Virus file processing method, device, electronic device and readable storage medium

Abstract

The embodiment of the present application provides a method, device, electronic device and readable storage medium for processing virus files. The method can be applied in the field of security protection technology, and the method includes: determining the virus behavior characteristics of the virus file to be processed based on the behavior log data of the virus file to be processed; matching the virus behavior characteristics with each sample TTPS rule, determining each target TTPS rule hit by the virus behavior characteristics, and matching with the family TTPS rules of each virus family, determining the virus family to which the virus file to be processed belongs; displaying the processing results including the virus family to which the virus to be processed belongs. In the embodiment of the present application, since the family TTPS rules of each virus family can stably reflect the behavior characteristics of the virus family, and then using the family TTPS rules of the virus family as the matching basic data, the accuracy of the virus family results can be effectively improved.

Description

Technical Field

[0001] The present application relates to the field of security protection technology. Specifically, the present application relates to a virus file processing method, device, electronic device and readable storage medium. Background Art

[0002] In people's production and life, viruses in computers have become an important factor affecting the effect and efficiency of computer use. Quickly and accurately determining the virus family to which a virus belongs plays a vital role in preventing and treating computer viruses. At present, the method used to determine the virus family to which a virus belongs is to determine the virus family to which a virus belongs based on relationship data. This method finds viruses belonging to the same category through the association relationship between nodes. For example, if multiple viruses access a common IP (Internet Protocol) or domain name, it is considered that the multiple viruses belong to the same virus family. However, this method is prone to generate interference data. For example, when a browser accesses the domain name of a certain virus, the browser program will also be divided into a certain virus family, resulting in inaccurate determination results. Summary of the invention

[0003] The purpose of this application is to solve at least one of the above-mentioned technical deficiencies, especially the technical defect of inaccurate results of virus family determination.

[0004] On the one hand, an embodiment of the present application provides a method for processing virus files, the method comprising:

[0005] Based on the behavior log data, determine the virus behavior characteristics of the virus file to be processed;

[0006] Match the virus behavior characteristics with each sample TTPS (Tactics, Techniques, Procedures) rule of the virus file to determine each target TTPS rule hit by the virus behavior characteristics, wherein, for any sample TTPS rule, the sample TTPS rule represents the virus behavior characteristics of the virus file;

[0007] Match each target TTPS rule with the family TTPS rule of each virus family. If each target TTPS rule hits any family TTPS rule of a virus family, the virus family corresponding to the hit family TTPS rule is determined as the virus family to which the virus file to be processed belongs.

[0008] The processing result of the virus file to be processed is displayed, and the processing result includes the virus family to which the virus file to be processed belongs.

[0009] On the other hand, an embodiment of the present application provides a virus file processing device, the device comprising:

[0010] A data acquisition module is used to obtain the behavior log data of the virus file to be processed;

[0011] A behavior feature determination module, used to determine the virus behavior features of the virus file to be processed based on the behavior log data;

[0012] A rule matching module is used to match the virus behavior characteristics with each sample TTPS rule of the virus file, and determine each target TTPS rule hit by the virus behavior characteristics, wherein, for any sample TTPS rule, the sample TTPS rule represents the virus behavior characteristics of the virus file;

[0013] The virus family determination module is used to match each target TTPS rule with the family TTPS rule of each virus family. If each target TTPS rule hits any family TTPS rule of a virus family, the virus family corresponding to the hit family TTPS rule is determined as the virus family to which the virus file to be processed belongs;

[0014] The result display module is used to display the processing result of the virus file to be processed, and the processing result includes the virus family to which the virus file to be processed belongs.

[0015] On the other hand, an embodiment of the present application provides an electronic device, including a processor and a memory: the memory is configured to store a computer program, and when the computer program is executed by the processor, the processor executes any one of the above-mentioned virus file processing methods.

[0016] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program is run on a computer, the computer can execute any one of the above-mentioned virus file processing methods.

[0017] The beneficial effects of the technical solution provided by the embodiment of the present application are:

[0018] In the embodiment of the present application, since the TTPS rule is extracted by summarizing the behavior corresponding to the attack method of the virus file, the TTPS rule characterizes the virus behavior characteristics of the virus file. Therefore, when determining the virus family to which the virus file to be processed belongs, the target TTPS rules hit by the virus file to be processed can be obtained based on the behavior log data of the processed virus file. Since the family TTPS rules of each virus family can stably reflect the behavior characteristics of the virus family, each target TTPS rule can be matched with the family TTPS rules of each virus family, and the virus family to which the virus file to be processed belongs can be determined based on the matching results. Since the family TTPS rules that can stably reflect the behavior characteristics of the virus family are used as the basic matching data in this process, the accuracy of the virus family results can be effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0020] Figure 1 A flowchart of a virus file processing method provided in an embodiment of the present application;

[0021] Figure 2 A schematic diagram of a system structure applicable to a virus file processing method provided in an embodiment of the present application;

[0022] Figure 3 A flowchart of another virus file processing method provided in an embodiment of the present application;

[0023] Figure 4 A schematic diagram of another virus file processing method provided in an embodiment of the present application;

[0024] Figure 5 A schematic diagram of the structure of a virus file processing device provided in an embodiment of the present application;

[0025] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0027] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0028] Cloud security refers to the general term for security software, hardware, users, organizations, and security cloud platforms based on cloud computing business model applications. Cloud security integrates emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through a large number of networked clients, it monitors abnormal software behavior in the network, obtains the latest information on Trojans and malicious programs on the Internet, and sends it to the server for automatic analysis and processing, and then distributes virus and Trojan solutions to each client.

[0029] The main research directions of cloud security include: 1. Cloud computing security, which mainly studies how to ensure the security of the cloud itself and various applications on the cloud, including cloud computer system security, secure storage and isolation of user data, user access authentication, information transmission security, network attack protection, compliance auditing, etc.; 2. Cloudification of security infrastructure, which mainly studies how to use cloud computing to build and integrate security infrastructure resources and optimize security protection mechanisms, including building a large-scale security event, information collection and processing platform through cloud computing technology, realizing the collection and correlation analysis of massive information, and improving the control ability of security events and risk control capabilities of the entire network; 3. Cloud security services, which mainly studies various security services provided to users based on cloud computing platforms, such as antivirus services.

[0030] In an embodiment of the present application, the behavior log data of the virus file to be processed obtained can be matched with the TTPS rules of each virus file based on the server using cloud computing to determine the target TTPS rules hit by the virus file to be processed, and then each target TTPS rule can be matched with the family TTPS rule of each virus family to determine the virus family to which the virus file to be processed belongs.

[0031] Among them, cloud computing refers to the delivery and use model of IT infrastructure, which means obtaining required resources through the network in an on-demand and easily scalable manner; in a broad sense, cloud computing refers to the delivery and use model of services, which means obtaining required services through the network in an on-demand and easily scalable manner. This service can be related to IT and software, the Internet, or other services. Cloud computing is the product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0032] With the development of the Internet, real-time data streams, and the diversification of connected devices, as well as the demand for search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Different from the previous parallel distributed computing, the emergence of cloud computing will promote revolutionary changes in the entire Internet model and enterprise management model from a conceptual perspective.

[0033] The following specific embodiments are used to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0034] First, several terms involved in this application are introduced and explained:

[0035] Virus family: Existing viruses are developed by different developers, so there must be many differences in code style and behavioral characteristics. Based on these characteristics, each virus can be divided into different virus families.

[0036] Md5 (Message Digest Algorithm, Message Digest Algorithm Fifth Edition) algorithm: a public information digest algorithm that can transform a "byte string" of any length into a 128-bit binary number, that is, a 32-bit hexadecimal number, and it is an irreversible string transformation algorithm.

[0037] TTPS rules: TTPS is the abbreviation of Tactics, Techniques, and Procedures. TTPS is based on the analysis and research of attacks carried out by all organizations around the world. Attacks can be described in the way of TTPS. Their attack process (Procedures) may be as follows: attack preparation, plan making, target selection, and attack implementation. Each step in the process will be different due to the different use methods (i.e., techniques) of different terrorist organizations. For example, the preparation stage requires obtaining finances, personnel training, and reconnaissance. Each organization has its own personnel training methods and financial methods. The methods and means (techniques) of each terrorist organization are different, but the process of implementing an attack is roughly the same.

[0038] TTPS can also be used for network security. Attack organizations or virus samples usually have attack steps or processes. Different attack organizations and virus samples also have their own attack habits and methods, which are also reflected in the viruses of these organizations. For example, the attack process includes: initial entry, execution, privilege escalation, etc., and each attack process will have different attack methods.

[0039] Dynamic sandbox: A sandbox is an execution environment that restricts program behavior according to security policies. Virus programs can be run in a sandbox, and then the behavior of virus programs can be detected by intercepting system calls.

[0040] Threat indicators: characteristic indicators used to characterize the degree of threat. These characteristic indicators can be used to determine whether an attack has actually occurred. They generally refer to the md5, IP or Domain (domain name) of the virus file.

[0041] Threat intelligence: compromised identifiers used to identify and detect threats, such as virus file HASH, IP, domain name, program running path, registry entries, etc., as well as related attribution tags (virus family).

[0042] Threat alert: When a network attack occurs, the corresponding threat intelligence, attack source, attack target, attack time and other information are displayed through a real-time system to remind security personnel to follow up and handle it.

[0043] The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0044] Figure 1A schematic flow chart of a method for processing a virus file provided in an embodiment of the present application is shown. The method can be executed by a server or a terminal device, and the server can be an independent physical server, or a server cluster or a distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and the present application does not limit this.

[0045] like Figure 1 As shown, the method may include:

[0046] Step S101, obtaining behavior log data of the virus file to be processed.

[0047] The virus file to be processed refers to a virus file that needs to be determined to belong to which virus family, and the behavior log data refers to various data generated by the virus file to be processed during operation, and the behavior log data can reflect the behavior characteristics of the virus file to be processed.

[0048] In an optional embodiment of the present application, obtaining behavior log data of the virus file to be processed includes:

[0049] By running the virus file to be processed in the sandbox, the behavior log data of the virus file to be processed is obtained.

[0050] Optionally, when obtaining the behavior log data of the virus file to be processed, the behavior log data of the virus file to be processed can be obtained by running the virus file to be processed in a sandbox. The sandbox is a virtual system program that allows browsers or other programs to be run in a sandbox environment, so the changes caused by running the virus file to be processed can be deleted later and will not have a permanent impact on the hard disk, thereby improving security.

[0051] Step S102: determining the virus behavior characteristics of the virus file to be processed based on the behavior log data.

[0052] Among them, the virus behavior characteristics represent the corresponding behavior of the virus file during the attack, and the behavior log data of the virus file to be processed records the various data generated by the virus file to be processed during the attack. At this time, the virus behavior characteristics of the virus file to be processed can be obtained based on the data representing the attack behavior of the virus file in the behavior log data.

[0053] Step S103, matching the virus behavior feature with each sample TTPS rule of the virus file, and determining each target TTPS rule hit by the virus behavior feature, wherein for any sample TTPS rule, the sample TTPS rule represents the virus behavior feature of the virus file.

[0054] Among them, each attack method of the virus file can correspond to a certain behavior. At this time, this behavior is summarized and extracted as a corresponding rule, and can be marked with a unique identifier T (such as T1). When multiple behaviors are extracted as corresponding rules, a rule combination is generated. For example, a rule combination can represent [T1, T2, T3, T4]. This rule combination is a TTPS rule, which indicates that the virus file can generate behaviors corresponding to T1, T2, T3, and T4 in a type of attack technology. The sample TTPS rules of the virus file refer to the TTPS rules extracted based on the attack methods of the existing known virus files. At this time, for any sample TTPS rule, the sample TTPS rule can characterize a virus behavior feature of the virus file. Among them, for the convenience of description, in actual applications, the Md5 algorithm can be used to represent the virus file TTPS rule, such as using Md5_1 to represent the TTPS rule [T1, T2, T3, T4].

[0055] Optionally, after determining the virus behavior characteristics of the virus file to be processed based on the behavior log data, the virus behavior characteristics can be matched with each sample TTPS rule of the virus file to determine which sample TTPS rules the behavior of the virus file to be processed during the attack process specifically corresponds to, and obtain the hit target TTPS rules.

[0056] Step S104, matching each target TTPS rule with the family TTPS rule of each virus family. If each target TTPS rule hits any family TTPS rule of a virus family, the virus family corresponding to the hit family TTPS rule is determined as the virus family to which the virus file to be processed belongs.

[0057] Among them, the family TTPS rule of the virus family refers to the TTPS rule that can stably represent the behavioral characteristics of each virus file belonging to the virus family, such as the TTPS rule of each virus file that can be hit by all virus files belonging to the virus family. Optionally, the family TTPS rule of the virus family supports AND or OR operations, for example, the family TTPS rule of the virus family can be expressed as [T1&&(T2||T3)&&T4], which means that the virus files belonging to the virus family can simultaneously generate the behavior corresponding to T1, the behavior corresponding to T2, and the behavior corresponding to T3 during the attack process, or simultaneously generate the behavior corresponding to T1, the behavior corresponding to T2, and the behavior corresponding to T4.

[0058] Optionally, when knowing each target TTPS rule hit by the virus file to be processed, each target TTPS rule can be matched with the family TTPS rule of each virus family to determine which virus family's family TTPS rule each target virus file TTPS hit by the virus file to be processed specifically matches, and determine the virus family to which the virus file to be processed belongs.

[0059] In practical applications, sometimes a virus family may include multiple family TTPS rules. For example, the family TTPS rule of a virus family can be expressed as [T1&&(T2||T3)&&T4]. Since the family TTPS rule of the virus family supports AND or OR operations, [T1&&(T2||T3)&&T4] can be ANDed or operated to obtain multiple family TTPS rules, such as family TTPS rule [T1&&T2&&T4] and family TTPS rule [T1&&T3&&T4]. Among them, [T1&&T2&&T4] means that the virus files belonging to the virus family can simultaneously generate the behavior corresponding to T1, the behavior corresponding to T2 and the behavior corresponding to T4 during the attack process, and [T1&&T3&&T4] means that the virus files belonging to the virus family can simultaneously generate the behavior corresponding to T1, the behavior corresponding to T2 and the behavior corresponding to T3 during the attack process.

[0060] Optionally, when there are multiple family TTPS rules for a virus family, when determining the virus family to which the virus file to be processed belongs, each target TTPS rule hit by the virus file to be processed can be matched with each family TTPS rule of the virus family. If each target TTPS rule hits any family TTPS rule of the virus family, it is determined that the virus file to be processed belongs to the virus family.

[0061] In an example, assuming that the family TTPS rules of virus family 1 include [T1&&T2&&T4] and [T1&&T3&&T4], the family TTPS rules of virus family 2 include [T3&&T4&&T5], and the target TTPS rules hit by the virus file to be processed are [T1&&T2&&T4]. At this time, the target TTPS rules hit by the virus file to be processed hit [T1&&T2&&T4] of virus family 1, then it is determined that the virus file to be processed belongs to virus family 1.

[0062] Step S105, displaying the processing result of the virus file to be processed, the processing result including the virus family to which the virus file to be processed belongs.

[0063] Optionally, after determining the virus family to which the virus file to be processed belongs, the processing result of the virus file can also be displayed to the user so that the user knows the processing status of the virus file, such as displaying the virus family to which the virus file to be processed belongs to the user.

[0064] In an embodiment of the present application, when determining the virus family to which the virus file to be processed belongs, the target TTPS rules for the virus to be processed can be determined based on the behavior log data of the virus file to be processed and the TTPS rules of each virus file, and then each target TTPS rule is matched with the family TTPS rule of each virus family to obtain the virus family to which the virus file to be processed belongs. Since the family TTPS rules of each virus family can stably reflect the behavioral characteristics of the virus family, the family TTPS rules of the virus family are used as the basic matching data when determining the virus family to which the virus file to be processed belongs, which can effectively improve the accuracy of the virus family results.

[0065] In an optional embodiment of the present application, each sample TTPS rule includes a TTPS rule corresponding to each attack technology type, and based on the behavior log data, determines the virus behavior characteristics of the virus file to be processed, including:

[0066] Based on the behavior log data, determine the attack technology characteristics of the virus file to be processed corresponding to each attack technology type during the attack;

[0067] The virus behavior characteristics of the virus file to be processed include attack technology characteristics corresponding to each attack technology type;

[0068] Match the virus behavior features with the TTPS rules of the virus file to determine the target TTPS rules hit by the virus behavior features, including:

[0069] For each attack technology type, the attack technology features of the attack technology type are matched with the sample TTPS rules corresponding to the attack technology type, and the sample TTPS rules that meet the preset matching conditions are determined as the TTPS rules hit by the attack technology type. Each target TTPS rule includes the TTPS rules hit by each attack technology type.

[0070] Among them, the virus behavior characteristics may include the attack technology characteristics corresponding to each attack technology type used by the virus file during the attack; the attack technology type may refer to the technology type used by the virus sample file during the attack process, such as the four technology types used, namely, the file, process, registry, and network. For example, the file technology type may include CreateFile, RenameFile, and SetFileAttributes, etc., the process technology type may include CreateProcess, CreateMutex, AllocateVirtualMemory, MapViewOfSection, etc., the registry technology type may include CreateKey, and the network technology type may include connect, etc.

[0071] Accordingly, when determining the virus behavior characteristics of the virus file to be processed, it is possible to determine the specific types of attack techniques used by the virus file to be processed during the attack based on the acquired behavior log data, and then determine the attack technology characteristics corresponding to each type of attack technology used, thereby obtaining the virus behavior characteristics of the virus file to be processed.

[0072] Optionally, each sample TTPS rule may include a TTPS rule corresponding to each attack technology type. In this case, after obtaining the virus behavior characteristics of the virus file to be processed, for each attack technology type included in the virus behavior characteristics, it is possible to determine which sample TTPS rules the attack technology type corresponds to, and then match the attack technology characteristics of the virus file to be processed corresponding to the attack technology type with the determined sample TTPS rules, and determine the sample TTPS rules that meet the preset matching conditions as the TTPS rules hit by the attack technology type; accordingly, the TTPS rules hit by each attack technology type of the virus file to be processed can be regarded as the target TTPS rules hit by the virus behavior characteristics.

[0073] Optionally, the specific content of the preset matching condition can be pre-configured according to the needs, and the embodiments of the present application are not limited. For example, when the number of the same key-value pairs of the attack technology feature and a sample TTPS rule reaches a preset number, the attack technology feature and the sample TTPS rule can be regarded as matching, and the sample TTPS rule is determined as the TTPS rule hit by the attack technology type.

[0074] In an optional embodiment of the present application, based on the behavior log data, the attack technology features corresponding to each attack technology type are determined, including:

[0075] Based on the behavior log data, determine the interface identifier and interface parameters of each interface corresponding to each attack technology type when the virus file to be processed attacks;

[0076] For each attack technology type, an attack technology feature corresponding to the attack technology type is determined according to the interface identifiers and interface parameters of each interface corresponding to the attack technology type.

[0077] Among them, the attack technology characteristics corresponding to the attack technology type can be reflected based on the interface called by the virus file when using the attack technology type to attack and the interface parameters of the called interface. That is to say, when determining the attack technology characteristics corresponding to each attack technology type, the interface identifier and interface parameters corresponding to each attack technology type when the virus file to be processed attacks can be determined based on the acquired behavior log data, and then the attack technology characteristics corresponding to each attack technology type can be determined based on the interface identifier and interface parameters corresponding to each attack technology type.

[0078] In an optional embodiment of the present application, for a sample TTPS rule, the sample TTPS rule includes key-value pairs, wherein the key in a key-value pair is an interface identifier of an interface, and the value is an interface parameter of the interface;

[0079] For each attack technology type, the attack technology features corresponding to the attack technology type are determined according to the interface identifiers and interface parameters of each interface corresponding to the attack technology type, including:

[0080] Using the interface identifier of each interface corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding first key-value pairs;

[0081] The first key-value pairs are combined according to their attack order to obtain attack behavior characteristics of the attack technology type.

[0082] Optionally, the interface identifier and interface parameters included in the sample TTPS rule may be expressed in the form of key-value pairs. That is, for a sample TTPS rule, the sample TTPS rule may include key-value pairs, where the key in a key-value pair is the interface identifier of an interface and the value is the interface parameter corresponding to the interface;

[0083] Optionally, when determining the attack technology characteristics corresponding to each attack technology type, it can also be reflected based on the key-value pair method. At this time, the interface identifier of each interface corresponding to the attack technology type obtained can be used as the key and the interface parameters of each interface can be used as the value to obtain the corresponding key-value pairs. Then, the key-value pairs are combined according to the attack order of each key-value pair to obtain the attack behavior characteristics of the attack technology type.

[0084] In an optional embodiment of the present application, each sample TTPS rule is obtained in the following manner:

[0085] Obtaining interface identifiers and interface parameters of interfaces of various attack technology types used by each sample virus file during the attack;

[0086] For each sample virus file, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file, determine the TTPS rule corresponding to each attack technology type of the sample virus file;

[0087] Based on the TTPS rules of each sample virus file corresponding to each attack technology type, each sample TTPS rule is determined.

[0088] Optionally, when extracting TTPS rules based on the behaviors of existing known virus files (i.e., sample virus files), the TTPS rules corresponding to each attack technology type for each sample virus file can be determined, and then the TTPS rules corresponding to each attack technology type can be determined as each sample TTPS rule. Specifically, the interface identifier and interface parameters of the interface of each attack technology type used by each sample virus file during the attack can be obtained, and then for each sample virus file, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type for the sample virus file, the TTPS rule corresponding to each attack technology type for the sample virus file is determined, and then based on the TTPS rules corresponding to each attack technology type for each sample virus file, each sample TTPS rule is determined.

[0089] In an optional embodiment of the present application, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file, determining the TTPS rule corresponding to each attack technology type of the sample virus file includes:

[0090] For each attack technology type, based on the interface identifier of each interface of the sample virus file corresponding to the attack technology type and the interface parameters of the interface, a TTPS rule corresponding to the attack technology type is obtained.

[0091] Among them, when determining the TTPS rule corresponding to each attack technology type, each interface and the interface parameters of each interface called by each sample virus file when using the attack technology type during the attack process can be determined in turn, and then the interface identifier of each interface called by each sample virus file and the interface parameters of the interface are used as a TTPS rule corresponding to the attack technology type.

[0092] In an optional embodiment of the present application, for each attack technology type, based on the interface identifier of each interface of the sample virus file corresponding to the attack technology type and the interface parameters of the interface, a TTPS rule corresponding to the attack technology type is obtained, including:

[0093] Using the interface identifier of each interface of the sample virus file corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding second key-value pairs;

[0094] The second key-value pairs are combined according to their attack order to obtain a TTPS rule corresponding to the attack technology type.

[0095] Optionally, when determining the TTPS rules corresponding to each attack technology type, a key-value pair can be used to represent it. For example, for each attack technology type, the interface identifier of each interface corresponding to each sample virus file of the attack technology type can be used as the key (i.e., Key), and the interface parameter corresponding to each interface can be used as the value (i.e., Value), to obtain each key-value pair corresponding to the attack technology type for each sample virus file, and for convenience, a key-value pair (i.e., key-Value) can be recorded as an act. Among them, the interface parameter value (i.e., Value) supports fuzzy matching and regular matching, that is, for each attack technology type, when matching the attack technology features of the attack technology type with the sample TTPS rules corresponding to the attack technology type, fuzzy matching or regular matching can be performed based on the Value in the key-value pair included in each attack technology type and the Value in each sample TTPS rule.

[0096] In actual applications, each sample virus file can call multiple interfaces for one attack technology type during the attack process. At this time, the actions corresponding to multiple interfaces can be arranged and combined according to the time when the calls occurred (i.e., the attack order), and the combined action can be used as a TTPS rule corresponding to the attack technology type.

[0097] In an example, suppose a sample virus file calls three interfaces for an attack technology type during the attack process. The key-value pairs corresponding to the three interfaces are act1, act2, and act3, and the order of occurrence is act1, act2, and act3. At this time, a TTPS rule for the attack technology type can be [act1&&act2&&act3,order:act1,act2,act3]. The TTPS rule means that the three acts must occur at the same time, and the order of occurrence is act1, act2, and act3.

[0098] In an optional embodiment of the present application, the virus family TTPS rules of each virus family are obtained by the following method:

[0099] Obtain a virus sample data set, which includes TTPS rules for each sample and behavior log data of each sample virus file belonging to each virus family;

[0100] For each virus family, the behavior log data of each sample virus file belonging to the virus family is matched with each sample TTPS rule to determine each sample TTPS rule hit by each sample virus file belonging to the virus family;

[0101] For each virus family, the family TTPS rule of the virus family is determined according to each sample TTPS rule hit by each sample virus file belonging to the virus family.

[0102] Among them, the virus sample data set refers to the virus family TTPS rule data set used to determine each virus family, which includes each sample TTPS rule and the behavior log data of each sample virus file belonging to each virus family. Among them, the sample TTPS rule refers to the TTPS rule extracted based on the behavior of existing known virus files, and each sample virus file refers to a virus file of an existing known virus family. The behavior log data of the sample virus file can also be obtained by running in a sandbox. Optionally, the method for obtaining the sample TTPS rule can be pre-configured, which is not limited in the embodiments of the present application. For example, it can be obtained from an external public website or in the process of daily analysis of virus files.

[0103] Optionally, for each virus family, the behavior log data of each sample virus file belonging to the virus family can be matched with each sample TTPS rule to determine each sample TTPS rule hit by each sample virus file belonging to the virus family; then for each virus family, the family TTPS rule of the virus family is obtained based on each sample TTPS rule hit by each sample virus file belonging to the virus family.

[0104] Among them, the specific implementation method of obtaining the family TTPS rule of the virus family according to each sample TTPS rule hit by each sample virus file belonging to the virus family can be pre-configured, and the embodiment of the present application is not limited. As an optional implementation, in an optional embodiment of the present application, for each virus family, according to each sample TTPS rule hit by each sample virus file belonging to the virus family, the virus family TTPS rule of the virus family is determined, including:

[0105] For each virus family, the sample TTPS rules that are hit by each sample virus file belonging to the virus family are used to determine the necessary TTPS rules for the virus family;

[0106] Based on the necessary TTPS rules of the virus family, the family TTPS rules of the virus family are determined, and the family TTPS rules include the necessary TTPS rules.

[0107] Specifically, the sample TTPS rules that are hit by each sample virus file belonging to the virus family can be determined, and then the necessary TTPS rules of the virus family are determined based on the sample TTPS rules that are hit by each sample virus file, and the determined necessary TTPS rules are determined as the family TTPS rules of the virus family.

[0108] In an example, assuming that virus family A includes sample virus file 1, sample virus file 2, and sample virus file 3, the sample TTPS rule hit by sample virus file 1 is recorded as md5_1[T1,T2,T3], the sample TTPS rule hit by sample virus file 2 is recorded as md5_2[T1,T2,T3,T4], and the sample TTPS rule hit by sample virus file 3 is recorded as md5_3[T1,T2,T3,T5]. At this time, the sample TTPS rule hit by sample virus file 1, sample virus file 2, and sample virus file 3 is [T1,T2,T3]. At this time, [T1,T2,T3] can be used as the family TTPS rule of the virus family, and [T1&&T2&&T3] is used to express it, which indicates that the virus files belonging to the virus family need to generate behaviors corresponding to T1, T2, and T4 at the same time during the attack process.

[0109] In an optional embodiment of the present application, the method further includes:

[0110] For each sample TTPS rule hit by each sample virus file belonging to each virus family, based on the number of sample virus files in the virus family that hit the sample TTPS rule, determine the unnecessary TTPS rules of the virus family;

[0111] Based on the necessary TTPS rules of the virus family, the family TTPS rules of the virus family are determined. The family TTPS rules include necessary TTPS rules, including:

[0112] Each non-essential TTPS rule of the virus family is combined with all necessary TTPS rules to obtain the TTPS rules of each family of the virus family.

[0113] Optionally, when determining the family TTPS rule for each virus family, for a virus family, the number of sample virus files for each sample TTPS rule that is hit in the virus family can also be determined, and then the non-essential TTPS rule for the virus family is determined based on the number, and then the family TTPS rule for the virus family is determined based on the non-essential TTPS rule and the necessary TTPS rule for the virus family. Among them, the specific numerical value of the number can be pre-configured according to actual needs, and the embodiments of the present application are not limited. For example, when the value of the number is set to the total number of sample virus files belonging to the virus family, the non-essential TTPS rule is a necessary TTPS rule.

[0114] In one example, assuming that the total number of sample virus files belonging to the virus family is 5, the value of the number is set to be less than 5 and greater than 2; accordingly, for a sample TTPS rule, the number of sample virus files in the virus family that hit the sample TTPS rule is 4 (less than 5 and greater than 2). At this time, the sample TTPS rule can be determined as a non-essential TTPS rule for the virus family.

[0115] Optionally, when determining the family TTPS rules of the virus family based on the non-essential TTPS rules and necessary TTPS rules of the virus family, each non-essential TTPS rule of the virus family and all necessary TTPS rules may be combined to obtain each family TTPS rule of the virus family.

[0116] In an example, assuming that the non-essential TTPS rules of the virus family include T2 and T3, and the necessary TTPS rules include T1 and T4, then T2 can be combined with T1 and T4 to obtain the family TTPS rule [T1, T2, T4], and T3 can be combined with T1 and T4 to obtain the family TTPS rule [T1, T3, T4]. At this time, the family TTPS rule [T1, T2, T4] and the family TTPS rule [T1, T3, T4] can be ANDed or operated to obtain the family TTPS rule [T1&&(T2||T3)&&T4] of the virus family, which indicates that the virus files belonging to the virus family need to simultaneously generate the behavior corresponding to T1 and the behavior corresponding to T4, as well as one of the behaviors corresponding to T2 and T3 during the attack process.

[0117] Of course, in actual applications, multiple non-essential TTPS rules of the virus family and all necessary TTPS rules can be combined to obtain the family TTPS rules of the virus family. For example, the non-essential TTPS rules T2 and T3 can be combined with the necessary TTPS rules (T1 and T4) to obtain the family TTPS rules [T1, T2, T3, T4]. The embodiments of the present application are not limited to this.

[0118] In an optional embodiment of the present application, after determining the virus family to which the virus file to be processed belongs, the process further includes:

[0119] Based on the behavior log data, obtain the threat indicator data corresponding to each target TTPS rule;

[0120] Threat intelligence data is generated and stored based on the virus family to which the virus file to be processed belongs, the target TTPS rules, and threat indicator data.

[0121] Optionally, after determining the virus family to which the virus file to be processed belongs, the threat indicator data corresponding to each target TTPS rule can be obtained based on the behavior log data of the virus file to be processed, and then threat intelligence data can be generated and stored in a database based on the virus family results to which the virus file to be processed belongs, the target TTPS rules hit by the virus file to be processed, and the acquired threat indicator data, so that the relevant information of the virus file to be processed can be directly obtained from the database when the virus file to be processed is subsequently processed.

[0122] In an optional embodiment of the present application, the threat indicator data includes at least one of an IP and a Domain;

[0123] Generate and store threat intelligence data based on the virus family to which the virus file to be processed belongs, the target TTPS rules, and threat indicator data, including:

[0124] Mark the threat indicator data according to the virus family to which the virus file to be processed belongs;

[0125] Threat intelligence data is generated and stored based on the marked threat indicator data and each target TTPS rule.

[0126] Among them, the threat indicator data may include at least one of the IP and Domain corresponding to the virus file during operation. Optionally, after obtaining the threat indicator data of the virus to be processed based on the behavior log data of the virus file to be processed, the threat indicator data can be marked based on the virus family to which the virus file to be processed belongs to obtain the marked threat indicator data, and then the marked threat indicator data and each target TTPS rule are stored in the database as threat intelligence data. Among them, marking the threat indicator data according to the virus family to which the virus file to be processed belongs can refer to marking the Domain and IP corresponding to the virus file to be processed during operation as the virus family to which the virus file to be processed belongs. For example, assuming that the virus file to be processed belongs to virus family A, the label attributes of the Domain and IP corresponding to the virus file to be processed during operation can be marked as virus family A.

[0127] In an optional embodiment of the present application, threat intelligence data is generated and stored according to the virus family to which the virus file to be processed belongs, each target TTPS rule, and threat indicator data, including:

[0128] Based on the preset security whitelist, filter each target TTPS rule and threat indicator data to obtain filtered target TTPS rules and threat indicator data;

[0129] Based on the filtered TTPS rules and threat indicator data of each target, threat intelligence data is generated and stored.

[0130] In actual applications, there are some safe programs that access the domain name of the virus file during its operation, but the program is not the virus file and does not belong to a certain virus family. For example, the browser program can access the domain name of the virus file during its operation. At this time, the threat indicator data obtained based on the behavior log data of the virus file may also include the browser domain name.

[0131] Based on this, a security whitelist can be pre-set in an embodiment of the present application. At this time, each target TTPS rule and each threat indicator data are filtered based on the security whitelist to obtain filtered target TTPS rules and each threat indicator data, and then threat intelligence data is generated and stored based on the filtered target TTPS rules and each threat indicator data.

[0132] In an optional embodiment of the present application, the security whitelist includes threat indicator data corresponding to each security application;

[0133] Based on the security whitelist, filter each target TTPS rule and each threat indicator data, including:

[0134] Based on the preset security whitelist, target indicator data that is the same as the threat indicator data corresponding to the security application program in the threat indicator data corresponding to each target TTPS rule is filtered;

[0135] Filter the TTPS rules corresponding to the target indicator data in each target TTPS rule.

[0136] Optionally, the security whitelist may include domain names and IP addresses corresponding to each security program. Furthermore, since each target TTPS rule has corresponding threat indicator data, that is, the acquired threat indicator data corresponds one-to-one to each target TTPS rule, the threat indicator data (that is, target threat indicator data) that are identical to the threat indicator data corresponding to the security application program in the acquired threat indicator data may be filtered out, and the TTPS rules corresponding to the target indicator data in each target TTPS rule may be filtered out, the threat indicator data that is different from that in the security whitelist may be retained, and the target TTPS rules corresponding to the retained threat indicator data may be retained.

[0137] In one example, assuming that the target TTPS rules include Md5_1, Md5_2 and Md5_3, the threat indicator data corresponding to Md5_1 is domain name 1 and IP1, the threat indicator data corresponding to Md5_2 is domain name 2 and IP2, and the threat indicator data corresponding to Md5_3 is domain name 3 and IP3, and the security whitelist includes domain name 1 and IP1. At this time, the obtained Md5_1, domain name 1 and IP1 can be filtered out, and then threat intelligence data is generated and stored based on Md5_2, domain name 2 and IP2 corresponding to Md5_2, and domain name 3 and IP3 corresponding to Md5_3 and Md5_3.

[0138] In an optional embodiment of the present application, after determining the virus family to which the virus file to be processed belongs, the process further includes:

[0139] Generate threat alert information for virus files to be processed.

[0140] Optionally, after determining the virus family to which the virus file to be processed belongs, threat alert information for the virus file to be processed can also be generated to inform the user to process the virus file to be processed in a timely manner and improve the safety factor. The specific form of the threat alert information can be preset and is not limited in the embodiment of the present application. For example, a voice playback method can be used to remind the user, or a message can be sent to a bound terminal device to remind the user, etc.

[0141] like Figure 2As shown, an embodiment of the present application provides a system structure diagram of a method for processing virus files, wherein the system includes a sample behavior collection module, a TTPS rule collection module, a matching engine, a TTPS family analysis module, a TTPS family operation module, a threat perception system and a threat intelligence library.

[0142] Among them, the sample behavior collection module is used to collect the behavior log data of each sample virus file (i.e., output log), and then collect each sample TTPS rule (i.e., provide rules) through the TTPS rule collection module, and match the behavior log data of the virus file belonging to each virus family with each sample TTPS rule through the matching engine, and output each sample TTPS rule hit by each sample virus file (i.e., output sample and TTPS rule); the TTPS family analysis module analyzes each sample TTPS rule hit by each sample virus file belonging to each virus family, obtains the family TTPS rule of each virus family and enters the TTPS family operation platform (i.e., outputs family TTPS rule). Among them, the TTPS operation platform can provide the threat perception system with the analysis capability of the virus file (such as the virus family to which the virus file belongs) (i.e., provide capability), and provide the threat intelligence library with the relevant data of the virus file (i.e., provide data), the threat perception system is used to output and display the virus family to which the virus file belongs, and the threat intelligence library is used to store the relevant data of the virus file (such as domain name, IP, etc.).

[0143] In order to better understand the method provided in the embodiments of the present application, Figure 3 As shown, the embodiment of the present application fully describes each step in the virus file processing method. In this example, the family TTPS rules of each virus family and each sample TTPS rule can be saved through the operation platform. The method can specifically include:

[0144] Step S301, obtaining TTPS rules for each sample and each sample virus file belonging to each virus family;

[0145] The method for obtaining the sample TTPS rules may be pre-configured, for example, it may be obtained from an external public website or obtained during the routine analysis of virus files.

[0146] Step S302, running each sample virus file of each virus family through a sandbox to obtain behavior log data of each sample virus file;

[0147] Specifically, a sandbox is an execution environment that restricts program behavior according to security policies. Virus files can be placed in a sandbox for execution, and then the behavior of virus files can be detected by intercepting system calls. Therefore, in order to obtain the behavior log data of each sample virus file, a sandbox environment can be built, and then each sample virus file can be run in the sandbox to obtain the behavior log data of each sample virus file. At this time, even if other changes occur during the execution of the sample virus file, it can be deleted later, and there will be no permanent impact on the hard disk.

[0148] Step S303, matching the behavior log data of each sample virus file with each sample TTPS rule, and determining each sample TTPS rule hit by each sample virus file;

[0149] Optionally, the sample TTPS rules may refer to rules extracted based on the attack methods of existing known virus files, which reflect the attack methods of the virus files during operation, and each attack method of the virus file may correspond to a certain behavior, which may be reflected by the acquired behavior log data; accordingly, after obtaining the behavior log data of each sample virus file, the behavior log data may be matched with each sample TTPS rule to determine each sample TTPS rule hit by each sample virus file.

[0150] Step S304, for each virus family, according to each sample TTPS rule hit by each sample virus file belonging to the virus family, determine the family TTPS rule of the virus family;

[0151] Specifically, necessary TTPS rules and non-essential TTPS rules can be determined based on each sample virus file belonging to the virus family, and then each non-essential TTPS rule of the virus family is combined with all necessary TTPS rules to obtain each family TTPS rule of the virus family. Among them, the sample TTPS rule that is hit by each sample virus file belonging to the virus family can be determined as the necessary TTPS rule of the virus family, and for each sample TTPS rule hit by each sample virus file belonging to each virus family, if not all sample virus files in the virus family hit the sample TTPS rule, the sample TTPS rule can be used as the non-essential TTPS rule of the virus family.

[0152] Step S305, obtaining the virus file to be processed;

[0153] Step S306, running the virus file to be processed through the sandbox to obtain behavior log data of the virus file to be processed, and determining the virus behavior characteristics of the virus file to be processed based on the behavior log data;

[0154] Optionally, since the specific behavioral characteristics of the virus file to be processed are unknown, in order to avoid causing other impacts on the system, a sandbox operating environment can be built at this time, and then the virus file to be processed can be run in the sandbox to obtain the behavioral log data of the virus file to be processed.

[0155] Step S307, matching the virus behavior characteristics of the virus file to be processed with each sample TTPS rule of the virus file to determine each target TTPS rule hit by the virus file to be processed;

[0156] Optionally, based on the behavior log data, the interface identifier and interface parameters of the interface attacked by the virus file to be processed can be determined and expressed in a key-value pair format, and then matched with each sample TTPS rule to obtain each target TTPS rule hit by the virus file to be processed.

[0157] Step S308, matching each target TTPS rule with the family TTPS rule of each virus family to determine the virus family to which the virus file to be processed belongs;

[0158] Optionally, there may be multiple family TTPS rules for the same virus family. In this case, if each target TTPS rule hit by the virus file to be processed hits any family TTPS rule of a virus family, it can be determined that the virus file to be processed belongs to the virus family.

[0159] Step S309, displaying the virus family to which the virus file to be processed belongs;

[0160] Optionally, in order to let the user know the virus family to which the virus file to be processed belongs so as to better process the virus file in the future, the virus family to which the virus file to be processed belongs is also displayed. For example, the virus family to which the virus file to be processed belongs can be displayed in the form of voice playback, or corresponding prompt information can be displayed in the bound terminal device.

[0161] Step S310, obtaining the IP and domain name of the virus file to be processed according to the behavior log data of the virus file to be processed;

[0162] In actual applications, the IP and domain name of the virus file to be processed can also be obtained through the behavior log data of the virus file to be processed, and then when the virus file to be processed needs to be processed later, the IP and domain name can be directly obtained for processing.

[0163] Step S311, based on a preset security whitelist, filtering the IP, domain name and each target TTPS rule to obtain the filtered IP, domain name and each target TTPS rule;

[0164] In actual applications, the acquired IP and domain name may include the IP and domain name of some security applications, and the IP and domain name of the application can be set as a security whitelist; correspondingly, if the acquired IP and domain name include the IP and domain name in the security whitelist, the IP and domain name that are the same as the IP and domain name in the security whitelist can be filtered out, and the retained IP and domain name, and the target TTPS rules corresponding to the retained IP and domain name can be used as the filtered IP, domain name and each target TTPS rule.

[0165] Step S312, marking the filtered IP and domain name according to the virus family to which the virus file to be processed belongs, to obtain the marked IP and domain name;

[0166] Optionally, in order to know the virus family to which the virus file to be processed belongs, the label attributes of the filtered IP and domain name can be marked as the virus family to which the virus file to be processed belongs, and the marked IP and domain name can be obtained.

[0167] Step S313, threat intelligence data is generated and stored according to the filtered target TTPS rules, marked IP and domain names.

[0168] Correspondingly, after obtaining the marked IP and domain name, the filtered target TTPS rules, marked IP and domain name can be used to generate threat intelligence data and stored in the database. When the virus file to be processed is subsequently processed, the target TTPS rules, IP and domain name corresponding to the virus file to be processed can be directly obtained from the database, and the virus family to which the virus to be processed belongs can be known based on the label attributes of the IP and domain name.

[0169] like Figure 4 As shown, in order to better understand the method provided by the embodiment of the present application, the method is described in detail below with reference to a specific example, which may specifically include a TTPS reserve phase and an application phase. Among them, the TTPS reserve phase includes:

[0170] 1. Obtain the TTPS rules of each sample and the virus files of each sample belonging to each virus family from external public websites or in the process of daily virus analysis (i.e. extract TTPS technical points);

[0171] 2. Run each sample virus file into a sandbox (i.e., dynamic sandbox) to generate behavior log data (i.e., the four md5 [T1, T2, T3, T4] in the figure), and match the generated behavior log data with each sample TTPS rule to determine the sample TTPS rule hit by each sample virus file, obtain the matching results and record them;

[0172] 3. According to the TTPS rules of each sample hit by each sample virus file belonging to each virus family, determine the family TTPS rule of each virus family (i.e., analyze and extract the family TTPS), such as the family TTPS rule of family A is [T1&&T2&&T3], the family TTPS rule of family B is [(T1&&T2)||T3], and the family TTPS rule of family C is [T1||T2||T3];

[0173] The application phase includes:

[0174] 1. Run the new virus sample (i.e., the virus file to be processed) into the sandbox to obtain the behavior log data, and determine the target TTPS rules hit by the new virus sample; match the TTPS of each target virus file with the family TTPS rules of each virus family to obtain the virus family to which the new virus sample belongs (such as virus family A), and display the virus family to which the new virus sample belongs and generate threat alert information (i.e., the warning & prompt virus family in the figure);

[0175] 2. After determining that the new virus sample belongs to virus family A, obtain the IP and Domain accessed by the new virus sample through the behavior log data (i.e., obtain the IP and Domain);

[0176] 3. Mark each target TTPS rule (i.e. md5), IP, and Domain that is hit as virus family A (i.e. md5_1, IP1, and Domain [Family A] in the figure) and generate threat intelligence data and store it in the database (i.e. enter the threat intelligence library).

[0177] The present application embodiment provides a virus file processing device, such as Figure 5 As shown, the virus file processing unit 60 may include: a data acquisition module 601, a behavior feature determination module 602, a rule matching module 603, a virus family determination module 604 and a result display module 605, wherein:

[0178] The data acquisition module 601 is used to acquire the behavior log data of the virus file to be processed;

[0179] A behavior feature determination module 602 is used to determine the virus behavior features of the virus file to be processed based on the behavior log data;

[0180] The rule matching module 603 is used to match the virus behavior feature with each sample TTPS rule of the virus file, and determine each target TTPS rule hit by the virus behavior feature, wherein, for any sample TTPS rule, the sample TTPS rule represents the virus behavior feature of a sample virus file;

[0181] The virus family determination module 604 is used to match each target TTPS rule with the family TTPS rule of each virus family. If the target TTPS rule hits any family TTPS rule of a virus family, the virus family corresponding to the hit family TTPS rule is determined as the virus family to which the virus file to be processed belongs;

[0182] The result display module 605 is used to display the processing result of the virus file to be processed, and the processing result includes the virus family to which the virus file to be processed belongs.

[0183] Optionally, when each sample TTPS rule includes a TTPS rule corresponding to each attack technology type, the behavior feature determination module determines the virus behavior feature of the virus file to be processed based on the behavior log data, specifically for:

[0184] Based on the behavior log data, determine the attack technology characteristics of the virus file to be processed corresponding to each attack technology type during the attack;

[0185] The virus behavior characteristics of the virus file to be processed include attack technology characteristics corresponding to each attack technology type;

[0186] The rule matching module is used to match the virus behavior characteristics with the sample TTPS rules of the virus file and determine the target TTPS rules hit by the virus behavior characteristics:

[0187] For each attack technology type, the attack technology features of the attack technology type are matched with the sample TTPS rules corresponding to the attack technology type, and the sample TTPS rules that meet the preset matching conditions are determined as the TTPS rules hit by the attack technology type. Each target TTPS rule includes the TTPS rules hit by each attack technology type.

[0188] Optionally, when the behavior feature determination module determines the attack technology feature corresponding to each attack technology type based on the behavior log data, it is specifically used to:

[0189] Based on the behavior log data, determine the interface identifier and interface parameters of each interface corresponding to each attack technology type when the virus file to be processed attacks;

[0190] For each attack technology type, an attack technology feature corresponding to the attack technology type is determined according to the interface identifiers and interface parameters of each interface corresponding to the attack technology type.

[0191] Optionally, for a sample TTPS rule, the sample TTPS rule includes key-value pairs, wherein a key in a key-value pair is an interface identifier of an interface, and a value is an interface parameter of the interface;

[0192] For each operation type, the behavior feature determination module is specifically used to:

[0193] Using the interface identifier of each interface corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding first key-value pairs;

[0194] The first key-value pairs are combined according to their attack order to obtain attack behavior characteristics of the attack technology type.

[0195] Optionally, the device further includes a rule determination module, and the virus family TTPS rule of each virus family is obtained by the rule determination module in the following manner:

[0196] Obtain a virus sample data set, which includes TTPS rules for each sample and behavior log data of each sample virus file belonging to each virus family;

[0197] For each virus family, the behavior log data of each sample virus file belonging to the virus family is matched with each sample TTPS rule to determine each sample TTPS rule hit by each sample virus file belonging to the virus family;

[0198] For each virus family, the family TTPS rule of the virus family is determined according to each sample TTPS rule hit by each sample virus file belonging to the virus family.

[0199] Optionally, when the rule determination module determines the virus family TTPS rule of each virus family according to each sample TTPS rule hit by each sample virus file belonging to the virus family, the rule determination module is specifically used to:

[0200] For each virus family, the sample TTPS rules that are hit by each sample virus file belonging to the virus family are used to determine the necessary TTPS rules for the virus family;

[0201] Based on the necessary TTPS rules of the virus family, the family TTPS rules of the virus family are determined, and the family TTPS rules include the necessary TTPS rules.

[0202] Optionally, the rule determination module is further used to:

[0203] For each sample TTPS rule hit by each sample virus file belonging to each virus family, based on the number of sample virus files in the virus family that hit the sample TTPS rule, determine the unnecessary TTPS rules of the virus family;

[0204] The rule determination module determines the family TTPS rule of the virus family based on the necessary TTPS rule of the virus family, when the family TTPS rule includes the necessary TTPS rule, specifically for:

[0205] Each non-essential TTPS rule of the virus family is combined with all necessary TTPS rules to obtain the TTPS rules of each family of the virus family.

[0206] Optionally, each sample TTPS rule is obtained by the rule determination module in the following manner:

[0207] Obtaining interface identifiers and interface parameters of interfaces of various attack technology types used by each sample virus file during the attack;

[0208] For each sample virus file, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file, determine the TTPS rule corresponding to each attack technology type of the sample virus file;

[0209] Based on the TTPS rules of each sample virus file corresponding to each attack technology type, each sample TTPS rule is determined.

[0210] Optionally, the rule determination module obtains the interface identifier and interface parameters of the interface of each attack technology type adopted by each sample virus file during the attack;

[0211] For each sample virus file, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file, determine the TTPS rule corresponding to each attack technology type of the sample virus file;

[0212] Based on the TTPS rules corresponding to each attack technology type for each sample virus file, the TTPS rules for each sample are determined to be specifically used for:

[0213] For each attack technology type, based on the interface identifier of each interface of the sample virus file corresponding to the attack technology type and the interface parameters of the interface, a TTPS rule corresponding to the attack technology type is obtained.

[0214] Optionally, when the rule determination module obtains a TTPS rule corresponding to each attack technology type based on the interface identifier of each interface corresponding to the attack technology type in the sample virus file and the interface parameters of the interface, the rule determination module is specifically used to:

[0215] Using the interface identifier of each interface of the sample virus file corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding second key-value pairs;

[0216] The second key-value pairs are combined according to their attack order to obtain a TTPS rule corresponding to the attack technology type.

[0217] Optionally, the device further includes a data processing module, which is used to:

[0218] After determining the virus family to which the virus file to be processed belongs, obtain the threat indicator data corresponding to each target TTPS rule based on the behavior log data;

[0219] Threat intelligence data is generated and stored based on the virus family to which the virus file to be processed belongs, the target TTPS rules, and threat indicator data.

[0220] Optionally, the threat indicator data includes at least one of a network protocol IP and a domain name Domain;

[0221] The data processing module generates and stores threat intelligence data according to the virus family to which the virus file to be processed belongs, the target TTPS rules, and the threat indicator data. Specifically, it is used to:

[0222] Mark the threat indicator data according to the virus family to which the virus file to be processed belongs;

[0223] Threat intelligence data is generated and stored based on the marked threat indicator data and each target TTPS rule.

[0224] Optionally, when the data processing module generates and stores threat intelligence data according to the virus family to which the virus file to be processed belongs, each target TTPS rule, and threat indicator data, it is specifically used to:

[0225] Based on the preset security whitelist, filter each target TTPS rule and threat indicator data to obtain filtered target TTPS rules and threat indicator data;

[0226] Based on the filtered TTPS rules and threat indicator data of each target, threat intelligence data is generated and stored.

[0227] Optionally, the security whitelist includes threat indicator data corresponding to each security application;

[0228] The data processing module is used to filter each target TTPS rule and each threat indicator data based on the security whitelist, specifically for:

[0229] Based on the preset security whitelist, target indicator data that is the same as the threat indicator data corresponding to the security application program in the threat indicator data corresponding to each target TTPS rule is filtered;

[0230] Filter the TTPS rules corresponding to the target indicator data in each target TTPS rule.

[0231] Optionally, the device further includes a reminder module, which is used to:

[0232] After determining the virus family to which the virus file to be processed belongs, threat alert information for the virus file to be processed is generated.

[0233] Optionally, when the data acquisition module acquires the behavior log data of the virus file to be processed, it is specifically used to:

[0234] By running the virus file to be processed in the sandbox, the behavior log data of the virus file to be processed is obtained.

[0235] The virus file processing device of the embodiment of the present application can execute a virus file processing method provided in the embodiment of the present application. The implementation principle is similar and will not be repeated here.

[0236] The present application embodiment provides an electronic device, such as Figure 6 As shown, Figure 6 The electronic device 2000 shown includes: a processor 2001 and a memory 2003. The processor 2001 and the memory 2003 are connected, such as through a bus 2002. Optionally, the electronic device 2000 may also include a transceiver 2004. It should be noted that in actual applications, the transceiver 2004 is not limited to one, and the structure of the electronic device 2000 does not constitute a limitation on the embodiments of the present application.

[0237] The processor 2001 is used in the embodiment of the present application to implement Figure 5 The functions of each module are shown.

[0238] Processor 2001 may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 2001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0239] The bus 2002 may include a path to transmit information between the above components. The bus 2002 may be a PCI bus or an EISA bus, etc. The bus 2002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0240] Memory 2003 may be ROM or other types of static storage devices that can store static information and computer programs, RAM or other types of dynamic storage devices that can store information and computer programs, or may be EEPROM, CD-ROM or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store or in the form of a data structure the desired computer program and can be accessed by a computer, but is not limited thereto.

[0241] The memory 2003 is used to store a computer program for executing the application program of the present application solution, and the execution is controlled by the processor 2001. The processor 2001 is used to execute the computer program of the application program stored in the memory 2003 to implement Figure 5 The illustrated embodiment provides actions of the apparatus for processing virus files.

[0242] An embodiment of the present application provides an electronic device, including a processor and a memory: the memory is configured to store a computer program, and when the computer program is executed by the processor, the processor performs any one of the methods in the above embodiments.

[0243] An embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program runs on a computer, the computer can execute any one of the methods in the above embodiments.

[0244] According to one aspect of the present application, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes any one of the methods in the above embodiments.

[0245] The nouns and implementation principles involved in a computer-readable storage medium in the present application can be specifically referred to a virus file processing method in an embodiment of the present application, and will not be repeated here.

[0246] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0247] The above description is only a partial implementation method of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for processing virus files, characterized in that: include: Obtain behavior log data of virus files to be processed; Determining virus behavior characteristics of the virus file to be processed based on the behavior log data; Matching the virus behavior feature with each sample tactic, technique and attack process TTPS rule of the virus file, and determining each target TTPS rule hit by the virus behavior feature, wherein for any sample TTPS rule, the sample TTPS rule characterizes the virus behavior feature of the virus file; Matching each of the target TTPS rules with the family TTPS rules of each virus family, if each of the target TTPS rules hits any family TTPS rule of a virus family, then determining the virus family corresponding to the hit family TTPS rule as the virus family to which the virus file to be processed belongs; Displaying the processing result of the virus file to be processed, wherein the processing result includes the virus family to which the virus file to be processed belongs; The virus behavior characteristics of the virus file to be processed include attack technology characteristics corresponding to each attack technology type; for a sample TTPS rule, the sample TTPS rule includes each key-value pair, wherein the key in a key-value pair is an interface identifier of an interface, and the value is an interface parameter of the interface; the virus behavior characteristics of the virus file to be processed based on the behavior log data include: Based on the behavior log data, determine the interface identifier and interface parameters of each interface corresponding to each attack technology type when the virus file to be processed attacks; Using the interface identifier of each interface corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding first key-value pairs; The first key-value pairs are combined according to the attack sequence of the first key-value pairs to obtain attack behavior characteristics of the attack technology type.

2. The method according to claim 1, characterized in that Each sample TTPS rule includes a TTPS rule corresponding to each attack technology type. The step of matching the virus behavior feature with each sample TTPS rule of the virus file to determine each target TTPS rule hit by the virus behavior feature includes: For each attack technology type, the attack technology features of the attack technology type are matched with the sample TTPS rules corresponding to the attack technology type, and the sample TTPS rules that meet the preset matching conditions are determined as the TTPS rules hit by the attack technology type. The target TTPS rules include the TTPS rules hit by each attack technology type.

3. The method according to claim 1, characterized in that After determining the virus family to which the virus file to be processed belongs, the method further includes: According to the behavior log data, acquiring threat indicator data corresponding to each target TTPS rule; Threat intelligence data is generated and stored according to the virus family to which the virus file to be processed belongs, the target TTPS rules, and the threat indicator data.

4. The method according to claim 3, characterized in that The threat indicator data includes at least one of a network protocol IP and a domain name Domain; The generating and storing threat intelligence data according to the virus family to which the virus file to be processed belongs, the target TTPS rules, and the threat indicator data includes: Marking each of the threat indicator data according to the virus family to which the virus file to be processed belongs; Threat intelligence data is generated and stored according to each of the marked threat indicator data and each of the target TTPS rules.

5. The method according to claim 1, characterized in that The family TTPS rules of each virus family are obtained in the following way: Acquire a sample data set, wherein the sample data set includes each sample TTPS rule and behavior log data of each sample virus file belonging to each virus family; For each of the virus families, matching the behavior log data of each of the sample virus files belonging to the virus family with each of the sample TTPS rules, and determining each of the sample TTPS rules hit by each of the sample virus files belonging to the virus family; For each of the virus families, the family TTPS rule of the virus family is determined according to each sample TTPS rule hit by each of the sample virus files belonging to the virus family.

6. The method according to claim 5, characterized in that For each of the virus families, according to each sample TTPS rule hit by each of the sample virus files belonging to the virus family, the virus family TTPS rule of the virus family is determined, including: For each of the virus families, the sample TTPS rules that are hit by each of the sample virus files belonging to the virus family are used to determine the necessary TTPS rules for the virus family; Based on the necessary TTPS rule of the virus family, a family TTPS rule of the virus family is determined, wherein the family TTPS rule includes the necessary TTPS rule.

7. The method according to claim 6, characterized in that The method further comprises: For each sample TTPS rule hit by each of the sample virus files belonging to each of the virus families, based on the number of sample virus files in the virus family that hit the sample TTPS rule, determine a non-essential TTPS rule for the virus family; The necessary TTPS rule based on the virus family determines the family TTPS rule of the virus family, wherein the family TTPS rule includes the necessary TTPS rule, including: Each non-essential TTPS rule of the virus family is combined with all necessary TTPS rules to obtain the TTPS rules of each family of the virus family.

8. The method according to claim 7, characterized in that The sample TTPS rules are obtained in the following ways: Obtaining interface identifiers and interface parameters of interfaces of various attack technology types used by each of the sample virus files during the attack; For each sample virus file, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file, determine the TTPS rule corresponding to each attack technology type of the sample virus file; Based on the TTPS rules of each sample virus file corresponding to each attack technology type, each sample TTPS rule is determined.

9. The method according to claim 8, characterized in that The step of determining the TTPS rule corresponding to each attack technology type of the sample virus file based on the interface identifier and interface parameter of the interface corresponding to each attack technology type of the sample virus file includes: For each attack technology type, based on the interface identifier of each interface of the sample virus file corresponding to the attack technology type and the interface parameters of the interface, a TTPS rule corresponding to the attack technology type is obtained.

10. The method according to claim 9, characterized in that For each attack technology type, based on the interface identifier of each interface corresponding to the attack technology type in the sample virus file and the interface parameters of the interface, a TTPS rule corresponding to the attack technology type is obtained, including: Using the interface identifier of each interface of the sample virus file corresponding to the attack technology type as a key and the interface parameter of each interface as a value to obtain corresponding second key-value pairs; The second key-value pairs are combined according to the attack sequence of the second key-value pairs to obtain a TTPS rule corresponding to the attack technology type.

11. The method according to claim 3, characterized in that The method generates and stores threat intelligence data according to the virus family to which the virus file to be processed belongs, each target TTPS rule, and threat indicator data, including: Based on the preset security whitelist, filter each target TTPS rule and threat indicator data to obtain filtered target TTPS rules and threat indicator data; Based on the filtered TTPS rules and threat indicator data of each target, threat intelligence data is generated and stored.

12. The method according to claim 11, characterized in that The security whitelist includes threat indicator data corresponding to each security application; Based on the security whitelist, filter each target TTPS rule and each threat indicator data, including: Based on the preset security whitelist, target indicator data that is the same as the threat indicator data corresponding to the security application program in the threat indicator data corresponding to each target TTPS rule is filtered; Filter the TTPS rules corresponding to the target indicator data in each target TTPS rule.

13. The method according to claim 1, characterized in that After determining the virus family to which the virus file to be processed belongs, it also includes: Generate threat alert information for virus files to be processed.

14. The method according to claim 1, characterized in that The step of obtaining the behavior log data of the virus file to be processed includes: The virus file to be processed is run through the sandbox to obtain the behavior log data of the virus file to be processed.

15. A virus file processing device, characterized in that: include: A data acquisition module is used to obtain the behavior log data of the virus file to be processed; A behavior feature determination module, used to determine the virus behavior feature of the virus file to be processed based on the behavior log data; A rule matching module, used to match the virus behavior feature with each sample TTPS rule of the virus file, and determine each target TTPS rule hit by the virus behavior feature, wherein, for any sample TTPS rule, the sample TTPS rule represents the virus behavior feature of the virus file; A virus family determination module, used for matching each target TTPS rule with a family TTPS rule of each virus family. If the target TTPS rule hits any family TTPS rule of a virus family, the virus family corresponding to the hit family TTPS rule is determined as the virus family to which the virus file to be processed belongs; A result display module, used to display the processing result of the virus file to be processed, wherein the processing result includes the virus family to which the virus file to be processed belongs; The virus behavior characteristics of the virus file to be processed include attack technology characteristics corresponding to each attack technology type; for a sample TTPS rule, the sample TTPS rule includes each key-value pair, wherein the key in a key-value pair is an interface identifier of an interface, and the value is an interface parameter of the interface; the behavior characteristic determination module is specifically used to determine the virus behavior characteristics of the virus file to be processed based on the behavior log data: Based on the behavior log data, determine the interface identifier and interface parameters of each interface corresponding to each attack technology type when the virus file to be processed attacks; Using the interface identifier of each interface corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding first key-value pairs; The first key-value pairs are combined according to their attack order to obtain attack behavior characteristics of the attack technology type.

16. The device according to claim 15, characterized in that Each sample TTPS rule includes a TTPS rule corresponding to each attack technology type. The rule matching module is specifically used to match the virus behavior features with each sample TTPS rule of the virus file to determine each target TTPS rule hit by the virus behavior features: For each attack technology type, the attack technology features of the attack technology type are matched with the sample TTPS rules corresponding to the attack technology type, and the sample TTPS rules that meet the preset matching conditions are determined as the TTPS rules hit by the attack technology type. Each target TTPS rule includes the TTPS rules hit by each attack technology type.

17. The device according to claim 15, characterized in that The device further includes a rule determination module, and the virus family TTPS rule of each virus family is obtained by the rule determination module in the following manner: Obtain a virus sample data set, which includes TTPS rules for each sample and behavior log data of each sample virus file belonging to each virus family; For each virus family, the behavior log data of each sample virus file belonging to the virus family is matched with each sample TTPS rule to determine each sample TTPS rule hit by each sample virus file belonging to the virus family; For each virus family, the family TTPS rule of the virus family is determined according to each sample TTPS rule hit by each sample virus file belonging to the virus family.

18. The device according to claim 17, characterized in that The rule determination module is specifically used to determine the virus family TTPS rule of each virus family according to each sample TTPS rule hit by each sample virus file belonging to the virus family for each virus family: For each virus family, the sample TTPS rules that are hit by each sample virus file belonging to the virus family are used to determine the necessary TTPS rules for the virus family; Based on the necessary TTPS rules of the virus family, the family TTPS rules of the virus family are determined, and the family TTPS rules include the necessary TTPS rules.

19. The device according to claim 18, characterized in that The rule determination module is also used for: For each sample TTPS rule hit by each sample virus file belonging to each virus family, based on the number of sample virus files in the virus family that hit the sample TTPS rule, determine the unnecessary TTPS rules of the virus family; Wherein, the rule determination module determines the family TTPS rule of the virus family based on the necessary TTPS rule of the virus family, when the family TTPS rule includes the necessary TTPS rule, specifically for: Each non-essential TTPS rule of the virus family is combined with all necessary TTPS rules to obtain the TTPS rules of each family of the virus family.

20. The device according to claim 19, characterized in that The sample TTPS rules are obtained by the rule determination module in the following manner: Obtaining interface identifiers and interface parameters of interfaces of various attack technology types used by each sample virus file during the attack; For each sample virus file, based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file, determine the TTPS rule corresponding to each attack technology type of the sample virus file; Based on the TTPS rules of each sample virus file corresponding to each attack technology type, each sample TTPS rule is determined.

21. The device according to claim 20, characterized in that The rule determination module is specifically used to: determine the TTPS rule corresponding to each attack technology type of the sample virus file based on the interface identifier and interface parameters of the interface corresponding to each attack technology type of the sample virus file: For each attack technology type, based on the interface identifier of each interface of the sample virus file corresponding to the attack technology type and the interface parameters of the interface, a TTPS rule corresponding to the attack technology type is obtained.

22. The device according to claim 21, characterized in that The rule determination module, for each attack technology type, obtains a TTPS rule corresponding to the attack technology type based on the interface identifier of each interface of the sample virus file corresponding to the attack technology type and the interface parameters of the interface, specifically for: Using the interface identifier of each interface of the sample virus file corresponding to the attack technology type as a key and the interface parameter of each interface as a value, to obtain corresponding second key-value pairs; The second key-value pairs are combined according to their attack order to obtain a TTPS rule corresponding to the attack technology type.

23. The device according to claim 15, characterized in that The device also includes a data processing module, wherein: The data processing module is used for: After determining the virus family to which the virus file to be processed belongs, obtain the threat indicator data corresponding to each target TTPS rule based on the behavior log data; Threat intelligence data is generated and stored based on the virus family to which the virus file to be processed belongs, the target TTPS rules, and threat indicator data.

24. The device according to claim 23, characterized in that The threat indicator data includes at least one of the network protocol IP and domain name Domain; The data processing module generates and stores threat intelligence data according to the virus family to which the virus file to be processed belongs, each target TTPS rule, and threat indicator data, and is specifically used to: Mark the threat indicator data according to the virus family to which the virus file to be processed belongs; Threat intelligence data is generated and stored based on the marked threat indicator data and each target TTPS rule.

25. The device according to claim 23, characterized in that The data processing module generates and stores threat intelligence data according to the virus family to which the virus file to be processed belongs, each target TTPS rule, and threat indicator data, and is specifically used to: Based on the preset security whitelist, filter each target TTPS rule and threat indicator data to obtain filtered target TTPS rules and threat indicator data; Based on the filtered TTPS rules and threat indicator data of each target, threat intelligence data is generated and stored.

26. The device according to claim 25, characterized in that The security whitelist includes threat indicator data corresponding to each security application; The data processing module is used to filter each target TTPS rule and each threat indicator data based on the security whitelist, specifically for: Based on the preset security whitelist, target indicator data that is the same as the threat indicator data corresponding to the security application program in the threat indicator data corresponding to each target TTPS rule is filtered; Filter the TTPS rules corresponding to the target indicator data in each target TTPS rule.

27. The device according to claim 15, characterized in that The device also includes a reminder module, which is used to: After determining the virus family to which the virus file to be processed belongs, threat alert information for the virus file to be processed is generated.

28. The device according to claim 15, characterized in that When acquiring the behavior log data of the virus file to be processed, the data acquisition module is specifically used to: By running the virus file to be processed in the sandbox, the behavior log data of the virus file to be processed is obtained.

29. An electronic device, characterized in that: Including processor and memory: The memory is configured to store a computer program, which, when executed by the processor, causes the processor to perform the method according to any one of claims 1 to 14.

30. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and when the computer program is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 14.

31. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 14 is implemented.

Images