Virus clustering method, virus clustering device, storage medium and electronic device

Abstract

The present disclosure provides a virus clustering method, a virus clustering device, a storage medium and an electronic device, and relates to the field of information security technology. The method includes: obtaining index information and feature information of files to be clustered; dividing the files to be clustered into multiple sample sets according to the index information of the files to be clustered; determining a target sample set associated with the seed virus file in the multiple sample sets according to the index information of the seed virus file; matching the feature information of the seed virus file with the feature information of the files to be clustered in the target sample set, and clustering the files to be clustered in the target sample set according to the matching results. The present disclosure can achieve highly subdivided virus clustering, which is conducive to quickly locking the category to which the virus file belongs during virus detection, improving detection efficiency, and can reduce the amount of calculation in the clustering process and reduce clustering time.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a virus clustering method, a virus clustering device, a computer-readable storage medium, and an electronic device. Background Art

[0002] With the development of Internet technology, more and more computer viruses have emerged, invading personal computers, mobile phones and other electronic devices, causing loss of people's property and information.

[0003] At present, virus clustering is mostly based on the characteristics of known viruses, clustering viruses with the same characteristics into one category or one family; in subsequent virus detection and virus killing, viruses are searched according to the characteristics of the virus family. However, with the rapid growth of the number and type of files on computer systems, this method is becoming increasingly inefficient. For example, the size of hard disks on personal computers currently generally reaches the TB level, and the number of files on hard disks has increased exponentially. When killing viruses, it takes a lot of time to check these files one by one, which increases the cost of users and antivirus vendors.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a virus clustering method, a virus clustering device, a computer-readable storage medium and an electronic device, thereby improving the efficiency of virus detection at least to a certain extent.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to a first aspect of the present disclosure, a virus clustering method is provided, comprising: obtaining index information and feature information of files to be clustered; dividing the files to be clustered into multiple sample sets according to the index information of the files to be clustered; determining a target sample set associated with the seed virus file from the multiple sample sets according to the index information of the seed virus file; matching the feature information of the seed virus file with the feature information of the files to be clustered in the target sample set, and clustering the files to be clustered in the target sample set according to the matching result.

[0008] Optionally, the characteristic information of the files to be clustered in the target sample set includes hot data and cold data; matching the characteristic information of the seed virus file with the characteristic information of the files to be clustered in the target sample set includes: matching the characteristic information of the seed virus file with the hot data, and if the match is unsuccessful, matching the characteristic information of the seed virus file with the cold data.

[0009] Optionally, the hot data is stored in a primary storage area of ​​the target sample set, and the cold data is stored in a secondary storage area of ​​the target sample set.

[0010] Optionally, matching the characteristic information of the seed virus file with the characteristic information of the files to be clustered in the target sample set includes: mapping the characteristic information of the seed virus file into a characteristic vector; mapping the characteristic information of the files to be clustered in the target sample set into a sample vector; and matching the characteristic vector and the sample vector by calculating the similarity between the characteristic vector and the sample vector.

[0011] Optionally, after obtaining a new file, if it is not certain whether the new file is a virus file, the new file is used as a file to be clustered, and the new file is added to a corresponding sample set according to the index information of the new file; if it is determined that the new file is a virus file, the new file is determined as a seed virus file.

[0012] Optionally, the index information includes any one or more of the following: the platform to which the file belongs, whether the file is a PE file (Portable Executable, executable file, the corresponding is a non-PE file), the specific type of the file, and the encryption shell information of the file.

[0013] Optionally, the feature information includes any one or more of the following: file code feature information, document object information, section information, access domain name information, and parent-child relationship information.

[0014] According to a second aspect of the present disclosure, a virus clustering device is provided, comprising: an information acquisition module, used to acquire index information and feature information of files to be clustered; a set division module, used to divide the files to be clustered into multiple sample sets according to the index information of the files to be clustered; a target determination module, used to determine a target sample set associated with the seed virus file in the multiple sample sets according to the index information of the seed virus file; an information matching module, used to match the feature information of the seed virus file with the feature information of the files to be clustered in the target sample set, and cluster the files to be clustered in the target sample set according to the matching result.

[0015] Optionally, the characteristic information of the files to be clustered in the target sample set includes hot data and cold data; the information matching module is used to match the characteristic information of the seed virus file with the hot data, and if the match is unsuccessful, match the characteristic information of the seed virus file with the cold data.

[0016] Optionally, the hot data is stored in a primary storage area of ​​the target sample set, and the cold data is stored in a secondary storage area of ​​the target sample set.

[0017] Optionally, the information matching module is used to map the feature information of the seed virus file into a feature vector, map the feature information of the files to be clustered in the target sample set into a sample vector, and match the feature vector and the sample vector by calculating the similarity between the feature vector and the sample vector.

[0018] Optionally, the information acquisition module is also used to, after acquiring a new file, if it is not certain whether the new file is a virus file, use the new file as a file to be clustered, and add the new file to a corresponding sample set according to the index information of the new file; if it is determined that the new file is a virus file, determine the new file as a seed virus file.

[0019] Optionally, the index information includes any one or more of the following: the platform to which the file belongs, whether the file is a PE file, the specific type of the file, and the encryption shell information of the file.

[0020] Optionally, the feature information includes any one or more of the following: file code feature information, document object information, section information, access domain name information, and parent-child relationship information.

[0021] According to a third aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, any one of the above-mentioned virus clustering methods is implemented.

[0022] According to a fourth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any one of the above-mentioned virus clustering methods by executing the executable instructions.

[0023] The technical solution disclosed in this disclosure has the following beneficial effects:

[0024] After obtaining the index information and feature information of the files to be clustered, the files are divided into multiple sample sets according to their index information, and then the associated target sample set is determined according to the index information of the seed virus file. In the target sample set, the feature information of the seed virus file and the files to be clustered are matched to cluster the viruses of the files to be clustered. On the one hand, the sample set is a preliminary classification based on the types of the files to be clustered, and the virus clustering is a further clustering based on the sample set, thereby achieving highly segmented clustering of the files, and the file category can be quickly locked according to the index information and feature information of the file, the virus type can be determined, and the source of the virus file can be traced, which is conducive to improving the efficiency of virus detection; on the other hand, in each sample set, the files to be clustered and the seed virus files are the same type of files. When matching the feature information between the two, due to the high similarity of data types and data formats, it is conducive to reducing the amount of matching calculations, especially when processing a large number of files to be clustered, the clustering time can be greatly reduced and the efficiency of clustering can be improved.

[0025] In an optional scheme, PE files and non-PE files can be divided into different categories through index information, and files using different encryption shells can be divided into different categories through the encryption shell information in the index information, thereby overcoming the data structure differences between PE files and non-PE files, and the interference caused by different encryption shells, and improving the clustering accuracy of PE files.

[0026] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and are used together with the specification to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 A flow chart of a virus clustering method in this exemplary embodiment is shown;

[0029] Figure 2 A sub-flow chart of a virus clustering method in this exemplary embodiment is shown;

[0030] Figure 3 A flow chart of another virus clustering method in this exemplary embodiment is shown;

[0031] Figure 4 A schematic diagram of a virus clustering method in this exemplary embodiment is shown;

[0032] Figure 5 A structural block diagram of a virus clustering device in this exemplary embodiment is shown;

[0033] Figure 6 An electronic device for implementing the above method in this exemplary embodiment is shown. DETAILED DESCRIPTION

[0034] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, exemplary embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the exemplary embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0035] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0036] In one scheme of the related technology, a fuzzy hash algorithm is used to cluster virus files. The main principle of fuzzy hashing is to use weak hashing to calculate the local content of the file, to fragment the file under specific conditions, and then use strong hashing to calculate the hash value for each fragment, take a part of these hash values ​​and connect them together with the fragmentation conditions to form a fuzzy hash result, which is expressed as a string; then the files are clustered and virus detection is performed based on the similarity of the string. Although the use of fuzzy hashing algorithm can identify partial changes in the source file (including modification, addition, and deletion of partial content in multiple places), the similarity between the changed file and the source file is found, which is conducive to virus clustering. However, due to the compilation characteristics of the PE file compiler, the content of the entire PE file changes greatly after each compilation, and the above scheme cannot be used to cluster PE files.

[0037] Based on one or more of the above problems, this exemplary embodiment first provides a virus clustering method. This method can be executed by a terminal device such as a personal computer, for example, when running an antivirus program on a computer or mobile phone, the virus clustering method is executed. It can also be executed by a server in the background of an enterprise, such as a business server of an antivirus manufacturer, when remotely checking and killing viruses on a terminal device, or when an administrator manually imports files to be detected. The virus clustering method is executed. It should be noted that the virus described in this exemplary embodiment is a broad virus, that is, a malicious file, which refers to a file (or program) that is installed and executed in an information system without authorization to achieve improper purposes, including viruses, Trojan horses, worms, zombie programs, etc.

[0038] Figure 1 A method flow of this exemplary embodiment is shown, which may include the following steps S110 to S140:

[0039] Step S110, obtaining index information and feature information of the files to be clustered.

[0040] The files to be clustered may be files of any type, such as program installation packages, documents, pictures, data tables, etc.

[0041] Index information refers to information that can indicate file classification features such as file type and file format. For example, the index information of the files to be clustered may include any one or more of the following: the platform to which the files to be clustered belong, such as whether the files to be clustered belong to the Windows platform, Linux platform or iOS platform; whether the files to be clustered are PE files, indicating whether the files to be clustered are PE files or non-PE files; the specific types of the files to be clustered, such as whether the files to be clustered are documents, pictures, audio or video, etc., and may also include the formats of the files to be clustered, such as file extensions, etc.; encryption shell information of the files to be clustered, including which encryption shell or compression shell is used by the files to be clustered, such as encryption shells such as VMP (VMProtect) and SE (SafeEngine), or compression shells such as UPX (the Ultimate Packer for eXecutables) and ASPack.

[0042] Feature information refers to information that can indicate various features of a file, such as its content, function, and logic. In this exemplary embodiment, the feature information may include all relevant information other than index information. For example, the feature information of the files to be clustered may include any one or more of the following: code feature information of the files to be clustered, including the language used by the code, the logical features of the code, function features, variable features, etc.; document object information, including objects referenced in the document, objects operated on, object properties, object methods, etc.; section information, which may include section table data and section data in the PE file; access domain name information, including access domain names, access URLs (Uniform Resource Locators), access IPs (Internet Protocol addresses), etc. contained in the files to be clustered; parent-child relationship information, which refers to the subordinate relationship between the files to be clustered and other files. It should be noted that the feature information may include static information, such as the above-mentioned code feature information, document object information, section information, etc., and dynamic information, such as the above-mentioned access domain name information and parent-child relationship information.

[0043] In this exemplary embodiment, the attributes of the index information and feature information can be set in advance, and the files to be clustered can be parsed according to the attributes to obtain the above-mentioned index information and feature information, wherein the more attributes there are and the richer the dimensions are, the more conducive it is to fully characterize the content information of the files to be clustered, and thus the more conducive it is to subsequent virus clustering.

[0044] Step S120: dividing the files to be clustered into multiple sample sets according to the index information of the files to be clustered.

[0045] The files to be clustered in step S110 are usually a batch of files for batch clustering. The files to be clustered with completely or partially identical index information can be divided into a sample set, and a sample set is a set of files to be clustered. The granularity of clustering can be set according to actual needs. For example, the image files of the Windows platform can be divided into a sample set, or the image files of the Windows platform such as JPG (Joint Photographic Experts Group, a picture format) and PNG (Portable Network Graphics, a picture format) can be formed into their own sample sets, which is not limited in this disclosure.

[0046] After classifying the clustered files based on the index information, PE files and non-PE files can be separated, and PE files can be further divided according to the type of encryption shell or compression shell they use. Each corresponding sample set only includes PE files with one shell information, and their data features have high similarity, avoiding interference between different shell information, which can improve the accuracy of PE file clustering.

[0047] Step S130: determining a target sample set associated with the seed virus file in the sample set according to the index information of the seed virus file.

[0048] Among them, the seed virus file is a file that is predetermined to carry a virus and can be used as a seed for virus clustering. In this exemplary embodiment, the index information and feature information of the seed virus file can be extracted in the manner of step S110, and the index information is used to determine which sample set or sets of sample sets the seed virus file is associated with, that is, the above-mentioned target sample set. Specifically, by matching the index information, the sample set with the highest matching degree with the index information of the seed virus file can be the target sample set, or multiple sample sets with matching degrees higher than a certain threshold can be the target sample set, or when the index information of the obtained seed virus file is incomplete, multiple target sample sets may also be matched, and the present disclosure does not limit this. It can be considered that the seed virus file and the files to be clustered in the target sample set are the same type of files.

[0049] Step S140, matching the characteristic information of the seed virus file with the characteristic information of the files to be clustered in the target sample set, and clustering the files to be clustered in the target sample set according to the matching result.

[0050] In this exemplary embodiment, the files to be clustered in the same sample set may belong to different virus families, and some of the files to be clustered may not carry viruses. Based on this, the seed virus file can be used to further cluster the files to be clustered in the target sample set. Specifically, the feature information of the seed virus file is matched with the feature information of each file to be clustered in the target sample set. If the match is successful, it means that the file to be clustered and the seed virus file belong to the same virus family, and the file to be clustered is added to the virus family.

[0051] In an optional embodiment, reference Figure 2 As shown, step S140 can be specifically implemented through steps S210 to S230:

[0052] Step S210, mapping the characteristic information of the seed virus file into a characteristic vector;

[0053] Step S220, mapping the feature information of the files to be clustered in the target sample set into sample vectors;

[0054] Step S230, matching the feature vector and the sample vector by calculating the similarity between the feature vector and the sample vector.

[0055] Among them, the feature vector and the sample vector have the same dimension, and each dimension represents the same meaning. The dimensions of each vector can be determined in advance according to the attributes of the feature information; when performing vector mapping, the data of each dimension can be digitized and regularized so that the value of each dimension can be directly calculated. The seed virus file obtains a corresponding feature vector, and each file to be clustered obtains a corresponding sample vector. The similarity between the feature vector and the sample vector can be calculated using algorithms such as cosine similarity, Euclidean distance, and Manhattan distance, which are not limited in this disclosure. The similarity is a measure of the degree of similarity between the content of the seed virus file and the file to be clustered. The similarity threshold can be set based on experience or actual needs. If the similarity is higher than the threshold, it means that the feature vector and the sample vector match, that is, the seed virus file and the file to be clustered match.

[0056] Furthermore, when calculating the similarity between the feature vector and the sample vector, the similarity can be calculated for the values ​​of each dimension separately, and then all dimensions can be weighted according to the preset weight of each dimension to obtain the similarity of the two vectors, or the dimensions can be screened first, so that multiple dimensions with similar attributes are appropriately deleted, and then the similarity of the two vectors is calculated by weighting the dimensions.

[0057] In addition to calculating vector similarity, the CRC (Cyclic Redundancy Check) difference between the seed virus file and the file to be clustered can also be considered. The smaller the difference, the closer the two files are. This factor is combined with vector similarity to evaluate whether the seed virus file and the file to be clustered match.

[0058] It should be understood that the number of the above-mentioned seed virus files is not limited to one, and multiple seed virus files can be obtained, and the target sample sets associated with each other are determined according to their index information, and then clustering is performed in the respective target sample sets. If the types of seed virus files are comprehensive and can cover various common virus families or virus types, then very sufficient and detailed virus clustering can be performed on each sample set.

[0059] In an optional implementation, the above method process may be executed cyclically, and after obtaining a new file, it may be processed in the following two ways:

[0060] If it is uncertain whether the new file is a virus file, the new file is taken as a file to be clustered, and the new file is added to the corresponding sample set according to the index information of the new file, and the feature information of the new file is added to the data of the sample set. In particular, if there is a clustered virus family in the sample set, the feature information of the new file can be matched with the feature information of the files in the family. If the match is successful, it is added to the virus family. If the match is unsuccessful, it is taken as a file to be clustered in the sample set and waits for subsequent clustering;

[0061] If the new file is determined to be a virus file, the new file is determined to be a seed virus file, and steps S130 and S140 are executed to further cluster the existing sample set.

[0062] The new file may be a file that needs to be clustered or detected for viruses and received by the server, or a new file that is downloaded or generated by the terminal device. The above steps may be performed immediately after each new file is obtained, or the new file may be placed in a queue and the above steps may be performed periodically for the new files in the queue. In this way, the virus family library may be continuously updated and expanded.

[0063] In an optional implementation, the files to be clustered in each sample set may be divided into hot and cold files, for example, the files to be clustered acquired within the last 24 hours are hot files, and the files to be clustered acquired 24 hours ago are cold files, or the files to be clustered with a high recent read and write frequency are hot files, and the files to be clustered with a low read and write frequency are cold files, etc. After dividing the files into hot and cold files, the feature information of the hot files may be further used as hot data, and the feature information of the cold files may be used as cold data, so that the data in each sample set can be divided into two categories: hot data and cold data.

[0064] Based on this, when matching the characteristic information of the seed virus file with the characteristic information of the files to be clustered in the target sample set, the characteristic information of the seed virus file can be matched with the hot data in the target sample set first. If the match fails, the characteristic information of the seed virus file can be matched with the cold data in the target sample set. In other words, the hot data is matched first, and when the match fails (including the situation that no hot data is matched successfully, or the number of hot data that is matched successfully is small), the cold data is matched. This can reduce the amount of matching calculations and further improve efficiency.

[0065] Furthermore, the hot data of each sample set can be stored in the primary storage area of ​​the sample set, and the cold data can be stored in the secondary storage area of ​​the sample set. Among them, the primary storage area is easier to access than the secondary storage area, because the hot data therein is read more frequently, and the cost of frequent reading and writing from the primary storage area is lower. For example, the primary storage area can be local storage, and the secondary storage area can be remote storage such as cloud storage, or the primary storage area can be a local Redis (a memory-based database) cache, and the secondary storage area can be a local MySQL (a commonly used relational database), and so on.

[0066] It should be understood that more than two heat levels can be set according to the characteristics of the files to be clustered in the sample set, and correspondingly more than two levels of multi-level storage can be set, and each level of storage is used to store data of the corresponding heat level, for example, the first-level storage is the local Redis cache, the second-level storage is the local MySQL, the third-level storage is the remote database, and so on.

[0067] Figure 3 A method flow of this exemplary embodiment is shown. Figure 3 As shown, first execute step S310 to obtain the files to be clustered; then execute step S320 to extract the index information of the files to be clustered; then execute step S330 to extract the feature information of the files to be clustered; then execute step S340 to divide the files to be clustered into sample sets according to the index information of the files to be clustered; then execute step S350 to obtain the seed virus files; then execute step S360 to input the seed virus files into the sample set associated with them; then execute step S370 to perform matching calculations; finally execute step S380 to cluster the virus families according to the matching results.

[0068] In the above process, the process of virus clustering based on the matching calculation of the seed virus file and the sample set can be further referred to Figure 4 As shown: After the files to be clustered are divided into sample sets, each sample set is configured with index data, which is the same part of the index data of the files to be clustered in the sample set; the index data of the seed virus file is matched with the index data of each sample set to determine the associated target sample set; then the seed virus file is matched with the primary storage data and the secondary storage data under the target sample set in turn, where the primary storage uses the local Redis cache and the secondary storage uses the local MySQL. The calculation process is implemented through a matching calculation engine, and the matching calculation engine can be distributed in a distributed system to speed up the calculation process. Based on Figure 4After obtaining a new file, if it is not certain whether it contains a virus, it is added to the corresponding sample set according to its index data. If it is determined that it contains a virus, it is used as a seed virus file and the above matching calculation process is performed with the sample set. Through the above processing, the result of virus family clustering can be obtained, for example, it can be expressed in the form of a data table or configuration file. In addition, based on a large number of virus clustering and virus detection statistics, each virus family can be sorted according to the query popularity to facilitate subsequent rapid virus search.

[0069] To summarize, in this exemplary embodiment, after obtaining the index information and feature information of the files to be clustered, they are divided into multiple sample sets according to their index information, and then the associated target sample set is determined according to the index information of the seed virus file. In the target sample set, the feature information of the seed virus file and the files to be clustered are matched to perform virus clustering on the files to be clustered. On the one hand, the sample set is a preliminary classification based on the types of files to be clustered, and virus clustering is a further clustering based on the sample set, thereby achieving highly segmented clustering of files. The category to which the file belongs can be quickly locked according to the index information and feature information of the file, the type of virus can be determined, and the source of the virus file can be traced, which is beneficial to improving the efficiency of virus detection; on the other hand, in each sample set, the files to be clustered and the seed virus files are of the same type of files. When matching the feature information between the two, due to the high similarity of data types and data formats, it is beneficial to reduce the amount of matching calculations, especially when processing a large number of files to be clustered, the clustering time can be greatly reduced and the clustering efficiency can be improved; in an optional implementation, PE files and non-PE files can be divided into different categories through index information, and files using different types of encryption shells can be divided into different categories through encryption shell information in the index information, thereby overcoming the data structure differences between PE files and non-PE files, and the interference caused by different encryption shells, and improving the clustering accuracy of PE files.

[0070] The exemplary embodiment of the present disclosure also provides a virus clustering device. Figure 5 As shown, the virus clustering device 500 may include: an information acquisition module 510, used to obtain index information and feature information of the files to be clustered; a set division module 520, used to divide the files to be clustered into multiple sample sets according to the index information of the files to be clustered; a target determination module 530, used to determine the target sample set associated with the seed virus file in the sample set according to the index information of the seed virus file; an information matching module 540, used to match the feature information of the seed virus file with the feature information of the files to be clustered in the target sample set, and cluster the files to be clustered in the target sample set according to the matching results.

[0071] In an optional implementation, the characteristic information of the files to be clustered in the target sample set may include hot data and cold data; the information matching module 540 may be used to match the characteristic information of the seed virus file with the hot data. If the match is unsuccessful, the characteristic information of the seed virus file is matched with the cold data.

[0072] In an optional implementation, the hot data may be stored in a primary storage area of ​​the target sample set, and the cold data may be stored in a secondary storage area of ​​the target sample set.

[0073] In an optional implementation, the information matching module 540 can be used to map the feature information of the seed virus file into a feature vector, map the feature information of the files to be clustered in the target sample set into a sample vector, and match the feature vector and the sample vector by calculating the similarity between the feature vector and the sample vector.

[0074] In an optional implementation, the information acquisition module 510 can also be used to, after acquiring a new file, if it is not certain whether the new file is a virus file, use the new file as a file to be clustered, and add the new file to the corresponding sample set according to the index information of the new file; if it is determined that the new file is a virus file, determine the new file as a seed virus file.

[0075] In an optional implementation, the index information may include any one or more of the following: the platform to which the file belongs, whether the file is an executable file, the specific type of the file, and the encryption shell information of the file.

[0076] In an optional implementation, the feature information may include any one or more of the following: code feature information of the file, document object information, section information, access domain name information, and parent-child relationship information.

[0077] The specific details of each module in the above device have been described in detail in the implementation method of the method part. The details of the undisclosed scheme can be found in the implementation method of the method part, so they will not be repeated here.

[0078] It should be noted that, although several modules of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules described above can be concretized in one module. Conversely, the features and functions of one module described above can be further divided into multiple modules to be concretized.

[0079] An exemplary embodiment of the present disclosure also provides an electronic device. Figure 6 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the embodiment of the present disclosure is shown.

[0080] It should be noted that Figure 6 The computer system 600 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0081] like Figure 6 As shown, computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. Various programs and data required for system operation are also stored in RAM 603. CPU 601, ROM 602 and RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to bus 604.

[0082] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0083] In particular, according to an embodiment of the present disclosure, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, various functions defined in the method and apparatus of the present application are executed. In some embodiments, the computer system 600 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0084] It should be noted that the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0085] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram or flow chart, and the combination of the square boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0086] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0087] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being installed in the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the following embodiment. For example, the electronic device can implement the following embodiment. Figures 1 to 3 The various steps shown, etc.

[0088] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0089] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A virus clustering method, characterized in that: include: Obtain index information and feature information of the files to be clustered; According to the index information of the to-be-clustered files, the to-be-clustered files are divided into a plurality of sample sets, each sample set is configured with index information, and the index information configured for the sample set is the same part of the index information of the to-be-clustered files in the sample set; Matching the index information of the seed virus file with the index information configured for each sample set, and determining, among the multiple sample sets, a sample set with a matching degree higher than a certain threshold as a target sample set associated with the seed virus file, wherein the seed virus file and the files to be clustered in the target sample set are files of the same type; The characteristic information of the seed virus file is matched with the characteristic information of the file to be clustered in the target sample set. If the match is successful, it is determined that the file to be clustered and the seed virus file belong to the same virus family, and the file to be clustered is added to the virus family.

2. The method according to claim 1, characterized in that The characteristic information of the files to be clustered in the target sample set includes hot data and cold data; The matching of the characteristic information of the seed virus file with the characteristic information of the files to be clustered in the target sample set includes: The characteristic information of the seed virus file is matched with the hot data. If the match fails, the characteristic information of the seed virus file is matched with the cold data.

3. The method according to claim 2, characterized in that The hot data is stored in a primary storage area of ​​the target sample set, and the cold data is stored in a secondary storage area of ​​the target sample set.

4. The method according to claim 1, characterized in that The matching of the characteristic information of the seed virus file with the characteristic information of the files to be clustered in the target sample set includes: Mapping the characteristic information of the seed virus file into a characteristic vector; Mapping feature information of the files to be clustered in the target sample set into sample vectors; The feature vector and the sample vector are matched by calculating the similarity between the feature vector and the sample vector.

5. The method according to claim 1, characterized in that After obtaining a new file, if it is uncertain whether the new file is a virus file, the new file is used as a file to be clustered, and the new file is added to the corresponding sample set according to the index information of the new file; If it is determined that the new file is a virus file, the new file is determined as a seed virus file.

6. The method according to any one of claims 1 to 5, characterized in that: The index information includes any one or more of the following: the platform to which the file belongs, whether the file is an executable file, the specific type of the file, and the encryption shell information of the file.

7. The method according to any one of claims 1 to 5, characterized in that: The characteristic information includes any one or more of the following: file code characteristic information, document object information, section information, access domain name information, and parent-child relationship information.

8. A virus clustering device, characterized in that: include: An information acquisition module is used to obtain index information and feature information of the files to be clustered; A set division module, used for dividing the to-be-clustered files into a plurality of sample sets according to the index information of the to-be-clustered files, each sample set is configured with index information, and the index information is the same part of the index information of the to-be-clustered texts in the sample set; A target determination module, used to match the index information of the seed virus file with the index information configured for each sample set, and determine, among the multiple sample sets, a sample set with a matching degree higher than a certain threshold as a target sample set associated with the seed virus file, wherein the seed virus file and the files to be clustered in the target sample set are files of the same type; The information matching module is used to match the characteristic information of the seed virus file with the characteristic information of the file to be clustered in the target sample set. If the match is successful, it is determined that the file to be clustered and the seed virus file belong to the same virus family, and the file to be clustered is added to the virus family.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to perform the method of any one of claims 1 to 7 by executing the executable instructions.

11. A computer program product, characterized in that The method comprises a computer program carried on a computer-readable medium, wherein the computer program contains a program code for executing the method according to any one of claims 1 to 7.

Images