Security detection method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a security detection method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of cloud security, and the method comprises the steps: firstly, obtaining a security detection rule and a to-be-detected sample; then, performing security detection on a to-be-detected sample by using a security detection rule; wherein the security detection rule is stored based on a bit array and a hash function. In the embodiment, the client stores the security detection rule based on the bit array and the hash function, so that the storage space can be reduced; moreover, the security detection is carried out on the to-be-detected sample by using the security detection rule stored based on the bit array and the hash function, so that the security detection speed can be improved, and the resource occupation of the client to the terminal equipment is reduced.

Description

Technical Field

[0001] The present application relates to the field of cloud security technology, and in particular to a security detection method, device, electronic device, storage medium, and program product. Background Art

[0002] With the development of Internet technology, the network has become closely intertwined with people's daily lives and work. When users connect to the Internet using terminal devices, the terminal devices themselves face a variety of security issues. To ensure the security of users' terminal devices and provide powerful and real-time detection and defense capabilities, a security client approach is often adopted. This involves deploying a program that provides security services on the terminal device (for example, a virtual host or physical machine) and interacting with the security server. Security information is collected from the client and sent to the cloud. The cloud server determines security actions and then executes them through the client.

[0003] To shorten the decision-making process and ensure real-time security actions, numerous security rules are typically stored locally on the client, allowing the client to quickly make decisions and execute them. However, the rich security protection features provided by the client require resources on the terminal device, such as the CPU, memory, and disk I / O, which can easily interfere with the normal operation of user services. Therefore, reducing the resource usage of the client on the terminal device has become a pressing issue. Summary of the Invention

[0004] The embodiments of the present application provide a security detection method, apparatus, electronic device, storage medium, and program product to reduce the resource occupation of a terminal device by a client.

[0005] In the first aspect, an embodiment of the present application provides a security detection method, which is applied to a client and includes: obtaining security detection rules and samples to be detected; using the security detection rules to perform security detection on the samples to be detected; wherein the security detection rules are stored based on a bit array and a hash function; the bit array represents data through binary bits.

[0006] In the second aspect, an embodiment of the present application provides a security detection device, which includes: an acquisition module for acquiring security detection rules and samples to be detected; a detection module for using the security detection rules to perform security detection on the samples to be detected; wherein the security detection rules are stored based on bit arrays and hash functions; the bit arrays represent data through binary bits.

[0007] On the third aspect, an embodiment of the present application provides a security detection system, including a client and a server; the client is used to obtain security detection rules and samples to be detected from the server, and the security detection rules are stored based on bit arrays and hash functions; the samples to be detected are security detected using the security detection rules; the server is used to generate security detection rules, and when it is determined that the number of incremental security detection rules reaches a preset threshold, the incremental security detection rules are sent to the client; the samples that have passed the security detection are received from the client, and security detection is performed on the samples that have passed the security detection.

[0008] In a fourth aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor implements any of the above methods when executing the computer program.

[0009] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, any of the above methods is implemented.

[0010] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements any of the above methods.

[0011] Compared with the prior art, this application has the following advantages:

[0012] This application provides a security detection method, apparatus, electronic device, storage medium, and program product. First, security detection rules and a sample to be detected are obtained. Then, security detection is performed on the sample to be detected using the security detection rules. The security detection rules are stored based on a bit array and a hash function. In this embodiment, the client stores the security detection rules based on the bit array and the hash function, which can reduce storage space. Furthermore, using the security detection rules stored based on the bit array and the hash function to perform security detection on the sample to be detected can increase the sample detection speed, thereby reducing the resource usage of the client on the terminal device.

[0013] The above description is only an overview of the technical solution of this application. In order to more clearly understand the technical means of this application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of this application more obvious and easy to understand, the specific implementation methods of this application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar components or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments according to the present application and should not be regarded as limiting the scope of the present application.

[0015] Figure 1 A schematic diagram of an application scenario of the security detection method provided in this application.

[0016] Figure 2 This is a flow chart of a security detection method according to an embodiment of the present application.

[0017] Figure 3 This is a schematic diagram of data storage according to an embodiment of the present application.

[0018] Figure 4 A schematic diagram of data query according to an embodiment of the present application.

[0019] Figure 5 This is a flow chart of a security detection method according to an embodiment of the present application.

[0020] Figure 6 This is a flowchart of rule processing according to an embodiment of the present application.

[0021] Figure 7 This is a structural block diagram of a safety detection device according to an embodiment of the present application.

[0022] Figure 8 A block diagram of an electronic device used to implement an embodiment of the present application. DETAILED DESCRIPTION

[0023] Hereinafter, only certain exemplary embodiments are briefly described. As will be appreciated by those skilled in the art, the described embodiments may be modified in various ways without departing from the spirit or scope of the present application. Therefore, the drawings and description are to be regarded as illustrative in nature and not restrictive.

[0024] To facilitate understanding of the technical solutions of the embodiments of the present application, the following describes the related technologies of the embodiments of the present application. The following related technologies can be combined with the technical solutions of the embodiments of the present application as optional solutions, and all of them fall within the scope of protection of the embodiments of the present application.

[0025] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0026] In related technologies, to reduce the resource consumption of the terminal device where the security client resides, a growing number of solutions are adopting a light client approach. Specifically, the security client only collects security data and executes security actions. The server accepts the data uploaded by the security client and uses various security rules, algorithms, and models to determine the security action. The results are then transmitted back to the security client to complete the action. This light client approach has a long decision-making process, making it impossible to provide real-time protection or ensure security effectiveness in complex scenarios. Furthermore, due to its strong reliance on the server, the client's reliability cannot be guaranteed, and network anomalies, server-side anomalies, and other failures can directly impact security effectiveness.

[0027] To address the above issues, in actual production environments, some security rules are periodically synchronized to the client, and the client first makes a policy judgment locally. This approach has the following problems:

[0028] 1. Some static blacklists or simple regular rules will be cached on the client. This method can only cache a small number of rules, and the caching effect is not good.

[0029] 2. When the client caches a large blacklist, hashing will be used to increase the calculation speed, but the space occupied will increase significantly.

[0030] 3. Using hashing to determine whether a blacklist is hit may result in misjudgment.

[0031] 4. In the event of network disconnection or server abnormality, only minimal security defense capabilities can be guaranteed.

[0032] In order to solve at least some of the above technical problems, the present invention provides a security detection method. Figure 1 A schematic diagram of an application scenario of the sample detection method provided in this application. The method provided in the embodiment of this application is applied to a scenario where a security client and a security server jointly perform sample detection. The security server is a service program that provides security capabilities and is deployed on the server to provide targeted content or capabilities to the security client, such as security detection rules, configuration information, etc. The security client refers to a program deployed on the user's terminal device (for example, a virtual host or a physical machine) to provide security services to the user.

[0033] like Figure 1 As shown, the rule center is deployed on the server side, responsible for generating security detection rules and synchronizing them to the client side. The client side is deployed on a host, which is the user's terminal device. The client side obtains the sample to be detected and obtains the security detection rules from the server side. The security detection rules are stored based on a bit array and a hash function. The bit array represents data using binary bits. For example, a Bloom filter (BF) is used to store and query security detection rules. A Bloom filter is a highly space-efficient probabilistic data structure used to determine whether an element is in a set. Specifically, a hash function is used to hash the security detection rules to obtain multiple hash values. The multiple hash values ​​are mapped to multiple locations in the bit array, and the values ​​of the multiple locations are set to preset values, which are used to indicate the presence of data. The security detection rules are then used to perform security detection on the sample to be detected. Specifically, a hash function is used to hash the sample to be detected to obtain multiple hash values. Based on the multiple hash values ​​and the mapping relationship, the values ​​of the multiple locations in the bit array corresponding to the multiple hash values ​​are queried to determine whether they are preset values. If so, the rule is determined to have been hit.

[0034] The security detection rules are generated by the server and sent to the client when the number of incremental security detection rules reaches a preset threshold. After obtaining the security detection rules, the client merges the security detection rules into the full set of security detection rules when it determines that the preset full merge time has arrived. If it determines that the preset full merge time has not arrived, the security detection rules are merged into the incremental set of security detection rules.

[0035] Security detection rules include whitelist rules. If the sample to be detected does not hit a whitelist rule, an interception action is executed. Whitelist rules include full whitelist rules and incremental whitelist rules. If the sample to be detected hits the full whitelist rule, the system determines whether it hits the incremental whitelist rule. If it does, the system performs a release action, sending the sample to be detected to the server for security detection. The server then determines whether to add the sample to the whitelist rule. If the sample to be detected does not hit the incremental whitelist rule, an interception action is executed.

[0036] In this embodiment, Bloom filters are used to optimize client local resource consumption, whitelist rules are used to reduce false positives, and secondary caches of incremental rules are used to reduce missed positives, thereby achieving rapid detection of massive samples on the client side.

[0037] 1. Cache a large number of security detection rules on the client and store them through Bloom filters, which greatly improves the sample detection speed, compresses the space occupied by the local cache, and reduces the client's resource usage on the terminal device.

[0038] 2. Use a whitelist approach to resolve false positives introduced by Bloom filters. When a sample to be detected does not hit the security detection rules, it is determined to be a malicious sample and is directly intercepted. When a sample to be detected hits the security detection rules, it may be a malicious sample and is sent to the server for further judgment, reducing the possibility of client misjudgment.

[0039] 3. Use full security detection rules and incremental security detection rules for secondary caching to reduce missed judgments of whitelist rules, maintain real-time synchronization with security detection rules stored on the server, and reduce pressure on the server.

[0040] The embodiment of the present application provides a security detection method. The method in this embodiment can be applied to a computing device, which may include a terminal device, etc. Figure 2 The flowchart of the security detection method according to one embodiment of the present application is shown, including:

[0041] Step S201: Obtain security detection rules and samples to be detected.

[0042] Step S202: Perform security detection on the sample to be detected using security detection rules.

[0043] Among them, the security detection rules are stored based on bit arrays and hash functions.

[0044] The method in this embodiment is applied to the client.

[0045] Among them, security detection rules are rules used for security detection, which can specifically include regular rules, blacklist rules, whitelist rules, etc., which can be determined according to specific needs, and this application does not limit this. Among them, blacklist rules include Internet Protocol (IP) addresses, IP packets, emails, etc. of users who have malicious behavior and need to be punished or banned. Whitelist rules correspond to "blacklist rules", and the IP addresses, IP packets, emails, etc. of users in the whitelist rules can be passed first. The client can obtain security detection rules and samples to be detected from the server or locally. Security detection rules are stored based on bit arrays and hash functions, where bit arrays represent data through binary bits.

[0046] This application provides a security detection method. First, a security detection rule and a sample to be detected are obtained. Then, a security detection is performed on the sample to be detected using the security detection rule. The security detection rule is stored based on a bit array and a hash function. In this embodiment, the client stores the security detection rule based on the bit array and the hash function, which can reduce storage space. Furthermore, using the security detection rule stored based on the bit array and the hash function to perform security detection on the sample to be detected can increase the sample detection speed, thereby reducing the resource usage of the client on the terminal device.

[0047] The following describes the specific implementation methods of each of the above steps through multiple implementation methods:

[0048] In one implementation, security detection rules are stored based on a bit array and a hash function, and are implemented in the following manner: a hash calculation is performed on the security detection rules using a hash function to obtain multiple hash values; the multiple hash values ​​are mapped to multiple positions in the bit array, and the values ​​of the multiple positions are set to preset values, which are used to represent the existence of data.

[0049] In practical applications, security detection rules can be cached using a Bloom filter (BF). A Bloom filter is a highly space-efficient probabilistic data structure used to determine whether an element is in a set. A Bloom filter consists of a bit array and multiple hash functions. When an element is added to the Bloom filter, it is hashed using multiple hash functions, mapped to multiple locations in the bit array, and then the bits in these locations are set to 1. The number of bits in the bit array can be determined based on specific needs.

[0050] In this embodiment, the client stores security detection rules based on a bit array and a hash function, which can reduce storage space and thus reduce the resource occupation of the terminal device by the client.

[0051] In one example, 100 and 350 are stored in a Bloom filter, such as Figure 3 As shown, 100 is calculated by hash functions F1, F2, and F3 respectively, and mapped to positions 1, 4, and 7 of the bit array, and the values ​​of positions 1, 4, and 7 are set to 1. 350 is calculated by hash functions F1, F2, and F3 respectively, and mapped to positions 2, 6, and 8 of the bit array, and the values ​​of positions 2, 6, and 8 are set to 1. The values ​​of other positions are set to 0.

[0052] In another example, the security detection rules stored on the client are 1 billion in size. This can be stored using a bit array 10 times the size (to reduce false positives), which is 10 billion binary bits, or approximately 1.2GB in bytes. Using a hash table as used in related art would require at least 100GB of space. Therefore, storing security detection rules using bit arrays and hash functions can save a significant amount of storage space.

[0053] In one implementation, step S202 performs a security check on the sample to be tested using security detection rules, including: performing a hash calculation on the sample to be tested using a hash function to obtain multiple hash values; and querying whether the values ​​of multiple positions in the bit array corresponding to the multiple hash values ​​are preset values ​​based on the multiple hash values ​​and the mapping relationship.

[0054] In practical applications, security checks are performed on samples to be tested, specifically by querying whether the sample exists in a Bloom filter. When checking whether an element is in a set, a hash function is used to calculate the element's position in the bit array. If all these positions have a value of 1, the element is likely in the set. If any position has a value of 0, the element is not in the set.

[0055] In this embodiment, the client performs security detection on the sample to be detected using the security detection rules stored based on the bit array and the hash function, which can improve the sample detection speed.

[0056] In one example, if Figure 4 As shown, query whether 1500 is in the Bloom filter, use hash functions F1, F2, and F3 to calculate respectively, and get three hash values. The corresponding positions in the bit array are: position 1, position 4, and position 8. If the values ​​of position 1, position 4, and position 8 are all 1, it means that 1500 is in the Bloom filter. If the value of any position of position 1, position 4, and position 8 is not 1, it means that 1500 is not in the Bloom filter.

[0057] In one implementation, the security detection rules include whitelist rules. In step S202, a security detection is performed on the sample to be detected using the security detection rules, including: if the sample to be detected does not hit the whitelist rules, an interception action is performed.

[0058] In actual applications, security detection rules include whitelist rules, which are stored using Bloom filters. When performing security detection, it is checked whether the sample to be detected hits the whitelist rules. If the sample to be detected does not hit the whitelist rules, it means that the sample to be detected may be a malicious sample. If it is released, there may be security problems, so the interception action is performed.

[0059] In one implementation, the whitelist rules include full whitelist rules and incremental whitelist rules. In step S202, security detection is performed on the sample to be detected using the security detection rules, including: if the sample to be detected hits the full whitelist rules, determining whether the sample to be detected hits the incremental whitelist rules; if so, executing the release action.

[0060] Whitelist rules include full whitelist rules and incremental whitelist rules. Full whitelist rules are accumulated over a longer, preset period of time, while incremental whitelist rules are accumulated over a shorter period of time after the full whitelist rules are obtained. Incremental whitelist rules are closer to the current time. If a sample matches both the full and incremental whitelist rules, the sample is deemed safe and released.

[0061] In one implementation, the security detection method further includes: if the sample to be detected hits the incremental whitelist rule, sending the sample to be detected to the server for security detection, so that the server determines whether to add the sample to be detected to the whitelist rule.

[0062] In actual applications, if the sample to be tested hits the full whitelist rules but does not hit the incremental whitelist rules, the sample to be tested will be sent to the server for security testing. If the server determines that the sample to be tested is safe after security testing, the sample to be tested will be added to the whitelist rules. When the preset conditions are met, the whitelist rules will be sent to the client.

[0063] In this embodiment, using full whitelist rules and incremental whitelist rules for secondary caching can reduce missed judgments of whitelist rules, maintain real-time synchronization with whitelist rules stored on the server, and reduce the pressure on the server.

[0064] In one example, if Figure 5 As shown, the sample to be detected is traffic data, such as domain names or IP addresses. When samples such as domain names or IP addresses enter the client, a preliminary pre-judgment is first made. For example, by judging by timestamps, it is determined whether it is greater than the timestamp of the incremental whitelist. If so, it is sent to the server. The server makes a judgment through dynamic rules. The dynamic rules can be configured according to specific needs. If the dynamic rules are not hit, it means that it is a malicious sample and an interception action is performed. If the dynamic rules are hit, it is released, and the number of new whitelist rules stored in the rule center is increased by 1. If there is no timestamp greater than the incremental whitelist, it is determined whether the full whitelist rules are hit (such as Figure 5 If not, it means it is a malicious sample and the interception action is executed. If it hits the full whitelist rule, the release action is executed and then it is determined whether it hits the incremental whitelist rule (such as Figure 5If a sample matches the incremental whitelist rules, the sample is released and sent to the server for further analysis to determine whether to add it to the whitelist. If it doesn't match the incremental whitelist rules, it's considered malicious and is blocked.

[0065] In one implementation, step S201, obtaining security detection rules, includes: receiving security detection rules sent by the server; the security detection rules are sent by the server when it determines that the number of incremental security detection rules reaches a preset threshold.

[0066] In practice, a threshold for the number of incremental security detection rules is configured on the server. This threshold represents the difference in the number of security detection rules between the client and server—that is, the number of security detection rules that the client lacks but the server does, representing the difference in security capabilities between the client and server. This threshold can be adjusted dynamically to control the frequency of rule synchronization on the client. When the number of security detection rules stored on the server reaches the threshold, the incremental security rules are sent to the client, which then receives the security detection rules sent by the server.

[0067] In this embodiment, the client can quickly obtain the latest security detection rules generated by the server. The process of obtaining the rules can reduce the pressure on the server and realize the dynamic update of the security detection rules.

[0068] In one implementation, after obtaining the security detection rules, the security detection method further includes: when it is determined that a preset full merge time has arrived, merging the security detection rules into a full security detection rule set.

[0069] In one implementation, after obtaining the security detection rules, the security detection method further includes: when it is determined that a preset full merge time has not been reached, merging the security detection rules into an incremental security detection rule set.

[0070] Among them, the full merge time can be set according to specific needs.

[0071] In one example, the processing of security detection rules is as follows: Figure 6 As shown, the rule center is deployed on the server side, and the rule center is used to generate and store security detection rules. The security detection rules in this embodiment are whitelist rules, hereinafter referred to as rules. The rule center generates whitelist rules incrementally, first judging whether the number of newly added whitelist rules is greater than the preset threshold (such as Figure 6If the number of newly added whitelist rules is greater than the preset threshold), the rule will not be pushed and the number of newly added rules will be increased by 1. If the number of newly added whitelist rules is greater than the preset threshold, the server will push the new rules to the client, that is, push the incremental whitelist rules (such as Figure 6 The client determines whether the preset full merge time has been reached (such as Figure 6 If not, the rule is merged into the incremental rule set, updating the incremental rule list. If the preset full merge time is reached, the rule is merged into the full rule set, merging the incremental rule into the full whitelist rule set. A notification message is sent to the server, which resets the incremental rule count. During the rule merging process, the new incremental rules can be backed up to avoid affecting the security detection effect during the merging process.

[0072] Corresponding to the application scenario and method of the method provided in the embodiment of the present application, the embodiment of the present application also provides a safety detection device. Figure 7 FIG. 1 is a block diagram of a safety detection device according to an embodiment of the present invention, which includes:

[0073] The acquisition module 701 is used to obtain security detection rules and samples to be detected.

[0074] The detection module 702 is used to perform security detection on the sample to be detected using security detection rules.

[0075] Among them, the security detection rules are stored based on bit arrays and hash functions.

[0076] This application provides a security detection device that first obtains security detection rules and a sample to be detected; then, uses the security detection rules to perform a security detection on the sample to be detected; wherein the security detection rules are stored based on a bit array and a hash function. In this embodiment, the client stores the security detection rules based on the bit array and the hash function, which can reduce storage space; furthermore, using the security detection rules stored based on the bit array and the hash function to perform security detection on the sample to be detected can increase the sample detection speed, thereby reducing the resource usage of the client on the terminal device.

[0077] In one implementation, security detection rules are stored based on a bit array and a hash function, and are implemented in the following manner: a hash calculation is performed on the security detection rules using a hash function to obtain multiple hash values; the multiple hash values ​​are mapped to multiple positions in the bit array, and the values ​​of the multiple positions are set to preset values, which are used to represent the existence of data.

[0078] In one implementation, the detection module 702 is configured to: perform hash calculation on a sample to be detected using a hash function to obtain multiple hash values; and query whether the values ​​of multiple positions in a bit array corresponding to the multiple hash values ​​are preset values ​​based on the multiple hash values ​​and the mapping relationship.

[0079] In one implementation, the security detection rule includes a whitelist rule, and the detection module 702 is configured to: execute an interception action if the sample to be detected does not hit the whitelist rule.

[0080] In one implementation, the whitelist rules include full whitelist rules and incremental whitelist rules. The detection module 702 is used to: if the sample to be detected hits the full whitelist rules, determine whether the sample to be detected hits the incremental whitelist rules; if so, perform a release action.

[0081] In one implementation, the security detection device is further configured to: if the sample to be detected hits the incremental whitelist rule, send the sample to be detected to the server for security detection, so that the server determines whether to add the sample to be detected to the whitelist rule.

[0082] In one implementation, the acquisition module 701 is configured to receive security detection rules sent by a server. The security detection rules are sent by the server when the server determines that the number of incremental security detection rules reaches a preset threshold.

[0083] In one implementation, the security detection device is further configured to: after obtaining the security detection rules, merge the security detection rules into the full security detection rule set when it is determined that a preset full merge time has arrived.

[0084] In one implementation, the security detection device is further configured to: after obtaining the security detection rules, when it is determined that a preset full merge time has not been reached, merge the security detection rules into an incremental security detection rule set.

[0085] The functions of each module in the embodiment of the present application can be referred to the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0086] The embodiment of the present application provides a security detection system, including a client and a server;

[0087] The client is used to obtain security detection rules and samples to be detected from the server. The security detection rules are stored based on bit arrays and hash functions. The client uses the security detection rules to perform security detection on the samples to be detected.

[0088] The server is used to generate security detection rules. When it is determined that the number of incremental security detection rules reaches a preset threshold, it sends the incremental security detection rules to the client; receives samples that have passed the security detection sent by the client, and performs security detection on the samples that have passed the security detection.

[0089] Among them, the specific working processes of the client and the server in the embodiment of the present application can be referred to the corresponding description in the above method, and have corresponding beneficial effects, which will not be repeated here.

[0090] Figure 8 FIG. 1 is a block diagram of an electronic device for implementing an embodiment of the present application. Figure 8 As shown, the electronic device includes: a memory 810 and a processor 820. The memory 810 stores a computer program that can be run on the processor 820. When the processor 820 executes the computer program, the method in the above embodiment is implemented. The number of the memory 810 and the processor 820 can be one or more.

[0091] The electronic device also includes:

[0092] The communication interface 830 is used to communicate with external devices and perform data exchange transmission.

[0093] If the memory 810, the processor 820, and the communication interface 830 are implemented independently, the memory 810, the processor 820, and the communication interface 830 can be connected to each other via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0094] Optionally, in a specific implementation, if the memory 810, the processor 820 and the communication interface 830 are integrated on a chip, the memory 810, the processor 820 and the communication interface 830 can communicate with each other through an internal interface.

[0095] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which implements the method provided in the embodiment of the present application when the program is executed by a processor.

[0096] An embodiment of the present application provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the method provided in the embodiment of the present application is implemented.

[0097] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided in the embodiment of the present application.

[0098] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory. The input interface, the output interface, the processor and the memory are connected through an internal connection path. The processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0099] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor that supports the Advanced RISC Machines (ARM) architecture.

[0100] Furthermore, optionally, the above-mentioned memory may include a read-only memory and a random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct memory bus random access memory (DR RAM).

[0101] In the above embodiments, all or part of the embodiments may be implemented using software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments may be implemented in the form of a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions according to the present application are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0102] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials, or characteristics described may be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification, as well as features of different embodiments or examples, unless they are mutually inconsistent.

[0103] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. Throughout the description of this application, "plurality" means two or more, unless otherwise specifically defined.

[0104] Any process or method described in the flowchart or otherwise described herein can be understood to represent a module, segment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process. The scope of the preferred embodiments of the present application includes other implementations in which the functions may be performed in a different order than shown or discussed, including performing the functions substantially simultaneously or in reverse order depending on the functions involved.

[0105] The logic and / or steps described in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with such instruction execution systems, apparatuses or devices.

[0106] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiment.

[0107] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing module, or each unit may exist physically separately, or two or more units may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or in the form of software functional modules. If the aforementioned integrated modules are implemented in the form of software functional modules and sold or used as independent products, they may also be stored in a computer-readable storage medium. The storage medium may be a read-only memory, a magnetic disk, or an optical disk, etc.

[0108] The above is merely an exemplary embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various modifications or substitutions within the technical scope described in this application, and such modifications or substitutions should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A safety detection method, characterized in that: The method is applied to a client, and includes: Obtain security detection rules and samples to be tested; Performing a safety test on the sample to be tested using the safety test rules; The security detection rules are stored based on bit arrays and hash functions.

2. The method according to claim 1, characterized in that The security detection rules are stored based on bit arrays and hash functions and are implemented in the following way: Performing hash calculation on the security detection rule using the hash function to obtain multiple hash values; The multiple hash values ​​are mapped to multiple positions in the bit array, and the values ​​of the multiple positions are set to preset values, where the preset values ​​are used to indicate that data exists.

3. The method according to claim 1, characterized in that The step of performing a safety test on the sample to be tested by using the safety test rule includes: Performing hash calculation on the sample to be detected using the hash function to obtain multiple hash values; According to the multiple hash values ​​and the mapping relationship, it is queried whether the values ​​of multiple positions in the bit array corresponding to the multiple hash values ​​are preset values.

4. The method according to any one of claims 1 to 3, characterized in that The security detection rules include whitelist rules, and the security detection of the sample to be detected using the security detection rules includes: If the sample to be detected does not match the whitelist rule, an interception action is performed.

5. The method according to claim 4, characterized in that The whitelist rules include full whitelist rules and incremental whitelist rules. The security detection rules are used to perform security detection on the sample to be detected, including: If the sample to be detected hits the full whitelist rule, it is determined whether the sample to be detected hits the incremental whitelist rule. If it hits, a release action is performed.

6. The method according to claim 5, characterized in that The method further comprises: If the sample to be detected hits the incremental whitelist rule, the sample to be detected is sent to the server for security detection, so that the server determines whether to add the sample to be detected to the whitelist rule.

7. The method according to any one of claims 1 to 3, characterized in that Obtain security detection rules, including: Receive the security detection rule sent by the server; the security detection rule is sent when the server determines that the number of incremental security detection rules reaches a preset threshold.

8. The method according to any one of claims 1 to 3, characterized in that After obtaining the security detection rules, the method further includes: When it is determined that the preset full merging time has arrived, the security detection rules are merged into the full security detection rule set.

9. The method according to any one of claims 1 to 3, characterized in that After obtaining the security detection rules, the method further includes: When it is determined that the preset full merge time has not been reached, the security detection rules are merged into the incremental security detection rule set.

10. A safety detection device, characterized in that: The device comprises: The acquisition module is used to obtain security detection rules and samples to be detected; A detection module, configured to perform a safety detection on the sample to be detected using the safety detection rules; The security detection rules are stored based on bit arrays and hash functions.

11. A safety detection system, characterized in that: The system includes a client and a server; The client is used to obtain security detection rules and samples to be detected from the server, wherein the security detection rules are stored based on a bit array and a hash function; Performing a safety test on the sample to be tested using the safety test rules; The server is used to generate security detection rules, and when it is determined that the number of incremental security detection rules reaches a preset threshold, send the incremental security detection rules to the client; receive samples that pass the security detection sent by the client, and perform security detection on the samples that pass the security detection.

12. An electronic device, characterized in that: The electronic device includes a memory, a processor, and a computer program stored in the memory, and the processor implements the method according to any one of claims 1 to 9 when executing the computer program.

13. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

14. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images