Malicious file detection method, device, electronic device and storage medium

Abstract

The present application discloses a malicious file detection method, device, electronic device and storage medium, which relate to the field of network security technology. The malicious file detection method includes: encoding the API behavior and API behavior parameters of the acquired target file to obtain a target code set corresponding to the target file; vectorizing the target code set to obtain a target behavior vector; determining whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vector in the black and white sample set; when the target file is a malicious file, determining the malicious category of the target file based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set. The present application discloses a malicious file detection method, device, electronic device and storage medium that retains behavioral features, improves the richness of training inputs, and reduces the false alarm rate of machine learning models.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a malicious file detection method, device, electronic device and storage medium. Background Art

[0002] Major cybersecurity incidents such as the Aurora, Stuxnet, Night Dragon, and RSA token seed theft have brought to public attention a new type of attack characterized by advanced techniques, long duration, and precise targets. This type of attack is known internationally as an Advanced Persistent Threat (APT) attack. This type of attack not only uses traditional viruses and Trojans as a means of attack, but also employs social engineering tactics such as email as a "pilot attack," sending carefully crafted files exploiting zero-day vulnerabilities to users. Once the user opens the file, the vulnerability is triggered, and the attack code is injected into the user's system, subsequently downloading other viruses and Trojans to maintain its long-term operation. Traditional firewalls and enterprise antivirus software have very limited detection and protection capabilities against these unsigned malicious files or code.

[0003] APT attack detection and defense technology has become a hot topic in next-generation network security research. The technical challenge lies in rapidly detecting attacks that exploit unknown vulnerabilities. A series of studies have been conducted both domestically and internationally, resulting in the development of various approaches, most notably file- or sample-based dynamic behavioral analysis. This technology primarily targets the malicious code insertion process during APT attacks. Using controlled environments such as sandboxes and virtual machines, it dynamically analyzes the dynamic behavior of suspicious sample files entering protected systems, identifying malicious behavior and attack code, blocking malicious code insertion, and preventing subsequent destructive activity. This technology can detect and prevent attacks before they enter the network, thus preventing the protected system from being compromised. Determining the maliciousness of code files relies on a behavioral signature library, which stores malicious behavior signatures extracted through manual code analysis. The speed and accuracy of the signature library's rule updates determine the success rate of malicious code detection.

[0004] Due to the rapid evolution of malicious code, researchers are attempting to meet practical detection needs through machine learning. Using large numbers of malicious samples, these models are trained to learn malware behavior patterns and automatically determine the malware's maliciousness. However, traditional machine learning methods rely on the distribution of samples, leading to poor detection accuracy due to sample imbalance. Furthermore, they are highly sensitive to numerical data types and struggle to distinguish and identify semantic behavioral data features. Summary of the Invention

[0005] To solve the above technical problems, the embodiments of the present application are implemented as follows:

[0006] The present invention provides a method for detecting malicious files, including:

[0007] Encode the obtained API behavior and API behavior parameters of the target file to obtain a target code set corresponding to the target file;

[0008] performing vectorization processing on the target code set to obtain a target behavior vector;

[0009] Determining whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set;

[0010] When the answer is yes, the malicious category of the target file is determined according to the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0011] Optionally, encoding the acquired API behavior and API behavior parameters of the target file to obtain a target code set corresponding to the target file includes:

[0012] Encoding the API behavior to obtain a first encoding set;

[0013] Encoding the API behavior parameters to obtain a second code set;

[0014] The first code set and the second code set are combined in a unified dimension to obtain the normalized target code set.

[0015] Optionally, the API behavior parameter is a directory path, and encoding the API behavior parameter to obtain a second code set includes:

[0016] Catalog and hierarchize the API behavior parameters;

[0017] Encoding the API behavior parameters after directory stratification to obtain the second code set;

[0018] When the path length of the API behavior parameter exceeds a preset length, the path length of the API behavior parameter is adjusted to the preset length before performing directory stratification.

[0019] Optionally, encoding the API behavior to obtain a first code set includes:

[0020] Performing hexadecimal encoding on the API behavior to obtain the first code set of a predetermined code length;

[0021] The encoding of the API behavior parameters to obtain a second code set includes:

[0022] Hash-encoding the API behavior parameters to obtain the second encoding set;

[0023] The combining the first code set and the second code set in a unified dimension to obtain the normalized target code set includes:

[0024] The codes in the second code set are converted into hexadecimal codes, and the codes in the first code set are combined with the converted codes in the second code set in a one-to-one correspondence to obtain the target code set.

[0025] Optionally, determining whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set includes:

[0026] Calculating a first average distance between the target behavior vector and the sample behavior vectors corresponding to the black samples in the black and white sample set;

[0027] Calculating a second average distance between the target behavior vector and the sample behavior vectors corresponding to the white samples in the black and white sample set;

[0028] When the first average distance is greater than or equal to the second average distance, the target file is determined to be a malicious file.

[0029] Optionally, determining the malicious category of the target file based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set includes:

[0030] Calculating a third average distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set;

[0031] When the third average distance does not exceed the preset critical value, the malicious category of the black sample corresponding to the minimum value of the third average distance is selected as the malicious category of the target file;

[0032] Otherwise, the malicious category of the target file is classified into a new malicious category.

[0033] Optionally, the method further includes:

[0034] The API behavior and the API behavior parameters are obtained after an external analysis engine runs the target file.

[0035] Optionally, the API behavior is loading a system DLL file, writing a temporary file, or modifying a registry.

[0036] Optionally, the method further includes:

[0037] Obtaining sample API behaviors and sample API behavior parameters of sample files in a training sample set, wherein the sample files include black sample files and white sample files, wherein the black sample files include at least one of viruses, Trojans, worms, and ransomware, and the white sample files are normal files;

[0038] Encoding the obtained sample API behavior and the sample API behavior parameters to obtain a sample encoding set corresponding to the training sample set;

[0039] Determining the weight corresponding to each code according to the frequency of occurrence of the same sample file and different sample files corresponding to each code in the sample code set;

[0040] The sample code set corresponding to the sample file in the training sample set is vectorized according to the weight corresponding to each code, and the sample behavior vector in the black and white sample set is obtained.

[0041] Optionally, the type of the sample file is a PE file, a PDF file or a text file.

[0042] The embodiment of the present application further provides a malicious file detection device, the malicious file detection device comprising:

[0043] An encoding module, configured to encode the obtained API behavior and API behavior parameters of the target file to obtain a target code set corresponding to the target file;

[0044] A vectorization module, configured to perform vectorization processing on the target code set to obtain a target behavior vector;

[0045] a determination module, configured to determine whether the target file is a malicious file based on a distance between the target behavior vector and a sample behavior vector in a black and white sample set; and

[0046] When the answer is yes, the malicious category of the target file is determined according to the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0047] An embodiment of the present application further provides an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the bus;

[0048] Memory for storing computer programs;

[0049] The processor is used to execute the program stored in the memory to implement any of the method steps described in the above claims.

[0050] An embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, any of the above-described method steps is implemented.

[0051] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects:

[0052] The solution provided by the embodiment of the present application retains behavioral characteristics, improves the richness of training input, and reduces the false alarm rate of the machine learning model.

[0053] The solution provided by the embodiment of the present application can not only distinguish the maliciousness of the target file, but also identify the type of the target file by distance and discover new types of malicious files.

[0054] The solution provided in the embodiment of the present application has good scalability in supporting file types. Compared with the traditional solution that only supports executable PE file analysis models, the solution provided in the embodiment of the present application also supports other types of files such as Word and PDF.

[0055] The solution provided by the embodiment of the present application is more complex than the deep learning network malicious file detection method, reduces the adjustment of weights and parameter values, and improves the reliance of the statistical behavior model based on the number of behaviors on sample distribution.

[0056] In addition, the solution provided in the embodiment of the present application has a good generalization effect on sample imbalance. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0058] Figure 1 Flowchart of a malicious file detection method provided in a preferred embodiment of the present application.

[0059] Figure 2 A flowchart of another malicious file detection method provided in a preferred embodiment of the present application.

[0060] Figure 3 A block diagram of an electronic device provided in accordance with a preferred embodiment of the present application.

[0061] Figure 4 A block diagram of a malicious file detection device provided in a preferred embodiment of the present application.

[0062] Icon: 100 - electronic device; 110 - processor; 120 - internal bus; 130 - network interface; 140 - memory; 150 - malicious file detection device; 151 - encoding module; 152 - vectorization module; 153 - determination module. DETAILED DESCRIPTION

[0063] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0064] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0065] See also Figure 1 , is a flow chart of a malicious file detection method provided by an embodiment of the present application, which is applied to electronic devices and used to detect malicious files such as viruses, Trojans, worms, and ransomware. Figure 1 The process shown is described in detail.

[0066] Step S101 : Encode the acquired API behavior and API behavior parameters of the target file to obtain a target code set corresponding to the target file.

[0067] In the embodiments of the present application, the API behavior may include, but is not limited to, starting a process, loading a system DLL file, writing a temporary file, or modifying the registry under Windows, Linux, Unix, and other systems. The API behavior parameters refer to parameters included in the command, such as a directory path. The target file type may include, but is not limited to, PE files, PDF files, and text files. The API behavior for the same target file corresponds to the API behavior parameters one-to-one.

[0068] Before encoding the target file's API behaviors and API behavior parameters, the target file to be tested is first run through an external analysis engine, which can be, but is not limited to, a sandbox or virtual machine. After running the target file, the target file's API behaviors and API behavior parameters are obtained, encoded, and combined in a unified dimension to obtain a target encoding set corresponding to the target file.

[0069] During encoding, each API behavior and the corresponding API behavior parameters are encoded separately, and then the obtained codes are unified into a dimensional combination. Specifically, the API behavior is hexadecimal encoded, and the encoding length of the API behavior is pre-set to obtain a first code set of a predetermined length. At the same time, the API behavior parameters are vectorized to obtain a second code set. Then, the codes in the second code set are converted into hexadecimal codes that are consistent with the encoding format in the first code set, and the codes in the first code set are combined one by one with the converted codes in the second code set to obtain a normalized target code set.

[0070] In the embodiment of the present application, hexadecimal encoding is used to encode API behavior. It is understandable that in some other embodiments, binary, octal or decimal encoding may also be used. When encoding, if the encoding method used by the encoding in the first encoding set is different from that used by the encoding in the second encoding set, the encoding in the second encoding set needs to be converted into the same type of encoding as the encoding in the first encoding set, or the encoding in the first encoding set needs to be converted into the same type of encoding as the encoding in the second encoding set. If the encoding method used by the encoding in the first encoding set is the same as that used by the encoding in the second encoding set, no conversion is required.

[0071] The API behavior parameters may be encoded using, but are not limited to, hashing or other methods. In the embodiment of the present application, hash coding is used to encode the API behavior parameters.

[0072] For the sake of convenience, here we take the target file corresponding to an API behavior and an API behavior parameter as an example. Assume that the first code set corresponding to the API behavior contains a hexadecimal code 0200, and the second code set corresponding to the API behavior parameter contains a decimal code 67574613. The code in the second code set can be converted into a hexadecimal code 4071B55. Then the code in the target code set obtained after combination is a hexadecimal code 02004071B55.

[0073] Furthermore, to improve the accuracy of target file detection, the solution provided in this embodiment of the application also pre-sets the path length of the API behavior parameter. When encoding the API behavior parameter, if the path length of the API behavior parameter exceeds a preset length, the path length of the API behavior parameter is adjusted to the preset length before directory layering is performed. Adjusting the path length of the API behavior parameter can be achieved by adding a fixed trailing parameter, undefine.

[0074] For example, if the preset longest encoding path is c: / system and an API action parameter is c: / system / host / , you can adjust the API action parameter to c: / system / undefine before encoding. This will make the resulting encoding length uniform, facilitate feature extraction, avoid the situation where broad feature descriptions lead to low feature differentiation, and improve the accuracy of subsequent malicious file detection.

[0075] Step S102: vectorize the target code set to obtain a target behavior vector.

[0076] In this embodiment, a sample code set is created based on the API behavior and API behavior parameter encoding of the black and white samples in the black and white sample set. Each code in this sample code set has a different weight. The black samples include at least one of viruses, trojans, worms, and ransomware, while the white sample files are normal files.

[0077] When vectorizing the target code set, different weights are assigned to different codes in the target code set according to the weights of each code, and the weight assigned to the codes that do not appear in the sample code set is 0. In this way, the target behavior vector corresponding to the target code set can be obtained.

[0078] For example, the target coding set is {A1, A2, B1, A3, C1, A4}, the weight corresponding to coding A1 in the sample coding set is a1, the weight corresponding to A2 is a2, the weight corresponding to A3 is a3, and the weight corresponding to A4 is a5, while coding B1 and coding C1 do not exist in the sample coding set. After vectorization processing of the target coding set, the target behavior vector obtained is (a1, a2, 0, a3, 0, a4).

[0079] It is understandable that in some other embodiments, the weight assigned to the codes that do not appear in the sample code set may also be other values, for example, the weight assigned to the codes that do not appear in the sample code set may also be 1.

[0080] Step S103 : determining whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set.

[0081] The black and white sample set includes sample behavior vectors corresponding to black samples and sample behavior vectors corresponding to white samples. Black samples include at least one of viruses, Trojans, worms, and ransomware, while white sample files are normal files. In the embodiment of the present application, black samples include viruses, Trojans, worms, and ransomware to ensure that various types of malicious files can be detected. The sample behavior vectors are obtained by encoding the API behavior and API behavior parameters of the black and white samples in the black and white sample set and then vectorizing them. The process is consistent with the process of encoding and vectorizing the API behavior and API behavior parameters of the target file mentioned above.

[0082] When determining whether a target file is a malicious file, first calculate the first distance between the target behavior vector and the sample behavior vectors corresponding to all black samples in the black and white sample set, and the second distance between the target behavior vector and the sample behavior vectors corresponding to all white samples in the black and white sample set. The first distance and the second distance can be, but are not limited to, an average distance or an intermediate value among multiple distances. In the embodiment of the present application, the first distance and the second distance are both average distances, that is, the first average distance between the target behavior vector and the sample behavior vectors corresponding to all black samples in the black and white sample set is calculated, and the second average distance between the target behavior vector and the sample behavior vectors corresponding to all white samples in the black and white sample set is calculated.

[0083] The distance calculation between the target behavior vector and the sample behavior vector may be calculated by, but is not limited to, Euclidean distance, cosine similarity calculation, etc. In the embodiment of the present application, the distance calculation between the target behavior vector and the sample behavior vector is calculated by cosine similarity calculation.

[0084] Assume that the target behavior vector is J x , the sample behavior vector corresponding to a black sample is J k , then the target behavior vector J x The sample behavior vector J corresponding to the black sample k The distance can be expressed as Calculate the distance between the sample behavior vector and the target behavior vector corresponding to all black samples, and get the distance list [d1, d2, ...d B ], take the average value of the distance list to get the first average distance between the target behavior vector and the sample behavior vectors corresponding to all black samples in the black and white sample set. The first average distance can be expressed as Likewise, a second average distance between the target behavior vector and the sample behavior vectors corresponding to all white samples in the black and white sample set can be obtained.

[0085] Then, the first average distance is compared with the second average distance. If the first average distance is less than the second average distance, the target file is determined to be a normal file and the detection ends. If the first average distance is greater than or equal to the second average distance, the target file is determined to be a malicious file.

[0086] Step S104 : when the target file is a malicious file, the malicious category of the target file is determined based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0087] If the target file corresponding to the target behavior vector is a malicious file, the malicious category of the target file can be determined based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0088] Specifically, first calculate the third average distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples (virus, trojan, worm, ransomware) in the black and white sample set. The third average distance between the target behavior vector and the sample behavior vector corresponding to the virus is expressed as D α The third average distance between the target behavior vector and the sample behavior vector corresponding to the Trojan is expressed as D β The third average distance between the target behavior vector and the sample behavior vector corresponding to the worm is expressed as D θ The third average distance between the target behavior vector and the sample behavior vector corresponding to the ransomware is expressed as D μ The third average distance D α 、D β 、D θ and D μ Compare with the preset critical value respectively to judge D α 、D β 、D θ and D μ Whether it exceeds the critical value, if D α 、D β 、D θ and D μ If all exceed the critical value, it means that the target behavior vector is significantly different from the sample behavior vectors corresponding to various black samples. In this case, the target file corresponding to the target behavior vector is classified as a new category of malicious file in addition to viruses, Trojans, worms, and ransomware. α 、D β 、D θ and D μ If there are one or more black samples that do not exceed the preset critical value, the malicious category of the black sample corresponding to the minimum value is selected as the malicious category of the target file.

[0089] For example, assuming the critical value is s, if s<Dα <D β <D θ <D μ , the target file is classified as a new category of malicious file in addition to viruses, Trojans, worms, and ransomware. If D α <D β <D θ <D μ <s, the target file is determined to be a malicious file and its category is virus type.

[0090] See also Figure 2 , is a flow chart of another malicious file detection method provided by the embodiment of the present application. Figure 2 The process shown is described in detail.

[0091] Step S201: Obtain sample API behaviors and sample API behavior parameters of sample files in a training sample set.

[0092] In this embodiment of the present application, the sample files include black sample files and white sample files. Black sample files include at least one of viruses, Trojans, worms, and ransomware, while white sample files are normal files. The sample file types can be, but are not limited to, PE files, PDF files, or text files.

[0093] Before testing a target file, a training sample set is needed to determine whether the target file is malicious and what its malicious category is. Specifically, the sample files in the training sample set are first run through an external analysis engine to obtain the sample API behavior and sample API behavior parameters for each sample file. The external analysis engine can be, but is not limited to, a sandbox or virtual machine.

[0094] Furthermore, when obtaining the sample API behaviors and sample API behavior parameters of the sample files in the training sample set, when there are behaviors with the same sample API behaviors and sample API behavior parameters (the behavior contains a sample API behavior and its corresponding sample API behavior parameters), the behaviors with the same sample API behaviors and sample API behavior parameters can be merged to form a non-repetitive set, which can effectively avoid data redundancy and reduce the amount of calculation.

[0095] Step S202 : Encode the acquired sample API behaviors and sample API behavior parameters to obtain a sample encoding set corresponding to the training sample set.

[0096] Specifically, for each sample file, the corresponding sample API behavior is hexadecimal-encoded with a preset encoding length to obtain a third code set of a predetermined length. Simultaneously, the corresponding sample API behavior parameters are encoded to obtain a fourth code set. The codes in the fourth code set are then converted into hexadecimal codes consistent with those in the third code set. The codes in the third code set are then combined with the converted codes in the fourth code set in a one-to-one correspondence to obtain a normalized sample code set.

[0097] In the embodiment of the present application, hexadecimal encoding is used to encode the sample API behavior. It is understandable that in some other embodiments, binary, octal or decimal encoding may also be used. When other base encoding is used, if the encoding method used by the encoding in the third encoding set is different from that used by the encoding in the fourth encoding set, then the encoding in the fourth encoding set must also be converted into the same type of encoding as the encoding in the third encoding set, or the encoding in the third encoding set must be converted into the same type of encoding as the encoding in the fourth encoding set. The encoding of the sample API behavior parameters may be performed by, but is not limited to, hashing, etc. In the embodiment of the present application, hashing is used to encode the sample API behavior parameters.

[0098] Step S203 : determining the weight corresponding to each code according to the frequency of occurrence of the same sample file and different sample files corresponding to each code in the sample code set.

[0099] The weight corresponding to each code can be determined by, but is not limited to, the TF-IDF algorithm, the TextRank algorithm, etc. In the embodiment of the present application, the TF-IDF algorithm is adopted. Specifically, for the frequency of occurrence of the same sample file corresponding to the same code in the sample code set (that is, the frequency of occurrence of the behavior corresponding to the code in the same sample file), the higher the frequency of occurrence, the higher the weight assigned. And for the frequency of occurrence of different sample files corresponding to the same code in the sample code set (that is, the frequency of occurrence of the behavior corresponding to the code in different sample files), the higher the frequency of occurrence, the lower the weight assigned.

[0100] Step S204 , performing vectorization processing on the sample code set corresponding to the sample file in the training sample set according to the weight corresponding to each code, and obtaining the sample behavior vector in the black and white sample set.

[0101] Step S205 , encoding the obtained API behavior and API behavior parameters of the target file to obtain a target code set corresponding to the target file.

[0102] Step S206: perform vectorization processing on the target code set to obtain a target behavior vector.

[0103] Step S207 : determining whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set.

[0104] Step S208 : When the target file is a malicious file, the malicious category of the target file is determined based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0105] In summary, the malicious file detection method provided by the embodiment of the present application encodes and normalizes the API behavior and API behavior parameters of the target file, and then performs vector conversion after combining them to obtain the target behavior vector of the target file. It determines whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set, and determines the malicious category of the target file based on the distance between the target behavior vector and the sample behavior vectors of different types of black samples in the black and white sample set when the target file is a vector. Since the behavioral characteristics are retained and the richness of the training input is improved, the detection accuracy can be improved when detecting malicious files, and the false alarm rate of the machine learning model can be reduced. At the same time, according to the distance between the target behavior vector and the sample behavior vectors corresponding to various types of black samples, it can also distinguish the maliciousness of the target file while identifying the type of the target file by distance and discovering new types of malicious files. Secondly, the solution provided by the embodiment of the present application has good file type scalability support. Compared with the traditional solution that only supports executable PE file analysis models, the solution of the embodiment of the present application also supports other types of files such as Word and PDF. Again, the solution provided by the embodiment of the present application is more complex than the deep learning network malicious file detection method, reduces the adjustment of weights and parameter values, and improves the dependence of the behavior model based on the statistical number of behaviors on the sample distribution. And the solution provided by the embodiment of the present application has a good generalization effect for sample imbalance. In addition, the method provided by the embodiment of the present application can make the obtained coding length uniform, facilitate feature extraction, avoid the situation where the feature discrimination is not high due to broad feature description, and further improve the accuracy of malicious file detection. Finally, when establishing a training sample set, the sample API behaviors and the behaviors with the same sample API behavior parameters are merged to form a non-repetitive set, which can effectively avoid data redundancy and reduce the amount of calculation.

[0106] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0107] Figure 3 This is a block diagram of an electronic device 100 provided by an embodiment of the present application. Figure 3 At the hardware level, the electronic device 100 includes a processor 110, and optionally also includes an internal bus 120, a network interface 130, and a memory 140. The memory 140 may include internal memory, such as high-speed random-access memory (RAM), or may also include non-volatile memory, such as at least one disk storage device. Of course, the electronic device 100 may also include hardware required for other services.

[0108] The processor 110, the network interface 130, and the memory 140 can be interconnected via an internal bus 120, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0109] The memory 140 is used to store programs. Specifically, the programs may include program codes, which include computer operating instructions. The memory 140 may include internal memory and non-volatile memory, and provides instructions and data to the processor 110.

[0110] The processor 110 reads the corresponding computer program from the non-volatile memory into the memory and then runs it, forming a malicious file detection device 150 at the logical level. The processor 110 executes the program stored in the memory 140 and is specifically used to perform the following operations:

[0111] The obtained API behavior and API behavior parameters of the target file are vectorized and converted to obtain the target behavior vector corresponding to the target file; based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set, it is determined whether the target file is a malicious file; if the target file is a malicious file, the malicious category of the target file is determined based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0112] The above application Figure 3The method performed by the malicious file detection device 150 disclosed in the illustrated embodiment can be applied to or implemented by the processor 110. The processor 110 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits or software instructions in the processor 110. The processor 110 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 140, and processor 110 reads information from memory 140 and, in conjunction with its hardware, completes the steps of the above method.

[0113] The electronic device 100 may also perform Figure 1 and Figure 2 The method is implemented by the malicious file detection device 150. Figure 1 、 Figure 2 The functions of the illustrated embodiment will not be described in detail in the embodiments of the present application.

[0114] Of course, in addition to software implementation, the electronic device 100 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0115] The embodiment of the present application also provides a computer-readable storage medium, which stores one or more programs, wherein the one or more programs include instructions, which, when executed by a portable electronic device including multiple application programs, can enable the portable electronic device to execute Figure 1 、 Figure 2 The method of the embodiment shown is specifically used to perform the following operations:

[0116] The obtained API behavior and API behavior parameters of the target file are vectorized and converted to obtain the target behavior vector corresponding to the target file; based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set, it is determined whether the target file is a malicious file; if the target file is a malicious file, the malicious category of the target file is determined based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0117] Figure 4 This is a block diagram of a malicious file detection device 150 provided by an embodiment of the present application. Figure 4 In a software implementation, the malicious file detection device 150 may include:

[0118] The encoding module 151 is used to encode the obtained API behavior and API behavior parameters of the target file to obtain a target code set corresponding to the target file.

[0119] It can be understood that the encoding module 151 can be used to execute the above-mentioned step S101 or step S205.

[0120] The vectorization module 152 is used to perform vectorization processing on the target code set to obtain a target behavior vector.

[0121] It can be understood that the vectorization module 152 can be used to execute the above-mentioned step S102 or step S206.

[0122] Determination module 153 is configured to determine whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set. Furthermore, if the target file is a malicious file, the malicious category of the target file is determined based on the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

[0123] It can be understood that the determination module 153 can be used to execute the above steps S103 and S104 or steps S207 and S208.

[0124] In short, the above description is only a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

[0125] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0126] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0127] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0128] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

Claims

1. A malicious file detection method, characterized in that: include: Encoding the API behavior to obtain a first code set, wherein encoding the API behavior to obtain the first code set includes: Performing hexadecimal encoding on the API behavior to obtain the first code set of a predetermined code length; Encoding the API behavior parameters to obtain a second code set, wherein encoding the API behavior parameters to obtain the second code set includes: Hash-encoding the API behavior parameters to obtain the second encoding set; The API behavior parameter is a directory path, and encoding the API behavior parameter to obtain a second code set includes: Catalog and hierarchize the API behavior parameters; Encoding the API behavior parameters after directory stratification to obtain the second code set; When the path length of the API behavior parameter exceeds a preset length, the path length of the API behavior parameter is adjusted to the preset length before performing directory stratification; Converting the codes in the second code set into hexadecimal codes, and combining the codes in the first code set with the converted codes in the second code set in a one-to-one correspondence to obtain a target code set; performing vectorization processing on the target code set to obtain a target behavior vector; Determining whether the target file is a malicious file based on the distance between the target behavior vector and the sample behavior vectors in the black and white sample set; When the answer is yes, the malicious category of the target file is determined according to the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

2. The method according to claim 1, characterized in that The determining whether the target file is a malicious file according to the distance between the target behavior vector and the sample behavior vectors in the black and white sample set includes: Calculating a first average distance between the target behavior vector and the sample behavior vectors corresponding to the black samples in the black and white sample set; Calculating a second average distance between the target behavior vector and the sample behavior vectors corresponding to the white samples in the black and white sample set; When the first average distance is greater than or equal to the second average distance, the target file is determined to be a malicious file.

3. The method according to claim 1, characterized in that The determining the malicious category of the target file according to the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set includes: Calculating a third average distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set; When the third average distance does not exceed the preset critical value, the malicious category of the black sample corresponding to the minimum value of the third average distance is selected as the malicious category of the target file; Otherwise, the malicious category of the target file is classified into a new malicious category.

4. The method according to claim 1, wherein The method further comprises: The API behavior and the API behavior parameters are obtained after an external analysis engine runs the target file.

5. The method according to claim 1, wherein The API behavior is to load a system DLL file, write a temporary file, or modify the registry.

6. The method according to claim 1, characterized in that The method further comprises: Obtaining sample API behaviors and sample API behavior parameters of sample files in a training sample set, wherein the sample files include black sample files and white sample files, wherein the black sample files include at least one of viruses, Trojans, worms, and ransomware, and the white sample files are normal files; Encoding the obtained sample API behavior and the sample API behavior parameters to obtain a sample encoding set corresponding to the training sample set; Determining the weight corresponding to each code according to the frequency of occurrence of the same sample file and different sample files corresponding to each code in the sample code set; The sample code set corresponding to the sample file in the training sample set is vectorized according to the weight corresponding to each code, and the sample behavior vector in the black and white sample set is obtained.

7. The method according to claim 6, characterized in that The type of the sample file is a PE file, a PDF file or a text file.

8. A malicious file detection device, characterized in that: The malicious file detection device includes: The encoding module is configured to encode the API behavior to obtain a first code set, wherein encoding the API behavior to obtain the first code set includes: Performing hexadecimal encoding on the API behavior to obtain the first code set of a predetermined code length; Encoding the API behavior parameters to obtain a second code set, wherein encoding the API behavior parameters to obtain the second code set includes: Hash-encoding the API behavior parameters to obtain the second encoding set; The API behavior parameter is a directory path, and encoding the API behavior parameter to obtain a second code set includes: Catalog and hierarchize the API behavior parameters; Encoding the API behavior parameters after directory stratification to obtain the second code set; When the path length of the API behavior parameter exceeds a preset length, the path length of the API behavior parameter is adjusted to the preset length before performing directory stratification; Converting the codes in the second code set into hexadecimal codes, and combining the codes in the first code set with the converted codes in the second code set in a one-to-one correspondence to obtain a target code set; A vectorization module, configured to perform vectorization processing on the target code set to obtain a target behavior vector; a determination module, configured to determine whether a target file is a malicious file based on a distance between the target behavior vector and a sample behavior vector in a black and white sample set; and When the answer is yes, the malicious category of the target file is determined according to the distance between the target behavior vector and the sample behavior vectors corresponding to different types of black samples in the black and white sample set.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the bus; Memory for storing computer programs; A processor, configured to execute a program stored in a memory to implement the method steps described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The storage medium stores a computer program, which, when executed by a processor, implements the method steps described in any one of claims 1 to 7.

Images