A method, device and storage medium for detecting malicious files

Abstract

The present application discloses a method for detecting malicious files, including: a detection device runs a test file in a virtual operating environment to obtain operating data of the test file, the operating data including incremental memory data or parameter data, the incremental memory data being data stored in the memory space requested by the test file during operation, the parameter data including data corresponding to each parameter in a first call parameter set, the first call parameter set including parameters used when the test file calls a target function once or multiple times during operation; static detection is performed on at least one reconstructed file generated based on the operating data, and whether the test file is a malicious file is determined based on the results of the static detection. The technical solution of the present application generates a reconstructed file based on the operating data of the test file in the virtual operating environment, and determines whether the test file is a malicious file based on the static detection results of the reconstructed file, thereby effectively solving the problem of poor detection effect on malicious files after obfuscation.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device and storage medium for detecting malicious files. Background Art

[0002] A malicious file is a file containing a program written by a programmer with attack intent. These files are often executable files, such as viruses, worms, or Trojan horses that perform malicious tasks on computer systems. Malicious files exploit vulnerabilities in computer systems to perform malicious tasks, such as stealing confidential information or destroying stored data. Static detection technology is a common technique for detecting malicious files. It analyzes programs without running the computer program. Static detection uses a signature library to match test files. For example, it analyzes the test file's source code, assembly, syntax, structure, procedures, or interfaces to determine whether the test file contains signatures from the signature library. Based on the signature matching results, the test file is then confirmed as malicious. As the battle between malicious files and security software continues, a large number of detection evasion techniques (also known as obfuscation techniques) have emerged, such as packing, encryption, and junk instructions. Malicious files use these evasion techniques to hide or modify code data, thereby avoiding detection by security devices using these static detection techniques.

[0003] Existing static detection technologies are not effective in detecting malicious files that have been processed by detection evasion techniques. In particular, existing static detection technologies are not effective in detecting malicious files that have been processed by encryption or packing techniques. Summary of the Invention

[0004] The embodiments of the present application provide a method for detecting malicious files, which can solve the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0005] In order to achieve the above objectives, this application provides the following technical solutions:

[0006] In a first aspect, the present application provides a method for detecting malicious files. A detection device runs a test file in a virtual runtime environment to obtain operational data for the test file. The virtual runtime environment is a sandbox, and the detection device is a computer device running the virtual runtime environment. The virtual runtime environment is isolated from the detection device's actual runtime environment. The detection device allows browsers or other programs to run within the virtual runtime environment, and changes resulting from running the browsers or other programs can be subsequently deleted. Programs running within the virtual runtime environment do not permanently impact the detection device's hard drive. The test file is a file to be tested for maliciousness. After obtaining the test file, the detection device enters the test file into the virtual runtime environment for execution. The operational data includes at least one of incremental memory data and parameter data. The incremental memory data is data stored in a first memory space, which represents the memory requested by the test file during execution. During execution, the test file may initiate one or more memory requests to the detection device, thereby implementing various dynamic behaviors, such as system service requests, file reads and writes, registry modifications, API calls, or network access. The detection device intercepts the call parameters of each memory request function call made by the test file to determine the address information of each memory request made by the test file. The sum of the memory requested each time constitutes the first memory space, and the data stored in the first memory space constitutes the incremental memory data. The parameter data includes the data corresponding to each parameter in the first call parameter set, which includes the parameters used by the test file when calling the target function one or more times during execution. The testing device obtains the parameters used by the test file each time the target function is called, thereby obtaining one or more parameters used by the test file when calling the target function one or more times during execution. The first call parameter set includes these one or more parameters. The testing device obtains the data corresponding to each parameter in the first call parameter set, thereby obtaining the parameter data. The data corresponding to each parameter in the first call parameter set may be a type of data or an address pointed to by a parameter, such as a string or some small data structure. The target function belongs to a predetermined function set. The predetermined function set includes one or more target functions. The target function is any target function in the predetermined function set. After obtaining the execution data, the testing device generates at least one reconstruction file based on the execution data. If the data types included in the acquired execution data vary, the at least one reconstruction file generated based on the execution data will also vary. For example, when the operating data includes incremental memory data or parameter data, the at least one reconstruction file is a file generated based on the incremental memory data or parameter data. For example, if the operating data only includes incremental memory data or parameter data, the at least one reconstruction file is the incremental memory data or parameter data.If the running data includes other data in addition to incremental memory data or parameter data, the number of the at least one reconstruction file may be 1, and the reconstruction file is generated based on the incremental memory data or parameter data and the other data; or the number of the at least one reconstruction file is 2, one of the reconstruction files is incremental memory data or parameter data, and the other reconstruction file is a file generated based on the incremental memory data or parameter data and the other data. When the running data includes other data in addition to incremental memory data and parameter data, the number of the at least one reconstruction file may be 1, 2 or 3. Any combination of incremental memory data, parameter data and other data can be used as a reconstruction file for subsequent static detection. After generating the at least one reconstruction file, the detection device performs static detection on the at least one reconstruction file. When the static detection result of any one of the at least one reconstruction file shows that it is a malicious file, the test file is determined to be a malicious file.

[0007] From the first aspect above, it can be seen that by obtaining the running data of the test file in the virtual running environment, the running data includes the incremental memory data in the memory requested during the running process of the test file and at least one of the parameter data corresponding to each first call parameter adopted by the test file to call the target function once or multiple times during the running process, and then determining at least one reconstruction file that can describe the behavioral information of the test file during the execution process based on the running data, and finally judging whether the test file is a malicious file based on the static detection result of the at least one reconstructed file, thereby effectively solving the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0008] Optionally, in conjunction with the first aspect above, in a first possible implementation of the first aspect, the incremental memory data includes first data and second data. The first data is data stored in the second memory space, which is memory requested and released by the test file during execution. The second data is data stored in the third memory space, which is memory requested by the test file during execution and not released after execution. When the execution data includes incremental memory data, a specific method for obtaining the test file's execution data is as follows: the detection device first obtains a second call parameter set and a third call parameter set. During execution, the test file will call the memory request function at least twice to request memory, each time the test file calls the memory request function using a parameter. The detection device obtains the parameters used in each call of the memory request function during execution and records the memory address of the memory space pointed to by the parameter pointer of each parameter, thereby obtaining a second call parameter set. That is, the second call parameter set includes the parameters used by the test file when calling the memory request function multiple times during execution. The parameters in the second call parameter set indicate the memory address of the first memory space. During execution, the test file releases memory by calling the memory release function one or more times. The detection device obtains the parameters used by the test file each time it calls the memory release function during operation to obtain a third call parameter set. The third call parameter set includes the parameters used when the test file calls the memory release function once or multiple times during operation. Each time the test file calls the memory release function, it uses a parameter in the third call parameter set. The parameters in the third call parameter set are used to indicate the memory address of the second memory space. After obtaining the second call parameter set, the detection device obtains the first data from the memory address of the second memory space. The third memory space is the memory that the test file applies for but does not release during operation. When the test file finishes running in the virtual operating environment, the detection device determines the memory address of the third memory space based on the pre-recorded memory address of the first memory space and the memory address of the second memory space, and then obtains the second data from the memory address of the third memory space.

[0009] From the first possible implementation method of the first aspect above, it can be seen that by obtaining the second calling parameter set of the memory application function called by the test file during the running process and the third calling parameter set of the memory release function called by the test file, the data stored in the memory applied for by the test file during the running process can be accurately extracted, thereby improving the accuracy of the test file feature restoration of the subsequently generated reconstructed file and ensuring the detection effect of the test file.

[0010] Optionally, in combination with the above-mentioned first aspect or the first possible implementation of the first aspect, in the second possible implementation of the first aspect, when the running data includes parameter data, obtaining the running data of the test file includes: obtaining the parameters used when the test file calls the target function one or more times, thereby obtaining a first call parameter set; obtaining parameter data from the memory address pointed to by the pointer of each parameter in the first call parameter set. The detection device obtains the parameters used each time the test file calls the target function, thereby obtaining one or more parameters when the test file calls the target function one or more times during the running process, and the first call parameter set contains the one or more parameters. The detection device obtains the data corresponding to each parameter in the first call parameter set, thereby obtaining parameter data.

[0011] From the first and second possible implementation methods above, it can be seen that by obtaining the first call parameter set of the target function called by the test file during the running process, the parameter data of the target function called by the test file during the running process can be accurately extracted, thereby improving the accuracy of the test file feature restoration of the subsequently generated reconstructed file, and ensuring the detection effect of the test file.

[0012] Optionally, in combination with the first aspect and any one of the first to second possible implementations of the first aspect, in the third possible implementation of the first aspect, the parameter data is data that satisfies a preset condition in the memory address pointed to by the pointer of the parameter in the first call parameter set, and the preset condition includes at least one of the following: the data type of the parameter data is a string type, the data length of the parameter data is greater than or equal to the preset length, and the parameter data appears for the first time during the running of the test file (i.e., there should be no repeated data in the parameter data). For example, when the preset condition includes the condition that "the data type of the parameter data is a string type", when the detection device obtains the parameter data, it will filter out the data with a data type of a string type from the data corresponding to each first call parameter as the parameter data. For example, when the preset condition includes the two conditions that "the data type of the parameter data is a string type" and "the parameter data appears for the first time during the running of the test file", when the detection device obtains the parameter data, it will filter the data corresponding to each parameter in the first call parameter set. When the data type of the parameter data is a string type, it also needs to meet the condition that it is the parameter data that appears for the first time during the running of the test file before it can be filtered as the parameter data.

[0013] From the third possible implementation of the first aspect above, it can be seen that by setting screening conditions for parameter data, the detection performance of the detection equipment can be improved.

[0014] Optionally, in combination with the first aspect and any one of the first to third possible implementations of the first aspect, in the fourth possible implementation of the first aspect, the operation data also includes image memory data, and the image memory data is the data stored in the fourth memory space after the test file is completed. The fourth memory space is the memory space allocated by the operating system for the initial image data, and the initial image data is the data loaded from the hard disk into the memory during the initialization phase of the virtual operating environment running the test file. Specifically, when the detection device inputs the test file into the virtual operating space for execution, the operating system of the detection device will first allocate a specific memory space for the test file to load the initial image data of the initialization phase of the virtual operating environment running the test file. During the process of the test file running in the virtual operating space, the data stored in the specific memory space may change. The image memory data in the embodiment of the present application is the data stored in the specific memory space after the test file is completed. After the test file is completed, the detection device will obtain the image memory data from the specific memory space.

[0015] Optionally, in combination with the fourth possible implementation of the first aspect described above, in the fifth possible implementation of the first aspect, when the operating data includes incremental memory data and image memory data, the at least one reconstructed file includes a first reconstructed file. The specific method by which the detection device generates the at least one reconstructed file based on the operating data is to generate the first reconstructed file based on the incremental memory data and the image memory data. For example, the incremental memory data and the image memory data are saved as the first reconstructed file. Correspondingly, the detection device performs static testing on the at least one reconstructed file and determines whether the test file is a malicious file based on the results of the static testing, including: performing static testing on the first reconstructed file and determining whether the test file is a malicious file based on the results of the static testing of the first reconstructed file.

[0016] Optionally, in combination with the fourth possible implementation of the first aspect described above, in the sixth possible implementation of the first aspect, when the operating data includes incremental memory data, parameter data, and image memory data, the at least one reconstructed file includes a second reconstructed file, and the specific method in which the detection device generates the at least one reconstructed file based on the operating data is to generate the second reconstructed file based on the incremental memory data, parameter data, and image memory data. Correspondingly, the specific method in which the detection device performs static testing on the at least one reconstructed file and determines whether the test file is a malicious file based on the results of the static testing is to perform static testing on the second reconstructed file and determine whether the test file is a malicious file based on the results of the static testing on the second reconstructed file.

[0017] From the sixth possible implementation method of the first aspect above, it can be seen that in addition to being able to save the incremental memory data and the image memory data as a reconstructed file for detecting whether the test file is a malicious file, a reconstructed file can also be generated based on the incremental memory data, parameter data and image memory data to detect whether the test file is a malicious file, thereby ensuring the diversity of the detection scheme.

[0018] Optionally, in combination with the sixth possible implementation of the first aspect described above, in the seventh possible implementation of the first aspect, at least one reconstructed file includes not only the second reconstructed file but also a third reconstructed file. The specific method in which the detection device generates the at least one reconstructed file based on the operational data further includes: generating the third reconstructed file based on the incremental memory data and the image memory data. Correspondingly, the detection device performs static testing on the at least one reconstructed file, and determines whether the test file is a malicious file based on the results of the static testing. This includes: the detection device performs static testing on the second and third reconstructed files, respectively, and when either the second and third reconstructed files is detected as a malicious file, determining that the test file is a malicious file.

[0019] From the seventh possible implementation method of the first aspect above, it can be seen that the incremental memory data and the image memory data can be saved as a reconstruction file, and another reconstruction file can be generated based on the incremental memory data, parameter data and image memory data. Then, the two reconstruction files are statically detected separately. When any reconstructed file is detected as a malicious file, the test file is a malicious file, which not only ensures the detection effect of the test file, but also increases the diversity of the detection scheme.

[0020] Optionally, in combination with the sixth or seventh possible implementation of the first aspect, in the eighth possible implementation of the first aspect, the specific method by which the detection device generates the second reconstruction file based on the incremental memory data, the parameter data, and the image memory data is as follows: first, a reconstruction file is generated based on the image memory data; then, the target memory data and the parameter data are sequentially written to the end of the reconstruction file to obtain the second reconstruction file, wherein the target memory data is determined based on the incremental memory data. In an optional embodiment, the target memory data is the incremental memory data.

[0021] Optionally, in combination with the eighth possible implementation of the first aspect above, in the ninth possible implementation of the first aspect, before the detection device writes the target memory data and the parameter data into the tail of the reconstructed file in sequence, it will first determine the target memory data based on the incremental memory data. The number of memory data contained in the target memory data is a first value, the first value is less than or equal to the number of memory data contained in the incremental memory data, and the data size of the target memory data is a second value, the second value is less than or equal to the data size of the incremental memory data. For example, the detection device limits the number and total size of the additional memory data according to the performance of the device, and makes some adjustments and modifications to the incremental memory data according to the limit to obtain the target memory data that meets the memory quantity and total size. For example, if the number of memory data contained in the incremental memory data is Q, the number of memory data contained in the target memory data can be set to P, where P is a value greater than 0 and less than or equal to Q. For example, if the data size of the incremental memory data is X, the data size of the target memory data can be set to Y, where Y is a value greater than 0 and less than or equal to X.

[0022] From the ninth possible implementation of the first aspect above, it can be seen that by limiting the number and total size of incremental memory data, the detection performance of the detection equipment can be improved.

[0023] Optionally, in combination with the eighth or ninth possible implementation of the first aspect above, in the tenth possible implementation of the first aspect, the detection device generates a reconstructed file based on the image memory data, including: determining the file header of the reconstructed file based on the file header of the image memory data; copying the file section table in the image memory data to the end of the file header of the reconstructed file to obtain the file section table of the reconstructed file; determining the section data of the reconstructed file based on the section data in the image memory data, the section data of the reconstructed file being located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; performing target processing on the file section table of the reconstructed file or the file header of the reconstructed file based on the position information of each section data in the section data of the reconstructed file to obtain the reconstructed file, the target processing including one or more of the following: offset correction and data correction.

[0024] Optionally, in combination with the tenth possible implementation of the first aspect, in an eleventh possible implementation of the first aspect, the file header of the reconstructed file is the same as the file header of the image memory data. Specifically, the detection device directly copies the file header of the image memory data from the image memory data to the header of the reconstructed file.

[0025] Optionally, in combination with the tenth or eleventh possible implementation of the first aspect, in a twelfth possible implementation of the first aspect, the file header of the reconstructed file uses a pre-constructed preset file header, rather than generating the file header of the reconstructed file based on the image memory data. The preset file header is a universal file header. The specific method for the detection device to generate a reconstructed file based on the image memory data includes: determining that the file header of the reconstructed file is a preset file header; copying the file section table in the image memory data to the end of the preset file header to obtain the file section table of the reconstructed file; determining the section data of the reconstructed file based on the section data in the image memory data, and the section data of the reconstructed file is located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes the section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes the valid data in the section data corresponding to each section table. In order to avoid the reconstructed file from containing too much invalid data, the detection device identifies the valid data of the section data during the process of copying the section data, and deletes the invalid data at the end of the section data based on the file alignment data in the file header; and performing target processing on the file section table of the reconstructed file or the file header of the reconstructed file based on the position information of each section data in the section data of the reconstructed file to obtain the reconstructed file, and the target processing includes one or more of the following: offset correction and data correction. Optionally, in the above steps, the invalid data identification method adopts the following manner: the tail data of the section data exceeds the file alignment data length continuous single-byte or multi-byte (for example: 2 to 8) repeated data, that is, invalid data.

[0026] A second aspect of the present application provides a malicious file detection device, comprising: an acquisition module, configured to run a test file in a virtual operating environment to obtain operating data of the test file, the operating data including at least one of incremental memory data and parameter data, the incremental memory data being data stored in a first memory space, the first memory space being memory requested by the test file during operation, the parameter data including data corresponding to each parameter in a first call parameter set, the first call parameter set including parameters used when the test file calls a target function once or multiple times during operation, the target function belonging to a predetermined function set; a generation module, configured to generate at least one reconstructed file based on the operating data acquired by the acquisition module; a static detection module, configured to perform static detection on the at least one reconstructed file generated by the generation module, and determine whether the test file is a malicious file based on the result of the static detection.

[0027] Optionally, in combination with the above-mentioned second aspect, in a first possible implementation method of the second aspect, the incremental memory data includes first data and second data, the first data is data stored in the second memory space, the second memory space is the memory applied for and released by the test file during the running process, and the second data is data stored in the third memory space, the third memory space is the memory applied for by the test file during the running process and not released after the running ends. When the running data includes the incremental memory data, the acquisition module is used to obtain the second call parameter set and the third call parameter set, wherein the second call parameter set includes the parameters used when the test file calls the memory application function multiple times during the running process, and the test file calls the memory application function each time The test file uses a parameter in a second call parameter set when calling the memory release function, and the parameters in the second call parameter set are used to indicate the memory address of the first memory space. The third call parameter set includes parameters used when the test file calls the memory release function once or multiple times during the running process. The test file uses a parameter in a third call parameter set each time it calls the memory release function, and the parameters in the third call parameter set are used to indicate the memory address of the second memory space; the first data is obtained from the memory address of the second memory space; after the test file ends running in the virtual running environment, the memory address of the third memory space is determined according to the memory address of the first memory space and the memory address of the second memory space, and the second data is obtained from the memory address of the third memory space.

[0028] Optionally, in combination with the above-mentioned second aspect or the first possible implementation of the second aspect, in the second possible implementation of the first aspect, when the running data includes parameter data, an acquisition module is used to obtain the parameters used when the test file calls the target function once or multiple times, thereby obtaining a first calling parameter set; and obtain the parameter data from the memory address pointed to by the pointer of each parameter in the first calling parameter set.

[0029] Optionally, in combination with the above-mentioned second aspect and any one of the first to second possible implementation methods of the second aspect, in the third possible implementation method of the second aspect, the parameter data is data that meets preset conditions in the memory address pointed to by the pointer of the parameter in the first calling parameter set, and the preset conditions include at least one of the following: the data type of the parameter data is a string type, the data length of the parameter data is greater than or equal to the preset length, and the parameter data appears for the first time during the execution of the test file.

[0030] Optionally, in combination with the above-mentioned second aspect and any one of the first to third possible implementation methods of the second aspect, in the fourth possible implementation method of the second aspect, the running data also includes image memory data, and the image memory data is the data stored in the fourth memory space after the test file is run. The fourth memory space is the memory space allocated by the operating system for the initial image data, and the initial image data is the data loaded from the hard disk into the memory during the initialization stage of running the test file in the virtual running environment.

[0031] Optionally, in combination with the fourth possible implementation of the second aspect above, in the fifth possible implementation of the second aspect, when the running data includes incremental memory data and image memory data, at least one reconstruction file includes a first reconstruction file, and a generation module is used to generate the first reconstruction file based on the incremental memory data and the image memory data; correspondingly, a static detection module is used to perform static detection on the first reconstruction file generated by the generation module, and determine whether the test file is a malicious file based on the results of the static detection.

[0032] Optionally, in combination with the fourth possible implementation method of the second aspect above, in the sixth possible implementation method of the second aspect, when the running data includes incremental memory data, parameter data and image memory data, at least one reconstruction file includes a second reconstruction file, and a generation module is used to generate the second reconstruction file based on the incremental memory data, parameter data and image memory data; correspondingly, a static detection module is used to perform static detection on the second reconstruction file generated by the generation module, and determine whether the test file is a malicious file based on the results of the static detection.

[0033] Optionally, in combination with the sixth possible implementation of the second aspect above, in the seventh possible implementation of the second aspect, at least one reconstruction file also includes a third reconstruction file, and the generation module is further used to generate the third reconstruction file based on the incremental memory data and the image memory data; correspondingly, the static detection module is used to perform static detection on the second reconstruction file and the third reconstruction file generated by the generation module, respectively, and when any one of the second reconstruction file and the third reconstruction file is detected as a malicious file, the test file is determined to be a malicious file.

[0034] Optionally, in combination with the sixth or seventh possible implementation of the second aspect above, in the eighth possible implementation of the second aspect, the generation module is used to generate a reconstruction file based on the image memory data; and write the target memory data and the parameter data into the end of the reconstruction file in sequence to obtain the second reconstruction file, wherein the target memory data is determined based on the incremental memory data.

[0035] Optionally, in combination with the eighth possible implementation method of the second aspect above, in the ninth possible implementation method of the second aspect, the generation module is further used to determine the target memory data based on the incremental memory data, wherein the number of memory data contained in the target memory data is a first value, and the first value is less than or equal to the number of memory data contained in the incremental memory data, and the data size of the target memory data is a second value, and the second value is less than or equal to the data size of the incremental memory data.

[0036] Optionally, in combination with the eighth or ninth possible implementation of the second aspect above, in the tenth possible implementation of the second aspect, a generation module is provided for determining the file header of the reconstructed file based on the file header of the image memory data; copying the file section table in the image memory data to the tail of the file header of the reconstructed file to obtain the file section table of the reconstructed file; determining the section data of the reconstructed file based on the section data in the image memory data, the section data of the reconstructed file being located at the tail of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; performing target processing on the file section table of the reconstructed file or the file header of the reconstructed file based on the position information of each section data in the section data of the reconstructed file to obtain the reconstructed file, the target processing including one or more of the following: offset correction and data correction.

[0037] Optionally, in combination with the tenth possible implementation manner of the second aspect above, in an eleventh possible implementation manner of the second aspect, the file header of the reconstructed file is the same as the file header of the image memory data.

[0038] Optionally, in combination with the tenth or eleventh possible implementation of the second aspect above, in the twelfth possible implementation of the second aspect, a module is generated to determine that the file header of the reconstructed file is a preset file header; the file section table in the image memory data is copied to the end of the preset file header to obtain the file section table of the reconstructed file; the section data of the reconstructed file is determined based on the section data in the image memory data, and the section data of the reconstructed file is located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; according to the position information of each section data in the section data of the reconstructed file, the file section table of the reconstructed file or the file header of the reconstructed file is subjected to target processing to obtain the reconstructed file, and the target processing includes one or more of the following: offset correction and data correction.

[0039] A third aspect of the present application provides a computer device comprising a processor and a memory. The memory is configured to store computer-readable instructions (or computer programs), and the processor is configured to read the computer-readable instructions to implement the method of the first aspect or any possible implementation of the first aspect.

[0040] In some implementations, the computer device further includes a transceiver for receiving and transmitting data.

[0041] In a fourth aspect, the present application provides a computer storage medium, which may be non-volatile, storing computer-readable instructions that, when executed by a processor, implement the method of the first aspect or any possible implementation of the first aspect.

[0042] An embodiment of the present application adopts a method for detecting malicious files, by obtaining running data of a test file in a virtual running environment, where the running data includes incremental memory data in the memory requested during the running process of the test file and at least one of parameter data corresponding to each first call parameter adopted by the test file to call a target function once or multiple times during the running process, and then determining at least one reconstructed file that can describe the behavioral information of the test file during the execution process based on the running data, and finally judging whether the test file is a malicious file based on the static detection result of the at least one reconstructed file, thereby effectively solving the problem that traditional static detection methods cannot effectively detect packed and encrypted files. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a schematic diagram of an application scenario of the malicious file detection method provided in an embodiment of the present application;

[0044] Figure 2 is a schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0045] Figure 3 This is a schematic diagram of an embodiment of a method for detecting malicious files provided in an embodiment of the present application;

[0046] Figure 4 This is a schematic diagram of another embodiment of the method for detecting malicious files provided in an embodiment of the present application;

[0047] Figure 5 This is a schematic diagram of another embodiment of the method for detecting malicious files provided in an embodiment of the present application;

[0048] Figure 6 1 is a schematic diagram of an embodiment of a method for generating a second reconstruction file provided in an embodiment of the present application;

[0049] FIG7( a ) is a schematic diagram showing the organizational relationship of various parts of the second reconstructed file generated based on incremental memory data, parameter data, and image memory data according to an embodiment of the present application;

[0050] FIG7( b ) is a schematic diagram of the data organization relationship of various parts of data in generating a reconstructed file based on image memory data according to an embodiment of the present application;

[0051] FIG7( c ) is a schematic diagram of another data organization relationship for generating various parts of data of a reconstructed file based on image memory data provided by an embodiment of the present application;

[0052] Figure 8 This is a schematic diagram of another embodiment of the method for detecting malicious files provided in an embodiment of the present application;

[0053] Figure 9 Schematic diagram of a malicious file detection method according to an embodiment of the present invention;

[0054] Figure 10 Schematic diagram of the structure of the malicious file detection device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0055] The following describes the embodiments of the present application in conjunction with the accompanying drawings. As new application scenarios emerge, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0056] The terms "first," "second," and the like in the specification and claims of this application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. The naming or numbering of steps in this application does not imply that the steps in the method flow must be executed in the chronological or logical order indicated by the naming or numbering. Named or numbered process steps may be executed in a different order based on the technical objectives to be achieved, as long as the same or similar technical effects are achieved. Figure 1 A schematic diagram of an application scenario of a method for detecting malicious files is provided for an embodiment of the present application.

[0057] like Figure 1As shown, the application scenarios involved in the embodiment of the present application include a network device 101, a user device 102, the Internet 103 and a virtual operating environment 1011. Optionally, the user device 102 is a user device located in an internal network such as an enterprise's local area network; the network device 101 is a firewall, a security gateway device, or a router with security functions, etc. located between the internal network and the Internet. The network device 101 is used to securely protect the communication data between the user device 102 and the Internet 103. Optionally, in the embodiment of the present application, the virtual operating environment 1011 refers to a sandbox. Optionally, the virtual operating environment 1011 is implemented by a professional software product, or it can be implemented by a virtual machine.

[0058] Optionally, the virtual operating environment 1011 runs inside the network device 101. The network device 101 executes the malicious file detection method described in the subsequent embodiments of the present application by running the test file in the virtual operating environment 1011.

[0059] Optionally, the device for executing the malicious file detection method described in the subsequent embodiments of this application includes but is not limited to: Figure 1 The network device 101 and the user device 102 in the embodiment.

[0060] Optionally, the application scenario involved in the embodiments of the present application also includes a detection device 104. In this case, the virtual operating environment 1011 is located on the detection device 104, rather than running on the network device 101. The detection device 104 is independent of the network device 101 and is connected to the network device 101. Optionally, the detection device 104 is a sandbox device, or other type of computer device with integrated sandbox functionality. The embodiments of the present application do not specifically limit the type of the detection device 104.

[0061] In this embodiment of the present application, the virtual operating environment 1011 is isolated from the actual operating environment of the host computer running the virtual operating environment 1011. The host computer allows the operation of a browser or other program within the virtual operating environment, and changes made by the operation of the browser or other program can be deleted later. Programs running within the virtual operating environment 1011 will not permanently affect the hard disk of the host computer running the virtual operating environment 1011.

[0062] From the perspective of hardware structure, the network device 101 or detection device 104 running the virtual operating environment 1011 may be implemented by the same physical device, or by multiple physical devices, or by a logical function module within a physical device. This embodiment of the present application does not specifically limit this. The network device 101 or detection device 104 running the virtual operating environment 1011 may be implemented by Figure 2 The computer device 20 of the structure shown is implemented.

[0063] The computer device 20 includes a network interface 201 , a processor 202 , a memory 203 and a bus system 204 .

[0064] Memory 203 is used to store programs. Specifically, the programs may include program code, which includes computer operating instructions. Memory 203 may be random access memory (RAM) or non-volatile memory, such as at least one disk storage device. The figure shows only one memory; however, multiple memories can be provided as needed. Optionally, memory 203 is a memory in processor 202.

[0065] The memory 203 stores the following elements, executable modules or data structures, or a subset or an extension thereof:

[0066] Operation instructions: include various operation instructions, used to implement various operations.

[0067] Operating system: includes various system programs used to implement various basic services or process hardware-based tasks.

[0068] Processor 202 controls the operation of network device 20. Optionally, processor 202 is a central processing unit (CPU). In specific applications, the various components of computer device 20 are coupled together via bus system 204. Bus system 204 includes not only a data bus but also a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are labeled as bus system 204 in the figure. For ease of illustration, Figure 2 The drawing is only schematic.

[0069] The malicious file detection method provided in the embodiments of the present application described below is applied to the processor 202 or implemented by the processor 202.

[0070] Processor 202 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be completed by hardware integrated logic circuits or software instructions in processor 202. The above-mentioned processor 202 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It may implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in conjunction with the embodiments of this application may be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or the like. The storage medium is located in the memory 203 , and the processor 202 reads the information in the memory 203 and executes the method steps executed by the detection device in the following text in combination with its hardware.

[0071] In some implementations, the memory 203 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 202. The processor 202 is used to execute the computer-executable instructions stored in the memory 203, thereby implementing the malicious file detection method provided in the embodiment of the present application.

[0072] Based on the above application scenarios and devices running a virtual operating environment, the malicious file detection method provided in the embodiment of the present application will be introduced below.

[0073] like Figure 3 , which is a schematic diagram of an embodiment of a method for detecting malicious files provided in an embodiment of the present application.

[0074] See Figure 3 An embodiment of the malicious file detection method provided in the embodiment of the present application includes the following steps 301 to 303.

[0075] 301. The detection device runs a test file in a virtual running environment to obtain running data of the test file, where the running data includes at least one of incremental memory data and parameter data. The incremental memory data is data stored in a first memory space, and the first memory space is memory requested by the test file during running. The parameter data includes data corresponding to each parameter in a first calling parameter set, and the first calling parameter set includes parameters used when the test file calls a target function once or multiple times during running, and the target function belongs to a predetermined function set.

[0076] The detection device in the embodiment of the present application is a computer device running a virtual operating environment, and the test file is a file to be detected to see if it is a malicious file. Figure 1 The virtual operating environment 1011 is integrated in Figure 1 When the network device 101 in the embodiment of the present application is on, the detection device is the network device 10. After the network device 101 obtains the communication data between the user device 102 and the Internet 103 from the network, it obtains the file transmitted in the communication data through the traffic restoration technology, that is, the test file, and then inputs the test file into the virtual operation environment for operation. Figure 1 When the virtual operating environment 1011 in the embodiment of the present application is located on the detection device 104, the detection device in the embodiment of the present application is the detection device 104. The network device 101 obtains the communication data between the user device 102 and the Internet 103 from the network, obtains the file transmitted in the communication data as a test file through traffic restoration technology, and then sends the test file to the detection device 104. The detection device 104 inputs the test file into the virtual operating environment for execution. Optionally, the network device 101 can also use the port mirroring function to send the communication data between the user device 102 and the Internet 103 to the detection device 104, and the detection device 104 performs traffic restoration to obtain the test file.

[0077] In an embodiment of the present application, after obtaining a test file to be tested, the detection device first inputs the test file into a virtual execution environment for execution, and then monitors the execution of the test file to obtain the test file's execution data. Optionally, during actual application, the detection device monitors the execution of the test file by enabling application programming interface (API) monitoring of the virtual execution environment to achieve monitoring of the test file's execution.

[0078] In an embodiment of the present application, the operating data acquired by the detection device includes at least one of incremental memory data and parameter data.

[0079] In the embodiments of the present application, incremental memory data refers to data stored in the first memory space. The first memory space is the memory requested by the test file during operation. Specifically, during operation, the test file may initiate one or more memory requests to the detection device, thereby implementing various dynamic behaviors, such as system service requests, file reads and writes, registry modifications, API calls, or network access. For example, during operation, the test file may invoke a memory request function one or more times to request memory from the detection device. Based on these one or more requests for memory, the test file implements a series of dynamic behaviors with respect to the detection device. The detection device intercepts the call parameters of each memory request function call by the test file to determine the address information of each memory request made by the test file. In the embodiments of the present application, the first memory space is the memory requested by the test file during operation, including the memory requested by each call to the memory request function. The data stored in the first memory space is the incremental memory data in the embodiments of the present application. During subsequent detection, the incremental memory data is used to determine whether the test file's operation contains malicious behavior, thereby serving as a basis for determining whether the test file is malicious.

[0080] Optionally, the incremental memory data in the embodiment of the present application includes two parts: first data and second data. The first data is the data stored in the second memory space, which is the memory requested and released by the test file during operation. The second data is the data stored in the third memory space, which is the memory requested by the test file during operation and not released after the operation ends. In the embodiment of the present application, the detection device obtains the incremental memory data by separately obtaining the first data and the second data.

[0081] Optionally, in an embodiment of the present application, the detection device obtains incremental memory data through the following steps (1) to (3).

[0082] (1) The detection device obtains a second call parameter set, which includes parameters used when the test file calls the memory allocation function multiple times during the running process.

[0083] In an embodiment of the present application, the test file will call the memory application function at least twice to apply for memory during the running process, and the test file uses a parameter each time it calls the memory application function. In an embodiment of the present application, the detection device obtains the parameters used by the test file each time it calls the memory application function during the running process, and records the memory address of the memory space pointed to by the parameter pointer of each parameter, thereby obtaining a second call parameter set. The second call parameter set contains multiple parameters, and the multiple parameters are the parameters used when the test file calls the memory application function multiple times. The sum of the multiple memory spaces pointed to by the pointers of the parameters in the second call parameter set obtained by the detection device is the first memory space in the embodiment of the present application.

[0084] For example: the test file calls the memory allocation function three times during the running process. The parameter used in the first call of the memory allocation function is parameter A, and the memory pointed to by the parameter pointer of parameter A is memory a. The parameter used in the second call of the memory allocation function is parameter B, and the memory pointed to by the parameter pointer of parameter B is memory b. The parameter used in the third call of the memory allocation function is parameter C, and the memory pointed to by the parameter pointer of parameter C is memory c. Then the first memory space includes memory a, memory b and memory c.

[0085] (2) The detection device obtains a third call parameter set, which includes parameters used when the test file calls the memory release function once or multiple times during the running process, and obtains data in the second memory space indicated by the parameters in the third call parameter set to obtain the first data.

[0086] In an embodiment of the present application, the test file will release memory by calling the memory release function once or multiple times during operation. In an embodiment of the present application, the detection device obtains the parameters adopted by the test file each time the memory release function is called during operation to obtain a third call parameter set. When the test file calls the memory release function once or multiple times during operation, the detection device obtains the parameters adopted by the memory release function each time in the one or more times. Among them, each call to the memory release function corresponds to obtaining a parameter, and finally a third call parameter set containing one or more parameters is obtained. The detection device records the memory address of the memory space pointed to by the pointer of each parameter contained in the third call parameter set, and obtains the data in the memory address of the memory space pointed to by the pointer of each parameter, thereby obtaining the first data. In an embodiment of the present application, the second memory space is the sum of the memory spaces pointed to by the pointer of each parameter in the third call parameter set.

[0087] For example, during the running process, the test file calls the memory application function three times to apply for memory a, memory b, and memory c. After using memory a and memory b, the test file calls the memory release function twice to release memory a and memory b respectively. Memory a and memory b are the second memory space in the embodiment of the present application. The parameter used by the test file when calling the memory release function for the first time is parameter M. The parameter pointer of parameter M points to memory a. When the detection device obtains parameter M, it will obtain the data in memory a before memory a is released. The function used by the test file when calling the memory release function for the second time is parameter N. The parameter pointer of parameter N points to memory b. When the detection device obtains parameter N, it will obtain the data in memory b before memory b is released. The data in memory a and the data in memory b are the first data.

[0088] (3) After the test file is finished running in the virtual running environment, the detection device determines the memory address of the third memory space according to the memory address of the first memory space and the memory address of the second memory space, and obtains the second data from the memory address of the third memory space.

[0089] In this embodiment of the present application, the third memory space is memory allocated but not released during the execution of the test file. When the test file completes execution in the virtual execution environment, the detection device determines the memory address of the third memory space based on the pre-recorded memory addresses of the first memory space and the second memory space, and then retrieves the second data from the third memory space.

[0090] For example, if the first memory space is memory a, memory b, and memory c, and the second memory space is memory a and memory b, then the third memory space is memory C. After the test file is run, the detection device obtains the address information of the memory c that was requested but not released based on the memory a, memory b, and memory c recorded when the memory was requested, as well as the memory a and memory b recorded when the memory was released, and then obtains the second data from memory c.

[0091] After obtaining the first data and the second data through the above method, the incremental memory data in the embodiment of the present application can be obtained.

[0092] In an embodiment of the present application, the parameter data includes data corresponding to each parameter in the first call parameter set. The first call parameter set includes the parameters used when the test file calls the target function once or multiple times during the operation process. Each time the test file calls the target function during the operation process, the detection device obtains a parameter used by the test file to call the target function. The target function belongs to a predetermined function set. The predetermined function set in the embodiment of the present application includes one or more target functions, and the one or more target functions can be pre-set. Specifically, since the test file will also call some functions during operation, various dynamic behaviors are realized. For example, the test file executes a series of behaviors such as requesting system services, reading and writing files, modifying the registry, calling APIs, and accessing the network by calling one or more functions. Therefore, by setting the predetermined function set containing one or more target functions, the detection device monitors the test file's calls to these target functions, and then obtains relevant data of the calls to the target functions, such as the parameter data in the embodiment of the present application, as a basis for judging whether the test file is a malicious file.

[0093] For example, an embodiment of the present application provides a predetermined function set, as shown in Table 1. The predetermined function set includes multiple target functions (for the sake of simplicity, only the function names are listed in Table 1). It should be noted that Table 1 is only an exemplary description and should not be understood as a limitation of the present application. Optionally, in actual application, the predetermined function set includes some or all of the functions in Table 1. Alternatively, the predetermined function set not only includes some or all of the functions in Table 1, but also includes other functions. Optionally, in some cases, the predetermined function set does not include any of the functions in Table 1. The embodiment of the present application does not specifically limit the type and number of target functions included in the predetermined function set.

[0094] Table 1 A set of predetermined functions

[0095]

[0096]

[0097]

[0098]

[0099]

[0100]

[0101] In the embodiment of the present application, the target function refers to any target function in a predetermined function set. In the embodiment of the present application, the detection device obtains the parameters used each time the test file calls the target function, thereby obtaining one or more parameters when the test file calls the target function once or multiple times during the running process, and the first call parameter set contains the one or more parameters. The detection device obtains the data corresponding to each parameter in the first call parameter set, thereby obtaining parameter data. Specifically, the data corresponding to each parameter in the first call parameter set may be a type of data type data, or it may be the address pointed to by the parameter indication, such as a character string, some small data structures, etc.

[0102] Optionally, in an embodiment of the present application, to balance the performance of the detection device, the detection device sets preconditions during the process of acquiring parameter data. Only data that meets the preconditions is determined to be parameter data. The preconditions may be one or more of the following conditions: the data type of the parameter data is a string type, the data length of the parameter data is greater than or equal to a precondition, and the parameter data first appears during the execution of the test file. It should be noted that the preconditions may also include other types of conditions, which are not specifically limited in the embodiment of the present application. For example, when the preconditions include the condition that "the data type of the parameter data is a string type," when acquiring parameter data, the detection device will filter out data with a string data type from the data corresponding to each first call parameter as parameter data. For example, when the preconditions include the conditions that "the data type of the parameter data is a string type" and "the parameter data first appears during the execution of the test file," when acquiring parameter data, the detection device will filter out data corresponding to each parameter in the first call parameter set. Only data that meets the conditions that the data type of the parameter data is a string type and that it first appears during the execution of the test file will be filtered out as parameter data.

[0103] Optionally, the operating data acquired by the detection device in the embodiment of the present application includes only one of incremental memory data and parameter data. Optionally, the operating data acquired by the detection device in the embodiment of the present application can include both incremental memory data and parameter data. Optionally, the operating data acquired by the detection device can include other data in addition to at least one of incremental memory data and parameter data, and this embodiment of the present application is not limited to this.

[0104] 302. The detection device generates at least one reconstruction file according to the operation data.

[0105] In the embodiment of the present application, after the test file is executed in the virtual execution environment, the detection device determines at least one reconstruction file based on the acquired operation data. When the data types included in the acquired operation data are different, the at least one reconstruction file generated based on the operation data is also different.

[0106] For example, when the operating data includes incremental memory data or parameter data, the at least one reconstruction file is a file generated based on the incremental memory data or parameter data. For example, if the operating data only includes incremental memory data or only includes parameter data, the at least one reconstruction file is the incremental memory data or parameter data. If the operating data includes other data in addition to the incremental memory data or parameter data, the number of the at least one reconstruction file can be 1, and the reconstruction file is generated based on the incremental memory data or parameter data and the other data; or the number of the at least one reconstruction file is 2, one of the reconstruction files is the incremental memory data or parameter data, and the other reconstruction file is a file generated based on the incremental memory data or parameter data and the other data.

[0107] Optionally, when the running data includes both incremental memory data and parameter data, the number of the at least one reconstruction file is 1, and the reconstruction file is a file generated based on the incremental memory data and parameter data, for example, a file formed by recombining the incremental memory data and parameter data. Optionally, when the running data includes both incremental memory data and parameter data, the number of the at least one reconstruction file is 2, one of which can be any one of the incremental memory data and parameter data, and the other reconstruction file is the other of the incremental memory data and parameter data. Optionally, when the running data includes both incremental memory data and parameter data, the number of the at least one reconstruction file is 2, one of which can be any one of the incremental memory data and parameter data, and the other reconstruction file is a file formed by recombining the incremental memory data and parameter data.

[0108] When the running data includes other data in addition to incremental memory data and parameter data, the number of at least one reconstruction file can be 1, 2, or 3. Any combination of incremental memory data, parameter data, and other data can be used as a reconstruction file for subsequent static testing.

[0109] 303. The detection device performs a static detection on the at least one reconstructed file, and determines whether the test file is a malicious file based on a result of the static detection.

[0110] In an embodiment of the present application, after determining at least one reconstructed file based on the operating data, the detection device performs a static detection on each of the at least one reconstructed file. If the static detection result of any of the at least one reconstructed file indicates that the file is malicious, the test file is determined to be a malicious file.

[0111] In the embodiment of the present application, the specific method for statically detecting files can be any one of the static detection technologies for malicious files in the prior art. The embodiment of the present application does not limit this and will not elaborate on it.

[0112] An embodiment of the present application adopts a method for detecting malicious files, by obtaining running data of a test file in a virtual running environment, where the running data includes incremental memory data in the memory requested during the running process of the test file and at least one of parameter data corresponding to each first call parameter adopted by the test file to call a target function once or multiple times during the running process, and then determining at least one reconstructed file that can describe the behavioral information of the test file during the execution process based on the running data, and finally judging whether the test file is a malicious file based on the static detection result of the at least one reconstructed file, thereby effectively solving the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0113] based on Figure 3 In the embodiment, when the running data obtained by the detection device includes incremental memory data and image memory data, another embodiment of the method for detecting malicious files provided by the embodiment of the present application is as follows: Figure 4 shown.

[0114] Figure 4 A schematic diagram of another embodiment of the method for detecting malicious files provided in an embodiment of the present application.

[0115] See Figure 4 Another embodiment of the malicious file detection method provided in the embodiment of the present application includes the following steps 401 to 403.

[0116] 401. A detection device runs a test file in a virtual running environment to obtain running data of the test file, where the running data includes incremental memory data and image memory data.

[0117] The detection device in the embodiment of the present application is a computer device running a virtual operating environment, and the test file is a file to be detected to see if it is a malicious file. Figure 3 The relevant contents in step 301 can be understood by referring to the embodiment of the present invention, which will not be repeated here.

[0118] In the embodiment of the present application, after obtaining the test file to be tested, the detection device first inputs the test file into the virtual running environment for execution, and then monitors the running process of the test file to obtain the running data of the test file.

[0119] In the embodiment of the present application, the running data of the test file obtained by the detection device includes incremental memory data and image memory data.

[0120] Among them, the incremental memory data can be found in Figure 3 The relevant contents in step 301 can be understood by referring to the embodiment of the present invention, which will not be repeated here.

[0121] When the detection device inputs the test file into the virtual operation space for operation, the operating system of the detection device will first allocate a specific memory space for the test file to load the initial image data of the initialization phase of the virtual operation environment running the test file. During the process of the test file running in the virtual operation space, the data stored in the specific memory space may change. The image memory data in the embodiment of the present application is the data stored in the specific memory space after the test file is completed. After the test file is completed, the detection device will obtain the image memory data from the specific memory space.

[0122] 402. The detection device generates a first reconstruction file according to the operation data.

[0123] In the embodiment of the present application, after obtaining the operating data of the test file, the detection device generates a first reconstruction file based on the operating data. Specifically, the detection device generates the first reconstruction file based on the incremental memory data and the image memory data. Alternatively, in actual application, after obtaining the incremental memory data and the image memory data, the detection device directly saves the incremental memory data and the image memory data into a single file. This single file is the first reconstruction file.

[0124] 403. The detection device performs a static detection on the first reconstructed file, and determines whether the test file is a malicious file based on the result of the static detection.

[0125] In an embodiment of the present application, after generating the first reconstructed file, the detection device performs a static detection on the first reconstructed file. When the static detection result of the first reconstructed file indicates that the first reconstructed file is a malicious file, the detection device can determine that the test file is a malicious file.

[0126] In the embodiments of the present application, the specific method of statically detecting files can be understood by referring to any one of the static detection technologies for malicious files in the prior art. The embodiments of the present application do not limit this and will not elaborate on it.

[0127] The present embodiment employs a method for detecting malicious files, detecting and acquiring the running data of a test file in a virtual running environment. This running data includes the incremental memory data in memory requested during the test file's execution and the image memory data of the test file after the test file's execution. Based on the running data, the detection device further determines a first reconstruction file that can describe the test file's behavior during execution. Finally, based on the static detection results of this first reconstruction file, the detection device determines whether the test file is malicious. This effectively addresses the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0128] based on Figure 3 In the embodiment, when the running data obtained by the detection device includes incremental memory data, parameter data and image memory data, another embodiment of the detection method of malicious files provided by the embodiment of the present application is as follows: Figure 5 shown.

[0129] Figure 5 A schematic diagram of another embodiment of the method for detecting malicious files provided in an embodiment of the present application.

[0130] See Figure 5 Another embodiment of the malicious file detection method provided in the embodiment of the present application includes the following steps 501 to 503.

[0131] 501. A detection device runs a test file in a virtual running environment to obtain running data of the test file, where the running data includes incremental memory data, parameter data, and image memory data.

[0132] In the embodiment of the present application, after obtaining a test file to be tested, the detection device first inputs the test file into a virtual execution environment for execution, and then monitors the execution of the test file to obtain the test file's execution data. In the embodiment of the present application, the test file's execution data obtained by the detection device includes incremental memory data, parameter data, and image memory data.

[0133] The embodiments of this application can be found in Figure 3 Step 301 and Figure 4 The relevant contents in step 401 in FIG. 4 can be understood for reference only and will not be repeated here.

[0134] 502. The detection device generates a second reconstruction file according to the operation data.

[0135] In an embodiment of the present application, after obtaining the running data of the test file, the detection device generates a second reconstructed file according to the incremental memory data, the parameter data and the image memory data.

[0136] Optionally, in the embodiment of the present application, the specific method for the detection device to generate the second reconstruction file according to the incremental memory data, parameter data and image memory data is as follows: Figure 6 The method shown. Figure 6 The embodiment of the present application also provides a schematic diagram of the data organization relationship of each part of the second reconstructed file generated based on the incremental memory data, parameter data, and image memory data, as shown in Figure 7(a). The embodiment of the present application also provides two different schematic diagrams of the data organization relationship of each part of the reconstructed file generated based on the image memory data, as shown in Figures 7(b) and 7(c).

[0137] Among them, Figure 7 (a) first shows the stack space, file memory image space and first memory space in the virtual operating environment. Among them, the parameter data is obtained from the stack space by the detection device during the operation of the test file in the virtual operating environment. The first memory space is the memory requested by the test file during the operation. For example, the test file calls the memory request function multiple times during the operation, and each call requests a memory block (or called a memory, as shown in memory 1 to memory MAX in Figure 7 (a), where MAX is a natural number greater than 1). Multiple calls correspond to multiple memory blocks, and the first memory space contains the multiple memory blocks. For details, please refer to Figure 3 The relevant contents of step 301 are understood and will not be repeated here. The detection device obtains incremental memory data from the first memory space during the operation of the test file in the virtual operation environment. The file memory image space is the memory space allocated by the operating system of the detection device for the initial image data. For details, please refer to Figure 4 After the test file is finished running in the virtual running environment, the detection device obtains the image memory data from the file memory image space.

[0138] Combined with Figure 7(a) and Figure 7(b), we will now Figure 6 The method shown in FIG. 1 is a detailed description of a specific method for a detection device to generate a second reconstruction file based on incremental memory data, parameter data, and image memory data. Figure 6 The method shown includes the following steps 5021-5025.

[0139] 5021. The detection device determines the file header of the reconstructed file.

[0140] In the embodiment of the present application, when the detection device generates the second reconstructed file based on the incremental memory data, parameter data and image memory data, it first needs to determine the file header of the reconstructed file. Optionally, the embodiment of the present application provides two ways to determine the file header of the reconstructed file.

[0141] Optionally, in the first implementation method for determining the file header of the reconstructed file, the file header of the reconstructed file can have the same file header as the image memory data of the test file. Specifically, the testing device copies the file header of the image memory data directly from the image memory data to the header of the reconstructed file. As shown in Figure 7(b), the testing device extracts the file header of the image memory data from the file memory image space and copies the file header of the image memory data directly to the header of the reconstructed file.

[0142] It should be noted that in the above-mentioned step 401, since the detection device usually reserves a relatively large amount of memory space when the test file is loaded into a specific memory space and saved as the initial image data, in the embodiment of the present application, when the detection device extracts the file header data from the image memory data, some invalid data may be included at the end of the file header. Therefore, during the extraction, only valid data is selected, and the length of the valid data is determined based on the information in the file header.

[0143] Optionally, in the second implementation method for determining the header of the reconstructed file, the header of the reconstructed file uses a pre-constructed preset file header. In other words, the preset file header is a universal file header. In the second implementation method for determining the header of the reconstructed file, the preset file header is directly used as the header of the reconstructed file, rather than generating the header of the reconstructed file based on the image memory data. As shown in Figure 7(c), the detection device directly uses the preset file header as the header of the reconstructed file.

[0144] In the specific implementation process, the embodiment of the present application does not limit the method used to determine the file header of the reconstructed file.

[0145] 5022. The detection device copies the file section table in the image memory data to the end of the file header of the reconstructed file to obtain the file section table of the reconstructed file.

[0146] In this embodiment of the present application, after determining the file header of the reconstructed file, the detection device copies the file section table in the image memory data from the specific memory space in its original file format to the end of the file header of the reconstructed file to obtain the file section table of the reconstructed file. As shown in Figures 7(b) and 7(c), the detection device extracts the file section table from the file memory image space and copies it to the end of the file header of the reconstructed file.

[0147] 5023. The detection device determines the section data of the reconstructed file based on the section data in the image memory data. The section data of the reconstructed file is located at the end of the file section table of the reconstructed file. The section data in the image memory data includes the section data corresponding to each section table in one or more section tables included in the file section table in the image memory data. The section data of the reconstructed file includes the valid data in the section data corresponding to each section table.

[0148] In this embodiment of the present application, after determining the file section table of the reconstructed file, the detection device then copies the section data corresponding to each section table to the end of the file section table of the reconstructed file based on the information of one or more section tables contained in the file section table. As shown in Figures 7(b) and 7(c), the detection device copies the section data in the file memory image space to the end of the file section table of the reconstructed file.

[0149] It should be noted that when the test file is loaded into a specific memory space and saved as the initial image data, the section data is the same as the file header, and the detection device usually reserves a larger memory space. Therefore, in the embodiment of the present application, in order to avoid too much invalid data in the reconstructed file, the detection device identifies the valid data of the section data during the copying of the section data, and deletes the invalid data at the end of the section data according to the file alignment data in the file header. Optionally, the length of the valid data of the section data is determined according to the information in the file header. Optionally, the method for identifying invalid data adopts the following method: the tail data of the section data exceeds the continuous single-byte or multi-byte (for example: 2 to 8) repeated data of the file alignment data length, which is invalid data.

[0150] 5024. The detection device performs target processing on the file section table or the file header of the reconstructed file according to the position information of each section data in the section data of the reconstructed file to obtain the reconstructed file. The target processing includes one or more of the following: offset correction and data correction.

[0151] In an embodiment of the present application, after generating the section data of the reconstructed file, the detection device performs target processing on the file section table or the file header of the reconstructed file based on the location information of each section data in the reconstructed file to obtain the reconstructed file. The target processing includes one or more of the following: offset correction and data correction.

[0152] For example, the file section table stores the file offset and data size. For data sections within the image memory data, which contain uninitialized data and are initialized when loaded into memory, the file size of this data section is always 0, but the memory size is not. Therefore, when extracting the data from this data section and copying it into the reconstructed file, the data size information in the file section table must be updated to reflect the actual data size extracted to account for the memory size of the data section. The file offsets of subsequent data sections must also be adjusted accordingly to ensure they correctly point to the data location. Because data offsets may change during file reconstruction, the corresponding file memory image size, entry point offsets, and data directory table offsets may also change. If these changes are not corrected, file format parsing errors can occur, impacting file detection. The file memory image size is corrected to the sum of the file header length and the lengths of all data sections. All file offsets are corrected by subtracting the original offset from the reconstructed file section start address. The file image size in the file header is corrected by replacing the original size with the actual size of the reconstructed file.

[0153] 5025. The detection device appends the target memory data and the parameter data to the end of the reconstruction file in sequence.

[0154] In this embodiment of the present application, after the detection device performs target processing on the file section table or header of the reconstructed file to obtain the reconstructed file, it first appends the target memory data to the end of the reconstructed file to obtain an appended file, and then appends the parameter data to the end of the appended file to obtain a second reconstructed file. As shown in Figure 7(a), after the reconstructed file is generated through steps 5021-5024, the detection device appends the data from the multiple memory blocks obtained from the first memory space to the end of the reconstructed file to obtain an appended file, and then appends the parameter data obtained from the stack space to the end of the appended file in sequence, thereby obtaining the second reconstructed file.

[0155] Optionally, in an embodiment of the present application, the target memory data is the incremental memory data obtained in step 501.

[0156] Optionally, in an embodiment of the present application, the target memory data is data obtained based on the incremental memory data. For example, the detection device limits the number of memory blocks attached to the end of the reconstructed file and the total size of the incremental memory data based on the performance of the device, and makes some adjustments and modifications to the incremental memory data based on the limit to obtain the target memory data that meets the number of memory blocks and the total size. For example, the test file calls the memory request function Q times in total during the running process, corresponding to the application of Q memory blocks, and the incremental memory data contains data obtained from the Q memory blocks, then the target memory data is set to contain data corresponding to P memory blocks out of the Q memory blocks, where P is a value greater than 0 and less than or equal to Q. For example, if the data size of the incremental memory data is X, then the data size of the target memory data can be set to Y, where Y is a value greater than 0 and less than or equal to X.

[0157] Optionally, in some application scenarios, the detection device further limits the number and size of the parameter data attached to the end of the additional file, which is not limited in this application. For example, the number of data contained in the parameter data obtained by the detection device when the test file is running is M, and the number of data contained in the parameter data actually attached to the end of the additional file can be set to N, where N is a value greater than 0 and less than or equal to M. For example, the data size of the parameter data obtained by the detection device when the test file is running is L, and the data size of the parameter data actually attached to the end of the additional file can be set to K, where K is a value greater than 0 and less than or equal to L.

[0158] It should be noted that the specific method in which the above-mentioned detection device generates the second reconstruction file based on incremental memory data, parameter data and image memory data is only an exemplary implementation method. Optionally, in the actual application process, there are other ways to generate the second reconstruction file, and the embodiments of this application are not limited to this.

[0159] 503. The detection device performs a static detection on the second reconstructed file, and determines whether the test file is a malicious file based on the result of the static detection.

[0160] In an embodiment of the present application, after generating the second reconstructed file, the detection device performs static detection on the second reconstructed file. When the static detection result of the second reconstructed file indicates that the second reconstructed file is a malicious file, the detection device determines that the test file is a malicious file.

[0161] In the embodiments of the present application, the specific method of statically detecting files can be understood by referring to any one of the static detection technologies for malicious files in the prior art. The embodiments of the present application do not limit this and will not elaborate on it.

[0162] An embodiment of the present application adopts a method for detecting malicious files, which obtains the running data of a test file in a virtual running environment, wherein the running data includes incremental memory data in the memory applied for during the running process of the test file, parameter data corresponding to each first call parameter used by the test file to call the target function once or multiple times during the running process, and image memory data of the test file after the running is completed. Based on the running data, a second reconstruction file that can describe the behavioral information of the test file during the execution process is determined, and finally, based on the static detection result of the second reconstruction file, it is judged whether the test file is a malicious file, thereby effectively solving the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0163] based on Figure 3 In the embodiment, when the running data obtained by the detection device includes incremental memory data, parameter data and image memory data, another embodiment of the detection method of malicious files provided by the embodiment of the present application is as follows: Figure 8 As shown, Figure 8 Includes steps 701 to 703.

[0164] The present application also provides a corresponding embodiment Figure 8 The flowchart of the method for detecting malicious files is shown in FIG. Figure 9 Next, we will combine Figure 9 ,right Figure 8 The specific process of the malicious file detection method in the present invention is introduced in detail.

[0165] 701. A detection device runs a test file in a virtual running environment to obtain running data of the test file, where the running data includes incremental memory data, parameter data, and image memory data.

[0166] The embodiments of this application can be found in Figure 5 For details, please refer to step 501 in Figure 9 The flowchart in the understanding, Figure 9 Please refer to the relevant contents in Figure 7(a) for understanding the stack space, file memory image space, and first memory space in the virtual operating environment, and no further details will be given here.

[0167] 702. The detection device generates a first reconstruction file and a second reconstruction file according to the operation data.

[0168] In the embodiment of the present application, after obtaining the running data of the test file, the detection device generates a first reconstruction file based on the incremental memory data and the image memory data, and generates a second reconstruction file based on the incremental memory data, the parameter data and the image memory data. Figure 4For a detailed description of step 402 in FIG. 1 , refer to the embodiment of generating the second reconstruction file based on the incremental memory data, parameter data and image memory data. Figure 5 The data organization relationship between the incremental memory data, parameter data and image memory data and the first reconstruction file and the second reconstruction file can be found in Figure 9 Understanding the flowchart in .

[0169] 703. The detection device performs static detection on the first reconstructed file and the second reconstructed file, and determines whether the test file is a malicious file based on the result of the static detection.

[0170] In the embodiment of the present application, after generating the first reconstruction file and the second reconstruction file, the detection device performs static detection on the first reconstruction file and the second reconstruction file respectively, such as Figure 9 As shown, when the static detection result of any one of the first reconstructed file and the second reconstructed file is detected as a malicious file, the detection device determines that the test file is a malicious file.

[0171] In the embodiments of the present application, the specific method of statically detecting files can be understood by referring to any one of the static detection technologies for malicious files in the prior art. The embodiments of the present application do not limit this and will not elaborate on it.

[0172] An embodiment of the present application adopts a method for detecting malicious files by obtaining running data of a test file in a virtual running environment, wherein the running data includes incremental memory data in the memory applied for during the running process of the test file, parameter data corresponding to each first call parameter used by the test file to call the target function once or multiple times during the running process, and image memory data of the test file after the running is completed. Based on the running data, two different reconstruction files that can describe the behavioral information of the test file during the execution process are respectively determined. When the static detection result of any one of the two different reconstruction files is a malicious file, the test file can be judged as a malicious file. The malicious file detection method provided by the embodiment of the present application can effectively solve the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0173] The above describes the malicious file detection method provided in the embodiment of the present application. The embodiment of the present application can divide the detection device into functional modules according to the above method embodiment. For example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical function division. There are other division methods in actual implementation.

[0174] For example, when the functional modules are divided in an integrated manner, Figure 10 A schematic diagram of the structure of a malicious file detection device is shown. The detection device 80 corresponds to Figure 3-Figure 7(c) The detection device in the embodiment.

[0175] See Figure 10 The malicious file detection device 80 provided in the embodiment of the present application includes: an acquisition module 801, a generation module 802 and a static detection module 803.

[0176] Acquisition module 801 is used to run the test file in the virtual running environment to obtain the running data of the test file, the running data including at least one of incremental memory data and parameter data, the incremental memory data is the data stored in the first memory space, the first memory space is the memory requested by the test file during the running process, the parameter data includes the data corresponding to each parameter in the first call parameter set, the first call parameter set includes the parameters used by the test file when calling the target function once or multiple times during the running process, and the target function belongs to the predetermined function set. For specific implementation methods, please refer to Figure 3 The detailed description of step 301 in the illustrated embodiment will not be repeated here.

[0177] The generating module 802 is configured to generate at least one reconstruction file according to the operation data acquired by the acquiring module 801. Figure 3 The detailed description of step 302 in the illustrated embodiment will not be repeated here.

[0178] The static detection module 803 is used to perform static detection on the at least one reconstructed file generated by the generation module 802, and determine whether the test file is a malicious file based on the result of the static detection. Figure 3 The detailed description of step 303 in the illustrated embodiment will not be repeated here.

[0179] An embodiment of the present application adopts a malicious file detection device, which obtains the running data of a test file in a virtual running environment, where the running data includes the data in the memory requested during the running process of the test file and at least one of the parameter data corresponding to each parameter used by the test file to call the target function once or multiple times during the running process. Then, based on the running data, at least one reconstructed file that can describe the behavioral information of the test file during the execution process is determined. Finally, based on the static detection result of the at least one reconstructed file, whether the test file is a malicious file is judged, thereby effectively solving the problem that traditional static detection methods cannot effectively detect packed and encrypted files.

[0180] Optionally, as an embodiment, the incremental memory data includes first data and second data, the first data is data stored in the second memory space, the second memory space is memory applied for and released by the test file during operation, the second data is data stored in the third memory space, the third memory space is memory applied for by the test file during operation and not released after the operation ends, when the operation data includes the incremental memory data, the acquisition module 801 is used to obtain a second call parameter set and a third call parameter set, wherein the second call parameter set includes parameters used when the test file calls the memory application function multiple times during operation, and the test file uses one second call parameter set each time it calls the memory application function The parameters in the second call parameter set are used to indicate the memory address of the first memory space, and the third call parameter set includes the parameters used by the test file when calling the memory release function once or multiple times during the running process. The test file uses a parameter in the third call parameter set each time it calls the memory release function. The parameters in the third call parameter set are used to indicate the memory address of the second memory space; the first data is obtained from the memory address of the second memory space; when the test file ends running in the virtual running environment, the memory address of the third memory space is determined according to the memory address of the first memory space and the memory address of the second memory space, and the second data is obtained from the memory address of the third memory space. For specific implementation methods, please refer to Figure 3 Detailed description of step 301 in the embodiment shown, Figure 4 Detailed description of step 401 in the embodiment shown, Figure 5 Detailed description of step 501 in the embodiment shown and Figure 8 The detailed description of step 701 in the illustrated embodiment will not be repeated here.

[0181] Optionally, as an embodiment, when the running data includes the parameter data, the acquisition module 801 is used to acquire the parameters used when the test file calls the target function once or multiple times, thereby obtaining the first call parameter set; and to acquire the parameter data from the memory address pointed to by the pointer of each parameter in each first call parameter set. For specific implementation methods, please refer to Figure 3 The detailed description of step 301 in the embodiment shown is omitted here. Figure 3 Detailed description of step 301 in the embodiment shown, Figure 5 Detailed description of step 501 in the embodiment shown and Figure 8 The detailed description of step 701 in the illustrated embodiment will not be repeated here.

[0182] Optionally, as an embodiment, the parameter data is data that meets preset conditions in the memory address pointed to by the pointer of the parameter of the first call parameter set, and the preset conditions include at least one of the following: the data type of the parameter data is a string type, the data length of the parameter data is greater than or equal to the preset length, and the parameter data appears for the first time during the running of the test file. For specific implementation methods, please refer to Figure 3 Detailed description of step 301 in the embodiment shown, Figure 5 Detailed description of step 501 in the embodiment shown and Figure 8 The detailed description of step 701 in the illustrated embodiment will not be repeated here.

[0183] Optionally, as an embodiment, the running data further includes image memory data, which is data stored in the fourth memory space after the test file is run. The fourth memory space is the memory space allocated by the operating system for the initial image data, and the initial image data is data loaded from the hard disk into the memory during the initialization phase of the virtual running environment running the test file. For specific implementation methods, please refer to Figure 4 Detailed description of step 401 in the embodiment shown, Figure 5 Detailed description of step 501 in the embodiment shown and Figure 8 The detailed description of step 701 in the illustrated embodiment will not be repeated here.

[0184] Optionally, as an embodiment, when the running data includes the incremental memory data and the image memory data, the at least one reconstruction file includes a first reconstruction file, and the generating module 802 is used to save the incremental memory data and the image memory data as the first reconstruction file; correspondingly, the static detection module is used to perform static detection on the first reconstruction file generated by the generating module, and determine whether the test file is a malicious file based on the result of the static detection. For specific implementation methods, please refer to Figure 4 Detailed description of step 402 in the illustrated embodiment and Figure 8 The detailed description of step 702 in the illustrated embodiment will not be repeated here.

[0185] Optionally, as an embodiment, when the operating data includes the incremental memory data, the parameter data, and the image memory data, the at least one reconstruction file includes a second reconstruction file, and the generation module is used to generate the second reconstruction file based on the incremental memory data, the parameter data, and the image memory data; correspondingly, the static detection module is used to perform static detection on the second reconstruction file generated by the generation module, and determine whether the test file is a malicious file based on the result of the static detection. For specific implementation methods, please refer to Figure 5Detailed description of step 502 in the illustrated embodiment and Figure 8 The detailed description of step 702 in the illustrated embodiment will not be repeated here.

[0186] Optionally, as an embodiment, the at least one reconstructed file further includes a third reconstructed file, and the generating module 802 is further configured to save the incremental memory data and the image memory data as the third reconstructed file; correspondingly, the static detection module is configured to perform static detection on the second reconstructed file and the third reconstructed file generated by the generating module, respectively, and when any one of the second reconstructed file and the third reconstructed file is detected as a malicious file, the test file is determined to be a malicious file. For specific implementation methods, please refer to Figure 8 The detailed description of step 702 in the illustrated embodiment will not be repeated here.

[0187] Optionally, as an embodiment, the generating module 802 is configured to generate a reconstruction file based on the image memory data; and write the target memory data and the parameter data into the end of the reconstruction file in sequence to obtain the second reconstruction file, wherein the target memory data is determined based on the incremental memory data. For specific implementation methods, please refer to Figure 6 The detailed description of steps 5021 to 5025 in the illustrated embodiment will not be repeated here.

[0188] Optionally, as an embodiment, the generating module 802 is further configured to determine the target memory data based on the incremental memory data, wherein the number of memory data included in the target memory data is a first value, which is less than or equal to the number of memory data included in the incremental memory data, and the data size of the target memory data is a second value, which is less than or equal to the data size of the incremental memory data. For specific implementation methods, please refer to Figure 6 The detailed description of step 5025 in the illustrated embodiment will not be repeated here.

[0189] Optionally, as an embodiment, the generation module 802 is used to determine the file header of the reconstructed file based on the file header of the image memory data; copy the file section table in the image memory data to the end of the file header of the reconstructed file to obtain the file section table of the reconstructed file; determine the section data of the reconstructed file based on the section data in the image memory data, the section data of the reconstructed file is located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; perform target processing on the file section table of the reconstructed file or the file header of the reconstructed file based on the position information of each section data in the section data of the reconstructed file to obtain the reconstructed file, the target processing including one or more of the following: offset correction, data correction. For specific implementation methods, please refer to Figure 6 The detailed description of steps 5021 to 5024 in the illustrated embodiment will not be repeated here.

[0190] Optionally, as an embodiment, the file header of the reconstructed file is the same as the file header of the image memory data. Figure 6 The detailed description of step 5021 in the illustrated embodiment will not be repeated here.

[0191] Optionally, as an embodiment, the generation module 802 is used to determine that the file header of the reconstructed file is a preset file header; copy the file section table in the image memory data to the end of the preset file header to obtain the file section table of the reconstructed file; determine the section data of the reconstructed file based on the section data in the image memory data, the section data of the reconstructed file is located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; perform target processing on the file section table of the reconstructed file or the file header of the reconstructed file based on the position information of each section data in the section data of the reconstructed file to obtain the reconstructed file, the target processing includes one or more of the following: offset correction, data correction. For specific implementation methods, please refer to Figure 6 The detailed description of steps 5021 to 5025 in the illustrated embodiment will not be repeated here.

[0192] Optionally, an embodiment of the present application provides a chip system that includes a processor for supporting a detection device in implementing the above-mentioned malicious file detection method. In one possible design, the chip system also includes a memory. The memory is used to store program instructions and data necessary for the detection device. The chip system can be composed of a chip or can include a chip and other discrete components, which is not specifically limited in the embodiments of the present application.

[0193] It should be understood that the processor mentioned in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0194] It should also be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM).

[0195] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) is integrated into the processor.

[0196] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0197] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0198] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0199] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0200] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0201] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0202] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0203] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, a computer, a server, or a data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode to another website, a computer, a server, or a data center. The computer-readable storage medium can be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium can be a magnetic medium, (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state drive Solid State Disk (SSD)), etc.

Claims

1. A method for detecting malicious files, characterized in that: include: Running a test file in a virtual execution environment to obtain execution data of the test file, the execution data including at least one of incremental memory data and parameter data, the incremental memory data being data stored in a first memory space, the first memory space being memory requested by the test file during execution, the requested memory being used to implement dynamic behavior of the test file, the parameter data including data corresponding to each parameter in a first call parameter set, the first call parameter set including parameters used when the test file calls a target function one or more times during execution, the target function belonging to a predetermined function set; generating at least one reconstruction file according to the operating data; Perform static detection on the at least one reconstructed file, and determine whether the test file is a malicious file based on a result of the static detection.

2. The method according to claim 1, characterized in that The incremental memory data includes first data and second data, the first data is data stored in the second memory space, the second memory space is memory applied for and released by the test file during operation, and the second data is data stored in the third memory space, the third memory space is memory applied for and not released after the test file is run. When the operation data includes the incremental memory data, obtaining the operation data of the test file includes: Obtaining a second call parameter set and a third call parameter set, wherein the second call parameter set includes parameters used by the test file when calling a memory allocation function multiple times during execution, the test file using one parameter from the second call parameter set each time the memory allocation function is called, and the parameters in the second call parameter set are used to indicate a memory address of the first memory space; and the third call parameter set includes parameters used by the test file when calling a memory release function one or more times during execution, the test file using one parameter from the third call parameter set each time the memory release function is called, and the parameters in the third call parameter set are used to indicate a memory address of the second memory space; Obtaining the first data from a memory address of the second memory space; After the test file finishes running in the virtual running environment, the memory address of the third memory space is determined according to the memory address of the first memory space and the memory address of the second memory space, and the second data is obtained from the memory address of the third memory space.

3. The method according to claim 1 or 2, characterized in that When the operating data includes the parameter data, obtaining the operating data of the test file includes: Obtaining parameters used when the test file calls the target function one or more times, thereby obtaining the first call parameter set; The parameter data is obtained from the memory address pointed to by the pointer of each parameter in the first calling parameter set.

4. The method according to claim 1 or 2, characterized in that The parameter data is data that meets preset conditions in the memory address pointed to by the pointer of the parameter in the first call parameter set, and the preset conditions include at least one of the following: the data type of the parameter data is a string type, the data length of the parameter data is greater than or equal to the preset length, and the parameter data appears for the first time during the execution of the test file.

5. The method according to claim 1 or 2, characterized in that The running data also includes image memory data, which is the data stored in the fourth memory space after the test file is run. The fourth memory space is the memory space allocated by the operating system for the initial image data, and the initial image data is the data loaded from the hard disk into the memory during the initialization phase of the virtual running environment running the test file.

6. The method according to claim 5, characterized in that When the running data includes the incremental memory data and the image memory data, the at least one reconstruction file includes a first reconstruction file, Generating at least one reconstruction file according to the operating data includes: generating the first reconstruction file according to the incremental memory data and the image memory data; Correspondingly, the performing static detection on the at least one reconstructed file and determining whether the test file is a malicious file according to the result of the static detection includes: Performing a static detection on the first reconstructed file, and determining whether the test file is a malicious file based on a result of the static detection.

7. The method according to claim 5, characterized in that When the operating data includes the incremental memory data, the parameter data and the image memory data, the at least one reconstruction file includes a second reconstruction file, Generating at least one reconstruction file according to the operating data includes: generating the second reconstruction file according to the incremental memory data, the parameter data and the image memory data; Correspondingly, the performing static detection on the at least one reconstructed file and determining whether the test file is a malicious file according to the result of the static detection includes: Performing a static detection on the second reconstructed file, and determining whether the test file is a malicious file based on a result of the static detection.

8. The method according to claim 7, characterized in that The at least one reconstruction file further includes a third reconstruction file, and the generating of the at least one reconstruction file according to the operating data further includes: generating the third reconstruction file according to the incremental memory data and the image memory data; Correspondingly, the performing static detection on the at least one reconstructed file and determining whether the test file is a malicious file according to the result of the static detection includes: Static detection is performed on the second reconstructed file and the third reconstructed file respectively. When any one of the second reconstructed file and the third reconstructed file is detected as a malicious file, the test file is determined to be a malicious file.

9. The method according to claim 8, characterized in that Generating a second reconstruction file according to the incremental memory data, the parameter data and the image memory data includes: generating a reconstruction file according to the image memory data; The target memory data and the parameter data are sequentially written into the tail of the reconstruction file to obtain the second reconstruction file, wherein the target memory data is determined according to the incremental memory data.

10. The method according to claim 9, characterized in that Before writing the target memory data and the parameter data into the tail of the reconstructed file in sequence, the method further includes: The target memory data is determined based on the incremental memory data, wherein the number of memory data included in the target memory data is a first value, the first value is less than or equal to the number of memory data included in the incremental memory data, and the data size of the target memory data is a second value, and the second value is less than or equal to the data size of the incremental memory data.

11. The method according to claim 10, characterized in that The generating of the reconstruction file according to the image memory data comprises: Determining the file header of the reconstructed file according to the file header of the image memory data; Copying the file section table in the image memory data to the end of the file header of the reconstructed file to obtain the file section table of the reconstructed file; Determining the section data of the reconstructed file based on the section data in the image memory data, where the section data of the reconstructed file is located at the end of a file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each of one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; According to the position information of each section data in the section data of the reconstructed file, target processing is performed on the file section table of the reconstructed file or the file header of the reconstructed file to obtain the reconstructed file, and the target processing includes one or more of the following: offset correction and data correction.

12. The method according to claim 11, characterized in that The file header of the reconstructed file is the same as the file header of the image memory data.

13. The method according to claim 10, characterized in that The generating of the reconstruction file according to the image memory data comprises: Determining that the file header of the reconstructed file is a preset file header; Copying the file section table in the image memory data to the end of the preset file header to obtain the file section table of the reconstructed file; Determining the section data of the reconstructed file based on the section data in the image memory data, where the section data of the reconstructed file is located at the end of a file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each of one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; According to the position information of each section data in the section data of the reconstructed file, target processing is performed on the file section table of the reconstructed file or the file header of the reconstructed file to obtain the reconstructed file, and the target processing includes one or more of the following: offset correction and data correction.

14. A malicious file detection device, characterized in that: include: an acquisition module, configured to execute a test file in a virtual execution environment to acquire execution data of the test file, the execution data including at least one of incremental memory data and parameter data, the incremental memory data being data stored in a first memory space, the first memory space being memory requested by the test file during execution, the requested memory being used to implement dynamic behavior of the test file, the parameter data including data corresponding to each parameter in a first call parameter set, the first call parameter set including parameters used when the test file calls a target function one or more times during execution, the target function belonging to a predetermined function set; a generating module, configured to generate at least one reconstruction file according to the operating data acquired by the acquiring module; A static detection module is used to perform static detection on the at least one reconstructed file generated by the generation module, and determine whether the test file is a malicious file based on the result of the static detection.

15. The device according to claim 14, characterized in that The incremental memory data includes first data and second data, the first data is data stored in the second memory space, the second memory space is memory applied for and released by the test file during operation, and the second data is data stored in the third memory space, the third memory space is memory applied for and not released after the test file is run. When the operation data includes the incremental memory data, The acquisition module is used to acquire a second call parameter set and a third call parameter set, wherein the second call parameter set includes parameters used by the test file when calling a memory allocation function multiple times during operation, and the test file uses a parameter in the second call parameter set each time the memory allocation function is called, and the parameters in the second call parameter set are used to indicate the memory address of the first memory space; the third call parameter set includes parameters used by the test file when calling a memory release function once or multiple times during operation, and the test file uses a parameter in the third call parameter set each time the memory release function is called, and the parameters in the third call parameter set are used to indicate the memory address of the second memory space; obtain the first data from the memory address of the second memory space; when the test file ends running in the virtual operating environment, determine the memory address of the third memory space based on the memory address of the first memory space and the memory address of the second memory space, and obtain the second data from the memory address of the third memory space.

16. The device according to claim 14 or 15, characterized in that When the operating data includes the parameter data, The acquisition module is used to obtain the parameters used when the test file calls the target function once or multiple times, thereby obtaining the first call parameter set; and obtain the parameter data from the memory address pointed to by the pointer of each parameter in the first call parameter set.

17. The device according to claim 14 or 15, characterized in that The parameter data is data that meets preset conditions in the memory address pointed to by the pointer of the parameter in the first call parameter set, and the preset conditions include at least one of the following: the data type of the parameter data is a string type, the data length of the parameter data is greater than or equal to the preset length, and the parameter data appears for the first time during the execution of the test file.

18. The device according to claim 14 or 15, characterized in that The running data also includes image memory data, which is the data stored in the fourth memory space after the test file is run. The fourth memory space is the memory space allocated by the operating system for the initial image data, and the initial image data is the data loaded from the hard disk into the memory during the initialization phase of the virtual running environment running the test file.

19. The device according to claim 18, characterized in that When the running data includes the incremental memory data and the image memory data, the at least one reconstruction file includes a first reconstruction file, The generating module is configured to generate the first reconstruction file according to the incremental memory data and the image memory data; Correspondingly, the static detection module is used to perform static detection on the first reconstructed file generated by the generation module, and determine whether the test file is a malicious file based on the result of the static detection.

20. The device according to claim 18, wherein When the operating data includes the incremental memory data, the parameter data and the image memory data, the at least one reconstruction file includes a second reconstruction file, The generating module is configured to generate the second reconstruction file according to the incremental memory data, the parameter data and the image memory data; Correspondingly, the static detection module is used to perform static detection on the second reconstructed file generated by the generation module, and determine whether the test file is a malicious file based on the result of the static detection.

21. The device according to claim 20, characterized in that The at least one reconstruction file further includes a third reconstruction file, The generating module is further configured to generate the third reconstruction file according to the incremental memory data and the image memory data; Correspondingly, the static detection module is used to perform static detection on the second reconstruction file and the third reconstruction file generated by the generation module respectively. When any one of the second reconstruction file and the third reconstruction file is detected as a malicious file, the test file is determined to be a malicious file.

22. The device according to claim 21, characterized in that The generation module is used to generate a reconstruction file based on the image memory data; write the target memory data and the parameter data into the end of the reconstruction file in sequence to obtain the second reconstruction file, wherein the target memory data is determined based on the incremental memory data.

23. The device according to claim 22, characterized in that The generation module is also used to determine the target memory data based on the incremental memory data, wherein the number of memory data included in the target memory data is a first value, and the first value is less than or equal to the number of memory data included in the incremental memory data; the data size of the target memory data is a second value, and the second value is less than or equal to the data size of the incremental memory data.

24. The device according to claim 23, characterized in that The generation module is used to determine the file header of the reconstructed file based on the file header of the image memory data; copy the file section table in the image memory data to the end of the file header of the reconstructed file to obtain the file section table of the reconstructed file; determine the section data of the reconstructed file based on the section data in the image memory data, the section data of the reconstructed file is located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; according to the position information of each section data in the section data of the reconstructed file, target processing is performed on the file section table of the reconstructed file or the file header of the reconstructed file to obtain the reconstructed file, and the target processing includes one or more of the following: offset correction and data correction.

25. The device according to claim 24, characterized in that The file header of the reconstructed file is the same as the file header of the image memory data.

26. The device according to claim 23, characterized in that The generation module is used to determine that the file header of the reconstructed file is a preset file header; copy the file section table in the image memory data to the end of the preset file header to obtain the file section table of the reconstructed file; determine the section data of the reconstructed file based on the section data in the image memory data, and the section data of the reconstructed file is located at the end of the file section table of the reconstructed file, wherein the section data in the image memory data includes section data corresponding to each section table in one or more section tables included in the file section table in the image memory data, and the section data of the reconstructed file includes valid data in the section data corresponding to each section table; according to the position information of each section data in the section data of the reconstructed file, target processing is performed on the file section table of the reconstructed file or the file header of the reconstructed file to obtain the reconstructed file, and the target processing includes one or more of the following: offset correction and data correction.

27. A computer device, characterized in that: Including: processor, memory; The memory is used to store computer-readable instructions or computer programs, and the processor is used to read the computer-readable instructions to implement the method according to any one of claims 1 to 13.

28. A computer-readable storage medium, characterized in that The method comprises computer program instructions which, when executed on a computer, cause the computer to perform the method according to any one of claims 1 to 13.

Images