Clustering Method, Device, Electronic Device and Storage Medium for Virus Samples

Abstract

A clustering method, device, electronic device, and storage medium for virus samples are disclosed to cluster the attacking viruses for processing to improve security. The clustering method includes: obtaining the behavioral characteristics of the virus samples to be clustered; generating a group of behavior identifiers for the behavioral characteristics of the virus samples based on a preset reference set of behavioral characteristics, where each reference behavioral characteristic in the preset reference set of behavioral characteristics has a unique behavior identifier; generating a group characteristic value for indicating the virus family to which the virus sample belongs based on the group of behavior identifiers of the virus sample; generating an ethnic group characteristic value for indicating the virus ethnic group to which the virus sample belongs based on the group characteristic value of the virus sample, where each virus ethnic group includes at least one virus family; and clustering the virus samples based on the group characteristic value and the ethnic group characteristic value of the virus sample.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and more particularly, to a clustering method, apparatus, electronic device, and storage medium for virus samples. Background Art

[0002] With the rise of the Internet era, the types and quantities of computer viruses have grown explosively. Security vendors receive thousands of virus samples every day. To quickly handle the security threats posed by these virus samples, security vendors need to quickly and accurately extract commonalities from these virus samples and classify them into families, so as to provide solutions based on virus families. One of the existing solutions is a virus family clustering method based on relational data. This method discovers similar virus samples through associations between nodes, that is, virus samples belonging to the same virus family. For example, if different virus samples access the same IP or domain name, it is considered that these different virus samples belong to the same virus family. However, this situation is prone to generating interfering data. For example, if a browser accesses the domain name of a virus, the browser program will be classified into a certain virus family, resulting in inaccurate or unstable clustering results.

[0003] Therefore, there is a need for a clustering method for virus samples with simple operation, small computational complexity, and high stability. Summary of the Invention

[0004] Embodiments of the present disclosure provide a clustering method for virus samples, including: obtaining at least one behavior feature of a virus sample to be clustered; generating a behavior identification group for at least one behavior feature of the virus sample based on a preset reference behavior feature set, where each reference behavior feature in the preset reference behavior feature set has a unique behavior identification; generating a group feature value of the virus sample based on the behavior identification group of the virus sample, where the group feature value is used to indicate the virus family to which the virus sample belongs; generating an ethnic group feature value of the virus sample based on the group feature value of the virus sample, where the ethnic group feature value is used to indicate the virus ethnic group to which the virus sample belongs, and each virus ethnic group includes at least one virus family; and clustering the virus sample based on the group feature value and ethnic group feature value of the virus sample to determine the virus ethnic group and virus family to which the virus sample belongs.

[0005] According to an embodiment of the present disclosure, clustering the virus sample based on the group feature value and ethnic group feature value of the virus sample includes: determining a target ethnic group of the virus sample based on the ethnic group feature value of the virus sample; and determining a target family of the virus sample based on the target ethnic group and the group feature value of the virus sample.

[0006] According to an embodiment of the present disclosure, determining the target ethnic group of the virus sample based on the ethnic group characteristic value of the virus sample includes: obtaining the ethnic group characteristic values of at least one candidate ethnic group; comparing the ethnic group characteristic value of the virus sample with the ethnic group characteristic values of the at least one candidate ethnic group; when there is a candidate ethnic group having an ethnic group characteristic value identical to the ethnic group characteristic value of the virus sample, determining the candidate ethnic group as the target ethnic group of the virus sample; and when there is no candidate ethnic group having an ethnic group characteristic value identical to the ethnic group characteristic value of the virus sample, creating a new virus ethnic group and determining the new virus ethnic group as the target ethnic group of the virus sample.

[0007] According to an embodiment of the present disclosure, determining the target family of the virus sample based on the target ethnic group and the group characteristic value of the virus sample includes: when the target ethnic group is a candidate ethnic group, obtaining the family characteristic values of at least one candidate family included in the candidate ethnic group; matching the group characteristic value of the virus sample with the family characteristic values of the at least one candidate family; when there is a candidate family having a family characteristic value matching the group characteristic value of the virus sample, determining the candidate family as the target family of the virus sample; when there is no candidate family having a family characteristic value matching the group characteristic value of the virus sample, creating a new virus family and determining the new virus family as the target family of the virus sample; and when the target ethnic group is a new virus ethnic group, creating a new virus family in the new virus ethnic group and determining the new virus family as the target family of the virus sample.

[0008] According to an embodiment of the present disclosure, generating the group characteristic value of the virus sample based on the behavior identification group of the virus sample includes: calculating the hash value of each behavior identification in the behavior identification group, where the hash value of the behavior identification includes a first number of bits; and generating the group characteristic value of the virus sample based on the hash values of each behavior identification in the behavior identification group, where the group characteristic value includes a first number of bits.

[0009] According to an embodiment of the present disclosure, generating a group feature value of the virus sample based on the hash value of each behavior identifier in the behavior identifier group includes: constructing a hash matrix using the hash value of each behavior identifier in the behavior identifier group, where the hash value of each behavior identifier serves as the first direction vector of the hash matrix, and the first direction vector has a first dimension, and the first dimension is the same as the first quantity; for each second direction vector in the hash matrix, calculating the eigenvalue of the second direction vector, where the second direction vector has a second dimension, and the number of the second dimension is the same as the number of behavior identifiers of the virus sample; generating the group feature value of the virus sample using the eigenvalues of each second direction vector in the hash matrix, where the group feature value has a first dimension, and where the first direction vector is a row vector and the second direction vector is a column vector, or the first direction vector is a column vector and the second direction vector is a row vector.

[0010] According to an embodiment of the present disclosure, where the second direction vector includes at least one first value and at least one second value, and calculating the eigenvalue of the second direction vector for each second direction vector in the hash matrix includes: obtaining an initial value of the eigenvalue; for each first value in the second direction vector, increasing the eigenvalue by a first cumulative value to update the eigenvalue; for each second value in the second direction vector, increasing the eigenvalue by a second cumulative value to update the eigenvalue; and using the updated eigenvalue as the eigenvalue of the second direction vector, where the first cumulative value is different from the second cumulative value.

[0011] According to an embodiment of the present disclosure, generating the group feature value of the virus sample using the eigenvalues of each second direction vector in the hash matrix includes: for each second direction vector, performing a binary conversion on its eigenvalue and using the converted value as the value corresponding to the second direction vector, and combining the values corresponding to all second direction vectors to obtain the group feature value of the virus sample.

[0012] According to an embodiment of the present disclosure, generating an ethnic group feature value of the virus sample based on the group feature value of the virus sample includes: numbering the first quantity of bits in the group feature value to obtain the first quantity of numbers; performing a numerical mapping on the numbers to obtain the first quantity of mapped values; selecting at least one of the mapped values based on the values of the first quantity of bits in the group feature value; and generating the ethnic group feature value using the at least one mapped value.

[0013] According to an embodiment of the present disclosure, among the values of the first number of bits in the group feature values, determine the second number of bits having a first value, where the second number is less than or equal to the first number, determine the second number of numbers corresponding to the second number of bits respectively, sort the second number of mapping values corresponding to the second number of numbers from small to large, select the smallest third number of mapping values, and sort the third number of mapping values in ascending order according to their corresponding numbers to form an array, and use the array as the ethnic group feature value.

[0014] According to an embodiment of the present disclosure, based on a preset reference behavior feature set, generate a behavior identification group for at least one behavior feature of the virus sample, including: for each behavior feature in the at least one behavior feature, match it with each reference behavior feature in the preset reference behavior feature set, and when the behavior feature has a matching reference behavior feature, use the behavior identification of the reference behavior feature as the behavior identification of the behavior feature; and when the number of behavior identifications of the virus sample exceeds a predetermined number threshold, combine the behavior identifications of the virus sample into the behavior identification group of the virus sample.

[0015] An embodiment of the present disclosure provides a clustering device for virus samples, including: an acquisition module, a generation module, and a clustering module. The acquisition module is used to acquire at least one behavior feature of the virus sample. The generation module is used to: based on a preset reference behavior feature set, generate a behavior identification group for at least one behavior feature of the virus sample, where each reference behavior feature in the preset reference behavior feature set has a unique behavior identification; based on the behavior identification group of the virus sample, generate a group feature value of the virus sample, where the group feature value is used to indicate the virus family to which the virus sample belongs; and based on the group feature value of the virus sample, generate an ethnic group feature value of the virus sample, where the ethnic group feature value is used to indicate the virus ethnic group to which the virus sample belongs, and each virus ethnic group includes at least one virus family. The clustering module is used to cluster the virus sample based on the group feature value and the ethnic group feature value of the virus sample to determine the virus ethnic group and virus family to which the virus sample belongs.

[0016] According to an embodiment of the present disclosure, clustering the virus sample based on the group feature value and the ethnic group feature value of the virus sample includes: determining the target ethnic group of the virus sample based on the ethnic group feature value of the virus sample; and determining the target family of the virus sample based on the target ethnic group and the group feature value of the virus sample.

[0017] Embodiments of the present disclosure provide an electronic device, including: at least one memory and at least one processor; the memory stores a program, and the processor calls the program stored in the memory, and the program is used to implement the clustering method of virus samples as described above.

[0018] Embodiments of the present disclosure provide a computer-readable storage medium, on which computer-executable instructions are stored, and the instructions are used to implement the clustering method of virus samples as described above when executed by a processor.

[0019] Embodiments of the present disclosure provide a computer program product or a computer program. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the clustering method of virus samples according to the embodiments of the present disclosure.

[0020] Embodiments of the present disclosure provide a clustering method, device, electronic device and storage medium for virus samples. The clustering technology of virus samples provided by the embodiments of the present disclosure can rely less on the environment and device attributes because the types of parameters required for executing the method are few (for example, only the behavior identification group and the sample identification are required). And because the behavior identification group can stably reflect the behavior characteristics of virus samples, the clustering results are more stable. And because the virus samples are initially classified based on the ethnic group characteristic values, and the storage resources and computing resources occupied by the ethnic group characteristic values can be less, the operation efficiency can be greatly improved, so as to support massive data operations to achieve the clustering of a large number of virus samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some exemplary embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 Shows a schematic flowchart of a clustering method for virus samples according to an embodiment of the present disclosure.

[0023] Figure 2 Shows a schematic diagram of an example process for generating group characteristic values of virus samples according to an embodiment of the present disclosure.

[0024] Figure 3 Shows a schematic flowchart of another clustering method for virus samples according to an embodiment of the present disclosure, where each sub-step of step S140 is shown.

[0025] Figure 4 A schematic diagram showing an example process of generating population characteristic values of virus samples according to an embodiment of the present disclosure.

[0026] Figure 5 Shows as according to an embodiment of the present disclosure Figure 1 The sub-steps of step S150 in the clustering method shown.

[0027] Figure 6 A schematic scenario diagram for clustering virus samples according to an embodiment of the present disclosure.

[0028] Figure 7 A structural block diagram of a clustering device for virus samples according to an embodiment of the present disclosure.

[0029] Figure 8 A structural block diagram of a clustering system for virus samples according to an embodiment of the present disclosure.

[0030] Figure 9 A structural block diagram of an electronic device according to an embodiment of the present disclosure. Detailed implementation manners

[0031] In order to make the objectives, technical solutions and advantages of the present disclosure more apparent, example embodiments according to the present disclosure will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all embodiments of the present disclosure. It should be understood that the present disclosure is not limited by the example embodiments described herein.

[0032] In this specification and the accompanying drawings, substantially the same or similar steps and elements are denoted by the same or similar reference numerals, and the repeated description of these steps and elements will be omitted. At the same time, in the description of the present disclosure, terms such as "first", "second", etc. are only used for distinguishing descriptions, and cannot be understood as indicating or implying relative importance or order.

[0033] Cloud Security refers to the general term for security software, hardware, users, organizations, and security cloud platforms based on the cloud computing business model. Cloud Security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through the abnormal monitoring of software behavior by a large number of client ends in a mesh network, the latest information about Trojans and malicious programs on the Internet is obtained and sent to the server side for automatic analysis and processing. Then, the solutions for viruses and Trojans are distributed to each client end. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, as well as big data and artificial intelligence platforms.

[0034] The main research directions of cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack prevention, compliance auditing, etc.; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize the security protection mechanism, including building a super-large-scale security event, information collection and processing platform through cloud computing technology to achieve the collection and correlation analysis of massive information, and enhancing the ability to control security events and risk control capabilities across the network; 3. Cloud security services, which mainly study various security services provided for users based on the cloud computing platform, such as anti-virus services.

[0035] The embodiments of the present disclosure relate to the processing scenario of virus clustering. For the convenience of understanding, some basic concepts related to the embodiments of the present disclosure are first introduced below. Virus family: Existing viruses are developed by different people, so there must be many differences in code style and behavior characteristics. According to these characteristics, viruses can be classified into different virus families.

[0036] Hash algorithm: It can transform a "string" of any length into a binary number with a fixed number of bits, and it is an irreversible string transformation algorithm.

[0037] MD5 algorithm: The full English name is Message Digest Algorithm MD5, which is translated as Message Digest Algorithm Version 5. It is one of many hash algorithms and generates a 128-bit binary number or a 32-bit hexadecimal number.

[0038] Perfect Hash Function (PHF): A hash function without collisions. That is, the function H(·) maps N KEY values to M integers, where both M and N are integers greater than 0, and M >= N. Moreover, for any two KEY values, denoted as KEY1 and KEY2, H(KEY1) is never equal to H(KEY2), then H(·) is called a perfect hash function.

[0039] TTPs: TTPs is an abbreviation for Tactics, Techniques, and Procedures. TTPs can be used in network security. Attack organizations or the virus samples they generate usually have common attack steps or processes, and different attack organizations and virus samples also have their own unique attack habits and attack methods, which are also reflected in the virus samples generated by these attack organizations. Table 1 shows the currently common attack processes and types of attack methods. As shown in Table 1, the attack processes include: initial entry, executing attacks, attack persistence, privilege escalation, etc. Each attack process will have corresponding multiple attack methods. For example, the attack methods corresponding to the initial entry include watering hole attacks, exploiting public vulnerabilities attacks, hardware attacks, and so on.

[0040]

Table 1

[0041]

[0042]

[0043] The above table only lists some examples of the attack process and its attack methods. Each attack method can correspond to a certain behavior exhibited by an existing virus sample (for example, calling a program, modifying the registry, etc.). This correspondence is known, and the virus behaviors currently known in the art can be extracted as corresponding behavior rules, that is, reference behaviors, thereby forming multiple reference behaviors corresponding to multiple attack methods as a preset reference behavior feature set, and a single reference behavior feature can be marked with a unique behavior identifier (for example, represented by a numerical value, and the behavior identifier is represented by TID in some places below). As the virus types are updated, those skilled in the art can continuously update the preset reference behavior feature set to make it as complete as possible. At the same time, in order to obtain the behavioral characteristics of the virus sample, the virus sample can be run in a virtual environment (such as a sandbox). After running the virus sample, a behavior log consisting of multiple behavioral characteristics of the virus sample is obtained, and the behavior log is matched with a preset reference behavior feature set. The multiple behavioral characteristics involved in the behavior log can hit multiple different reference behaviors in the preset reference behavior feature set, and a TID combination (for example, [3, 5, 12, 33]) is generated. This TID combination can be regarded as the TTPs of the virus sample, which can stably reflect the behavioral characteristics of the virus sample and is also called a behavior identification group.

[0044] Euclidean distance: also known as Euclidean distance or Euclidean metric, is used to represent the "ordinary" (i.e. straight-line) distance between two points in Euclidean space. In Euclidean space, taking n-dimensional space as an example, n is an integer greater than or equal to 1, and point x = (x1,...,x n ) and y=(y1,...,y n ) is:

[0045]

[0046] The embodiments of the present disclosure will be further described below with reference to the accompanying drawings.

[0047] Figure 1 A schematic flow chart of a method for clustering virus samples according to an embodiment of the present disclosure is shown.

[0048] In step S110, at least one behavioral feature of the virus sample is obtained.

[0049] Optionally, the behavioral characteristics of the virus sample to be clustered can be obtained in the following manner: the virus sample is input into a virtual operating environment, such as a sandbox, and after the virus sample is run in the virtual operating environment, a behavioral log consisting of multiple behavioral characteristics exhibited by the virus sample is obtained, and the behavioral log can describe the multiple behavioral characteristics of the virus sample.

[0050] In step S120, based on a preset reference behavior feature set, a behavior identification group of at least one behavior feature for the virus sample is generated, wherein each reference behavior feature in the preset reference behavior feature set has a unique behavior identification.

[0051] As described above, multiple behavior features of the virus sample can hit multiple different reference behavior features in the preset reference behavior feature set, and based on this, the behavior identification group of the virus sample can be obtained.

[0052] Specifically, for each behavior feature, it is matched with each reference behavior feature in the preset reference behavior feature set, and when the behavior feature has a matching reference behavior feature, the behavior identification of the reference behavior feature is used as the behavior identification of this behavior feature. The behavior identifications possessed by the virus sample are combined into the behavior identification group of the virus sample, and this behavior identification group can be represented by TTPs in this article.

[0053] For example, the preset reference behavior feature set includes {reference behavior feature 1, reference behavior feature 2, reference behavior feature 3,... reference behavior feature 12,...}, and reference behavior feature 1 is marked as TID = 3, reference behavior feature 2 is marked as TID = 11, reference behavior feature 3 is marked as TID = 21,... reference behavior feature 12 is marked as TID = 49, and so on. When multiple behavior features of the virus sample hit reference behavior features 1, 3, and 12, the behavior identification group (TTPs) of the virus sample is generated: {3, 21, 49}.

[0054] In addition, since the larger the number of behavior identifications possessed by the virus sample, that is, the more reference behavior features in the preset reference behavior feature set are hit, it indicates that the behavior features extracted from the virus sample are more complete and the accuracy of this clustering method is higher. Therefore, in some specific embodiments, only when the number of behavior identifications possessed by the virus sample to be clustered exceeds a predetermined quantity threshold, the behavior identifications possessed by the virus sample are combined into the behavior identification group of the virus sample for subsequent operations based on this behavior identification group.

[0055] In step S130, based on the behavior identification group of the virus sample, a group feature value of the virus sample is generated, and the group feature value is used to indicate the virus family to which the virus sample belongs.

[0056] Optionally, the group eigenvalue of the virus sample can be generated in the following manner: for each behavior identifier in the behavior identifier group of the virus sample, calculate the hash value of the behavior identifier, where the hash value of the behavior identifier includes a first number of bits; and based on the hash values of each behavior identifier in the behavior identifier group, generate the group eigenvalue of the virus sample, where the group eigenvalue includes a first number of bits. The first number is determined by the type of hash operation performed on the behavior identifiers in the behavior identifier group.

[0057] More specifically, after obtaining the hash value of each behavior identifier, a hash matrix is constructed using the hash values of each behavior identifier in the behavior identifier group, where the hash value of each behavior identifier serves as the first direction vector of the hash matrix, and the first direction vector has a first dimension, and the first dimension is the same as the first number; for each second direction vector in the hash matrix, calculate the eigenvalue of the second direction vector, where the second direction vector has a second dimension, and the number of the second dimension is the same as the number of behavior identifiers that the virus sample has; use the eigenvalues of each second direction vector in the hash matrix to generate the group eigenvalue of the virus sample, and the group eigenvalue has a first dimension, where the first direction vector is a row vector and the second direction vector is a column vector, or the first direction vector is a column vector and the second direction vector is a row vector.

[0058] For example, the hash value of the behavior identifier is the hash value calculated for the behavior identifier based on the MD5 algorithm, where the hash value calculated based on MD5 (hereinafter simply referred to as the MD5 value) is a binary number with a length of 128 bits. Therefore, when the MD5 value of each behavior identifier serves as the first direction vector of the hash matrix, the first dimension of the first direction vector is 128. In addition, assume that the behavior identifier group (TTPs) includes N behavior identifiers, and N is an integer greater than or equal to 1, then the second dimension of the second direction vector of the hash matrix is N. Of course, the first dimension and the second dimension are equivalent and can be interchanged, that is, the second dimension of the hash matrix can be 128, and the first dimension can be N.

[0059] Meanwhile, each second direction vector includes at least one first value and at least one second value (such as binary 1 and 0 in the case where the hash value of the behavior identifier is in the MD5 value format). Therefore, the eigenvalue of each second direction vector in the hash matrix can be calculated in the following manner: Obtain the initial value of the eigenvalue (such as 0); for each first value in the second direction vector, increase the eigenvalue by a first accumulation value (such as 1) to update the eigenvalue; for each second value in the second direction vector, increase the eigenvalue by a second accumulation value (such as -1) to update the eigenvalue; use the updated eigenvalue as the eigenvalue of the second direction vector. The first accumulation value and the second accumulation value are different. Thereafter, binarize the eigenvalue of each second direction vector, and use the value after binarization as the value corresponding to the second direction vector, and combine the values corresponding to all second direction vectors to obtain the group eigenvalue of the virus sample.

[0060] The following will combine Figure 2 to describe in more detail the schematic diagram of the example process for generating the group eigenvalue of the virus sample in this case.

[0061] As Figure 2 shown, the behavior identifier group (TTPs) includes N behavior identifiers TID_1, TID_2,..., TID_N, where N is an integer greater than or equal to 1. The MD5 value calculated for each behavior identifier (TID_i, where i is greater than or equal to 1 and less than or equal to N) is a binary number with a length of 128 bits. Therefore, a total of N binary numbers with a length of 128 bits are obtained, such as Figure 2 MD5_1, MD5_2,..., MD5_N shown in 128*N , which respectively correspond to TID_1, TID_2,..., TID_N. Therefore, the hash matrix A can be constructed, A ∈ R 128*N . The first bit of MD5_1, the first bit of MD5_2,..., the first bit of MD5_N form the first second direction vector, the second bit of MD5_1, the second bit of MD5_2,..., the first bit of MD5_N form the second second direction vector, and so on. A total of 128 second direction vectors are obtained.

[0062] For the first second direction vector, assume that the initial value of the eigenvalue of the second direction vector is 0. If the value of the first bit of the second direction vector is 1, then add 1 to the eigenvalue (increase the first accumulation value by 1), and if the value of the first bit of the second direction vector is 0, then subtract 1 from the eigenvalue (increase the second accumulation value by -1). Iteratively perform this process from the first bit to the Nth bit of the second direction vector to obtain the eigenvalue of the first second direction vector, and perform binary conversion on the eigenvalue. That is, if the eigenvalue is greater than or equal to the binary conversion reference value (for example, 0), then set it to 1, and if the eigenvalue is less than the binary conversion reference value, then set it to 0. Calculate the eigenvalues (and perform binary conversion) of the second, third, …, 128th second direction vectors in sequence through the same process, and concatenate and combine the eigenvalues of each second direction vector after binary conversion to obtain a 128-bit array, and this 128-bit array is the group eigenvalue of the behavior identification group. It should be understood that the first accumulation value and the second accumulation value can be selected according to actual needs, and the binary conversion reference value can also be selected according to actual needs (for example, other integers not equal to 0).

[0063] In step S140, based on the group eigenvalue of the virus sample, generate the ethnic group eigenvalue of the virus sample. The ethnic group eigenvalue is used to indicate the virus ethnic group to which the virus sample belongs, and each virus ethnic group includes at least one virus family.

[0064] Optionally, step S140 may include the following sub-steps, as Figure 3 shown. Figure 3 FIG. shows a schematic flowchart of another clustering method according to an embodiment of the present disclosure, where the sub-steps of step S140 are specifically shown.

[0065] In Figure 3 the steps S110-130 and S150 are the same as the steps S110-130 and S150 described in reference Figure 1 and will not be described again here. The following further describes step S140.

[0066] In sub-step S1401, number the first number of bits in the group eigenvalue.

[0067] For example, the first number of bits can be sequentially numbered starting from the integer 1 at an interval of 1. Of course, other numbering methods are also feasible, and the present disclosure does not limit this.

[0068] In sub-step S1402, perform numerical mapping on the numbers to obtain the first number of mapped values.

[0069] For example, a numerical mapping is a process of mapping numerical values of one set to numerical values of another set according to a certain rule, and the number of numerical values included in the two sets may be the same or different. In the present disclosure, a one-to-one numerical mapping of numbers can be performed through a hash function, and more specifically, for example, through a perfect hash function.

[0070] In sub-step S1403, at least one mapping value among the first number of mapping values is selected based on the values of the first number of bits.

[0071] For example, in sub-step S1403, the values of the second number of bits having the first value can be determined among the values of the first number of bits, where the second number is less than or equal to the first number, the second number of numbers corresponding to the second number of hash values is determined, the second number of mapping values corresponding to the second number of numbers is sorted from smallest to largest, and the smallest third number of mapping values is selected.

[0072] In sub-step S1404, an ethnic group characteristic value is generated using at least one mapping value.

[0073] For example, in sub-step S1404, the third number of mapping values can be sorted from smallest to largest according to their corresponding numbers to form an array, and this array is used as the ethnic group characteristic value.

[0074] The following will be combined with Figure 4 A schematic diagram of an example process for generating the ethnic group characteristic value of the virus sample will be described in more detail. The following is still described based on the above reference Figure 2 The described situation.

[0075] As Figure 4 shown, each bit of the group characteristic value of the behavior identification group is numbered from 1 to 128, and the numbers 1 to 128 are mapped (for example, through a perfect hash function) to obtain a sequence F composed of 128 mapping values f(i) (i is greater than or equal to 1 and less than or equal to 128), and each mapping value f(i) corresponds to a number one by one. Then, m bits with a value of 1 among the 128 bits of the group characteristic value are determined; the mapping values corresponding to the numbers of the m bits are sorted from smallest to largest, and the smallest p mapping integers are selected and sorted from smallest to largest according to the numbers to form an array (p is greater than or equal to 1 and less than or equal to m), and this array is used as the ethnic group characteristic value of the virus sample.

[0076] For example, in Figure 4Among them, the group characteristic value of the behavior identification group is shown as [1, 0, 1, 1, 1, 0, …, 1] (assuming that the unshown bits are all 0), and the 128 mapping values f(x) obtained by performing a perfect hash function mapping on the numbers 1 - 128 form a sequence F as [23, 11, 3, 4, 5, 6, …, 110] (assuming that the other values in the unshown sequence F are all larger than the shown values). Then, it is determined that the numbers of the bits with a value of 1 among the 128 bits of this group characteristic value are 1, 3, 4, 5, and 128, and the corresponding mapping values of the numbers 1, 3, 4, 5, and 128 are [23, 3, 4, 35, 110] respectively. Assuming p = 3, that is, the smallest 3 mapping values are selected, and in the order of the numbers from smallest to largest, the array [23, 3, 4] is used as the ethnic group characteristic value of this virus sample.

[0077] In step S150, based on the group characteristic value and the ethnic group characteristic value of the virus sample, clustering is performed on the virus sample to determine the virus ethnic group and virus family to which the virus sample belongs.

[0078] Optionally, based on the ethnic group characteristic value of the virus sample, the target ethnic group of the virus sample is determined; and based on the target ethnic group and the group characteristic value of the virus sample, the target family of the virus sample is determined.

[0079] More specifically, based on the ethnic group characteristic value of the virus sample, determining the target ethnic group of the virus sample may include the following sub - steps, as Figure 5 shown. Figure 5 shows the sub - steps of step S150 in the clustering method as Figure 1 shown according to an embodiment of the present disclosure.

[0080] In sub - step S1501, obtain the ethnic group characteristic values of at least one candidate ethnic group.

[0081] For example, for each candidate ethnic group, its ethnic group characteristic value is known and has been stored in a storage device (such as a memory, a flash memory device, etc.), so each ethnic group characteristic value of each candidate ethnic group can be read from this storage device.

[0082] In sub - step S1502, compare the ethnic group characteristic value of this virus sample with the ethnic group characteristic values of the at least one candidate ethnic group.

[0083] For example, the ethnic group characteristic value of the virus sample can be obtained based on the method described in Figure 2 and Figure 4 and as described above, each ethnic group characteristic value of each candidate ethnic group can be read from the storage device, and the ethnic group characteristic value of the virus sample is compared with the various ethnic group characteristic values read from this storage device. For example, each bit in the ethnic group characteristic value of the virus sample is compared with each bit in each ethnic group characteristic value in turn.

[0084] In sub-step S1503, when there is a candidate ethnic group with an ethnic group eigenvalue identical to that of the virus sample, the candidate ethnic group is determined as the target ethnic group of the virus sample.

[0085] For example, when the ethnic group eigenvalue of the virus sample is identical to that of a candidate ethnic group, the candidate ethnic group is determined as the target ethnic group of the virus sample. In sub-step S1504, when there is no candidate ethnic group with an ethnic group eigenvalue identical to that of the virus sample, a new virus ethnic group is created, and the new virus ethnic group is determined as the target ethnic group of the virus sample.

[0086] For example, when the ethnic group eigenvalue of the virus sample is not identical to that of any candidate ethnic group, a new virus ethnic group is created for the virus sample.

[0087] In another case, when the ethnic group eigenvalues of no candidate ethnic groups are stored in the storage device, for example, when the virus sample is the first sample to be clustered, this still belongs to the situation where there is no candidate ethnic group with an ethnic group eigenvalue identical to that of the virus sample. Therefore, a new virus ethnic group is created for the virus sample, and the virus ethnic group is used as the first candidate ethnic group.

[0088] In addition, since each virus ethnic group includes at least one virus family, after determining the target ethnic group of the virus sample, it is further necessary to determine whether the virus sample belongs to the virus families under the target ethnic group. Therefore, after determining the target ethnic group as a candidate ethnic group in sub-step S1503, the following steps can be further carried out.

[0089] In sub-step S1505, the family eigenvalues of at least one candidate family included in the candidate ethnic group are obtained.

[0090] Similarly, for example, for each candidate family under each candidate ethnic group, its family eigenvalue is known and has been stored in the storage device (such as a memory, a flash device, etc.). Therefore, the family eigenvalues of each candidate family under the candidate ethnic group determined in step S1503 or S1504 can be read from the storage device.

[0091] In sub-step S1506, the group eigenvalue of the virus sample is matched with the family eigenvalues of at least one candidate family.

[0092] For example, the family eigenvalue of the virus sample can be based on the reference Figure 2obtained by the described method, and as above, the family feature values of each candidate family under the candidate population determined in step S1503 or S1504 can be read from the storage device, and the family feature value of the virus sample is matched with each family feature value read from the storage device, and the degree of matching can reflect the possibility that the virus sample belongs to the candidate family.

[0093] In some embodiments, the following method can be used to determine whether there is a candidate family with a family feature value that matches the group feature value of the virus sample: calculate the Euclidean distance between the group feature value and the family feature value of the candidate family, and when the Euclidean distance is within a preset range, it is determined that there is a candidate family with a family feature value that matches the group feature value of the virus sample, otherwise there is no such candidate family.

[0094] In the case where there is a candidate family with a family feature value that matches the group feature value of the virus sample, in sub-step S1507, the candidate family is determined as the target family of the virus sample; and in the case where there is no candidate family with a family feature value that matches the group feature value of the virus sample, in sub-step S1508, a new virus family is created, and the new virus family is determined as the target family of the virus sample.

[0095] On the other hand, after determining the new virus population as the target population of the virus sample in sub-step S1504, in sub-step S1509, a new virus family can be created in the new virus population, and the new virus family is determined as the target family of the virus sample.

[0096] In some embodiments, each virus family includes a marked virus sample, and the marked virus sample is the first virus sample clustered into the virus family, that is, the group feature value of the first virus sample is used as the family feature value of the virus family, and the population feature value of the first virus sample is used as the population feature value of the virus population to which the virus family belongs. Therefore, when creating a new virus population and / or a new virus family, the virus sample being clustered at this time is the first virus sample clustered into the new virus family, that is, it serves as the marked virus sample of the new virus family, and then the family feature value of the new virus family is determined as above.

[0097] In some embodiments, the virus sample also has a sample identifier, which is transmitted together with the behavior identifier group, group feature value, and / or population feature value of the virus sample during the above process of clustering the virus sample to indicate the identity information of the virus sample.

[0098] In some embodiments, when clustering a virus sample into a new virus family, in addition to using the group feature value of the virus sample as the group feature value of the new virus family and storing it, the sample identifier of the virus sample is also used as the family identifier of the new virus family and stored.

[0099] In some embodiments, when clustering a virus sample into a new virus family, clustering-related information of the virus sample, such as the sample identifier, the virus family to which the virus sample belongs and its corresponding family feature value, and the virus ethnic group to which the virus sample belongs and its ethnic group feature value, is stored in a storage device such as a memory. Optionally, the clustering-related information of the virus sample can be stored in the form of a table.

[0100] In an embodiment of the present disclosure, after clustering virus samples by the above method, each virus family includes a marked virus sample, which is the first virus sample clustered into the virus family, and the group feature values corresponding to other virus samples in each virus family match the group feature value of the marked virus sample (for example, the Euclidean distances are all within a preset range), and the ethnic group feature values of other virus samples are the same as the ethnic group feature value corresponding to the marked virus sample. For example, a virus family includes five virus samples, and one of the virus samples is the marked virus sample of the virus family. Based on the calculated group feature values and ethnic group feature values of the five virus samples respectively, it is calculated that the ethnic group feature values of the five virus samples are equal, and the Euclidean distances between the group feature values corresponding to the four virus samples other than the marked virus sample and the group feature value corresponding to the marked virus sample are within a preset range, that is, the five virus samples within the virus family are similar enough. Obviously, a virus family can include more or fewer virus samples, and the present disclosure does not limit this.

[0101] In addition, after clustering multiple virus samples by the above clustering method, there can be multiple virus ethnic groups. Each virus ethnic group includes at least one virus family, and the ethnic group feature values of different marked virus samples in different virus families belonging to the same virus ethnic group are the same and the group feature values do not match (for example, the Euclidean distance is outside the preset range). The same ethnic group feature value is the ethnic group feature value of the virus ethnic group, and each group feature value serves as the family feature value of a different virus family.

[0102] For example, as Figure 6As shown, there are three virus groups G1, G2, and G3; the virus group G1 includes three virus families SG11, SG12, and SG13, the virus group G2 includes two virus families SG21 and SG22, and the virus group G3 includes one virus family SG31; the ethnic group characteristic values of the respective labeled virus samples C11, C12, and C13 of the three virus families SG11, SG12, and SG13 belonging to the virus group G1 are the same, but the group characteristic values do not match (not similar enough), the ethnic group characteristic values of the respective labeled virus samples C21 and C22 of the two virus families SG21 and SG22 belonging to the virus group G2 are the same, but the group characteristic values do not match (not similar enough), and the ethnic group characteristic value of the virus group G2 is not equal to the ethnic group characteristic value of the virus group G1 / G3. That is to say, different virus groups can be distinguished by the ethnic group characteristic values of the virus groups. In addition, as described above, new virus groups and new virus families can be created.

[0103] The following combines Figure 6 Specifically describe the schematic scenario diagram for clustering virus samples according to an embodiment of the present disclosure.

[0104] Suppose it is necessary to cluster three virus samples, and their sample identifiers are represented by VR1, VR2, and VR3 respectively. These three virus samples can be batch extracted from the database simultaneously, and their group characteristic values and ethnic group characteristic value pairs are represented as {group characteristic 1, ethnic group characteristic 1}, {group characteristic 2, ethnic group characteristic 2}, and {group characteristic 3, ethnic group characteristic 3} respectively.

[0105] It should be noted that only three virus samples are used here as examples to schematically describe the example process for clustering virus samples according to an embodiment of the present disclosure. Those skilled in the art should understand that the actual number of virus samples can be much larger than three, and the present disclosure does not limit this. Any number of virus samples can be clustered based on the same process as the process described below.

[0106] First, for the first virus sample (VR1), its ethnic group characteristic value (i.e., ethnic group characteristic 1) is different from the ethnic group characteristic values of the currently stored virus ethnic groups (G1, G2, and G3) (i.e., candidate ethnic groups). Therefore, a new virus ethnic group (GN) is created, and this new virus ethnic group (GN) is determined as the target ethnic group of the first virus sample (VR1). A new virus family (SGN) is generated under this new virus ethnic group (GN) as the target family of the first virus sample (VR1). In addition, the first virus sample (VR1) is used as the marker virus sample of this new virus family (SGN), the group characteristic value of the first virus sample (VR1) (i.e., group characteristic 1) is used as the family characteristic value of this new virus family (SGN), the ethnic group characteristic value of the first virus sample (VR1) (i.e., ethnic group characteristic 1) is used as the ethnic group characteristic value of this new virus ethnic group (GN), and the ethnic group characteristic value of this new virus ethnic group (GN) and the family characteristic value of this new virus family (SGN) are also stored.

[0107] For the second virus sample (VR2), its ethnic group characteristic value (i.e., ethnic group characteristic 2) is the same as the ethnic group characteristic value of one of the currently stored virus ethnic groups (G1, G2, and G3) (i.e., candidate ethnic groups), which is the ethnic group characteristic value of the virus ethnic group (G2). Therefore, the group characteristic value of the second virus sample (VR2) (i.e., group characteristic 2) is respectively matched with the family characteristic values (i.e., group characteristic 2) of the two virus families (SG21 and SG22) that are candidate families of the virus ethnic group (G2). Since the Euclidean distances between the group characteristic value of the second virus sample (VR2) (i.e., group characteristic 2) and the family characteristic values of the two virus families (SG21 and SG22) in the virus ethnic group (G2) are both outside the preset range, a new virus family (SG2N) is generated under the virus ethnic group (G2) as the target family of the second virus sample (VR2). In addition, the second virus sample (VR2) is used as the marker virus sample of this new virus family (SG2N), and the group characteristic value of the second virus sample is used as the family characteristic value of this new virus family (SG2N) and stored.

[0108] For the third virus sample (VR3), the population characteristic value thereof (i.e., population characteristic 3) is the same as the population characteristic value of one of the currently stored virus populations (G1, G2, and G3) (i.e., candidate populations), namely, the virus population (G1). Therefore, the group characteristic value of this third virus sample (VR3) (i.e., group characteristic 3) is respectively compared with the family characteristic values of three virus families (SG11, SG12, SG13) that are candidate families of this virus population (G1). Since the Euclidean distance between the group characteristic value of this third virus sample (VR3) (i.e., group characteristic 3) and the family characteristic value of the first virus family (SG11) in the virus population (G1) is within the preset range, this third virus sample (VR3) is clustered into the first virus family (SG11) in the virus population (G1).

[0109] It can be concluded from the above description that, through the clustering method for virus samples proposed in the embodiments of the present disclosure, since the types of parameters required for executing this method are few (for example, only the behavior identification group and the sample identification are required), it can rely less on the environment and device attributes. And since the behavior identification group can stably reflect the behavior characteristics of virus samples, the clustering results are more stable. And since the virus samples are primarily classified based on the population characteristic values, and the storage resources and computing resources occupied by the population characteristic values can be less, the operation efficiency can be greatly improved, thereby supporting massive data operations to achieve the clustering of a large number of virus samples.

[0110] According to another aspect of the present disclosure, there is also provided a clustering device for virus samples. Figure 7 FIG. shows a schematic structural block diagram of a clustering device 700 for virus samples according to an embodiment of the present disclosure.

[0111] As Figure 7 shown, the clustering device 700 for virus samples includes an acquisition module 710, a generation module 720, and a clustering module 730.

[0112] The acquisition module 710 is configured to acquire at least one behavior characteristic of a virus sample.

[0113] The generation module 720 is configured to generate a behavior identification group for at least one behavior characteristic of a virus sample based on a preset reference behavior characteristic set, wherein each reference behavior characteristic in the preset reference behavior characteristic set has a unique behavior identification; generate a group characteristic value of the virus sample based on the behavior identification group of the virus sample, the group characteristic value being used to indicate the virus family to which the virus sample belongs; and generate a population characteristic value of the virus sample based on the group characteristic value of the virus sample, the population characteristic value being used to indicate the virus population to which the virus sample belongs, wherein each virus population includes at least one virus family.

[0114] For example, the generation module 720 may include a matching sub-module, a group eigenvalue / ethnic group eigenvalue generation sub-module, and a storage sub-module (as Figure 8 shown in). More specifically, the matching sub-module may match at least one behavioral characteristic of the virus sample with a preset reference behavioral characteristic set to obtain a set of behavioral identifiers. The group eigenvalue / ethnic group eigenvalue generation sub-module may generate a group eigenvalue based on the set of behavioral identifiers, and further generate an ethnic group eigenvalue. And the storage sub-module may store the generated group eigenvalue / ethnic group eigenvalue, the sample identifier of the virus sample, etc.

[0115] The clustering module 730 is used to cluster virus samples based on the group eigenvalues and ethnic group eigenvalues of the virus samples to determine the virus ethnic group and virus family to which the virus samples belong.

[0116] For example, the clustering module 730 may obtain the group eigenvalue and ethnic group eigenvalue of the virus sample from the storage sub-module in the generation module 720.

[0117] In some embodiments, the clustering module 730 clusters virus samples based on the group eigenvalues and ethnic group eigenvalues of the virus samples, including: determining the target ethnic group of the virus sample based on the ethnic group eigenvalue of the virus sample; and determining the target family of the virus sample based on the target ethnic group and the group eigenvalue of the virus sample.

[0118] In addition, since each virus ethnic group includes at least one virus family, after determining the target ethnic group of the virus sample, it is further necessary to determine whether the virus sample belongs to the virus family under the target ethnic group. Therefore, after the clustering module 730 determines that the target ethnic group is a candidate ethnic group, it may further perform the following operations: obtaining the family eigenvalue of at least one candidate family included in the candidate ethnic group; matching the group eigenvalue of the virus sample with the family eigenvalues of at least one candidate family; in the case where there is a candidate family with a family eigenvalue that matches the group eigenvalue of the virus sample, determining the candidate family as the target family of the virus sample; in the case where there is no candidate family with a family eigenvalue that matches the group eigenvalue of the virus sample, creating a new virus family and determining the new virus family as the target family of the virus sample. Alternatively, after the clustering module 730 determines a new virus ethnic group as the target ethnic group of the virus sample, it creates a new virus family in the new virus ethnic group and determines the new virus family as the target family of the virus sample.

[0119] In some embodiments, each virus family includes a labeled virus sample, and the labeled virus sample is the first virus sample clustered into the virus family. That is, the group feature value of the first virus sample serves as the family feature value of the virus family, and the ethnic group feature value of the first virus sample serves as the ethnic group feature value of the virus ethnic group to which the virus family belongs. Therefore, when creating a new virus ethnic group and / or a new virus family, the virus sample being clustered at this time is the first virus sample clustered into the new virus family, that is, it serves as the labeled virus sample of the new virus family, and then the family feature value of the new virus family is determined as described above.

[0120] In some embodiments, the clustering module 730 can be offline. From the above description, it can be concluded that through the clustering method for virus samples proposed in the embodiments of the present disclosure, since the types of parameters required for executing this method are few (for example, only behavior identification groups and sample identifiers are required), it can rely less on the environment and device attributes. And since the behavior identification group can stably reflect the behavior characteristics of virus samples, the clustering results are more stable. And since the virus samples are primarily classified based on the ethnic group feature values, and the storage resources and computing resources occupied by the ethnic group feature values can be less, the operation efficiency can be greatly improved, thereby supporting massive data operations to achieve clustering of a large number of virus samples.

[0121] According to another aspect of the present disclosure, a clustering system for virus samples is also provided. Figure 8 FIG. 800 shows a clustering system for virus samples according to an embodiment of the present disclosure.

[0122] As Figure 8 shown, the clustering system 800 includes a clustering device 700 for virus samples as Figure 7 shown, a virus sample memory, a simulation executor, a preset reference behavior feature set platform, and a clustering result memory. Among them, the virus sample memory is used to provide virus samples to be clustered, and the simulation executor makes the virus samples run in a virtual environment to provide at least one behavior feature of the virus samples to the clustering device 700 for virus samples.

[0123] The clustering device 700 for virus samples receives at least one behavior feature of the virus samples and a preset reference behavior feature set from the preset reference behavior feature set platform, and generates a clustering result according to the generation process and clustering process described above. The clustering result memory stores the clustering result.

[0124] The specific working process of the clustering device 700 for virus samples is as described in reference Figure 7 and will not be described in detail here. According to yet another aspect of the present disclosure, an electronic device is also provided.Figure 9 FIG. 1 shows a schematic structural block diagram of an electronic device 900 according to an embodiment of the present disclosure.

[0125] Referring to Figure 9 , the electronic device 900 according to an embodiment of the present disclosure may include a processor 901 and a memory 902. The processor 901 and the memory 902 may be connected by a bus 903.

[0126] The processor 901 may perform various actions and processes according to programs stored in the memory 902. Specifically, the processor 901 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It may implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc., and may be of the X99 architecture or the ARM architecture.

[0127] The memory 902 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DR RAM). It should be noted that the memory of the methods described in the present disclosure is intended to include but not limited to these and any other suitable types of memories.

[0128] Embodiments of the present disclosure also provide a computer-readable storage medium having computer-executable instructions stored thereon, and when the computer instructions are executed by a processor, a clustering method for virus families according to embodiments of the present disclosure can be implemented. Similarly, the computer-readable storage medium in the embodiments of the present disclosure may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. It should be noted that the memory of the methods described herein is intended to include but not limited to these and any other suitable types of memories.

[0129] Embodiments of the present disclosure also provide a computer program product or a computer program. The computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the clustering method for virus families according to the embodiments of the present disclosure.

[0130] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, the program segment, or the part of code includes at least one executable instruction for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0131] Generally speaking, various example embodiments of the present disclosure may be implemented in hardware or a dedicated circuit, software, firmware, logic, or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software that can be executed by a controller, a microprocessor, or other computing devices. When aspects of the embodiments of the present disclosure are illustrated or described as block diagrams, flowcharts, or using some other graphical representation, it will be understood that the blocks, devices, systems, technologies, or methods described herein may be implemented as non-limiting examples in hardware, software, firmware, dedicated circuits or logic, general hardware or a controller or other computing devices, or some combination thereof.

[0132] The example embodiments of the present disclosure described in detail above are merely illustrative and not restrictive. Those skilled in the art should understand that various modifications and combinations can be made to these embodiments or their features without departing from the principles and spirit of the present disclosure, and such modifications should fall within the scope of the present disclosure.

Claims

1. A virus sample clustering method, comprising: Obtaining at least one behavioral feature of the virus sample to be clustered; Based on a preset reference behavior feature set, generating a behavior identifier group for at least one behavior feature of the virus sample, wherein each reference behavior feature in the preset reference behavior feature set has a unique behavior identifier; For each behavior identifier in the behavior identifier group of the virus sample, calculating a hash value of the behavior identifier, wherein the hash value of the behavior identifier includes a first number of bits; generating a group feature value of the virus sample based on a hash value of each behavior identifier in the behavior identifier group, wherein the group feature value is used to indicate the virus family to which the virus sample belongs, and the group feature value includes a first number of bits; Numbering a first number of bits in the set of eigenvalues to obtain a first number of numbers; Performing numerical mapping on the first number of numbers to obtain mapping values of the first number; selecting at least one mapped value from a first number of mapped values based on values of a first number of bits in the set of feature values; Generating a group characteristic value of the virus sample using the at least one mapping value, wherein the group characteristic value is used to indicate the virus group to which the virus sample belongs, wherein each virus group includes at least one virus family; and The virus samples are clustered based on the group characteristic values and the group characteristic values of the virus samples to determine the virus group and the virus family to which the virus samples belong.

2. The clustering method according to claim 1, wherein: Clustering the virus samples based on the group characteristic values and the group characteristic values of the virus samples includes: Determining a target population of the virus sample based on the population characteristic value of the virus sample; and A target family of the virus sample is determined based on the target population and the group characteristic value of the virus sample.

3. The clustering method according to claim 2, wherein: The determining of the target group of the virus sample based on the group characteristic value of the virus sample includes: Obtaining a population characteristic value of at least one candidate population; Comparing the population characteristic value of the virus sample with the population characteristic value of the at least one candidate population; If there is a candidate group having the same group characteristic value as that of the virus sample, determining the candidate group as the target group of the virus sample; and In the case that there is no candidate group having the same group characteristic value as the group characteristic value of the virus sample, a new virus group is created, and the new virus group is determined as the target group of the virus sample.

4. The clustering method according to claim 3, wherein: The determining the target family of the virus sample based on the target population and the group feature value of the virus sample includes: In a case where the target population is a candidate population, obtaining a family characteristic value of at least one candidate family included in the candidate population; matching the group characteristic value of the virus sample with the family characteristic value of the at least one candidate family; if there is a candidate family having a family characteristic value that matches the group characteristic value of the virus sample, determining the candidate family as the target family of the virus sample; if there is no candidate family having a family characteristic value that matches the group characteristic value of the virus sample, creating a new virus family and determining the new virus family as the target family of the virus sample; and In the case that the target group is a new virus group, a new virus family is created in the new virus group, and the new virus family is determined as the target family of the virus sample.

5. The clustering method according to claim 1, wherein: Generating the group feature value of the virus sample based on the hash value of each behavior identifier in the behavior identifier group includes: Constructing a hash matrix using the hash value of each behavior identifier in the behavior identifier group, wherein the hash value of each behavior identifier serves as a first direction vector of the hash matrix, the first direction vector having a first dimension, and the first dimension is the same as the first number; For each second direction vector in the hash matrix, calculating an eigenvalue of the second direction vector, where the second direction vector has a second dimension, and the number of the second dimensions is the same as the number of behavior identifiers of the virus sample; and Using the eigenvalue of each second direction vector in the hash matrix, a group eigenvalue of the virus sample is generated, where the group eigenvalue has a first dimension. The first direction vector is a row vector and the second direction vector is a column vector, or the first direction vector is a column vector and the second direction vector is a row vector. The clustering method according to claim 5 , wherein: The second direction vector includes at least one first value and at least one second value, For each second direction vector in the hash matrix, calculating the eigenvalue of the second direction vector includes: Obtaining an initial value of the characteristic value; For each first value in the second direction vector, increase the eigenvalue by a first accumulated value to update the eigenvalue; For each second value in the second direction vector, increase the eigenvalue by a second accumulated value to update the eigenvalue; and The updated eigenvalue is used as the eigenvalue of the second direction vector. The first accumulated value is different from the second accumulated value.

7. The clustering method according to claim 5 or 6, wherein: Generating a group eigenvalue of the virus sample using the eigenvalue of each second direction vector in the hash matrix includes: For each second direction vector, perform a binary conversion on its eigenvalue, and use the converted value as the value corresponding to the second direction vector, and The values corresponding to all second direction vectors are combined to obtain the group characteristic value of the virus sample.

8. The clustering method according to claim 1, wherein: The selecting at least one mapped value from the first number of mapped values based on the value of the first number of bits comprises: determining a second number of bits having a first value among a first number of bits in the set of feature values, the second number being less than or equal to the first number; Determine a second number of numbers corresponding to the second number of digits; and Sort the second number of mapping values corresponding to the second number of numbers from small to large, select the smallest third number of mapping values, and The step of generating the group characteristic value by using the at least one mapping value includes: The third number of mapping values are sorted in ascending order according to their corresponding numbers to form an array, and the array is used as the group characteristic value.

9. The clustering method according to claim 1, wherein: The generating of a behavior identification group for at least one behavior feature of the virus sample based on a preset reference behavior feature set includes: For each behavior feature of the at least one behavior feature, matching it with each reference behavior feature in the preset reference behavior feature set, and if the behavior feature has a matching reference behavior feature, using the behavior identifier of the reference behavior feature as the behavior identifier of the behavior feature; and When the number of the behavior identifiers of the virus sample exceeds a predetermined threshold, the behavior identifiers of the virus sample are combined into a behavior identifier group of the virus sample.

10. A virus sample clustering device, comprising: an acquisition module, configured to acquire at least one behavioral feature of the virus sample; A generation module, configured to generate a behavior identification group for at least one behavior feature of the virus sample based on a preset reference behavior feature set, wherein each reference behavior feature in the preset reference behavior feature set has a unique behavior identification; for each behavior identification in the behavior identification group of the virus sample, calculate a hash value of the behavior identification, wherein the hash value of the behavior identification includes a first number of bits; based on the hash value of each behavior identification in the behavior identification group, generate a group feature value for the virus sample, wherein the group feature value is used to indicate the virus family to which the virus sample belongs, and the group feature value includes a first number of bits; number the first number of bits in the group feature value to obtain a first number of numbers; perform numerical mapping on the first number of numbers to obtain a first number of mapping values; based on the values of the first number of bits in the group feature value, select at least one mapping value from the first number of mapping values; and generate a group feature value for the virus sample using the at least one mapping value, wherein the group feature value is used to indicate the virus group to which the virus sample belongs, wherein each virus group includes at least one virus family; and The clustering module is used to cluster the virus samples based on the group characteristic values and the group characteristic values of the virus samples to determine the virus group and virus family to which the virus samples belong. The clustering device according to claim 10 , wherein: Clustering the virus samples based on the group characteristic values and the group characteristic values of the virus samples includes: Determining a target population of the virus sample based on the population characteristic value of the virus sample; and A target family of the virus sample is determined based on the target population and the group characteristic value of the virus sample.

12. An electronic device, characterized in that: include: at least one memory and at least one processor; The memory stores a program, and the processor calls the program stored in the memory, where the program is used to implement the virus sample clustering method according to any one of claims 1 to 9.

13. A storage medium, characterized in that: A program for storing and implementing the virus sample clustering method according to any one of claims 1 to 9.

Images