detected file, outputting the abnormal files, i.e., the records with label-1, thereby achieving abnormal detection of the update files.

[0061] Step 6: According to steps 3 and 5, counting the source of the abnormal files, and determining whether the update files in the entire to-be-detected box are abnormal.

[0062] The present proposal provides an abnormal file detection and identification method, which identifies whether there is an abnormal file in the updated file within a preset time period by extracting the characteristics of the file update amount and content within the preset time period. On the one hand, it solves the problems of low efficiency and high cost caused by large file update amount, and on the other hand, it improves the accuracy of identifying new abnormal files and reduces the false positive rate.

[0063] The present proposal provides an abnormal file detection and identification method to solve the problems of low efficiency, low accuracy, high false positive rate, etc. in the prior art under the condition of large file update amount. The implementation is as follows:

[0064] Step 1, collect data.

[0065] Optionally, traverse the files under the specified host or directory to obtain the following data: file path (file_path), file creation time (file_create_time), file last modification time (last_modify_time), file name (filename), etc.

[0066] Optionally, according to a preset time period (such as one day), filter out the file set whose file last modification time (last_modify_time) is within the preset time period (today) as the detection data set data1 (i.e. the first data set), and filter out the file set whose file last modification time (last_modify_time) is within the previous period (yesterday) as the comparison data set data2 (i.e. the second data set).

[0067] Step 2, box scoring according to the collected data, the specific steps are as follows:

[0068] 1. According to the file last modification time (last_modify_time), divide the detection data set data1 and the comparison data set data2 into bins1 (i.e. the first box set) and bins2 (i.e. the second box set) according to a preset time length (such as 20 minutes).

[0069] Among them, each detection box set has 72 detection boxes.

[0070] 2. Count the total file update amount of each detection box in each box set.

[0071] For example, bin1_num1, bin1_num2, …, bin1_num72, and bin2_num1, bin2_num2, …, bin2_num72.

[0072] 3. Score each to-be-detected box according to the total file update amount.

[0073] 1) Obtain the file update amount of each to-be-detected box in the current period bin1_cnt.

[0074] 2) Calculate the sum of the total file update amount of each to-be-detected box in two periods bin_sum.

[0075] 3) Calculate the update ratio of the file update amount of each to-be-detected box in the current period to the sum of the file update amount of two periods:

[0076] 4) Calculate the average update ratio of the file update amount of each box in the current period to the sum of the file update amount of two periods: Wherein, n is the number of boxes in the current period, i.e. 72.

[0077] 5) Calculate the average update amount of the update amount of the to-be-detected period box:

[0078] Optionally, the median, mean, etc. can also be taken. In specific implementation, the value can be selected according to the data distribution or the actual situation of the business, and a value that can represent the overall level is preferably selected.

[0079] It should be noted that at this point, the business purpose of considering whether the updated files in each to-be-detected box are abnormal is mainly considered, so the maximum value and the minimum value, which are slightly extreme, cannot be selected when the value is selected, and the mean value can reflect the file update amount of all boxes in the period.

[0080] 6) Calculate the current box score score of each box:

[0081] Step 3, extract the to-be-detected file from the to-be-detected box according to the box score score obtained in step 2.

[0082] Optionally, this step will determine the extraction weight of the updated file in each to-be-detected box. For the box with a higher box score score (i.e. larger file update amount) in step 2, the extraction weight is smaller, and for the box with a smaller file update amount, the extraction weight is larger, thereby reducing the file detection amount while ensuring the comprehensiveness of the file content.

[0083] For example, the weight parameter is {2:0.1, 1:0.2, 0:0.5}.

[0084] Optionally, the extreme outlier threshold (i.e. the first score threshold) of the box score score obtained in step 2 is calculated.

[0085] Optionally, an extreme outlier threshold value extreme_outlier (i.e., a first score threshold value) is calculated, including:

[0086] 1) Sort the data set (i.e., the first data set) in ascending order according to the box score score.

[0087] 2) Determine the first position l1 = 0.25 * (n-1) + 1 and the second position l2 = 0.75 * (n-1) + 1.

[0088] 3) Round down the position of l1 to a1 and round up to b1, and select the data values value1(1), value1(2) corresponding to the positions a1 and b1 in the data set (i.e., the first data set) sorted in 1).

[0089] Round down the position of l2 to a2 and round up to b2, and select the data values value2(1), value2(2) corresponding to the positions a2 and b2 in the data set (i.e., the first data set) sorted in 1).

[0090] 4) Calculate Q1 = value1(1) + [l1-a1]*(value1(2)-value1(1)),

[0091] Q2 = value2(1) + [l2-a2]*(value2(2)-value2(1)).

[0092] 5) Calculate the extreme outlier value extreme_outlier outlier = Q2 + 3*(Q2-Q1).

[0093] Optionally, compare the size of the box score score of each to-be-detected box with the first score threshold value one by one.

[0094] For example, the to-be-detected box with a box score score greater than the extreme outlier threshold value extreme_outlier (i.e., the first score threshold value) is marked as 2, the extraction weight (i.e., the preset extraction ratio) is set to 0.1, the box with a box score score greater than the preset mild outlier threshold value mild_outlier (i.e., the second score threshold value) is marked as 1, the extraction weight (i.e., the preset extraction ratio) is set to 0.2, and the rest of the to-be-detected boxes are marked as 0, and the extraction weight (i.e., the preset extraction ratio) is set to 1.

[0095] Optionally, according to the file update amount of each to-be-detected box and the extraction weight (i.e., the preset extraction ratio), the number of files (rounded up) extracted from each box is calculated.

[0096] For example, if the file update quantity of the to-be-detected box 1 is 202, and the extraction weight (i.e., the preset extraction ratio) is 0.1, then the extraction file quantity (i.e., the number of to-be-detected files extracted) of the to-be-detected box 1 is 21.

[0097] Optionally, according to the extraction file quantity, a corresponding number of files are randomly extracted from each box respectively, and are collected to form a file data set data3 (i.e., a set of to-be-detected files).

[0098] Step 4: The file content of the file data set data3 in step 3 is read one by one (i.e., the to-be-detected files are read one by one), and then the byte entropy corresponding to each to-be-detected file is calculated, and the feature set featuer of each file is generated based on the byte entropy, which specifically includes the following steps:

[0099] 1. The file content content is read in binary mode.

[0100] 2. The file content content is converted into an unsigned 8-bit integer (uint8) array array_content.

[0101] 3. An array feat of (16, 16) with all elements being 0 is initialized.

[0102] 4. The preset sliding window window_len is 2048, and the step is 1024. The array array_content is slid with a window of 1024, and the entropy and the byte-entropy value pair in each sliding window are calculated.

[0103] Optionally, the calculation of the entropy and the byte-entropy value pair in each sliding window includes:

[0104] 1) Each element in the sliding window is right shifted (>>) by 4 bits to form a new element, such as element 232, which is right shifted by 4 bits to form 14.

[0105] 2) The number of times each element appears in the sliding window, i.e., CNT i , is counted, and an array array_c = array([CNT0, CNT1, CNT2, …, CNT 15 ]) is generated; where i represents the corresponding element value. For example, CNT0 represents the number of times element 0 appears in the sliding window.

[0106] 3) The probability value P of each element is calculated.

[0107] 4) The information entropy H of the sliding window is calculated as H = min(15, int(4 * ∑-P i log2P i )).

[0108] 5) Take the information entropy H of the sliding window as the index of the array feat, and accumulate the array feat[H] = array_c of the byte occurrence times in all sliding windows in the file content content.

[0109] 6) Convert the array feat from a (16, 16) two-dimensional array to a (1, 256) one-dimensional array feat1, normalize each element in feat1 to generate a feature set feature.

[0110] Step 5, take the feature set feature obtained in step 4 as the feature of each file to be detected, calculate the anomaly score of each file to be detected, output the abnormal file, i.e., the record with label -1, thereby realizing anomaly detection of the update file.

[0111] Optionally, this step can cut the data space with a random hyperplane by means of a binary tree, and each cutting can generate two subspaces, i.e., left and right children, and then continue to cut each subspace with a random hyperplane, and the cycle continues until each subspace cannot be cut any more.

[0112] It should be noted that intuitively, it can be found that clusters with high density need to be cut many times before stopping cutting, but points with low density will stop in a subspace very early. Finally, the anomaly score of each point is obtained by calculating the path length between the leaf node and the root node. Points with consistent behavior will be divided into a subspace, and their path to the root node is also the same, i.e., the anomaly score is the same.

[0113] Step 6, count the sources of abnormal files according to steps 3 and 5.

[0114] Optionally, if the abnormal files are derived from the to-be-detected box whose box score score is greater than the mild outlier threshold mild_outlier (i.e., the second score threshold) and the number exceeds the preset threshold (i.e., the preset proportion threshold, the number of box file extraction * 50%), it is determined that all the update files in the to-be-detected box are abnormal.

[0115] Optionally, if the abnormal files are derived from the to-be-detected box whose box score score is greater than the mild outlier threshold mild_outlier (i.e., the second score threshold) but the number does not exceed the preset threshold (i.e., the preset proportion threshold, the number of box file extraction * 50%), the update files in the to-be-detected box whose box score score is greater than the mild outlier threshold mild_outlier (i.e., the second score threshold) and are not extracted are detected again by steps 4 and 5 to determine which update files belong to abnormal files.

[0116] The technical scheme provided in the application divides a detection period (i.e. an updated file set in a preset time period) into bins, extracts the updated files of a corresponding weight part as a detection file set (i.e. a file to be detected) according to the abnormality degree of the file update amount of the bin to be detected, and ensures the file coverage while reducing the detection amount of the file.

[0117] According to the embodiments of the application, a file detection device is also provided. It should be noted that the file detection device can be used to execute the file detection method in the embodiments of the application, and the file detection method in the embodiments of the application can be executed in the file detection device.

[0118] Figure 3 is a schematic diagram of a file detection device according to an embodiment of the application, as shown in Figure 3 The device can include: an acquisition module 32 configured to acquire an updated file set in a preset time period, wherein the updated file set includes a plurality of bins to be detected, the plurality of bins to be detected are obtained by performing a binning operation on the files in the updated file set, and each bin to be detected includes updated files in a preset time length range; a first determination module 34 configured to identify the file update amount of each bin to be detected and determine a bin score of each bin to be detected, wherein the file update amount is used to represent the number of updated files recorded in each bin to be detected, and the bin score is determined by the file update amount; a second determination module 36 configured to extract a detection file from each bin to be detected according to a preset extraction ratio for abnormality detection and determine the number of abnormal files of each bin to be detected, wherein the preset extraction ratio is determined according to the bin score; and a third determination module 38 configured to determine an abnormal bin based on the bin score and the number of abnormal files of each bin to be detected, wherein the updated files recorded in the abnormal bin are abnormal files.

[0119] It should be noted that the acquisition module 32 in this embodiment can be used to execute step S102 in the embodiments of the application, the first determination module 34 in this embodiment can be used to execute step S104 in the embodiments of the application, the second determination module 36 in this embodiment can be used to execute step S106 in the embodiments of the application, and the third determination module 38 in this embodiment can be used to execute step S108 in the embodiments of the application. The above modules have the same examples and application scenarios as the corresponding steps, but are not limited to the contents disclosed in the above embodiments.

[0120] In the above embodiments of the present application, the update file set in the preset time period is obtained, wherein the update file set includes a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by binning operation on files in the update file set, and each to-be-detected box includes update files in a preset time length range; the file update amount of each to-be-detected box is identified, and the box score of each to-be-detected box is determined, wherein the file update amount is used to represent the number of update files recorded in each to-be-detected box, and the box score is determined by the file update amount; to-be-detected files are extracted from each to-be-detected box according to a preset extraction ratio for abnormality detection, and the number of abnormal files of each to-be-detected box is determined, wherein the preset extraction ratio is determined according to the box score; and based on the box score and the number of abnormal files of each to-be-detected box, an abnormal box is determined, wherein the update files recorded in the abnormal box are abnormal files. Thus, by binning the update file set, the plurality of to-be-detected boxes are selected, the abnormal box is selected from the plurality of to-be-detected boxes, and it is determined that all the update files in the to-be-detected box are abnormal files. The number of files subjected to abnormality detection can be reduced, the detection efficiency is improved, and the accuracy of the detection result can be ensured. Thus, the technical effects of improving the abnormal file detection efficiency and ensuring the accuracy of the detection result are achieved, and the technical problem that the conventional detection method cannot quickly and accurately detect and identify abnormal files is solved.

[0121] As an optional embodiment, the obtaining module includes: an obtaining unit, configured to obtain a first data set in a preset time period and a second data set in a historical time period, wherein the historical time period is a previous period of the preset time period, the first data set is a file created in the preset time period, and the second data set is a file created in the historical time period; a first determination unit, configured to bin the first data set according to a preset time length to determine a first box set, wherein the first box set includes a plurality of first binned boxes obtained by binning the first data set; a second determination unit, configured to bin the second data set according to the preset time length to determine a second box set, wherein the second box set includes a plurality of second binned boxes obtained by binning the second data set; a third determination unit, configured to compare the differences between the first binned boxes and the second binned boxes one by one, and determine that a file existing in the first binned boxes and not existing in the second binned boxes is a difference file; and a fourth determination unit, configured to determine that the difference file in the preset time period is the update file set.

[0122] As an optional embodiment, the first determining module comprises: an identifying sub-module, configured to identify a file update amount of each to-be-detected box within a preset time period; a first determining sub-module, configured to determine a total file update amount of each to-be-detected box within the preset time period and a historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update amount is a sum of the file update amount of the same to-be-detected box within the preset time period and the file update amount within the historical time period; a second determining sub-module, configured to determine a ratio of the file update amount to the total file update amount of each to-be-detected box as an update ratio; a third determining sub-module, configured to determine a mean update ratio of the plurality of to-be-detected boxes within the preset time period, wherein the mean update ratio is a mean value of the update ratios of the plurality of to-be-detected boxes within the preset time period; a fourth determining sub-module, configured to determine a mean update amount of the plurality of to-be-detected boxes within the preset time period, wherein the mean update amount is a mean value of the file update amounts of the plurality of to-be-detected boxes within the preset time period; a fifth determining sub-module, configured to determine a product of the update ratio and the file update amount of each to-be-detected box as a first parameter; a sixth determining sub-module, configured to determine a product of the mean update ratio and the mean update amount as a second parameter; a seventh determining sub-module, configured to determine a sum of the file update amount and the mean update amount of each to-be-detected box as a third parameter; and an eighth determining sub-module, configured to determine the box score of each to-be-detected box according to a sum of the first parameter and the second parameter and a ratio of the third parameter.

[0123] As an optional embodiment, the second determining module comprises: a fifth determining unit, configured to determine the preset extraction ratio according to the box score of each to-be-detected box; an extraction unit, configured to extract an update file from the to-be-detected box as a to-be-detected file according to the preset extraction ratio; a sixth determining unit, configured to perform anomaly detection on the to-be-detected file to determine an abnormal file; and a statistical unit, configured to count a number of the abnormal files extracted from each to-be-detected box to obtain an abnormal file number.

[0124] As an optional embodiment, the fifth determining unit comprises: a first judging sub-unit, configured to judge whether the box score of each to-be-detected box is higher than a first score threshold; a first determining sub-unit, configured to determine the preset extraction ratio as a first extraction ratio in the case that the box score is higher than the first score threshold; a second judging sub-unit, configured to judge whether the box score is higher than a second score threshold in the case that the box score is not higher than the first score threshold, wherein the second score threshold is lower than the first score threshold; and a second determining sub-unit, configured to determine the preset extraction ratio as a second extraction ratio in the case that the box score is higher than the second score threshold, wherein the second extraction ratio is higher than the first extraction ratio.

[0125] A third determining sub-unit, configured to determine the preset extraction ratio as a third extraction ratio in the case that the box score is not higher than the second score threshold, wherein the third extraction ratio is higher than the second extraction ratio.

[0126] As an optional embodiment, the sixth determining unit comprises: a reading subunit, configured to read the byte entropy of each to-be-detected file; a generating subunit, configured to generate a feature set of each to-be-detected file based on the byte entropy; and a fourth determining subunit, configured to determine whether the to-be-detected file is an abnormal file based on the feature set.

[0127] As an optional embodiment, the third determining module comprises: a seventh determining unit, configured to determine that a to-be-detected box with a box score greater than a first score threshold is an abnormal box; and an eighth determining unit, configured to determine that a to-be-detected box with a box score greater than a second score threshold and a proportion of abnormal files higher than a preset proportion threshold is an abnormal box, wherein the second score threshold is lower than the first score threshold.

[0128] As an optional embodiment, the apparatus further comprises: a ninth determining unit, configured to determine that a to-be-detected box with a box score greater than the second score threshold and a proportion of abnormal files not higher than the preset proportion threshold is a neutral box; and a tenth determining unit, configured to perform abnormal detection on an update file not extracted in the neutral box to determine an abnormal file.

[0129] Embodiments of the present application can provide a computer terminal, which can be any one of the computer terminal devices in the computer terminal group. Alternatively, in the present embodiment, the above computer terminal can also be replaced by a mobile terminal or other terminal device.

[0130] Alternatively, in the present embodiment, the above computer terminal can be located in at least one of the network devices in the computer network.

[0131] In the present embodiment, the above computer terminal can execute program codes for the following steps in the file detection method: obtaining an update file set within a preset time period, wherein the update file set comprises a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by performing a binning operation on the files in the update file set, and each to-be-detected box comprises update files within a preset time length range; identifying a file update amount of each to-be-detected box and determining a box score of each to-be-detected box, wherein the file update amount is used to represent the number of update files recorded in each to-be-detected box, and the box score is determined by the file update amount; extracting to-be-detected files from each to-be-detected box according to a preset extraction proportion to perform abnormal detection, and determining an abnormal file number of each to-be-detected box, wherein the preset extraction proportion is determined according to the box score; and determining an abnormal box based on the box score and the abnormal file number of each to-be-detected box, wherein the update files recorded in the abnormal box are abnormal files.

[0132] Alternatively, Figure 4 is a structural block diagram of a computer terminal according to an embodiment of the present application. As shown inFigure 4 As shown, the computer terminal 40 can include one or more (only one is shown in the figure) processors 42 and a memory 44.

[0133] The memory can be used to store software programs and modules, such as program instructions / modules corresponding to the file detection method and device in the embodiments of the present application. The processor executes various functions and data processing by running the software programs and modules stored in the memory, that is, implements the file detection method described above. The memory can include a high-speed random access memory, and can also include a non-volatile memory, such as one or more magnetic storage devices, flash memories, or other non-volatile solid-state memories. In some examples, the memory can further include a memory remotely arranged with respect to the processor, which can be connected to the terminal 40 through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0134] The processor can call information and application programs stored in the memory through the transmission device to perform the following steps: obtaining an updated file set in a preset time period, wherein the updated file set includes a plurality of to-be-detected bins, the plurality of to-be-detected bins are obtained by binning operation on files in the updated file set, and each to-be-detected bin includes updated files in a preset time length range; identifying a file update amount of each to-be-detected bin and determining a bin score of each to-be-detected bin, wherein the file update amount is used to represent the number of updated files recorded in each to-be-detected bin, and the bin score is determined by the file update amount; extracting to-be-detected files from each to-be-detected bin according to a preset extraction ratio for abnormality detection to determine an abnormal file number of each to-be-detected bin, wherein the preset extraction ratio is determined according to the bin score; and determining an abnormal bin based on the bin score and the abnormal file number of each to-be-detected bin, wherein the updated files recorded in the abnormal bin are abnormal files.

[0135] Optionally, the processor can further execute program codes of the following steps: obtaining a first data set in a preset time period and a second data set in a historical time period, wherein the historical time period is a previous period of the preset time period, the first data set is a file created in the preset time period, and the second data set is a file created in the historical time period; binning the first data set according to a preset time length to determine a first bin set, wherein the first bin set includes a plurality of first binned bins obtained by binning the first data set; binning the second data set according to the preset time length to determine a second bin set, wherein the second bin set includes a plurality of second binned bins obtained by binning the second data set; comparing the first binned bins and the second binned bins one by one to determine a difference file that exists in the first binned bins and does not exist in the second binned bins; and determining the difference file in the preset time period as an update file set.

[0136] Optionally, the processor can further execute program codes of the following steps: identifying a file update amount of each to-be-detected bin in the preset time period; determining a total file update amount of each to-be-detected bin in the preset time period and a historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update amount is a sum of the file update amount of the same to-be-detected bin in the preset time period and the file update amount in the historical time period; determining an update ratio of each to-be-detected bin as a ratio of the file update amount to the total file update amount; determining a mean update ratio of a plurality of to-be-detected bins in the preset time period, wherein the mean update ratio is a mean value of the update ratios of the plurality of to-be-detected bins in the preset time period; determining a mean update amount of the plurality of to-be-detected bins in the preset time period, wherein the mean update amount is a mean value of the file update amounts of the plurality of to-be-detected bins in the preset time period; determining a first parameter of each to-be-detected bin as a product of the update ratio and the file update amount; determining a second parameter as a product of the mean update ratio and the mean update amount; determining a third parameter as a sum of the file update amount and the mean update amount of each to-be-detected bin; and determining a bin score according to a sum of the first parameter and the second parameter and a ratio of the third parameter.

[0137] Optionally, the processor can further execute program codes of the following steps: determining a preset extraction ratio according to the bin score of each to-be-detected bin; extracting an update file from the to-be-detected bin as a to-be-detected file according to the preset extraction ratio; performing abnormality detection on the to-be-detected file to determine an abnormal file; and counting a number of the abnormal files extracted from each to-be-detected bin to obtain an abnormal file number.

[0138] Optionally, the processor can further execute program codes of the following steps: determining whether the box score of each to-be-detected box is higher than a first score threshold; in the case that the box score is higher than the first score threshold, determining that the preset extraction ratio is a first extraction ratio; in the case that the box score is not higher than the first score threshold, determining whether the box score is higher than a second score threshold, wherein the second score threshold is lower than the first score threshold; in the case that the box score is higher than the second score threshold, determining that the preset extraction ratio is a second extraction ratio, wherein the second extraction ratio is higher than the first extraction ratio; in the case that the box score is not higher than the second score threshold, determining that the preset extraction ratio is a third extraction ratio, wherein the third extraction ratio is higher than the second extraction ratio.

[0139] Optionally, the processor can further execute program codes of the following steps: reading the byte entropy of each to-be-detected file; generating a feature set of each to-be-detected file based on the byte entropy; and determining whether the to-be-detected file is an abnormal file based on the feature set.

[0140] Optionally, the processor can further execute program codes of the following steps: determining that the to-be-detected box with the box score greater than the first score threshold is an abnormal box; and determining that the to-be-detected box with the box score greater than the second score threshold and the proportion of the number of abnormal files higher than a preset proportion threshold is an abnormal box, wherein the second score threshold is lower than the second score threshold.

[0141] Optionally, the processor can further execute program codes of the following steps: determining that the to-be-detected box with the box score greater than the second score threshold and the proportion of the number of abnormal files not higher than the preset proportion threshold is a neutral box; and performing abnormal detection on the update file not extracted in the neutral box to determine an abnormal file.

[0142] The embodiment of the application provides a file detection scheme. A set of update files in a preset time period is acquired, wherein the set of update files comprises a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by performing a binning operation on files in the set of update files, and each to-be-detected box comprises update files in a preset time length range; a file update amount of each to-be-detected box is identified, and a box score of each to-be-detected box is determined, wherein the file update amount is used to represent the number of update files recorded in each to-be-detected box, and the box score is determined by the file update amount; to-be-detected files are extracted from each to-be-detected box according to a preset extraction ratio for abnormality detection, and an abnormal file number of each to-be-detected box is determined, wherein the preset extraction ratio is determined according to the box score; and an abnormal box is determined based on the box score and the abnormal file number of each to-be-detected box, wherein the update files recorded in the abnormal box are abnormal files, so that the set of update files is binned to determine the plurality of to-be-detected boxes, the abnormal box is selected from the plurality of to-be-detected boxes, and then it is determined that all the update files in the to-be-detected box belong to abnormal files, the number of files subjected to abnormality inspection can be reduced, the detection efficiency is improved, and the accuracy of the detection result can be ensured, thereby achieving the technical effects of improving the abnormal file detection efficiency and ensuring the accuracy of the detection result, and further solving the technical problem that the traditional detection means cannot quickly and accurately detect and identify abnormal files.

[0143] Those skilled in the art can understand that Figure 4 The structure shown is only schematic, and the computer terminal can also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a palm computer, a Mobile Internet Device (MID), a PAD, or the like. Figure 4 It does not limit the structure of the electronic device. For example, the computer terminal 40 can further include more or fewer components (such as a network interface, a display device, etc.) than Figure 4 shown, or have a different configuration than Figure 4 shown.

[0144] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by a program instructing the hardware of the terminal device, and the program can be stored in a computer readable storage medium, which can include a flash disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, etc.

[0145] The embodiments of the present application also provide a storage medium. Optionally, in the embodiments, the storage medium can be used to save the program code executed by the file detection method provided by the embodiments.

[0146] Optionally, in the embodiments, the storage medium can be located in any one of the computer terminals in the computer terminal group in the computer network, or in any one of the mobile terminals in the mobile terminal group.

[0147] Optionally, in the embodiments, the storage medium is configured to store program code for performing the following steps: obtaining an update file set in a preset time period, wherein the update file set includes a plurality of to-be-detected bins, the plurality of to-be-detected bins are obtained by binning the files in the update file set, and each to-be-detected bin includes update files in a preset time length range; identifying a file update amount of each to-be-detected bin and determining a bin score of each to-be-detected bin, wherein the file update amount is used to represent the number of update files recorded in each to-be-detected bin, and the bin score is determined by the file update amount; extracting to-be-detected files from each to-be-detected bin according to a preset extraction ratio for anomaly detection, and determining an abnormal file number of each to-be-detected bin, wherein the preset extraction ratio is determined according to the bin score; and determining an abnormal bin based on the bin score and the abnormal file number of each to-be-detected bin, wherein the update files recorded in the abnormal bin are abnormal files.

[0148] Optionally, in the embodiments, the storage medium is configured to store program code for performing the following steps: obtaining a first data set in a preset time period and a second data set in a historical time period, wherein the historical time period is a previous period of the preset time period, the first data set is a file created in the preset time period, and the second data set is a file created in the historical time period; binning the first data set according to a preset time length to determine a first bin set, wherein the first bin set includes a plurality of first binned bins obtained by binning the first data set; binning the second data set according to the preset time length to determine a second bin set, wherein the second bin set includes a plurality of second binned bins obtained by binning the second data set; comparing the differences between the first binned bins and the second binned bins one by one to determine a difference file that exists in the first bin but does not exist in the second binned bin; and determining the difference files in the preset time period as the update file set.

[0149] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: identifying a file update amount of each to-be-detected box within a preset time period; determining a total file update amount of each to-be-detected box within the preset time period and a historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update amount is a sum of the file update amount of the same to-be-detected box within the preset time period and the file update amount within the historical time period; determining an update ratio of the file update amount to the total file update amount of each to-be-detected box; determining a mean update ratio of the plurality of to-be-detected boxes within the preset time period, wherein the mean update ratio is a mean value of the update ratios of the plurality of to-be-detected boxes within the preset time period; determining a mean update amount of the plurality of to-be-detected boxes within the preset time period, wherein the mean update amount is a mean value of the file update amounts of the plurality of to-be-detected boxes within the preset time period; determining a first parameter as a product of the update ratio and the file update amount of each to-be-detected box; determining a second parameter as a product of the mean update ratio and the mean update amount; determining a third parameter as a sum of the file update amount and the mean update amount of each to-be-detected box; and determining a box score according to a sum of the first parameter and the second parameter and a ratio of the third parameter.

[0150] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: determining a preset extraction ratio according to the box score of each to-be-detected box; extracting an update file from the to-be-detected box as a to-be-detected file according to the preset extraction ratio; performing abnormality detection on the to-be-detected file to determine an abnormal file; and counting a number of the abnormal files extracted from each to-be-detected box to obtain an abnormal file number.

[0151] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: determining whether the box score of each to-be-detected box is higher than a first score threshold; in a case where the box score is higher than the first score threshold, determining that the preset extraction ratio is a first extraction ratio; in a case where the box score is not higher than the first score threshold, determining whether the box score is higher than a second score threshold, wherein the second score threshold is lower than the first score threshold; in a case where the box score is higher than the second score threshold, determining that the preset extraction ratio is a second extraction ratio, wherein the second extraction ratio is higher than the first extraction ratio; and in a case where the box score is not higher than the second score threshold, determining that the preset extraction ratio is a third extraction ratio, wherein the third extraction ratio is higher than the second extraction ratio.

[0152] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: reading a byte entropy of each to-be-detected file; generating a feature set of each to-be-detected file based on the byte entropy; and determining whether the to-be-detected file is an abnormal file based on the feature set.

[0153] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: determining that the to-be-detected box is an abnormal box when the box score is greater than a first score threshold; and determining that the to-be-detected box is an abnormal box when the box score is greater than a second score threshold and the proportion of the number of abnormal files is higher than a preset proportion threshold, wherein the second score threshold is lower than the second score threshold.

[0154] Optionally, in the embodiment, the storage medium is configured to store program code for performing the following steps: determining that the to-be-detected box is a neutral box when the box score is greater than the second score threshold and the proportion of the number of abnormal files is not higher than the preset proportion threshold; and performing abnormal detection on the update file not extracted in the neutral box to determine the abnormal file.

[0155] The serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0156] In the above embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0157] In the several embodiments of the present application, it should be understood that the disclosed technology can be implemented in other ways. Of course, the unit embodiment described above is only schematic. For example, the division of the units can be a logical function division, and there can be another division manner in actual implementation, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, and can be electrical or other forms.

[0158] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0159] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware, or in the form of software functional unit.

[0160] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0161] The above is only the preferred embodiment of the present application, and it should be pointed out that for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which should be considered as the protection scope of the present application.

Claims

1. A file detection method characterized by comprising: The method comprises: obtaining an update file set in a preset time period, wherein the update file set comprises a plurality of to-be-detected boxes, the plurality of to-be-detected boxes are obtained by binning operation on files in the update file set, and each to-be-detected box comprises update files in a preset time length range; identifying a file update quantity of each to-be-detected box and determining a box score of each to-be-detected box, wherein the file update quantity represents the number of update files recorded in each to-be-detected box, and the box score is determined by the file update quantity; extracting to-be-detected files from each to-be-detected box according to a preset extraction ratio for anomaly detection, and determining an abnormal file quantity of each to-be-detected box, wherein the preset extraction ratio is determined according to the box score; determining an abnormal box based on the box score and the abnormal file quantity of each to-be-detected box, wherein the update files recorded in the abnormal box are the abnormal files; wherein identifying the file update quantity of each to-be-detected box and determining the box score of each to-be-detected box comprises: identifying a file update quantity of each to-be-detected box in the preset time period; determining a total file update quantity of each to-be-detected box in the preset time period and a historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update quantity is the sum of the file update quantity of the to-be-detected box in the preset time period and the file update quantity of the to-be-detected box in the historical time period; determining an update ratio of the file update quantity to the total file update quantity of each to-be-detected box; determining a mean update ratio of a plurality of to-be-detected boxes in the preset time period, wherein the mean update ratio is the mean value of the update ratios of the plurality of to-be-detected boxes in the preset time period; determining a mean update quantity of a plurality of to-be-detected boxes in the preset time period, wherein the mean update quantity is the mean value of the file update quantities of the plurality of to-be-detected boxes in the preset time period; determining a first parameter as the product of the update ratio and the file update quantity of each to-be-detected box; determining a second parameter as the product of the mean update ratio and the mean update quantity; determining a third parameter as the sum of the file update quantity and the mean update quantity of each to-be-detected box; determining the box score according to the sum of the first parameter and the second parameter and the ratio of the third parameter.

2. The method of claim 1, wherein, Obtaining an update file set in a preset time period comprises: obtaining a first data set in the preset time period and a second data set in a historical time period, wherein the historical time period is a previous period of the preset time period, the first data set is a file created in the preset time period, and the second data set is a file created in the historical time period; binning the first data set according to the preset time length to determine a first box set, wherein the first box set comprises a plurality of first binning boxes obtained by binning the first data set; box the second data set according to the preset time length, to determine a second box set, wherein the second box set includes a plurality of second box bodies obtained by box the second data set; determine the difference between the first box body and the second box body one by one, and determine the file that exists in the first box body and does not exist in the second box body as a difference file; determine the difference file in the preset time period as the update file set.

3. The method of claim 1, wherein, extract the abnormal file number of each of the detection boxes according to the preset extraction ratio, including: determine the preset extraction ratio according to the box score of each of the detection boxes; extract the update file from the detection box according to the preset extraction ratio as the detection file; abnormal detection is performed on the detection file to determine the abnormal file; count the number of abnormal files extracted from each of the detection boxes to obtain the abnormal file number.

4. The method of claim 3, wherein, determine the preset extraction ratio according to the box score of each of the detection boxes, including: determine whether the box score of each of the detection boxes is higher than a first score threshold; in the case that the box score is higher than the first score threshold, determine that the preset extraction ratio is a first extraction ratio; in the case that the box score is not higher than the first score threshold, determine whether the box score is higher than a second score threshold, wherein the second score threshold is lower than the first score threshold; in the case that the box score is higher than the second score threshold, determine that the preset extraction ratio is a second extraction ratio, wherein the second extraction ratio is higher than the first extraction ratio; in the case that the box score is not higher than the second score threshold, determine that the preset extraction ratio is a third extraction ratio, wherein the third extraction ratio is higher than the second extraction ratio.

5. The method of claim 3, wherein, abnormal detection is performed on the detection file to determine the abnormal file, including: read the byte entropy of each of the detection files; generate a feature set of each of the detection files based on the byte entropy; determine whether the detection file is the abnormal file based on the feature set.

6. The method of claim 1, wherein, determine the abnormal box based on the box score and the abnormal file number of each of the detection boxes, including: determine the detection box with the box score greater than a first score threshold as the abnormal box; determine the detection box with the box score greater than a second score threshold and the abnormal file number ratio higher than a preset ratio threshold as the abnormal box, wherein the second score threshold is lower than the second score threshold.

7. A file detection apparatus characterized by comprising: including: an acquisition module, configured to acquire an update file set in a preset time period, wherein the update file set includes a plurality of detection boxes, the plurality of detection boxes are obtained by box operation on the files in the update file set, and each detection box includes update files in a preset time length range; The first determining module is configured to identify a file update quantity of each of the to-be-detected boxes and determine a box score of each of the to-be-detected boxes, wherein the file update quantity is used to represent a number of the update files recorded in each of the to-be-detected boxes, and the box score is determined by the file update quantity. The second determining module is configured to extract a to-be-detected file from each of the to-be-detected boxes according to a preset extraction ratio for abnormality detection and determine an abnormal file quantity of each of the to-be-detected boxes, wherein the preset extraction ratio is determined according to the box score. The third determining module is configured to determine an abnormal box based on the box score and the abnormal file quantity of each of the to-be-detected boxes, wherein the update files recorded in the abnormal box are the abnormal files. The first determining module includes: The identifying submodule is configured to identify a file update quantity of each of the to-be-detected boxes in the preset time period. The first determining submodule is configured to determine a total file update quantity of each of the to-be-detected boxes in the preset time period and a historical time period, wherein the historical time period is a previous period of the preset time period, and the total file update quantity is a sum of the file update quantity of the to-be-detected box in the preset time period and the file update quantity of the to-be-detected box in the historical time period. The second determining submodule is configured to determine a ratio of the file update quantity to the total file update quantity of each of the to-be-detected boxes as an update ratio. The third determining submodule is configured to determine a mean update ratio of a plurality of the to-be-detected boxes in the preset time period, wherein the mean update ratio is a mean value of the update ratios of the plurality of the to-be-detected boxes in the preset time period. The fourth determining submodule is configured to determine a mean update quantity of a plurality of the to-be-detected boxes in the preset time period, wherein the mean update quantity is a mean value of the file update quantities of the plurality of the to-be-detected boxes in the preset time period. The fifth determining submodule is configured to determine a product of the update ratio and the file update quantity of each of the to-be-detected boxes as a first parameter. The sixth determining submodule is configured to determine a product of the mean update ratio and the mean update quantity as a second parameter. The seventh determining submodule is configured to determine a sum of the file update quantity and the mean update quantity of each of the to-be-detected boxes as a third parameter. The eighth determining submodule is configured to determine the box score according to a ratio of a sum of the first parameter and the second parameter to the third parameter.

8. A non-volatile storage medium, characterized by The non-volatile storage medium stores a program, wherein the program controls a device in which the non-volatile storage medium is located to perform the file detection method in any one of claims 1 to 6 when the program is running.

9. A processor, comprising: The processor is configured to run a program, wherein the program performs the file detection method in any one of claims 1 to 6 when the program is running.

Images