Method, device and computer equipment for monitoring malicious code change trend

Abstract

The application discloses a method, device and computer equipment for monitoring change trend of malicious code, and belongs to the technical field of terminals. The method for monitoring change trend of malicious code provided by the application comprises the following steps: obtaining target network data according to a target object to be monitored; generating a relationship graph according to the target object and the target network data; generating a directed graph with the target object as a starting point according to the relationship graph; determining existing nodes and new nodes in a relationship path in the directed graph according to the relationship path; and determining a change trend of the current target object according to an increase amplitude of a distribution range of the existing nodes and a distribution range of the new nodes. The method can more accurately understand the propagation mode of the malicious code by monitoring the change of the node distribution range in the relationship path associated with the malicious code and its variants, thereby improving the monitoring strength of the malicious code and accurately monitoring the change trend of the malicious code.

Description

Technical Field

[0001] This application relates to the field of terminal technology, and in particular to a method, apparatus, and computer device for monitoring changes in malicious code. Background Technology

[0002] With the development and widespread application of terminal technology, terminals have become targets for malicious code, or viruses. Malicious code is code inserted into programs by developers to damage terminal functions or data; it is propagating and infectious, affecting terminal usability. Therefore, monitoring the evolving trends of malicious code is essential.

[0003] The relevant technologies mainly involve extracting the characteristics of known malicious code, then determining whether there are new files that match these characteristics, and monitoring the changing trends of malicious code based on the changes in the new files relative to existing files.

[0004] However, malicious code is constantly changing, and its characteristics are constantly being updated. The methods in related technologies may miss some characteristics, resulting in insufficient monitoring and an inability to accurately detect the changing trends of malicious code. Summary of the Invention

[0005] This application provides a method, apparatus, and computer device for monitoring changes in malicious code, which can solve the problem of inaccurate monitoring of changes in malicious code. The technical solution is as follows:

[0006] On the one hand, a method for monitoring changes in malicious code is provided, the method comprising:

[0007] Based on the target object to be monitored, acquire target network data that has a target relationship with the target object, wherein the target object includes a first malicious code to be monitored and a second malicious code obtained from a variant of the first malicious code;

[0008] Based on the target object and the target network data, a relationship graph is generated, which includes the node corresponding to the target object, the node corresponding to the target network data, and the relationship between the nodes.

[0009] Based on the relationship graph, a directed graph is generated with the target object as the starting point. The directed graph includes relationship paths, and the relationship paths include the nodes.

[0010] Based on the relational paths in the directed graph, determine the existing nodes and newly added nodes in the relational paths;

[0011] Determine the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes in the relationship path;

[0012] Based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes, the current changing trend of the target object is determined.

[0013] In one possible implementation, determining the existing and new nodes in the relational path based on the relational path in the directed graph includes:

[0014] Obtain the earliest occurrence time of a node in the current relationship path;

[0015] Get the last monitoring time of the target object;

[0016] Based on the earliest occurrence time of the current node and the last monitoring time of the target object, the existing nodes and newly added nodes in the relationship path are determined.

[0017] In another possible implementation, determining the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes in the relationship path includes:

[0018] Retrieve the distribution breadth of the newly added node from the node distribution breadth database;

[0019] Obtain the first distribution breadth of the existing nodes from the database;

[0020] Based on the last monitoring time of the target object, obtain the second distribution breadth of the existing nodes from the database;

[0021] The difference between the first distribution breadth and the second distribution breadth is used as the increment of the distribution breadth of the existing nodes.

[0022] In another possible implementation, acquiring the target network data that has a target relationship with the target object includes:

[0023] Obtain the target file associated with the target object;

[0024] The static data, behavioral data, and first relational data of the target file are obtained. The static data is data obtained from the binary data of the target file, the behavioral data is data obtained when the target file is running, and the first relational data is data that has a relationship with the target file when the target file is running.

[0025] Determine the relationship attributes between two static data and the relationship attributes between the static data and the static rule; combine the two static data and the relationship attributes between the two static data to form second relationship data; and combine the static data, the static rule, and the relationship attributes between the static data and the static rule to form the second relationship data.

[0026] Determine the relationship attributes between two behavioral data and the relationship attributes between the behavioral data and the behavioral rule; combine the two behavioral data and the relationship attributes between the two behavioral data to form a third relationship data; and combine the behavioral data, the behavioral rule, and the relationship attributes between the behavioral data and the behavioral rule to form the third relationship data.

[0027] The first relation data, the second relation data, and the third relation data are combined to form the target network data.

[0028] In another possible implementation, determining the relationship attributes between two static data points and the relationship attributes between the static data and the static rule includes:

[0029] In response to the fact that the first static data includes the second static data, the relationship attribute between the first static data and the second static data is determined to be inclusion;

[0030] In response to the fact that the similarity between the first static data and the second static data is greater than a first preset threshold, the relationship attribute between the first static data and the second static data is determined to be similar.

[0031] In response to the first static data conforming to the static rule, the relationship attribute between the first static data and the static rule is determined to be a match.

[0032] In another possible implementation, generating a relationship graph based on the target object and the target network data includes:

[0033] The target object, the first target network data, and the second target network data are respectively regarded as nodes, and the first target network data and the second target network data are any one of the target network data in the target network data;

[0034] Determine the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data;

[0035] Based on the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data, the nodes corresponding to the target object and the nodes corresponding to the first target network data, the nodes corresponding to the target object and the nodes corresponding to the second target network data, and the nodes corresponding to the first target network data and the nodes corresponding to the second target network data are connected to obtain the relationship graph.

[0036] In another possible implementation, determining the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data includes:

[0037] In response to the first target network data or the second target network data belonging to the target object, the relationship between the target object and the first target network data or the relationship between the target object and the second target network data is determined to be that the first target network data or the second target network data belongs to the target object;

[0038] In response to the fact that the first target network data belongs to the second target network data, the relationship between the first target network data and the second target network data is determined to be a match;

[0039] In response to the first target network data accessing the second target network data, the relationship between the first target network data and the second target network data is determined as an access;

[0040] In response to the fact that the similarity between the first target network data and the second target network data is greater than a first preset threshold, the relationship between the first target network data and the second target network data is determined to be similar;

[0041] In response to the generation of the second target network data based on the first target network data, the relationship between the first target network data and the second target network data is determined as generation.

[0042] In another possible implementation, the method further includes:

[0043] In response to the increase in the distribution breadth of the existing nodes being no less than a second preset threshold or the distribution breadth of the newly added nodes being no less than a third preset threshold, an alarm message is generated. The alarm message includes the path information of the relationship path, the attribute information of the existing nodes, the attribute information of the newly added nodes, and the attribute information of the relationship between nodes.

[0044] Based on the alarm information, the target program is launched, and the target object is detected and eliminated through the target program;

[0045] In response to the fact that the increase in the distribution breadth of the existing nodes is less than the second preset threshold and the distribution breadth of the newly added nodes is less than the third preset threshold, a new relationship path is selected from the directed graph, and the step of determining the existing nodes and newly added nodes in the relationship path based on the relationship path in the directed graph is executed.

[0046] In another possible implementation, the method further includes:

[0047] Based on the alarm information, generate monitoring results for the target object;

[0048] When a query request for the target object is received from a terminal, the monitoring result is sent to the terminal, which then displays the monitoring result on the query page.

[0049] On the other hand, an apparatus for monitoring changes in malicious code is provided, the apparatus comprising:

[0050] The first acquisition module is used to acquire target network data that has a target relationship with the target object to be monitored, the target object including a first malicious code to be monitored and a second malicious code obtained from a variant of the first malicious code;

[0051] The first generation module is used to generate a relationship graph based on the target object and the target network data. The relationship graph includes the nodes corresponding to the target object, the nodes corresponding to the target network data, and the relationships between the nodes.

[0052] The second generation module is used to generate a directed graph with the target object as the starting point based on the relationship graph. The directed graph includes relationship paths, and the relationship paths include the nodes.

[0053] The first determining module is used to determine the existing nodes and newly added nodes in the relationship path based on the relationship path in the directed graph;

[0054] The second determining module is used to determine the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes in the relationship path;

[0055] The third determining module is used to determine the current changing trend of the target object based on the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes.

[0056] In one possible implementation, the first determining module is further configured to obtain the earliest occurrence time of a node in the current relationship path; obtain the last monitoring time of the target object; and determine the existing nodes and newly added nodes in the relationship path based on the earliest occurrence time of the current node and the last monitoring time of the target object.

[0057] In another possible implementation, the second determining module is further configured to obtain the distribution breadth of the newly added node from the node distribution breadth database; obtain the first distribution breadth of the existing node from the database; obtain the second distribution breadth of the existing node from the database based on the last monitoring time of the target object; and use the difference between the first distribution breadth and the second distribution breadth as the increment of the distribution breadth of the existing node.

[0058] In another possible implementation, the first acquisition module is further configured to acquire a target file associated with the target object; acquire static data, behavioral data, and first relationship data of the target file, wherein the static data is data obtained from the binary data of the target file, the behavioral data is data obtained when the target file is run, and the first relationship data is data that has a relationship with the target file when the target file is run; determine the relationship attribute between two static data sets and the relationship attribute between the static data set and the static rule, and form a second relationship data set by combining the two static data sets and the relationship attribute between the two static data sets; determine the relationship attribute between two behavioral data sets and the relationship attribute between the behavioral data set and the behavioral rule, and form a third relationship data set by combining the two behavioral data sets and the relationship attribute between the two behavioral data sets; and form the third relationship data set by combining the behavioral data set, the behavioral rule, and the relationship attribute between the behavioral data set and the behavioral rule; and form the target network data by combining the first relationship data set, the second relationship data set, and the third relationship data set.

[0059] In another possible implementation, the first acquisition module is further configured to: determine the relationship attribute between the first static data and the second static data as inclusion in response to the first static data including the second static data; determine the relationship attribute between the first static data and the second static data as similar in response to the similarity between the first static data and the second static data being greater than a first preset threshold; and determine the relationship attribute between the first static data and the static rule as matching in response to the first static data conforming to the static rule.

[0060] In another possible implementation, the first generation module is further configured to use the target object, the first target network data, and the second target network data as nodes, where the first target network data and the second target network data are any one of the target network data; determine the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data; and based on the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data, connect the node corresponding to the target object with the node corresponding to the first target network data, the node corresponding to the target object with the node corresponding to the second target network data, and the node corresponding to the first target network data with the node corresponding to the second target network data to obtain the relationship graph.

[0061] In another possible implementation, the first generation module is further configured to, in response to the first target network data or the second target network data belonging to the target object, determine the relationship between the target object and the first target network data or the relationship between the target object and the second target network data as the first target network data or the second target network data belonging to the target object; in response to the first target network data belonging to the second target network data, determine the relationship between the first target network data and the second target network data as a match; in response to the first target network data accessing the second target network data, determine the relationship between the first target network data and the second target network data as an access; in response to the similarity between the first target network data and the second target network data being greater than a first preset threshold, determine the relationship between the first target network data and the second target network data as similar; and in response to the first target network data generating the second target network data, determine the relationship between the first target network data and the second target network data as a generation.

[0062] In another possible implementation, the device further includes:

[0063] The third generation module is used to generate alarm information in response to the increase in the distribution breadth of the existing nodes not being less than a second preset threshold or the distribution breadth of the newly added nodes not being less than a third preset threshold. The alarm information includes path information of the relationship path, attribute information of the existing nodes, attribute information of the newly added nodes, and attribute information of the relationship between nodes.

[0064] The detection and removal module is used to launch the target program based on the alarm information, and to detect and remove the target object through the target program;

[0065] The first determining module is further configured to, in response to the increase in the distribution breadth of the existing nodes being less than the second preset threshold and the distribution breadth of the newly added nodes being less than the third preset threshold, reselect a relation path from the directed graph and determine the existing nodes and newly added nodes in the relation path according to the relation path in the directed graph.

[0066] In another possible implementation, the device further includes:

[0067] The fourth generation module is used to generate monitoring results for the target object based on the alarm information;

[0068] The sending module is used to send the monitoring results to the terminal when it receives a query request for the target object from the terminal, and the terminal is used to display the monitoring results on the query page.

[0069] On the other hand, a computer device is provided, the computer device comprising:

[0070] A processor and a memory, wherein the memory stores at least one piece of program code, which is loaded and executed by the processor to perform any of the operations described in the methods for monitoring changes in malicious code.

[0071] On the other hand, a computer-readable storage medium is provided, wherein at least one piece of program code is stored therein, the at least one piece of program code being loaded and executed by a processor to perform any of the operations performed by the methods described above for monitoring changes in malicious code.

[0072] The beneficial effects of the technical solutions provided in this application are:

[0073] The method for monitoring the changing trends of malicious code provided in this application involves: acquiring target network data with target relationships to the target object; generating a relationship graph based on the target object and the target network data; generating a directed graph with the target object as the starting point based on the relationship graph; determining existing and new nodes in the relationship paths based on the relationship paths in the directed graph; determining the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes in the relationship paths; and determining the current changing trend of the target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes. This method detects the changing trends of malicious code by monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants. By monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants, it can more accurately understand the propagation methods of malicious code, thereby improving the monitoring effectiveness and accurately monitoring the changing trends of malicious code.

[0074] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this disclosure. Attached Figure Description

[0075] Figure 1 This is a schematic diagram of an implementation environment for monitoring changes in malicious code, provided in an embodiment of this application.

[0076] Figure 2 This is a schematic diagram illustrating a method for monitoring changes in malicious code, provided in an embodiment of this application.

[0077] Figure 3 This is a flowchart of a method for monitoring changes in malicious code, provided in an embodiment of this application.

[0078] Figure 4 This is a flowchart of a method for monitoring changes in malicious code, provided in an embodiment of this application.

[0079] Figure 5 This is a schematic diagram illustrating how a computer device obtains second relational data based on static data and static rules, according to an embodiment of this application.

[0080] Figure 6 This is a schematic diagram of a relationship graph provided in an embodiment of this application;

[0081] Figure 7 This is a schematic diagram illustrating how a computer device sequentially monitors a target object, as provided in an embodiment of this application.

[0082] Figure 8 This is a schematic diagram of the structure of a device for monitoring changes in malicious code, provided in an embodiment of this application.

[0083] Figure 9This is a structural block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0084] To make the technical solution and advantages of this application clearer, the embodiments of this application will be described in further detail below.

[0085] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application are authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the monitoring of target objects, target documents, etc. in this application all comply with relevant laws, regulations, and standards.

[0086] The following is an explanation of the terminology used in the embodiments of this application:

[0087] Malicious code: Code inserted into a program by its creator to disrupt terminal functions or data; also known as a virus.

[0088] Virus family: A general term for viruses and their variants. Files and related information within the same virus family are related or similar.

[0089] Distribution breadth: The number of users who have access to specific information. For example, if file A appears on the terminals of N users, then the distribution breadth of file A is N.

[0090] This application provides an application scenario for monitoring the changing trends of malicious code. This scenario is primarily applied to security software used to detect and remove malicious code. Malicious code is propagating and infectious, affecting terminal usage. Therefore, it is necessary to monitor the changing trends of malicious code. By monitoring these trends, security software can be upgraded to improve its ability to detect and remove malicious code, thus helping relevant personnel to more easily cope with the threats posed by constantly evolving malicious code. The security software can be a PC manager or a mobile phone manager; this application does not specifically limit it.

[0091] In one possible implementation, this application embodiment also provides an implementation environment for monitoring changes in malicious code, see [link to relevant documentation]. Figure 1The implementation environment includes a computer device 101 and a terminal 102. The computer device 101 is a server, and the computer device 101 and the terminal 102 can be connected wirelessly or via a wired connection. The computer device 101 acquires target network data related to the target object, which includes the first malicious code to be monitored and a second malicious code derived from a variant of the first malicious code. The target network data is relational data obtained by collecting static data, behavioral data, and first relational data of the target file. The computer device 101 generates a relational graph based on the target object and the target network data; finally, based on the relational graph, it monitors changes in nodes along the relational paths related to the target object, thereby achieving the purpose of monitoring the changing trends of the malicious code. (See also...) Figure 2 , Figure 2 This application provides a schematic diagram illustrating the monitoring of changes in malicious code, from... Figure 2 As can be seen, computer device 101 first collects static data, behavioral data, and primary relationship data of the target file, then processes the above data to generate a relationship graph, and monitors the changing trend of the target object based on the relationship graph.

[0092] In one possible implementation, see [link to previous section] Figure 2 The computer device 101 can generate alarm information based on changes in the target object, and then use this alarm information to detect and eliminate the target object. The computer device 101 can also send monitoring results of the target object to the terminal 102 based on a query request. The terminal 102 displays these monitoring results on a query page, allowing relevant personnel to promptly understand changes in the target object and thus improve the detection and elimination capabilities of security software. Through the method provided in this embodiment, the computer device 101 can comprehensively, clearly, and promptly monitor changes in the target object, including changes in the mode of change, technical means, and propagation methods. It can also monitor changes in the infection level and whether there is an outbreak trend, allowing relevant personnel to more easily cope with the threats posed by constantly evolving malicious code.

[0093] This application provides a method for monitoring changes in malicious code; see [link to relevant documentation]. Figure 3 The method includes:

[0094] Step 301: Based on the target object to be monitored, obtain target network data that has a target relationship with the target object. The target object includes the first malicious code to be monitored and the second malicious code obtained from the variant of the first malicious code.

[0095] Step 302: Generate a relationship graph based on the target object and the target network data. The relationship graph includes the nodes corresponding to the target object, the nodes corresponding to the target network data, and the relationships between the nodes.

[0096] Step 303: Based on the relationship graph, generate a directed graph with the target object as the starting point. The directed graph includes relationship paths, and the relationship paths include nodes.

[0097] Step 304: Based on the relational paths in the directed graph, determine the existing nodes and new nodes in the relational paths.

[0098] Step 305: Determine the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes in the relationship path.

[0099] Step 306: Determine the changing trend of the current target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes.

[0100] In one possible implementation, existing and new nodes in the relational paths of the directed graph are determined, including:

[0101] Get the earliest occurrence time of a node in the current relationship path;

[0102] Get the last monitoring time of the target object;

[0103] Based on the earliest occurrence time of the current node and the last monitoring time of the target object, determine the existing nodes and newly added nodes in the relationship path.

[0104] In another possible implementation, determining the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes in the relation path includes:

[0105] Retrieve the distribution breadth of the newly added node from the node distribution breadth database;

[0106] Retrieve the first distribution breadth of the currently existing nodes from the database;

[0107] Based on the last monitoring time of the target object, retrieve the second distribution breadth of the existing nodes from the database;

[0108] The difference between the first distribution breadth and the second distribution breadth is used as the increment of the distribution breadth of the existing nodes.

[0109] In another possible implementation, target network data that has a target relationship with the target object is obtained, including:

[0110] Retrieve the target file associated with the target object;

[0111] Obtain the static data, behavioral data, and first relation data of the target file. The static data is the data obtained from the binary data of the target file, the behavioral data is the data obtained when the target file is run, and the first relation data is the data that has a relationship with the target file when the target file is run.

[0112] Determine the relationship attributes between two static data and the relationship attributes between static data and static rules; combine the two static data and the relationship attributes between the two static data into second relation data; and combine the static data, static rules, and the relationship attributes between static data and static rules into second relation data.

[0113] Determine the relationship attributes between two behavioral data and the relationship attributes between behavioral data and behavioral rules; combine the relationship attributes between two behavioral data and the two behavioral data to form a third relationship data; and combine the relationship attributes between behavioral data, behavioral rules, and behavioral data and behavioral rules to form a third relationship data.

[0114] The first relation data, the second relation data, and the third relation data are combined to form the target network data.

[0115] In another possible implementation, the relationship attributes between two static data points and the relationship attributes between static data and static rules are determined, including:

[0116] In response to the fact that the first static data includes the second static data, the relationship attribute between the first static data and the second static data is determined to be inclusion;

[0117] In response to the fact that the similarity between the first static data and the second static data is greater than a first preset threshold, the relationship attribute between the first static data and the second static data is determined to be similar.

[0118] In response to the first static data conforming to the static rule, the relationship attribute between the first static data and the static rule is determined to be a match.

[0119] In another possible implementation, a relationship graph is generated based on the target object and target network data, including:

[0120] The target object, the first target network data, and the second target network data are respectively regarded as nodes, and the first target network data and the second target network data are any one of the target network data in the target network data;

[0121] Determine the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data;

[0122] Based on the relationships between the target object and the first target network data, the target object and the second target network data, and the first target network data and the second target network data, the nodes corresponding to the target object are connected to the nodes corresponding to the first target network data, the nodes corresponding to the target object are connected to the nodes corresponding to the second target network data, and the nodes corresponding to the first target network data are connected to the nodes corresponding to the second target network data to obtain a relationship graph.

[0123] In another possible implementation, determining the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data includes:

[0124] In response to the fact that the first target network data or the second target network data belongs to the target object, the relationship between the target object and the first target network data or the relationship between the target object and the second target network data is determined to mean that the first target network data or the second target network data belongs to the target object;

[0125] In response to the fact that the first target network data belongs to the second target network data, the relationship between the first target network data and the second target network data is determined as a match;

[0126] In response to the access of the first target network data to the second target network data, the relationship between the first target network data and the second target network data is determined as access;

[0127] If the similarity between the first target network data and the second target network data is greater than a first preset threshold, the relationship between the first target network data and the second target network data is determined to be similar.

[0128] In response to the generation of the first target network data, the relationship between the first target network data and the second target network data is determined as the generation process.

[0129] In another possible implementation, the method also includes:

[0130] In response to the increase in the distribution breadth of existing nodes not being less than the second preset threshold or the distribution breadth of newly added nodes not being less than the third preset threshold, an alarm message is generated. The alarm message includes path information of the relationship path, attribute information of existing nodes, attribute information of newly added nodes, and attribute information of the relationship between nodes.

[0131] Based on the alarm information, the target program is launched to detect and eliminate the target object.

[0132] In response to the fact that the increase in the distribution breadth of existing nodes is less than the second preset threshold and the distribution breadth of newly added nodes is less than the third preset threshold, a new relationship path is selected from the directed graph, and the steps of determining the existing nodes and newly added nodes in the relationship path based on the relationship path in the directed graph are executed.

[0133] In another possible implementation, the method also includes:

[0134] Based on the alarm information, generate monitoring results for the target object;

[0135] When a query request for a target object is received from the terminal, the monitoring results are sent to the terminal, which then displays the monitoring results on the query page.

[0136] The method for monitoring the changing trends of malicious code provided in this application involves: acquiring target network data with target relationships to the target object; generating a relationship graph based on the target object and the target network data; generating a directed graph with the target object as the starting point based on the relationship graph; determining existing and new nodes in the relationship paths based on the relationship paths in the directed graph; determining the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes in the relationship paths; and determining the current changing trend of the target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes. This method detects the changing trends of malicious code by monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants. By monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants, it can more accurately understand the propagation methods of malicious code, thereby improving the monitoring effectiveness and accurately monitoring the changing trends of malicious code.

[0137] This application provides a method for monitoring changes in malicious code; see [link to relevant documentation]. Figure 4 The method includes:

[0138] Step 401: The computer device acquires target network data that has a target relationship with the target object based on the target object to be monitored.

[0139] In this embodiment, the target object includes a first malicious code to be monitored and a second malicious code derived from a variant of the first malicious code; both the first and second malicious codes are computer viruses. The target relationship includes at least one of the following: belonging relationship, matching relationship, access relationship, similarity relationship, or generation relationship. For example, target network data belongs to the target object.

[0140] In one possible implementation, this step can be achieved by the following steps (1) to (5):

[0141] (1) The computer device acquires the target file associated with the target object.

[0142] The target file is a file on the terminal that may contain malicious code or a file containing malicious code. For example, the target file is a program file containing malicious code. The terminal can be a fixed terminal or a mobile terminal; in this embodiment, it is not specifically limited to either.

[0143] In one possible implementation, the computer device can obtain a file containing the malicious code identifier, or a file associated with the malicious code identifier, and use that file as the target file. Furthermore, the computer device can obtain the target file in real time or periodically; this is not specifically limited in this embodiment.

[0144] (2) The computer device acquires the static data, behavioral data and first relation data of the target file.

[0145] In this step, static data refers to the data obtained by the computer device based on the binary data of the target file; this static data is data that can be obtained without running the target file. Behavioral data is data obtained when the target file is run, and the first relational data is data that relates to the target file during runtime.

[0146] In one possible implementation, the computer device can obtain static data by analyzing the binary data of the target file; the computer device can monitor the target file during runtime to obtain behavioral data of the target file; and the computer device can monitor the target file during runtime to obtain first relation data related to the target file.

[0147] The static data includes the static analysis results of the target file, the matching results between the target file and the static rules, and the similarity results of the two target files before execution. The behavioral data includes the behavioral analysis results of the target file, the matching results between the target file and the behavioral rules, and the similarity results of the two target files during execution. The primary relational data includes various relational data during file execution. For example, file A accesses domain B, file A generates file C, and file D is downloaded from domain B.

[0148] (3) The computer device determines the relationship attribute between two static data and the relationship attribute between static data and static rules, and forms a second relationship data by combining two static data and the relationship attribute between two static data, and forms a second relationship data by combining static data, static rules and the relationship attribute between static data and static rules.

[0149] In one possible implementation, the computer device can determine the relationship attributes between two static data sets and the relationship attributes between static data and static rules through the following implementation:

[0150] In response to the fact that the first static data includes the second static data, the relationship attribute between the first static data and the second static data is determined to be inclusion;

[0151] In response to the fact that the similarity between the first static data and the second static data is greater than a first preset threshold, the relationship attribute between the first static data and the second static data is determined to be similar.

[0152] In response to the first static data conforming to the static rule, the relationship attribute between the first static data and the static rule is determined to be a match.

[0153] For example, if the first static data is file 1 and the second static data is domain 1, and file 1 includes domain 1, then the relationship between file 1 and domain 1 is inclusion. As another example, if the first static data is file 2 and the second static data is file 3, and the file data of file 2 and file 3 is similar with a similarity greater than 90%, then the relationship between file 2 and file 3 is similarity. Similarly, if the first static data is file 4 and the second static data is rule 1, and file 4 conforms to rule 1, then the relationship between file 4 and rule 1 is matching.

[0154] The first preset threshold can be set and changed as needed, and is not specifically limited in this embodiment. For example, the first preset threshold can be 90%, 95%, or 97%.

[0155] In one possible implementation, the computer device combines two static data sets and the relationship attributes between them into second relational data, and also combines static data, static rules, and the relationship attributes between static data and static rules into second relational data. This second relational data includes attributes of the static data, attributes of the static rules, attribute information of the relationship attributes between the two static data sets, and attribute information of the relationship attributes between the static data and static rules.

[0156] In one possible implementation, see Figure 5 Computer devices can use static data and static rules as nodes. The second relational data then includes two nodes, attribute information for each node, and attribute information about the relationship between the two nodes. Specifically, the node attribute information includes: distribution breadth, the earliest occurrence time of the node, and the latest occurrence time of the node; the attribute information about the relationship between the two nodes includes: reliability, the earliest occurrence time of the relationship between the two nodes, and the latest occurrence time of the relationship between the two nodes.

[0157] Among them, the distribution breadth of nodes is used to determine the scope of harm caused by malicious code, the earliest appearance time of a node is used to determine whether the node is an existing node or a newly added node, and the credibility is used to measure the credibility of the changes in malicious code.

[0158] In one possible implementation, the confidence level can be determined based on the matching result between static data and static rules, the similarity between static data, or the access relationship between static data. For example, when there is an access relationship between two static data, the confidence level is 100%.

[0159] (4) The computer device determines the relationship attribute between two behavioral data and the relationship attribute between behavioral data and behavioral rules, and forms a third relationship data by combining the relationship attribute between the two behavioral data and the relationship attribute between the two behavioral data, as well as forming a third relationship data by combining the behavioral data, behavioral rules and the relationship attribute between behavioral data and behavioral rules.

[0160] In one possible implementation, the computer device can determine the relationship attributes between two behavioral data and the relationship attributes between behavioral data and behavioral rules through the following implementation:

[0161] In response to the fact that the first row of data includes the second row of data, the relationship attribute between the first row of data and the second row of data is determined to be inclusive.

[0162] In response to the fact that the similarity between the first row data and the second row data is greater than a first preset threshold, the relationship attribute between the first row data and the second row data is determined to be similar.

[0163] In response to the first action data conforming to the action rule, the relationship attribute between the first action data and the action rule is determined to be a match.

[0164] It should be noted that the way the computer device determines the relationship attributes between two behavioral data and the relationship attributes between behavioral data and behavioral rules is similar to the way the computer device determines the relationship attributes between two static data and the relationship attributes between static data and static rules in step (3), and will not be repeated here.

[0165] In one possible implementation, the computer device can also use behavioral data and behavioral rules as nodes, then the third relationship data includes two nodes, attribute information of each node, and attribute information of the relationship between the two nodes.

[0166] (5) The computer equipment combines the first relation data, the second relation data and the third relation data into target network data.

[0167] In this step, the computer device directly combines the first relation data, the second relation data, and the third relation data into target network data.

[0168] It should be noted that since the first relational data itself includes the data, the attribute information of the data, and the attribute information of the relationship between the data, there is no need to generate relational data again; it can be used directly. For example, if file 5 accesses domain 2, then the relationship attribute between the two is "access." The first relational data includes file 5, domain 2, the attribute information of file 5, the attribute information of domain 2, and the attribute information of the relationship between file 5 and domain 2.

[0169] Another point to note is that the computer device stores a list of virus families. Before this step, the computer device can retrieve target objects from this list and then obtain target network data based on those target objects. Furthermore, the computer device can monitor each target object, i.e., virus family, in the list according to the method provided in this application embodiment.

[0170] Step 402: The computer device generates a relationship graph based on the target object and the target network data.

[0171] This relationship graph includes nodes corresponding to the target object, nodes corresponding to the target network data, and the relationships between nodes.

[0172] In one possible implementation, this step can be achieved by the following steps (1) to (3):

[0173] (1) The computer device uses the target object, the first target network data and the second target network data as nodes respectively.

[0174] The first target network data and the second target network data can be either target network data within the target network data set. For example, the first target network data and the second target network data can be files, domain names, behavioral rules, or static rules.

[0175] The computer device abstracts the target object, the first target network data, and the second target network data into nodes, respectively.

[0176] (2) The computer equipment determines the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data.

[0177] In response to the fact that the first target network data or the second target network data belongs to the target object, the computer device determines the relationship between the target object and the first target network data or the relationship between the target object and the second target network data as the first target network data or the second target network data belonging to the target object;

[0178] In response to the fact that the first target network data belongs to the second target network data, the computer device determines that the relationship between the first target network data and the second target network data is a match;

[0179] In response to the access of the first target network data to the second target network data, the computer device determines the relationship between the first target network data and the second target network data as an access;

[0180] In response to the fact that the similarity between the first target network data and the second target network data is greater than a first preset threshold, the computer device determines that the relationship between the first target network data and the second target network data is similar.

[0181] In response to the generation of second target network data from first target network data, the computer device determines the relationship between the first target network data and the second target network data as generation.

[0182] For example, if the target is a virus family S, and the first target network data is a behavior rule M, which is a behavior rule formulated by relevant personnel for virus family S, then the relationship between behavior rule M and virus family S is that behavior rule M belongs to virus family S. As another example, if the first target network data is file H, and the second target network data is behavior rule M, and the behavior data of file H conforms to behavior rule M, then the relationship between file H and behavior rule M is that file H matches behavior rule M.

[0183] In one possible implementation, the relationship between the first target network data or the second target network data and the target object, as well as the relationship between the first target network data and the second target network data, can be further refined. This is not specifically limited in the embodiments of this application. For example, if the first target network data is file H, and the second target network data is behavior rule M, and the behavior data of file H conforms to behavior rule M, then the relationship between file H and behavior rule M is precise behavior rule matching. As another example, if the first target network data is file K, and the second target network data is static rule L, and the static data of file K conforms to static rule L, then the relationship between file K and static rule L is precise static rule matching.

[0184] (3) The computer device connects the nodes corresponding to the target object with the nodes corresponding to the first target network data, the nodes corresponding to the target object with the nodes corresponding to the second target network data, and the nodes corresponding to the first target network data with the nodes corresponding to the second target network data, based on the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data, to obtain a relationship graph.

[0185] In this step, the computer device connects two related nodes based on the relationships between the nodes to obtain a relationship graph.

[0186] See Figure 6 , Figure 6 This is a schematic diagram of a relationship graph provided in an embodiment of this application. From Figure 6 This shows the relationship between any two nodes, for example, from Figure 6 This shows that behavior rule M belongs to virus family S, and file H matches the behavior rule, therefore file H may belong to virus family S. The specific confidence level can be determined based on the confidence level of the relationship between behavior rule M and virus family S, and the confidence level of the relationship between file H and behavior rule M. Additionally, Figure 6 In this context, X represents the node corresponding to other target network data.

[0187] Step 403: The computer device generates a directed graph with the target object as the starting point based on the relationship graph.

[0188] This directed graph includes relational paths, and each relational path contains nodes. These relational paths also include the relationships between the nodes.

[0189] The number of relational paths is one or more, and the number of nodes in the relational path is at least two.

[0190] In this step, the computer device takes the node corresponding to the target object as the starting point, determines the connection direction between each pair of nodes according to the relationship between each pair of nodes in the relationship graph, and finally obtains the directed graph.

[0191] It should be noted that if the computer device cannot generate a directed graph from the relationship graph, it can retrieve the target object from the virus family list and then execute steps 401-403. The inability to generate a directed graph from the relationship graph indicates that the relationship graph does not contain target network data related to the target object, or that a system problem prevents the generation of the directed graph. When the inability to generate a directed graph is due to a system problem, relevant personnel can repair the system.

[0192] Step 404: The computer device obtains the earliest occurrence time of the node in the current relationship path, as well as the last monitoring time of the target object.

[0193] In one possible implementation, the directed graph includes one or more relational paths. When the directed graph includes multiple relational paths, the computer device can enumerate a relational path from the directed graph and then determine the earliest occurrence time of each node in that relational path. The computer device can obtain the earliest occurrence time of a node from its attribute information.

[0194] In one possible implementation, the computer device can obtain the last monitoring time of the target object based on the monitoring records of the target object.

[0195] It should be noted that the computer device can monitor the changing trends of the target object periodically or irregularly. When the computer device monitors the changing trends of the target object periodically, the period can be 1 day, 2 days, or 1 week. In the embodiments of this application, no specific limitation is made.

[0196] Step 405: The computer device determines the existing and new nodes in the relationship path based on the earliest occurrence time of the current node and the last monitoring time of the target object.

[0197] In this step, if the earliest appearance time of the current node is later than the last monitoring time of the target object, the computer device determines that the node is a newly added node; if the earliest appearance time of the current node is not later than the last monitoring time of the target object, the computer device determines that the node is an existing node.

[0198] For example, if the earliest time a target object was monitored on the computer was "2019-11-28 00:00:00", if the earliest time this node appeared is later than "2019-11-28 00:00:00", it means that the node is a newly added node; if the earliest time this node appeared is not later than "2019-11-28 00:00:00", it means that the node is an existing node.

[0199] Step 406: The computer device determines the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes in the relational path.

[0200] In this step, the computer device can obtain the distribution breadth of the newly added node from the node distribution breadth database.

[0201] In one possible implementation, the computer device determines the increase in the distribution breadth of existing nodes in the relational path through the following steps (1) to (3):

[0202] (1) The computer device obtains the first distribution breadth of the currently existing nodes from the database.

[0203] In this step, the computer device can obtain the first distribution breadth of existing nodes from the database based on the node's identifier and the current monitoring time of the target object.

[0204] (2) The computer equipment retrieves the second distribution breadth of existing nodes from the database based on the last monitoring time of the target object.

[0205] In this step, the computer device can retrieve the second distribution breadth of existing nodes from the database based on the node's identifier and the last monitoring time of the target object.

[0206] (3) The computer device uses the difference between the first distribution breadth and the second distribution breadth as the increase in the distribution breadth of the existing nodes.

[0207] The computer equipment uses the difference between the two as the increment of the distribution breadth of existing nodes during the current monitoring period of the target object.

[0208] It should be noted that before this step, the computer device can collect user data periodically or irregularly, and use the user data related to the target object in the collected user data as nodes, and store the number of users as the distribution breadth of the node in the node distribution breadth database. In this way, the computer device can directly obtain the distribution breadth of each node from the database later.

[0209] Step 407: The computer device determines the changing trend of the current target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes.

[0210] In one possible implementation, in response to the increase in the distribution breadth of existing nodes being no less than a second preset threshold or the distribution breadth of newly added nodes being no less than a third preset threshold, the computer device determines that the current target object's change trend is increasing. In response to the increase in the distribution breadth of existing nodes being less than the second preset threshold and the distribution breadth of newly added nodes being less than the third preset threshold, the computer device determines that the current target object's change trend is under control.

[0211] In one possible implementation, in response to an increasing trend in the current state of the target object, the computer device can generate an alarm message, and take corresponding measures against the target object based on this alarm message. Accordingly, this implementation is as follows:

[0212] In response to the increase in the distribution breadth of existing nodes not being less than a second preset threshold or the distribution breadth of newly added nodes not being less than a third preset threshold, the computer device generates alarm information. The alarm information includes path information of the relationship path, attribute information of existing nodes, attribute information of newly added nodes, and attribute information of the relationship between nodes. Based on the alarm information, the computer device starts the target program and performs a detection and removal of the target object through the target program.

[0213] In one possible implementation, the computer device stores a configuration table containing code identifiers for target objects and corresponding alarm thresholds, namely a second preset threshold and a third preset threshold. The computer device can retrieve the second and third preset thresholds for alarm information corresponding to the code identifier from the configuration table based on the target object's code identifier, determine the relationship between the increase in the distribution breadth of existing nodes and the second threshold, and the relationship between the distribution breadth of newly added nodes and the third threshold, thereby determining whether to generate an alarm.

[0214] It's important to note that the second and third preset thresholds differ for different target groups. This is because malicious code varies. For example, APT malware, which is mostly targeted, has lower second and third preset thresholds (e.g., a second preset threshold of 1). For other types of malware, the second and third preset thresholds are higher, meaning that appropriate measures are only taken after the infection level reaches a certain point.

[0215] In one possible implementation, relevant personnel can query the monitoring results of the target object through a terminal. Accordingly, this implementation is as follows:

[0216] The computer equipment can also generate monitoring results for the target object based on alarm information; when it receives a query request for the target object from the terminal, it sends the monitoring results to the terminal, which then displays the monitoring results on the query page.

[0217] In this implementation, after the computer device generates monitoring results, it can store these results in a database. These results include changes in the current path relationships. The terminal receives a query request for the target object from relevant personnel on a query page and sends the query request to the computer device. When the computer device receives the query request from the terminal, it can retrieve the monitoring results from the database and send them back to the terminal. The terminal receives the monitoring results from the computer device and displays them on the query page. This allows relevant personnel to promptly understand changes in the target object based on the monitoring results, enhancing the ability to monitor changes in malicious code and improving the detection and removal capabilities of security software.

[0218] In one possible implementation, in response to the current target object's change being in a controllable state, the computer device may not take any action against the target object, but instead select a new relation path from the directed graph and then execute steps 404-407. Accordingly, this implementation is as follows:

[0219] In response to the fact that the increase in the distribution breadth of existing nodes is less than the second preset threshold and the distribution breadth of newly added nodes is less than the third preset threshold, the computer device reselects the relation path from the directed graph and executes the step of determining the existing nodes and newly added nodes in the relation path according to the relation path in the directed graph, that is, executing steps 404-407.

[0220] It should be noted that in this embodiment of the application, the computer device determines the existing nodes and newly added nodes of each relation path in the directed graph by repeatedly executing steps 404-407, and determines the changing trend of the target object based on the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes in each relation path.

[0221] In one possible implementation, after completing the monitoring of one target object, the computer device can retrieve the next target object from the virus family list and then execute steps 401-407. That is, the computer device monitors the target objects in the virus family list sequentially. See [link to relevant documentation]. Figure 7 , Figure 7 This is a schematic diagram illustrating how computer equipment sequentially monitors target objects. From... Figure 7 As can be seen, the computer device first enumerates a target object from the virus family list. If the enumeration fails, it means that the target object to be monitored does not exist in the virus family list, and the operation ends. If the enumeration is successful, a directed graph is generated based on the relationship graph of the target object. When a directed graph cannot be generated, the next target object to be monitored is obtained from the virus family list. When a directed graph is successfully generated, relationship paths are enumerated and selected from the directed graph. When there are no unselected relationship paths in the directed graph, the next target object to be monitored is obtained from the virus family list. When there are unselected relationship paths in the directed graph, the existing nodes and new nodes in the relationship path are determined; the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes are determined. When the increase in the distribution breadth of existing nodes is not less than a second preset threshold or the distribution breadth of new nodes is not less than a third preset threshold, an alarm message and the monitoring results of the target object are generated. When the increase in the distribution breadth of existing nodes is less than the second preset threshold and the distribution breadth of newly added nodes is less than the third preset threshold, a new relationship path is selected from the directed graph. The existing nodes and newly added nodes in the newly selected relationship path are determined, and the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes are determined.

[0222] In another possible implementation, the computer device can also obtain multiple target objects from the virus family list and simultaneously execute steps 401-407 on multiple target objects, that is, the computer device monitors the target objects in the virus family list at the same time. This is not specifically limited in the embodiments of this application.

[0223] The method for monitoring the changing trends of malicious code provided in this application involves: acquiring target network data with target relationships to the target object; generating a relationship graph based on the target object and the target network data; generating a directed graph with the target object as the starting point based on the relationship graph; determining existing and new nodes in the relationship paths based on the relationship paths in the directed graph; determining the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes in the relationship paths; and determining the current changing trend of the target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of new nodes. This method detects the changing trends of malicious code by monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants. By monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants, it can more accurately understand the propagation methods of malicious code, thereby improving the monitoring effectiveness and accurately monitoring the changing trends of malicious code.

[0224] This application provides an apparatus for monitoring changes in malicious code, see [link to relevant documentation]. Figure 8 The device includes:

[0225] The first acquisition module 801 is used to acquire target network data that has a target relationship with the target object based on the target object to be monitored. The target object includes the first malicious code to be monitored and the second malicious code obtained from the variant of the first malicious code.

[0226] The first generation module 802 is used to generate a relationship graph based on the target object and the target network data. The relationship graph includes the nodes corresponding to the target object, the nodes corresponding to the target network data, and the relationships between the nodes.

[0227] The second generation module 803 is used to generate a directed graph with the target object as the starting point based on the relationship graph. The directed graph includes relationship paths, and the relationship paths include nodes.

[0228] The first determining module 804 is used to determine the existing nodes and newly added nodes in the relational path based on the relational path in the directed graph;

[0229] The second determining module 805 is used to determine the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes in the relationship path.

[0230] The third determination module 806 is used to determine the changing trend of the current target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes.

[0231] In one possible implementation, the first determining module 804 is further configured to obtain the earliest occurrence time of a node in the current relationship path; obtain the last monitoring time of the target object; and determine the existing nodes and newly added nodes in the relationship path based on the earliest occurrence time of the current node and the last monitoring time of the target object.

[0232] In another possible implementation, the second determining module 805 is further configured to obtain the distribution breadth of the newly added node from the node distribution breadth database; obtain the first distribution breadth of the existing node from the database; obtain the second distribution breadth of the existing node from the database based on the last monitoring time of the target object; and use the difference between the first distribution breadth and the second distribution breadth as the increment of the distribution breadth of the existing node.

[0233] In another possible implementation, the first acquisition module 801 is further configured to acquire a target file associated with the target object; acquire static data, behavioral data, and first relational data of the target file, wherein the static data is data obtained from the binary data of the target file, the behavioral data is data obtained when the target file is run, and the first relational data is data that has a relationship with the target file when the target file is run; determine the relational attributes between two static data sets and the relational attributes between static data sets and static rules, and form a second relational data set by combining the two static data sets and the relational attributes between the two static data sets, and form a second relational data set by combining the static data sets, static rules, and the relational attributes between static data sets and static rules; determine the relational attributes between two behavioral data sets and the relational attributes between behavioral data sets and behavioral rules, and form a third relational data set by combining the two behavioral data sets and the relational attributes between the two behavioral data sets, and form a third relational data set by combining the behavioral data sets, behavioral rules, and the relational attributes between behavioral data sets and behavioral rules; and form target network data by combining the first relational data set, the second relational data set, and the third relational data set.

[0234] In another possible implementation, the first acquisition module 801 is further configured to, in response to the first static data including the second static data, determine the relationship attribute between the first static data and the second static data as inclusion; in response to the similarity between the first static data and the second static data being greater than a first preset threshold, determine the relationship attribute between the first static data and the second static data as similar; and in response to the first static data conforming to static rules, determine the relationship attribute between the first static data and the static rules as matching.

[0235] In another possible implementation, the first generation module 802 is further configured to use the target object, the first target network data, and the second target network data as nodes, where the first target network data and the second target network data are any one of the target network data; determine the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data; and based on the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data, connect the nodes corresponding to the target object with the nodes corresponding to the first target network data, the nodes corresponding to the target object with the nodes corresponding to the second target network data, and the nodes corresponding to the first target network data with the nodes corresponding to the second target network data to obtain a relationship graph.

[0236] In another possible implementation, the first generation module 802 is further configured to, in response to the first target network data or the second target network data belonging to the target object, determine the relationship between the target object and the first target network data or the relationship between the target object and the second target network data as the first target network data or the second target network data belonging to the target object; in response to the first target network data belonging to the second target network data, determine the relationship between the first target network data and the second target network data as a match; in response to the first target network data accessing the second target network data, determine the relationship between the first target network data and the second target network data as an access; in response to the similarity between the first target network data and the second target network data being greater than a first preset threshold, determine the relationship between the first target network data and the second target network data as similar; and in response to the first target network data generating the second target network data, determine the relationship between the first target network data and the second target network data as a generation.

[0237] In another possible implementation, the device also includes:

[0238] The third generation module is used to generate alarm information in response to the increase in the distribution breadth of existing nodes not being less than the second preset threshold or the distribution breadth of newly added nodes not being less than the third preset threshold. The alarm information includes path information of the relationship path, attribute information of existing nodes, attribute information of newly added nodes, and attribute information of the relationship between nodes.

[0239] The detection and removal module is used to launch the target program based on alarm information and then use the target program to detect and remove the target object.

[0240] The first determining module 804 is further configured to respond to the fact that the increase in the distribution breadth of existing nodes is less than a second preset threshold and the distribution breadth of newly added nodes is less than a third preset threshold, reselect a relation path from the directed graph, and determine the existing nodes and newly added nodes in the relation path based on the relation path in the directed graph.

[0241] In another possible implementation, the device also includes:

[0242] The fourth generation module is used to generate monitoring results for the target object based on the alarm information;

[0243] The sending module is used to send monitoring results to the terminal when it receives a query request for the target object. The terminal then displays the monitoring results on the query page.

[0244] The apparatus for monitoring the changing trends of malicious code provided in this application embodiment acquires target network data that has a target relationship with the target object, based on the target object to be monitored; generates a relationship graph based on the target object and the target network data; generates a directed graph with the target object as the starting point based on the relationship graph; determines existing nodes and newly added nodes in the relationship paths based on the relationship paths; determines the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes in the relationship paths; and determines the changing trend of the current target object based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes. This apparatus detects the changing trends of malicious code based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes. By monitoring the changes in the distribution breadth of nodes in the relationship paths associated with malicious code and its variants, it can more accurately understand the propagation methods of malicious code, thereby improving the monitoring effectiveness and accurately monitoring the changing trends of malicious code.

[0245] Figure 9 This is a structural block diagram of a computer device 900 provided in an embodiment of this application. The computer device 900 can vary significantly due to differences in configuration or performance, and may include one or more central processing units (CPUs) 901 and one or more memories 902. The memories 902 store at least one line of program code, which is loaded and executed by the processor 901 to implement the methods provided in the various method embodiments described above. Of course, the computer device 900 may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input and output. The computer device 900 may also include other components for implementing device functions, which will not be elaborated upon here.

[0246] This application also provides a computer-readable storage medium applied to a computer device, wherein the computer-readable storage medium stores at least one piece of program code, which is loaded and executed by a processor to implement the methods provided in the above-described method embodiments.

[0247] The above description is only for the purpose of enabling those skilled in the art to understand the technical solution of this application, and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for monitoring changes in malicious code, characterized in that, The method includes: Based on the target object to be monitored, acquire target network data that has a target relationship with the target object, wherein the target object includes a first malicious code to be monitored and a second malicious code obtained from a variant of the first malicious code; Based on the target object and the target network data, a relationship graph is generated, which includes the node corresponding to the target object, the node corresponding to the target network data, and the relationship between the nodes. Based on the relationship graph, a directed graph is generated with the target object as the starting point. The directed graph includes relationship paths, and the relationship paths include the nodes. Based on the relational paths in the directed graph, determine the existing nodes and newly added nodes in the relational paths; Determine the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes in the relationship path; Based on the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes, the current changing trend of the target object is determined; The step of acquiring target network data that has a target relationship with the target object includes: Obtain the target file associated with the target object; The static data, behavioral data, and first relational data of the target file are obtained. The static data is data obtained from the binary data of the target file, the behavioral data is data obtained when the target file is running, and the first relational data is data that has a relationship with the target file when the target file is running. Determine the relationship attributes between two static data and the relationship attributes between the static data and the static rule; combine the two static data and the relationship attributes between the two static data to form second relationship data; and combine the static data, the static rule, and the relationship attributes between the static data and the static rule to form the second relationship data. Determine the relationship attributes between two behavioral data and the relationship attributes between the behavioral data and the behavioral rules; combine the two behavioral data and the relationship attributes between the two behavioral data into a third relationship data; and combine the behavioral data, the behavioral rules, and the relationship attributes between the behavioral data and the behavioral rules into the third relationship data. The first relation data, the second relation data, and the third relation data are combined to form the target network data.

2. The method according to claim 1, characterized in that, The step of determining the existing and newly added nodes in the relational path based on the relational path in the directed graph includes: Obtain the earliest occurrence time of a node in the current relationship path; Get the last monitoring time of the target object; Based on the earliest occurrence time of the current node and the last monitoring time of the target object, the existing nodes and newly added nodes in the relationship path are determined.

3. The method according to claim 1, characterized in that, Determining the increase in the distribution breadth of existing nodes and the distribution breadth of newly added nodes in the relationship path includes: Retrieve the distribution breadth of the newly added node from the node distribution breadth database; Obtain the first distribution breadth of the existing nodes from the database; Based on the last monitoring time of the target object, obtain the second distribution breadth of the existing nodes from the database; The difference between the first distribution breadth and the second distribution breadth is used as the increment of the distribution breadth of the existing nodes.

4. The method according to claim 1, characterized in that, The determination of the relationship attributes between two static data points and the relationship attributes between the static data and static rules includes: In response to the fact that the first static data includes the second static data, the relationship attribute between the first static data and the second static data is determined to be inclusion; In response to the fact that the similarity between the first static data and the second static data is greater than a first preset threshold, the relationship attribute between the first static data and the second static data is determined to be similar. In response to the first static data conforming to the static rule, the relationship attribute between the first static data and the static rule is determined to be a match.

5. The method according to claim 1, characterized in that, The step of generating a relationship graph based on the target object and the target network data includes: The target object, the first target network data, and the second target network data are respectively regarded as nodes, and the first target network data and the second target network data are any one of the target network data in the target network data; Determine the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data; Based on the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data, the nodes corresponding to the target object and the nodes corresponding to the first target network data, the nodes corresponding to the target object and the nodes corresponding to the second target network data, and the nodes corresponding to the first target network data and the nodes corresponding to the second target network data are connected to obtain the relationship graph.

6. The method according to claim 5, characterized in that, Determining the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data includes: In response to the first target network data or the second target network data belonging to the target object, the relationship between the target object and the first target network data or the relationship between the target object and the second target network data is determined to be that the first target network data or the second target network data belongs to the target object; In response to the fact that the first target network data belongs to the second target network data, the relationship between the first target network data and the second target network data is determined to be a match; In response to the first target network data accessing the second target network data, the relationship between the first target network data and the second target network data is determined as an access; In response to the fact that the similarity between the first target network data and the second target network data is greater than a first preset threshold, the relationship between the first target network data and the second target network data is determined to be similar; In response to the generation of the second target network data based on the first target network data, the relationship between the first target network data and the second target network data is determined as generation.

7. The method according to claim 1, characterized in that, The method further includes: In response to the increase in the distribution breadth of the existing nodes being no less than a second preset threshold or the distribution breadth of the newly added nodes being no less than a third preset threshold, an alarm message is generated. The alarm message includes the path information of the relationship path, the attribute information of the existing nodes, the attribute information of the newly added nodes, and the attribute information of the relationship between nodes. Based on the alarm information, the target program is launched, and the target object is detected and eliminated through the target program; In response to the fact that the increase in the distribution breadth of the existing nodes is less than the second preset threshold and the distribution breadth of the newly added nodes is less than the third preset threshold, a new relationship path is selected from the directed graph, and the step of determining the existing nodes and newly added nodes in the relationship path based on the relationship path in the directed graph is executed.

8. A device for monitoring changes in malicious code, characterized in that, The device includes: The first acquisition module is used to acquire target network data that has a target relationship with the target object to be monitored, the target object including a first malicious code to be monitored and a second malicious code obtained from a variant of the first malicious code; The first generation module is used to generate a relationship graph based on the target object and the target network data. The relationship graph includes the nodes corresponding to the target object, the nodes corresponding to the target network data, and the relationships between the nodes. The second generation module is used to generate a directed graph with the target object as the starting point based on the relationship graph. The directed graph includes relationship paths, and the relationship paths include the nodes. The first determining module is used to determine the existing nodes and newly added nodes in the relationship path based on the relationship path in the directed graph; The second determining module is used to determine the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes in the relationship path; The third determining module is used to determine the current changing trend of the target object based on the increase in the distribution breadth of the existing nodes and the distribution breadth of the newly added nodes. The first acquisition module is configured to: acquire a target file associated with the target object; acquire static data, behavioral data, and first relationship data of the target file, wherein the static data is data obtained from the binary data of the target file, the behavioral data is data obtained when the target file is running, and the first relationship data is data that has a relationship with the target file when the target file is running; determine the relationship attribute between two static data sets and the relationship attribute between the static data sets and static rules, and form a second relationship data set by combining the two static data sets and the relationship attribute between the two static data sets; determine the relationship attribute between two behavioral data sets and the relationship attribute between the behavioral data sets and behavioral rules, and form a third relationship data set by combining the behavioral data sets, behavioral rules, and the relationship attribute between the behavioral data sets and behavioral rules; and form the target network data by combining the first relationship data set, the second relationship data set, and the third relationship data set.

9. The apparatus according to claim 8, characterized in that, The first determining module is used for: Obtain the earliest occurrence time of a node in the current relationship path; Get the last monitoring time of the target object; Based on the earliest occurrence time of the current node and the last monitoring time of the target object, the existing nodes and newly added nodes in the relationship path are determined.

10. The apparatus according to claim 8, characterized in that, The second determining module is used for: Retrieve the distribution breadth of the newly added node from the node distribution breadth database; Obtain the first distribution breadth of the existing nodes from the database; Based on the last monitoring time of the target object, obtain the second distribution breadth of the existing nodes from the database; The difference between the first distribution breadth and the second distribution breadth is used as the increment of the distribution breadth of the existing nodes.

11. The apparatus according to claim 8, characterized in that, The first acquisition module is used for: In response to the fact that the first static data includes the second static data, the relationship attribute between the first static data and the second static data is determined to be inclusion; In response to the fact that the similarity between the first static data and the second static data is greater than a first preset threshold, the relationship attribute between the first static data and the second static data is determined to be similar. In response to the first static data conforming to the static rule, the relationship attribute between the first static data and the static rule is determined to be a match.

12. The apparatus according to claim 8, characterized in that, The first generation module is used for: The target object, the first target network data, and the second target network data are respectively regarded as nodes, and the first target network data and the second target network data are any one of the target network data in the target network data; Determine the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data; Based on the relationship between the target object and the first target network data, the relationship between the target object and the second target network data, and the relationship between the first target network data and the second target network data, the nodes corresponding to the target object and the nodes corresponding to the first target network data, the nodes corresponding to the target object and the nodes corresponding to the second target network data, and the nodes corresponding to the first target network data and the nodes corresponding to the second target network data are connected to obtain the relationship graph.

13. The apparatus according to claim 12, characterized in that, The first generation module is used for: In response to the first target network data or the second target network data belonging to the target object, the relationship between the target object and the first target network data or the relationship between the target object and the second target network data is determined to be that the first target network data or the second target network data belongs to the target object; In response to the fact that the first target network data belongs to the second target network data, the relationship between the first target network data and the second target network data is determined to be a match; In response to the first target network data accessing the second target network data, the relationship between the first target network data and the second target network data is determined as an access; In response to the fact that the similarity between the first target network data and the second target network data is greater than a first preset threshold, the relationship between the first target network data and the second target network data is determined to be similar; In response to the generation of the second target network data based on the first target network data, the relationship between the first target network data and the second target network data is determined as generation.

14. The apparatus according to claim 8, characterized in that, The device further includes: The third generation module is used to generate alarm information in response to the increase in the distribution breadth of the existing nodes not being less than a second preset threshold or the distribution breadth of the newly added nodes not being less than a third preset threshold. The alarm information includes path information of the relationship path, attribute information of the existing nodes, attribute information of the newly added nodes, and attribute information of the relationship between nodes. The detection and removal module is used to launch the target program based on the alarm information, and to detect and remove the target object through the target program; The first determining module is configured to, in response to the increase in the distribution breadth of the existing nodes being less than the second preset threshold and the distribution breadth of the newly added nodes being less than the third preset threshold, reselect a relation path from the directed graph and execute the step of determining the existing nodes and newly added nodes in the relation path based on the relation path in the directed graph.

15. A computer device, characterized in that, The computer device includes: A processor and a memory, wherein the memory stores at least one line of program code, which is loaded and executed by the processor to implement the method for monitoring changes in malicious code as described in any one of claims 1 to 7.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one piece of program code, which is loaded and executed by a processor to implement the method for monitoring changes in malicious code as described in any one of claims 1 to 7.

Images