A virus identification and defense method, device, storage medium and equipment

Abstract

The present application relates to a virus identification and defense method, device, storage medium and equipment, the method comprising: identifying malicious programs through host behavior analysis; identifying the logs of malicious programs to determine the attack behavior of malicious programs; and using corresponding preset strategies to defend against the attack behavior of malicious programs according to the attack behavior of malicious programs. The present invention identifies malicious programs through host behavior analysis, and based on the identification of the logs of malicious programs, various behavioral actions generated by malicious programs and their effects and intentions are determined, and finally the attack behavior is determined, so that the corresponding response strategy can be used to effectively defend against the attack behavior, thereby realizing accurate identification and linkage defense against unknown ransomware viruses.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a virus identification and defense method, device, storage medium and equipment. Background Art

[0002] In recent years, ransomware has been widely spread, and various encryption and ransomware security incidents have occurred frequently. Especially for industrial hosts of industrial production enterprises, the encrypted hosts cannot be used, which is directly related to whether the production of the enterprise can continue, so ransomware against industrial enterprises is more effective.

[0003] However, traditional host protection software currently generally identifies and kills known viruses based on features. However, industrial control networks are generally physically or logically isolated from the outside world, and the virus database cannot be updated in real time. For ransomware that has not been updated or has newly emerged, that is, ransomware whose features are not in the feature database, traditional host protection software cannot be used to protect against it. Summary of the invention

[0004] Based on this, the purpose of the present invention is to provide a virus identification and defense method, device, storage medium and equipment, aiming to solve the current problem of being unable to accurately identify and jointly defend against unknown ransomware viruses.

[0005] A virus identification and defense method according to an embodiment of the present invention includes:

[0006] Identify malicious programs through host behavior analysis;

[0007] Identify the logs of the malicious program to determine the attack behavior of the malicious program;

[0008] According to the attack behavior of the malicious program, a corresponding preset strategy is adopted to defend against the attack behavior of the malicious program.

[0009] In addition, a virus identification and defense method according to the above embodiment of the present invention may also have the following additional technical features:

[0010] Preferably, the step of identifying malicious programs through host behavior analysis includes:

[0011] Collect system logs through host tracking technology;

[0012] Generate a call relationship graph based on the system log and the system object call relationship;

[0013] The call relationship graph is clustered using a graph clustering method to identify the community generated by the malicious program.

[0014] Preferably, the step of identifying the log of the malicious program and determining the attack behavior of the malicious program includes:

[0015] Classifying the logs of the malicious program according to the data types targeted by the logs of the malicious program;

[0016] The attack behavior of the malicious program is determined by using a preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs.

[0017] Preferably, the target category includes a plurality of preset sub-events, and the step of determining the attack behavior of the malicious program by using the preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs includes:

[0018] Calculate the ratio of the number of the preset sub-events triggered by the log of the malicious program to the total number of the preset sub-events to obtain a matching degree;

[0019] Determining whether the matching degree is greater than a threshold;

[0020] If so, it is determined that the malicious program has an attack behavior on the data type corresponding to the target category.

[0021] Preferably, the target category includes a plurality of preset sub-events, and the step of determining the attack behavior of the malicious program by using the preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs includes:

[0022] Determining whether the log of the malicious program triggers the preset sub-event;

[0023] If so, it is determined that the malicious program has an attack behavior of a nature corresponding to the preset sub-event.

[0024] Preferably, the preset strategy includes starting a network firewall, traffic blocking, and port / IP shielding.

[0025] Preferably, the step of identifying malicious programs through host behavior analysis includes:

[0026] Extracting dynamic features of the malicious program, wherein the dynamic features include first startup time, number of encryption attempts, and whether external connection behavior has occurred;

[0027] When it is determined that the malicious program has illegal external connection behavior, the first startup time difference is within a preset period of time, and the number of encryption attempts exceeds a preset number, the malicious program is determined to be a suspected ransomware virus.

[0028] The embodiment of the present invention further provides a virus identification and defense device, the device comprising:

[0029] Virus identification module, used to identify malicious programs through host behavior analysis;

[0030] A behavior recognition module, used to recognize the logs of the malicious program and determine the attack behavior of the malicious program;

[0031] The virus defense module is used to defend against the attack behavior of the malicious program by adopting a corresponding preset strategy according to the attack behavior of the malicious program.

[0032] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned virus identification and defense method is implemented.

[0033] The present invention also proposes a virus identification and defense device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned virus identification and defense method when executing the program.

[0034] Compared with the existing technology: malicious programs are identified through host behavior analysis, and based on the logs of malicious programs, various behavioral actions generated by malicious programs as well as their impacts and intentions are determined, and finally the attack behavior is determined, so that corresponding response strategies can be adopted to effectively defend against the attack behavior, thereby achieving accurate identification and joint defense of unknown ransomware viruses.

[0035] Details of one or more embodiments of the present application are set forth in the following drawings and description to make other features, objects, and advantages of the present application more readily apparent. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0037] Figure 1 is a flow chart of the virus identification and defense method in the first embodiment of the present invention;

[0038] Figure 2 is a flow chart of a virus identification and defense method in a second embodiment of the present invention;

[0039] Figure 3 Schematic diagram of the structure of a virus identification and defense device in a third embodiment of the present invention;

[0040] Figure 4 Schematic diagram of the structure of the virus identification and defense device in the fourth embodiment of the present invention.

[0041] The following specific implementations will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application. In addition, it can also be understood that although the efforts made in this development process may be complex and lengthy, for ordinary technicians in the field related to the contents disclosed in the present application, some changes such as design, manufacturing or production based on the technical contents disclosed in the present application are only conventional technical means, and should not be understood as insufficient contents disclosed in the present application.

[0043] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0044] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation, and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to greater than or equal to two. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The terms "first", "second", "third" and the like involved in the present application are merely used to distinguish similar objects and do not represent a specific ordering of the objects.

[0045] Embodiment 1

[0046] See also Figure 1, shown is a virus identification and defense method in Embodiment 1 of the present invention, which can be applied to virus identification and defense equipment. The virus identification and defense equipment can be, for example, an industrial host. The virus identification and defense method can be implemented by software and / or hardware. The method specifically includes steps S01 to S03.

[0047] Step S01, identifying malicious programs through host behavior analysis.

[0048] Specifically, we first need to collect the logs of the host system. The log information that needs to be collected by the host system includes logs generated by kernel functions and user space application processes. Most industrial hosts are Windows systems to collect system logs. Therefore, we can use host tracking technology to analyze the collected log information after collecting logs, generate a call relationship graph based on the system object call relationship, and then use a graph clustering algorithm to cluster the call relationship graph and analyze the community generated by malicious programs to identify malicious programs.

[0049] In addition, after analyzing the community where the malicious program is generated, the calling relationship of the malicious program and the specific behavior generated can be further analyzed to finally identify the impact and intention of the malicious program. At the same time, after extracting the system log, the system log can be screened by deleting redundant logs to extract and retain key logs.

[0050] Step S02: Identify the log of the malicious program to determine the attack behavior of the malicious program.

[0051] It should be understood that in order to correctly identify attack behaviors, some suspicious behaviors need to be pre-defined, so that when it is determined that a program triggers any preset suspicious behavior, the program can be determined to be a malicious program.

[0052] For the purpose of analysis, suspicious behavior is defined as follows:

[0053] Operations targeting host files that can cause harm are divided into: f1: create executable files, f2: modify important system files, f3: delete important system files.

[0054] The operations targeting the registry that may cause harm are divided into: r1: realizing automatic service startup, r2: reducing system security, and r3: obtaining the maximum system permissions.

[0055] The operations targeting processes that may cause harm are divided into: p1: creating an existing process in the system, p2: injecting other processes, p3: creating a malicious child process, and p4: creating a tor service.

[0056] Operations targeting the network that may cause harm are divided into: t1: regularly sending information to a certain window, t2: transmitting host information, t3: abnormal communication on a certain port.

[0057] In addition to the operations mentioned above, different attacks produce different specific operations. Therefore, they are further divided into:

[0058] Identifiable operations that may be generated by ransomware worm viruses: l1: generate key information, l2: encrypt files.

[0059] Identifiable operations generated by the password-stealing Trojan virus: w1: records username and password, w2: records keyboard operations.

[0060] Identifiable operations generated by downloading Trojan viruses: x1: uploading and downloading large amounts of files, x2: generating remote control commands.

[0061] Identifiable operations generated by the proxy Trojan virus: d1: turn on http proxy, d2: turn on socket proxy.

[0062] Therefore, the attack can be represented as a quintuple: {F[f1, f2, f3], R[r1, r2, r3], P[p1, p2, p3, p4], T[t1, t2, t3], [l1, l2, w1, w2, x1, x2, d1, d2]}.

[0063] In the present invention, if the matching degree of each of the first four parts (F, R, P, T) of the above five-tuple exceeds 50% (empirical value obtained through statistical analysis), it is considered that the system is in the attack stage. Among them, the matching degree is the ratio of the operation generated by the sample to the operation behavior pre-defined in the five-tuple. When it is detected that the sub-behavior defined in the five-tuple occurs in the sample data, it is recorded as 1, otherwise, it is recorded as 0. For example, a certain sample generates two operations f1 and f2 for a file, that is, there is F{1, 1, 0}, then the matching degree of the suspicious behavior for the file is: 2 / 3, so it can be determined that the file has an attack behavior on the host file. And the weights between each tuple are the same. If the fifth part of the five-tuple matches a specific operation event, it is classified as a corresponding type of attack.

[0064] Step S03: according to the attack behavior of the malicious program, a corresponding preset strategy is adopted to defend against the attack behavior of the malicious program.

[0065] The preset strategies include starting a network firewall, blocking traffic, and blocking ports / IPs. That is, when a malicious program is identified, such as a suspected ransomware virus, the kernel-level network firewall implemented by the network driver technology can be started to accurately identify traffic between different services, block illegal traffic accurately, and automatically link and add micro-isolation rules. Quick operations can be used to directly input ports that need to be closed or malicious IPs that need to be blocked, and automatically generate isolation rules.

[0066] In summary, the virus identification and defense method in this embodiment identifies malicious programs through host behavior analysis, and identifies the various behavioral actions generated by the malicious program and its impact and intention based on the log of the malicious program, and finally determines the attack behavior so that the corresponding response strategy can be adopted to effectively defend against the attack behavior, thereby realizing accurate identification and joint defense of unknown ransomware viruses, which can accurately and quickly find ransomware viruses, effectively reduce false alarms, and form defense capabilities across the entire network.

[0067] Embodiment 2

[0068] See also Figure 2 , shown is a virus identification and defense method in Embodiment 2 of the present invention, which can be applied to virus identification and defense equipment. The virus identification and defense equipment can be, for example, an industrial host. The virus identification and defense method can be implemented by software and / or hardware. The method specifically includes steps S11 to S19.

[0069] Step S11, collecting system logs through host tracking technology.

[0070] Step S12, generating a call relationship graph according to the system log and the system object call relationship.

[0071] Step S13: clustering the call relationship graph using a graph clustering method to identify the community generated by the malicious program.

[0072] Step S14, extracting static features and dynamic features of the malicious program.

[0073] Among them, the dynamic features include the time and method of entering the corresponding workstation, the first startup time, the startup duration, whether external connection behavior and external connection parameters have been generated, the number of encryption attempts, the area ID of the workstation and other information; the static features include the MD5 value, which is mainly used to identify the malicious program.

[0074] Step S15: When it is determined that the malicious program has illegal external connection behavior, the first startup time difference is within a preset period, and the number of encryption attempts exceeds a preset number, the malicious program is determined to be a suspected ransomware virus.

[0075] Step S16: classify the logs of the malicious program according to the data types targeted by the logs of the malicious program.

[0076] The data types include host files, registry, process, network, and others, which correspond to the five-tuple in the first embodiment: {F[f1, f2, f3], R[r1, r2, r3], P[p1, p2, p3, p4], T[t1, t2, t3], [l1, l2, w1, w2, x1, x2, d1, d2]}.

[0077] Step S17, using a preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs, to determine the attack behavior of the malicious program.

[0078] Specifically, the target category includes multiple preset sub-events. For example, when the target category is F, the multiple preset sub-events are f1, f2, and f3. For the first four cases of the five-tuple (F, R, P, and T), step S17 specifically includes:

[0079] Calculate the ratio of the number of the preset sub-events triggered by the log of the malicious program to the total number of the preset sub-events to obtain a matching degree;

[0080] Determining whether the matching degree is greater than a threshold;

[0081] If so, it is determined that the malicious program has an attack behavior on the data type corresponding to the target category.

[0082] In specific implementation, when the log of a malicious program triggers any preset sub-event, the triggered preset sub-event is 1, otherwise, it is recorded as 0. For example, when an executable file is created and an important system file is modified in the log of a malicious program, the log of the malicious program triggers f1 and f2 at the same time, and F is {1, 1, 0} at this time. At this time, the ratio of the number of preset sub-events triggered by the log of the malicious program to the total number of preset sub-events is calculated to be 2 / 3, which is more than 50%, and it is determined that the file has an attack behavior on the host file.

[0083] In addition, for the last case (other types) of the quintuple, step S17 specifically includes:

[0084] Determining whether the log of the malicious program triggers the preset sub-event;

[0085] If so, it is determined that the malicious program has an attack behavior of a nature corresponding to the preset sub-event.

[0086] Step S18, according to the attack behavior of the malicious program, adopting the response strategy of starting a network firewall, traffic blocking, and / or port / IP shielding to defend against the attack behavior of the malicious program.

[0087] Embodiment 3

[0088] Another aspect of the present invention is to provide a virus identification and defense device. Figure 3 , which shows a virus identification and defense device in Embodiment 3 of the present invention, which can be applied to virus identification and defense equipment. The virus identification and defense device specifically includes:

[0089] The virus identification module 11 is used to identify malicious programs through host behavior analysis;

[0090] A behavior identification module 12 is used to identify the log of the malicious program and determine the attack behavior of the malicious program;

[0091] The virus defense module 13 is used to defend against the attack behavior of the malicious program by adopting a corresponding preset strategy according to the attack behavior of the malicious program.

[0092] Specifically, we first need to collect the logs of the host system. The log information that needs to be collected by the host system includes logs generated by kernel functions and user space application processes. Most industrial hosts are Windows systems to collect system logs. Therefore, we can use host tracking technology to analyze the collected log information, generate a call relationship graph based on the system object call relationship, and then use a graph clustering algorithm to cluster the call relationship graph and analyze the community generated by malicious programs to identify malicious programs.

[0093] In addition, after analyzing the community where the malicious program is generated, the calling relationship of the malicious program and the specific behavior generated can be further analyzed to finally identify the impact and intention of the malicious program. At the same time, after extracting the system log, the system log can be screened by deleting redundant logs to extract and retain key logs.

[0094] It should be understood that in order to correctly identify attack behaviors, some suspicious behaviors need to be pre-defined, so that when it is determined that a program triggers any preset suspicious behavior, the program can be determined to be a malicious program.

[0095] For the purpose of analysis, suspicious behavior is defined as follows:

[0096] Operations targeting host files that can cause harm are divided into: f1: create executable files, f2: modify important system files, f3: delete important system files.

[0097] The operations targeting the registry that may cause harm are divided into: r1: realizing automatic service startup, r2: reducing system security, and r3: obtaining the maximum system permissions.

[0098] The operations targeting processes that may cause harm are divided into: p1: creating an existing process in the system, p2: injecting other processes, p3: creating a malicious child process, and p4: creating a tor service.

[0099] Operations targeting the network that may cause harm are divided into: t1: regularly sending information to a certain window, t2: transmitting host information, t3: abnormal communication on a certain port.

[0100] In addition to the operations mentioned above, different attacks produce different specific operations. Therefore, they are further divided into:

[0101] Identifiable operations that may be generated by ransomware worm viruses: l1: generate key information, l2: encrypt files.

[0102] Identifiable operations generated by the password-stealing Trojan virus: w1: records username and password, w2: records keyboard operations.

[0103] Identifiable operations generated by downloading Trojan viruses: x1: uploading and downloading large amounts of files, x2: generating remote control commands.

[0104] Identifiable operations generated by the proxy Trojan virus: d1: turn on http proxy, d2: turn on socket proxy.

[0105] Therefore, the attack can be represented as a quintuple: {F[f1, f2, f3], R[r1, r2, r3], P[p1, p2, p3, p4], T[t1, t2, t3], [l1, l2, w1, w2, x1, x2, d1, d2]}.

[0106] In the present invention, if the matching degree of each of the first four parts (F, R, P, T) of the above five-tuple exceeds 50% (empirical value obtained through statistical analysis), it is considered that the system is in the attack stage. Among them, the matching degree is the ratio of the operation generated by the sample to the operation behavior pre-defined in the five-tuple. When it is detected that the sub-behavior defined in the five-tuple occurs in the sample data, it is recorded as 1, otherwise, it is recorded as 0. For example, a certain sample generates two operations f1 and f2 for a file, that is, there is F{1, 1, 0}, then the matching degree of the suspicious behavior for the file is: 2 / 3, so it can be determined that the file has an attack behavior on the host file. And the weights between each tuple are the same. If the fifth part of the five-tuple matches a specific operation event, it is classified as a corresponding type of attack.

[0107] Preferably, in some optional embodiments of the present invention, the virus identification module 11 includes:

[0108] A log collection unit, used for collecting system logs through host tracking technology;

[0109] A relationship graph generating unit, used to generate a call relationship graph according to the system log and the system object call relationship;

[0110] The virus identification unit is used to cluster the call relationship graph using a graph clustering method to identify the community generated by the malicious program.

[0111] Preferably, in some optional embodiments of the present invention, the behavior recognition module 12 includes:

[0112] A classification unit, used to classify the logs of the malicious program according to the data type targeted by the logs of the malicious program;

[0113] The behavior identification unit is used to determine the attack behavior of the malicious program by adopting a preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs.

[0114] Preferably, in some optional embodiments of the present invention, the target category includes multiple preset sub-events, and the behavior identification unit is also used to calculate the ratio of the number of preset sub-events triggered by the log of the malicious program to the total number of preset sub-events to obtain a matching degree; determine whether the matching degree is greater than a threshold; if so, determine that the malicious program has an attack behavior on the data type corresponding to the target category.

[0115] Preferably, in some optional embodiments of the present invention, the behavior identification unit is further used to determine whether the log of the malicious program triggers the preset sub-event; if so, it is determined that the malicious program has an attack behavior of a nature corresponding to the preset sub-event.

[0116] Preferably, in some optional embodiments of the present invention, the preset strategy includes starting a network firewall, traffic blocking, and port / IP shielding. That is, when a malicious program is identified, such as a suspected ransomware virus, a kernel-level network firewall implemented by network driver technology can be started to accurately identify traffic between different services, accurately block illegal traffic, and automatically link and add micro-isolation rules. Quick operations directly input ports that need to be closed or malicious IPs that need to be shielded, and automatically generate isolation rules.

[0117] Preferably, in some optional embodiments of the present invention, the virus identification module 11 further includes:

[0118] A feature extraction unit, used to extract dynamic features of the malicious program, wherein the dynamic features include first startup time, number of encryption attempts, and whether external connection behavior has occurred;

[0119] The suspected ransomware virus determination unit determines that the malicious program is a suspected ransomware virus when it is determined that the malicious program has illegal external connection behavior, the first startup time difference is within a preset time period, and the number of encryption attempts exceeds a preset number.

[0120] The functions or operation steps implemented when the above modules and units are executed are generally the same as those in the above method embodiments, and will not be repeated here.

[0121] In summary, the virus identification and defense device in the above-mentioned embodiment of the present invention identifies malicious programs through host behavior analysis, and identifies the various behavioral actions generated by the malicious program and their impact and intention based on the log of the malicious program, and finally determines the attack behavior so as to adopt the corresponding response strategy to effectively defend against the attack behavior, thereby realizing accurate identification and linkage defense of unknown ransomware viruses.

[0122] Embodiment 4

[0123] Another aspect of the present invention is to provide a virus identification and defense device. Figure 4 , shown is a virus identification and defense device in Embodiment 4 of the present invention, including a memory 20, a processor 10, and a computer program 30 stored in the memory and executable on the processor. When the processor 10 executes the program 30, the virus identification and defense method as described above is implemented.

[0124] Among them, the virus identification and defense device can specifically be an industrial host, an office computer, a server, etc., and the processor 10 in some embodiments can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor or other virus identification and defense chip, which is used to run the program code stored in the memory 20 or process data, such as executing access restriction programs, etc.

[0125] Among them, the memory 20 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), magnetic memory, disk, CD, etc. The memory 20 can be an internal storage unit of the virus identification and defense device in some embodiments, such as the hard disk of the virus identification and defense device. The memory 20 can also be an external storage device of the virus identification and defense device in other embodiments, such as a plug-in hard disk equipped on the virus identification and defense device, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), etc. Further, the memory 20 can also include both the internal storage unit of the virus identification and defense device and an external storage device. The memory 20 can not only be used to store application software and various types of data installed in the virus identification and defense device, but also can be used to temporarily store data that has been output or is to be output.

[0126] It should be pointed out that Figure 4The structure shown does not constitute a limitation on the virus identification and defense device. In other embodiments, the virus identification and defense device may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0127] In summary, the virus identification and defense device in the above-mentioned embodiment of the present invention identifies malicious programs through host behavior analysis, and identifies the various behavioral actions generated by the malicious program and its impact and intention based on the log of the malicious program, and finally determines the attack behavior so as to adopt the corresponding response strategy to effectively defend against the attack behavior, thereby realizing accurate identification and linkage defense of unknown ransomware viruses.

[0128] The embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the virus identification and defense method as described above is implemented.

[0129] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0130] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, such as by optically scanning the paper or other medium, then editing, interpreting or processing in other suitable ways as necessary to obtain the program electronically, and then storing it in a computer memory.

[0131] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0132] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0133] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

Claims

1. A virus identification and defense method, characterized in that: The method comprises: Identify malicious programs through host behavior analysis; Classifying the logs of the malicious program according to the data types targeted by the logs of the malicious program; Determine the attack behavior of the malicious program by using a preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs; The target category includes a plurality of preset sub-events, and the step of determining the attack behavior of the malicious program by using the preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs includes: Calculate the ratio of the number of the preset sub-events triggered by the log of the malicious program to the total number of the preset sub-events to obtain a matching degree; Determining whether the matching degree is greater than a threshold; If yes, it is determined that the malicious program has an attack behavior on the data type corresponding to the target category; According to the attack behavior of the malicious program, a corresponding preset strategy is adopted to defend against the attack behavior of the malicious program.

2. The virus identification and defense method according to claim 1, characterized in that: The steps of identifying malicious programs through host behavior analysis include: Collect system logs through host tracking technology; Generate a call relationship graph based on the system log and the system object call relationship; The call relationship graph is clustered using a graph clustering method to identify the community generated by the malicious program.

3. The virus identification and defense method according to claim 1, characterized in that: The target category includes a plurality of preset sub-events, and the step of determining the attack behavior of the malicious program by using the preset attack behavior determination rule corresponding to the target category to which the log of the malicious program belongs includes: Determining whether the log of the malicious program triggers the preset sub-event; If so, it is determined that the malicious program has an attack behavior of a nature corresponding to the preset sub-event.

4. The virus identification and defense method according to claim 1, characterized in that: The preset strategy includes starting a network firewall, traffic blocking, and port / IP shielding.

5. The virus identification and defense method according to claim 1, characterized in that: The steps to identify malicious programs through host behavior analysis include: Extracting dynamic features of the malicious program, wherein the dynamic features include first startup time, number of encryption attempts, and whether external connection behavior has occurred; When it is determined that the malicious program has illegal external connection behavior, the first startup time difference is within a preset period of time, and the number of encryption attempts exceeds a preset number, the malicious program is determined to be a suspected ransomware virus.

6. A virus identification and defense device, characterized in that: The device comprises: Virus identification module, used to identify malicious programs through host behavior analysis; A behavior identification module is used to classify the logs of the malicious program according to the data types targeted by the logs of the malicious program; and determine the attack behavior of the malicious program by using the preset attack behavior determination regulations corresponding to the target category to which the logs of the malicious program belong; wherein the target category contains a plurality of preset sub-events, and the step of determining the attack behavior of the malicious program by using the preset attack behavior determination regulations corresponding to the target category to which the logs of the malicious program belong comprises: calculating the ratio of the number of preset sub-events triggered by the logs of the malicious program to the total number of preset sub-events to obtain a matching degree; determining whether the matching degree is greater than a threshold; and if so, determining that the malicious program has an attack behavior on the data type corresponding to the target category; The virus defense module is used to defend against the attack behavior of the malicious program by adopting a corresponding preset strategy according to the attack behavior of the malicious program.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the virus identification and defense method as described in any one of claims 1 to 5 is implemented.

8. A virus identification and defense device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the virus identification and defense method according to any one of claims 1 to 5 is implemented.

Images