A method, system and server for determining a system whitelist

Abstract

The present invention discloses a method, system and server for determining a system whitelist, wherein a search database is provided, the search database includes security files under various systems, the security files have corresponding string data, and the method comprises: for a target file in a target system to be detected, extracting string data from a binary sequence representing the target file; comparing the extracted string data with the target string data in the search database; if the extracted string data matches the target string data, adding the target file to the system whitelist. The technical solution provided by the present application can effectively determine the files in the system whitelist, thereby greatly improving the scanning efficiency.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a method, system and server for determining a system whitelist. Background Art

[0002] With the continuous development of network security technology, host intrusion detection systems and various anti-virus software can provide security protection and virus detection for hosts in the network. Currently, when scanning executable files in the system, in order to reduce the scanning time, files that have been scanned and confirmed to be safe can usually be added to the whitelist, and the files in the whitelist will no longer be scanned and checked for viruses.

[0003] The files in the whitelist are usually marked by hash values ​​(such as MD5 values), which means that even if the file to be detected is only slightly different from a file in the whitelist, the scanning process cannot be skipped. For example, a file under the centos7.1 system is stored in the whitelist, and the same file under the centos7.5 system needs to be scanned. However, due to different versions, even if the files are only slightly different, the scanning process cannot be skipped. In actual applications, there are countless files with slight differences, so the determination method of the whitelist in the prior art cannot improve the scanning efficiency well. Summary of the invention

[0004] The purpose of the present application is to provide a method, system and server for determining a system whitelist, which can effectively determine the files in the system whitelist, thereby greatly improving the scanning efficiency.

[0005] To achieve the above-mentioned purpose, the present application provides, on the one hand, a method for determining a system whitelist, and provides a retrieval database, wherein the retrieval database includes security files under various systems, and the security files have corresponding string data. The method comprises: for a target file in a target system to be detected, extracting string data from a binary sequence representing the target file; comparing the extracted string data with the target string data in the retrieval database; if the extracted string data matches the target string data, adding the target file to the system whitelist.

[0006] To achieve the above-mentioned purpose, the present application further provides a system for determining a system whitelist, which includes a retrieval database, wherein the retrieval database includes security files under various systems, and the security files have corresponding string data. The system includes: a string data extraction unit, which is used to extract string data from a binary sequence representing the target file in the target system to be detected; a comparison unit, which is used to compare the extracted string data with the target string data in the retrieval database; and a whitelist adding unit, which is used to add the target file to the system whitelist if the extracted string data matches the target string data.

[0007] To achieve the above-mentioned purpose, the present application further provides a server on the other hand, wherein the server is provided with a retrieval database, wherein the retrieval database includes security files under each system, wherein the security files have corresponding string data, and wherein the server includes a memory and a processor, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the above-mentioned method for determining the system whitelist is implemented.

[0008] As can be seen from the above, the technical solution provided by one or more embodiments of the present application can have its own string data for the security files in the system in the retrieval database. For the target file in the target system to be detected, it is not matched with the security file in the retrieval database through the hash value, but first extracts the string data from the binary sequence of the target file, and then compares the extracted string data with the target string data in the retrieval database. If the two string data match, it can be determined that the target file can be added to the system whitelist, so there is no need to scan the target file. Since the matching process of the string data can allow a small range of changes to the file, even if the hash values ​​of the two files are different, the two files may still match. In this way, for the same system, the retrieval database does not need to store all versions of the security files, but only needs to store one version of the security file. In this way, other files to be detected can be automatically added to the whitelist through the matching process of the string data, thereby eliminating the scanning process and greatly improving the scanning efficiency of the files in the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1is a step diagram of a method for determining a system whitelist in an embodiment of the present invention;

[0011] Figure 2 A schematic diagram of functional modules of a system for determining a system whitelist in an embodiment of the present invention;

[0012] Figure 3 It is a schematic diagram of the structure of the server in an embodiment of the present invention. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in combination with the specific implementation methods of this application and the corresponding drawings. Obviously, the described implementation methods are only part of the implementation methods of this application, not all of the implementation methods. Based on the implementation methods in this application, all other implementation methods obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0014] The present application provides a method for determining a system whitelist. When implementing the method, a retrieval database may be constructed first. The retrieval database may include security files under various systems. The scanning process of the security files in the retrieval database may be omitted.

[0015] In practical applications, the security files in the retrieval database can be executable files that are confirmed to be safe after being scanned by the host intrusion detection system or anti-virus software. The retrieval database can be continuously updated, and the security files in the retrieval database can be removed or added according to the update results. In this embodiment, since the version of the operating system is usually continuously iterated, if the security files under different versions of the system are all stored in the retrieval database, it will undoubtedly greatly increase the construction cost and maintenance cost of the retrieval database. In view of this, in this embodiment, it is only necessary to store the security files under the large version of the system in the retrieval database. For example, for the centos system, the large version can be, for example, versions such as 7.1 and 7.2, and under each large version, a smaller small version can be provided. For example, under version 7.1, a small version such as 7.1.1523 can be provided. Of course, in practical applications, the version number of the large version can be flexibly determined based on the total number of versions of the same system. For example, suppose a system only has version 1.0. Under version 1.0, there can be two minor versions, 1.0.1 and 1.0.2. Under version 1.0.1, there can be a smaller version, such as 1.0.1.1544. In this case, 1.0.1 and 1.0.2 can be regarded as major versions, and only the security files under these two versions of the system can be stored in the retrieval database. In other words, the definition of major versions can be flexibly set according to the actual application scenario, as long as the construction cost and maintenance cost of the retrieval database are maintained within an acceptable range.

[0016] In this embodiment, the security files under each system contained in the retrieval database may have corresponding version numbers and directories. For example, for a system of centos7.1 version, a security file named ps is located in the / bin directory, then the version number corresponding to the security file may be 7.1, and the directory may be / bin / ps. Of course, in actual applications, each security file may also have more detailed information. For example, it may have the timestamp when the security file is added to the retrieval database, and it may also have the capacity of the security file, etc.

[0017] In this embodiment, in addition to the above-mentioned version number and directory, the security file may also have corresponding string data, which may be extracted from the binary sequence of the security file. Specifically, in a computer, files are usually stored in the form of binary sequences. Using the preset instructions in the system, you can search for printable strings in the binary sequence of the security file, and the printable strings can be used as string data extracted from the binary sequence. For example, in a Linux system, you can use the strings instruction to print out the printable strings in the binary sequence. The printed string data can be arranged line by line, and each line has a fixed length limit.

[0018] Of course, in actual applications, the above-mentioned preset instructions may also be different depending on the system type, but as long as the corresponding string data can be extracted from the binary sequence, it should be within the protection scope of this application.

[0019] According to the above method, character string data of each security file in the retrieval database can be generated, and the character string data can be bound to the corresponding security file.

[0020] See also Figure 1 A method for determining a system whitelist provided in one embodiment of the present application may include the following steps.

[0021] S1: For a target file in a target system to be detected, extract character string data from a binary sequence representing the target file.

[0022] In this embodiment, the target system to be detected can be any operating system, and the executable file in the target system can be used as the target file to be detected. By detecting the target file, it can be determined whether the target file can be added to the system whitelist.

[0023] In actual applications, the target file can be determined in two ways. The first is to use the target system to be detected as the basis, and use any executable file in the target system as the target file, and then determine whether the target file can be added to the system whitelist. The second is to determine the target file to be detected in the target system in combination with the security files in the retrieval database.

[0024] Specifically, for the second case, first, any operating system that needs to be detected can be used as the target system to be detected, and then the matching system that matches the target system can be queried in the retrieval database. The basis for the query can be the system name of the target system. In the system name, the current version of the target system can be marked. For example, the system name of the target system may be centos7.5. When querying the matching system in the retrieval database, the system with the same major version can be used as the matching system. For example, for centos7.5, the major version may be centos7, and if there is centos7.1 in the retrieval database, centos7.1 can be used as the matching system for the target system centos7.5. In this way, through the query, a matching system that is the same or similar to the target system can be obtained.

[0025] In this embodiment, after obtaining the matching system, the target file to be detected in the target system can be determined for the security files in the matching system. Specifically, any security file located in the retrieval database can be determined in the matching system, and then the target directory of the security file in the matching system can be queried. Since the matching system and the target system belong to the same system (only the version may be different), the directories in the two systems are consistent. In this way, after the target directory is obtained by query, the file pointed to by the target directory in the target system can be used as the target file to be detected. For example, the current target system to be detected is centos7.5, and the matching system similar to the target system in the retrieval database is centos7.1. In the matching system centos7.1, there is a security file named ps located in the retrieval database, and the complete directory of the security file is / bin / ps. In this way, based on this directory, the target file pointed to by the target directory / bin / ps can be found in the target system centos7.5. In this way, the security file corresponding to the target string data has the same directory as the target file.

[0026] In this embodiment, after the target file to be detected is determined, the character string data can be extracted from the binary sequence representing the target file in the above manner. The detailed process can be referred to the above description and will not be repeated here.

[0027] S3: Compare the extracted character string data with the target character string data in the search database.

[0028] In this embodiment, after obtaining the string data of the target file, the string data can be compared with the target string data of the security file in the search database. For example, the string data of the ps file in centos7.5 can be compared with the target string data of the ps file in centos7.1 in the search database.

[0029] When comparing two string data, the similarity between the two string data can be calculated. Specifically, the first feature vector of the extracted string data can be extracted, and the second feature vector of the target string data can be extracted, and the similarity between the first feature vector and the second feature vector can be calculated. The similarity between the two feature vectors can be used as the similarity between the two string data.

[0030] In one embodiment, considering that the length of the string data extracted from the binary sequence may be long, if the similarity between two long string data is directly compared, on the one hand, the amount of data calculated is large, and on the other hand, the calculation result may be inaccurate. In view of this, in this embodiment, when extracting the first feature vector, the extracted string data can be first divided into multiple character substrings, and each of the character substrings is taken as a word, thereby generating a word set corresponding to the extracted string data. Obviously, the data volume of the word set will be smaller than the data volume of the string data. Subsequently, the feature vectors of the word set can be counted, and the counted feature vectors can be used as the first feature vector corresponding to the extracted string data. Among them, when dividing the character substrings, the length of each character substring can be pre-set, and then the string data can be divided into multiple character substrings according to the set length.

[0031] In one implementation, if the character string data is a printable character string printed according to the strings instruction, the printable character string is arranged line by line, and the character string data in each line can be used as a corresponding character substring.

[0032] Similarly, when extracting the second feature vector of the target string data, the target string data can be divided into multiple character substrings, and each of the character substrings can be used as a word to generate a word set corresponding to the target string data. Then, the feature vectors of the word set can be counted, and the counted feature vectors can be used as the second feature vector corresponding to the target string data. It should be noted that in order to ensure the accuracy of subsequent calculations, the extraction criteria of the first feature vector and the second feature vector are usually kept consistent. For example, when dividing the character substrings, the division needs to be performed according to the same criteria.

[0033] In practical applications, a variety of algorithms can be used to count the feature vectors of a word set. For example, the bag-of-words model, TF-IDF (Term Frequency–Inverse Document Frequency) algorithm or word embedding algorithm can be used to analyze the above word set to obtain the corresponding feature vector, which will not be described here.

[0034] In this embodiment, after extracting the feature vector of the character string data, the similarity between two feature vectors can be calculated by means of Pearson correlation coefficient, chi-squared validation, cosine similarity, etc.

[0035] Through the above method, the matching matching system in the database is first retrieved, and then the target file to be detected is determined. Each target file to be detected is only compared and matched with the security file in the same directory in the retrieval database, with small calculation amount and high reliability.

[0036] Of course, if the target file is determined according to the first method in step S1, the string data of the target file can be compared with the string data of each security file in the search database one by one. In this case, the target string data can be the string data of the security file currently being compared. However, this method has a large amount of calculation and low reliability.

[0037] S5: If the extracted character string data matches the target character string data, the target file is added to a system whitelist.

[0038] In this embodiment, after calculating the similarity between the two string data, if the similarity is greater than or equal to the specified similarity threshold, it can be determined that the extracted string data matches the target string data, and the target file can be directly added to the system whitelist, and there is no need to scan the target file when performing virus scanning detection. The above similarity threshold can be flexibly set based on actual conditions. For example, assuming that the maximum value of the similarity is 1, the specified similarity threshold can be set to 0.9.

[0039] In this way, for the target file in the target system to be detected, by converting the target file into string data, it can be determined whether the target file can be added to the system whitelist. This can not only reduce the number of safe files required to search the database, but also improve the scanning efficiency of the system.

[0040] See also Figure 2The present application also provides a system for determining a system whitelist, which includes a search database, wherein the search database includes security files under each system, and the security files have corresponding string data. The system includes:

[0041] A character string data extraction unit, for extracting character string data from a binary sequence representing a target file in a target system to be detected;

[0042] a comparison unit, for comparing the extracted character string data with the target character string data in the retrieval database;

[0043] The whitelist adding unit is used to add the target file to the system whitelist if the extracted character string data matches the target character string data.

[0044] See also Figure 3 The present application also provides a server, which is provided with a retrieval database, which includes security files under various systems, and the security files have corresponding string data. The server includes a memory and a processor, and the memory is used to store a computer program. When the computer program is executed by the processor, the above-mentioned method for determining the system whitelist is implemented.

[0045] In the present application, the memory may include a physical device for storing information, which is usually a device that digitizes the information and then stores it in a medium using electrical, magnetic or optical methods. The memory may also include: a device that stores information using electrical energy, such as RAM or ROM; a device that stores information using magnetic energy, such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a magnetic bubble memory or a USB flash drive; a device that stores information using optical means, such as a CD or a DVD. Of course, there are other types of memory, such as quantum memory or graphene memory, etc.

[0046] In the present application, the processor may be implemented in any suitable manner. For example, the processor may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, etc.

[0047] As can be seen from the above, the technical solution provided by one or more embodiments of the present application can have its own string data for the security files in the system in the retrieval database. For the target file in the target system to be detected, it is not matched with the security file in the retrieval database through the hash value, but first extracts the string data from the binary sequence of the target file, and then compares the extracted string data with the target string data in the retrieval database. If the two string data match, it can be determined that the target file can be added to the system whitelist, so there is no need to scan the target file. Since the matching process of the string data can allow a small range of changes to the file, even if the hash values ​​of the two files are different, the two files may still match. In this way, for the same system, the retrieval database does not need to include all versions of the security files, but only needs to include one version of the file. In this way, other files to be detected can be automatically added to the whitelist through the matching process of the string data, thereby eliminating the scanning process and greatly improving the scanning efficiency of the files in the system.

[0048] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the embodiments of the system and the server, they can all refer to the introduction and comparison of the embodiments of the aforementioned method.

[0049] It will be appreciated by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0050] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0051] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0052] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0053] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0054] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0055] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0056] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0057] The above is only the implementation mode of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for determining a system whitelist, characterized in that: A search database is provided, the search database includes security files under various systems, the security files have corresponding string data, and the method includes: For a target file in a target system to be detected, character string data is extracted from a binary sequence representing the target file; wherein the target file is determined in the following manner: a matching system matching the target system is searched in the search database, and a target directory of security files in the matching system is searched; the file pointed to by the target directory in the target system is taken as the target file; and the extracted character string data is compared with the target character string data in the search database; If the extracted string data matches the target string data, the target file is added to a system whitelist.

2. The method according to claim 1, characterized in that Extracting string data from a binary sequence representing the target file includes: A printable character string is searched from the binary sequence of the target file using a preset instruction, and the printable character string found is used as the extracted character string data.

3. The method according to claim 1, characterized in that The security file corresponding to the target character string data has the same directory as the target file.

4. The method according to claim 1, characterized in that: Comparing the extracted character string data with the target character string data in the search database comprises: A first feature vector of the extracted character string data is extracted, and a second feature vector of the target character string data is extracted, and a similarity between the first feature vector and the second feature vector is calculated.

5. The method according to claim 4, characterized in that Extracting a first feature vector of the extracted character string data includes: Dividing the extracted character string data into a plurality of character substrings, and treating each of the character substrings as a word, so as to generate a word set corresponding to the extracted character string data; The feature vectors of the word set are counted, and the counted feature vectors are used as the first feature vectors corresponding to the extracted character string data.

6. The method according to claim 5, characterized in that Dividing the extracted character string data into a plurality of character substrings comprises: If the extracted character string data is a printable character string, the character string data in each line is used as a corresponding character substring.

7. The method according to claim 4, characterized in that Extracting a second feature vector of the target character string data includes: Divide the target character string data into a plurality of character substrings, and regard each of the character substrings as a word, so as to generate a word set corresponding to the target character string data; The feature vectors of the word set are counted, and the counted feature vectors are used as second feature vectors corresponding to the target character string data.

8. The method according to claim 4, characterized in that The extracted character string data matches the target character string data including: The calculated similarity is greater than or equal to a specified similarity threshold.

9. A system for determining a system whitelist, characterized in that: A search database is provided, the search database includes security files under various systems, the security files have corresponding string data, and the system includes: A character string data extraction unit is used to extract character string data from a binary sequence representing a target file in a target system to be detected; wherein the target file is determined in the following manner: a matching system matching the target system is searched in the search database, and a target directory of security files in the matching system is searched; and a file pointed to by the target directory in the target system is used as the target file; a comparison unit, for comparing the extracted character string data with the target character string data in the retrieval database; The whitelist adding unit is used to add the target file to the system whitelist if the extracted character string data matches the target character string data.

10. A server, characterized in that: The server is provided with a retrieval database, which includes security files under various systems, and the security files have corresponding string data. The server includes a memory and a processor, and the memory is used to store a computer program. When the computer program is executed by the processor, it implements the method described in any one of claims 1 to 8.

Images