A security file identification method, device, electronic device and storage medium

Abstract

The present application discloses a method, device, electronic device and computer-readable storage medium for identifying a secure file. The method includes: obtaining a feature set, which can reflect keywords and their defined positions in files; detecting the frequency of occurrence of each feature in the feature set in a target file; constructing a file feature vector of the target file according to the frequency of occurrence of each feature in the target file; calling a first preset classification model to identify whether the target file is a secure file according to the file feature vector of the target file; the first preset classification model is pre-trained and generated based on the file feature vectors of each sample file. The present application constructs a feature set using features that can reflect keywords and their defined positions in files, and performs model training based on the frequency difference of the above features in secure files and non-secure files, thereby achieving accurate identification of secure files, effectively improving the accuracy of the identification results of secure files, and ensuring the safety of file use.

Description

Technical Field

[0001] The present application relates to the technical field of document security detection, and in particular to a method, device, electronic device and computer-readable storage medium for identifying a security document. Background Art

[0002] In view of the severe situation of cyber attacks and other problems in today's information and network era, it is very important to use the security file recognition technology to effectively distinguish between security files (i.e. white files) and non-security files (i.e. malicious files) for maintaining corporate interests and normal social order. At present, some related technical solutions distinguish between security files and non-security files by counting the word frequency information of the string in the file. However, the method of counting the word frequency of the file string is relatively rough, and the actual recognition results are often limited in accuracy, which poses a great security risk.

[0003] In view of this, providing a solution to the above-mentioned technical problems has become an urgent concern for those skilled in the art. Summary of the invention

[0004] The purpose of the present application is to provide a method, device, electronic device and computer-readable storage medium for identifying a security document, so as to effectively improve the recognition accuracy of the security document.

[0005] In order to solve the above technical problems, on the one hand, the present application discloses a method for identifying a security document, comprising:

[0006] Obtaining a feature set, wherein the feature set can reflect the keywords and the definition positions of the keywords in the file;

[0007] Detecting the frequency of occurrence of each feature in the feature set in the target file;

[0008] Constructing a file feature vector of the target file according to the frequency of occurrence of each feature in the target file;

[0009] A first preset classification model is called to identify whether the target file is a safe file according to a file feature vector of the target file; the first preset classification model is generated and trained in advance based on the file feature vectors of each sample file.

[0010] Optionally, the sample file includes a secure sample file and a non-secure sample file; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file;

[0011] For each of the first-category features, the difference between the frequency of the first keyword defined at the first definition position in the security sample file and the frequency of the first keyword defined at the first definition position in the non-security sample file is greater than a first preset threshold;

[0012] Accordingly, the detecting the frequency of occurrence of each feature in the feature set in the target file includes:

[0013] For each of the first-category features, the frequency of the first keyword being defined at the first definition position in the target document is detected.

[0014] Optionally, the feature set further includes: a second type of features consisting of a second keyword;

[0015] For each of the second-category features, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold;

[0016] Accordingly, the detecting the frequency of occurrence of each feature in the feature set in the target file further includes:

[0017] For each of the second-category features, the frequency of the second keyword appearing in the target document is detected.

[0018] Optionally, the feature set further includes: a third type of features consisting of a third defined position;

[0019] Wherein, for each of the third type of features, the frequency of the third definition position appearing in the security sample file is greater than the frequency of the third definition position appearing in the non-security sample file, and the difference is greater than a third preset threshold;

[0020] Accordingly, the detecting the frequency of occurrence of each feature in the feature set in the target file includes:

[0021] For each of the third type features, the frequency of occurrence of the third definition position in the target file is detected.

[0022] Optionally, the training process of the first preset classification model is as follows:

[0023] For each sample file, detecting the frequency of each feature in the feature set appearing in the sample file;

[0024] Construct a file feature vector of the sample file according to the frequency of each feature appearing in the sample file;

[0025] The first preset classification model is trained and generated by taking the file feature vector of each of the sample files as input and taking the known label of each of the sample files as output whether it is a safe file.

[0026] The present application also discloses another security document identification method, comprising:

[0027] Obtaining a feature set and a semantic vector corresponding to each feature in the feature set; the feature set can reflect keywords and their defined positions in the file;

[0028] Detecting features belonging to the feature set that appear in the target file in the target file, and using the features that appear in the target file as target features;

[0029] Combining the semantic vectors corresponding to the target features to calculate a file feature vector of the target file;

[0030] A second preset classification model is called to identify whether the target file is a safe file according to a file feature vector of the target file; the second preset classification model is generated in advance based on the file feature vector training of each sample file.

[0031] Optionally, the sample file includes a secure sample file and a non-secure sample file; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file;

[0032] For each of the first-category features, a difference between a frequency of the first keyword being defined at the first definition position in the security sample file and a frequency of the first keyword being defined at the first definition position in the non-security sample file is greater than a first preset threshold.

[0033] Optionally, the feature set further includes: a second type of features consisting of a second keyword;

[0034] For each of the second-category features, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold.

[0035] Optionally, the feature set further includes: a third type of features consisting of a third defined position;

[0036] For each of the third type of features, the frequency of the third definition position appearing in the security sample file is greater than a third preset threshold compared to the frequency of the third definition position appearing in the non-security sample file.

[0037] Optionally, the process of generating the semantic vector corresponding to each feature includes:

[0038] Statistically generating a frequency matrix of the sample file with respect to the feature set; the frequency matrix records the occurrence frequency of each feature in each sample file;

[0039] The frequency matrix is ​​semantically analyzed to generate a semantic vector corresponding to each feature.

[0040] Optionally, the training process of the second preset classification model is as follows:

[0041] For each sample file, determining, according to the frequency matrix, each feature belonging to the feature set that appears in the sample file;

[0042] Combining the semantic vectors of the features appearing in the sample file to calculate a file feature vector of the sample file;

[0043] The second preset classification model is trained and generated by taking the file feature vector of each of the sample files as input and taking the known label of each of the sample files as output whether it is a safe file.

[0044] On the other hand, the present application also discloses a security document identification device, comprising:

[0045] An acquisition module, used to acquire a feature set, wherein the feature set can reflect the keywords and the definition positions of the keywords in the file;

[0046] A detection module, used to detect the frequency of occurrence of each feature in the feature set in the target file;

[0047] A calculation module, used for constructing a file feature vector of the target file according to the frequency of occurrence of each feature in the target file;

[0048] An identification module, used to call a first preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file;

[0049] The training module is used to generate the first preset classification model based on the file feature vector training of each sample file in advance.

[0050] Optionally, the sample file includes a secure sample file and a non-secure sample file; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file;

[0051] For each of the first-category features, the difference between the frequency of the first keyword defined at the first definition position in the security sample file and the frequency of the first keyword defined at the first definition position in the non-security sample file is greater than a first preset threshold;

[0052] Accordingly, the detection module is specifically used for:

[0053] For each of the first-category features, the frequency of the first keyword being defined at the first definition position in the target document is detected.

[0054] Optionally, the feature set further includes: a second type of features consisting of a second keyword;

[0055] For each of the second-category features, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold;

[0056] Accordingly, the detection module is specifically used for:

[0057] For each of the second-category features, the frequency of the second keyword appearing in the target document is detected.

[0058] Optionally, the feature set further includes: a third type of features consisting of a third defined position;

[0059] Wherein, for each of the third type of features, the frequency of the third definition position appearing in the security sample file is greater than the frequency of the third definition position appearing in the non-security sample file, and the difference is greater than a third preset threshold;

[0060] Accordingly, the detection module is specifically used for:

[0061] For each of the third type features, the frequency of occurrence of the third definition position in the target file is detected.

[0062] Optionally, the training module is specifically used for:

[0063] For each sample file, the frequency of each feature in the feature set appearing in the sample file is detected; a file feature vector of the sample file is constructed according to the frequency of each feature appearing in the sample file; the first preset classification model is trained and generated using the file feature vector of each sample file as input and the known label of each sample file as output as to determine whether it is a safe file.

[0064] The present application also discloses another security document identification device, comprising:

[0065] An acquisition module, used to acquire a feature set and a semantic vector corresponding to each feature in the feature set; the feature set can reflect the keywords and the definition position of the keywords in the file;

[0066] A detection module, used for detecting features belonging to the feature set that appear in the target file, and taking the features that appear in the target file as target features;

[0067] A calculation module, used for combining the semantic vectors corresponding to the target features to calculate the file feature vector of the target file;

[0068] an identification module, configured to call a second preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file;

[0069] The training module is used to generate the second preset classification model based on the file feature vector training of each sample file in advance.

[0070] Optionally, the sample file includes a secure sample file and a non-secure sample file; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file;

[0071] For each of the first-category features, a difference between a frequency of the first keyword being defined at the first definition position in the security sample file and a frequency of the first keyword being defined at the first definition position in the non-security sample file is greater than a first preset threshold.

[0072] Optionally, the feature set further includes: a second type of features consisting of a second keyword;

[0073] For each of the second-category features, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold.

[0074] Optionally, the feature set further includes: a third type of features consisting of a third defined position;

[0075] For each of the third type of features, the frequency of the third definition position appearing in the security sample file is greater than a third preset threshold compared to the frequency of the third definition position appearing in the non-security sample file.

[0076] Optionally, the acquisition module is specifically used for:

[0077] A frequency matrix of the sample file with respect to the feature set is statistically generated; the frequency matrix records the occurrence frequency of each feature in each sample file; and a semantic analysis is performed on the frequency matrix to generate a semantic vector corresponding to each feature.

[0078] Optionally, the training module is specifically used for:

[0079] For each sample file, the features belonging to the feature set that appear in the sample file are determined according to the frequency matrix; the semantic vectors of the features that appear in the sample file are combined to calculate the file feature vector of the sample file; the second preset classification model is trained and generated with the file feature vector of each sample file as input and the known label of each sample file as output as to whether it is a safe file.

[0080] In a third aspect, the present application further discloses an electronic device, comprising:

[0081] Memory for storing computer programs;

[0082] A processor is used to execute the computer program to implement the steps of any security document identification method as described above.

[0083] In a fourth aspect, the present application further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program is used to implement the steps of any of the security document identification methods described above.

[0084] The beneficial effects of the security file identification method, device, electronic device and computer-readable storage medium provided by the present application are: the present application uses features that can reflect keywords and the defined positions of keywords in files to construct a feature set, and performs model training based on the difference in the frequency of occurrence of the above features in security files and non-security files, and then uses the first preset classification model generated by training to achieve accurate identification of security files, effectively improving the accuracy of the identification results of security files and ensuring the safety of file use.

[0085] In addition, the present application provides another security file identification method, device, electronic device and computer-readable storage medium, the beneficial effects of which are: on the basis of the aforementioned identification method, the semantic vector corresponding to each feature is obtained based on semantic analysis processing, so as to obtain the file feature vector based on the semantic vector with the added connection between features, improve the accuracy and sufficiency of the file feature vector in expressing the file feature, and thus improve the recognition accuracy of the file. Moreover, the process of generating the semantic vector by semantic analysis processing is usually a dimensionality reduction process, which can effectively simplify the amount of data, improve the processing speed of security file identification, and reduce the number of sample files required for the training process, reducing the burden of the number of sample files in the training process. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the technical solutions in the prior art and the embodiments of the present application, the drawings required for use in the description of the prior art and the embodiments of the present application are briefly introduced below. Of course, the drawings described below in relation to the embodiments of the present application are only part of the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work, and the obtained other drawings also belong to the protection scope of the present application.

[0087] Figure 1 A flowchart of a security document identification method disclosed in an embodiment of the present application;

[0088] Figure 2 A schematic diagram of a feature set disclosed in an embodiment of the present application;

[0089] Figure 3 A flow chart of a method for training and generating a first preset classification model disclosed in an embodiment of the present application;

[0090] Figure 4 A flowchart of another security document identification method disclosed in an embodiment of the present application;

[0091] Figure 5 A flow chart of a method for training and generating a second preset classification model disclosed in an embodiment of the present application;

[0092] Figure 6 A structural block diagram of a security document identification device disclosed in an embodiment of the present application;

[0093] Figure 7 A structural block diagram of another security document identification device disclosed in an embodiment of the present application;

[0094] Figure 8 This is a structural block diagram of an electronic device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0095] The core of this application is to provide a method, device, electronic device and computer-readable storage medium for identifying security documents, so as to effectively improve the recognition accuracy of security documents.

[0096] In order to describe the technical solutions in the embodiments of the present application more clearly and completely, the technical solutions in the embodiments of the present application will be introduced below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0097] At present, in the face of network attacks and other problems, it is very important to use security file identification technology to effectively distinguish between security files (i.e., white files) and non-security files (i.e., malicious files) for maintaining corporate interests and normal social order. At present, some related technical solutions distinguish between security files and non-security white files by counting the word frequency information of character strings in files. However, the way of counting the word frequency of file strings is relatively rough, and the actual recognition results often have limited accuracy and pose a greater security risk. In view of this, the present application provides a security file identification solution that can effectively solve the above problems.

[0098] See also Figure 1 As shown, the embodiment of the present application discloses a method for identifying a security document, which mainly includes:

[0099] S101: Acquire a feature set, where the feature set can reflect keywords and their defined positions in the file.

[0100] Among them, the feature set is a set of multiple features, which is the basis for identifying safe files and non-safe files in this application. It should be emphasized that the feature set in this application can reflect the keywords and the definition position of the keywords in the file, that is, the feature set not only includes features related to the keywords themselves, but also includes features related to the positions where the keywords are defined in the file.

[0101] It should be noted that common files generally have corresponding fixed formats, including several fixed parts. For example, PE format files generally include several different file parts such as DOS header (DOS_HEADER, DOS stub), block table (Section Table), block (Section), debugging information, etc. For the same keyword, its definition position in the secure file and the non-secure file may not be the same, that is, the specific file part where it appears in the file may not be the same. For example, in a secure file, a keyword may generally appear in the first file part, while in a non-secure file, the keyword is likely to generally appear in another file part. And, further, even if it appears in the same file part, the frequency of occurrence of the keyword may be different.

[0102] It can be seen that if the definition position of the keyword in the file is not distinguished and the recognition is performed blindly, the accuracy of the recognition result is likely to be affected. In this way, the present application not only uses the difference between the keywords contained in the security file and the non-security file to identify the security file, but also uses the difference in the definition position of the keyword in the security file and the non-security file to identify, thereby effectively improving the recognition accuracy of the security file.

[0103] Therefore, when constructing the feature set, the present application not only uses features that can reflect the keywords, but also uses features that can reflect the definition position of the keywords in the file (i.e., the DOS radical, block table, block, etc. mentioned above). Among them, the keywords can be extracted from a large number of sample files by those skilled in the art according to certain rules, or conventional settings can be adopted in combination with actual experience, and the present application does not further limit this.

[0104] S102: Detect the frequency of each feature in the feature set appearing in the target file.

[0105] The target file is the file to be identified. After the target file is determined, each feature in the feature set can be detected and counted in the target file to determine the frequency of occurrence of each feature in the feature set in the target file.

[0106] S103: constructing a file feature vector of the target file according to the frequency of occurrence of each feature in the target file.

[0107] Specifically, based on the features and their frequencies appearing in the target file, a file feature vector of the target file can be constructed and generated. The file feature vector reflects all associated features between the target file and the feature set, and is the feature basis for identifying whether it is a safe file.

[0108] S104: calling a first preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file; the first preset classification model is generated and trained in advance based on the file feature vectors of each sample file.

[0109] Specifically, it should be pointed out that the present application generates a first preset classification model based on the file feature vector training of each sample file in advance. The first preset classification model identifies the input target file based on the file feature vector, and then outputs a judgment result on whether the target file is a safe file.

[0110] It is easy to understand that the number of sample files should be large enough and generally representative. The file types of the sample files are known, and they should include secure sample files and non-secure sample files. Based on the difference in file feature vectors between secure sample files and non-secure sample files, a classification model using algorithms such as artificial intelligence and machine learning is trained to obtain a first preset classification model that can identify whether a file is a secure file based on the file feature vector of the file. Therefore, the present application can obtain a secure file identification result of the target file by inputting the file feature vector of the target file into the first preset classification model.

[0111] The method for identifying secure files provided in the embodiment of the present application includes: obtaining a feature set, which can reflect keywords and their defined positions in files; detecting the frequency of occurrence of each feature in the feature set in a target file; constructing a file feature vector of the target file according to the frequency of occurrence of each feature in the target file; calling a first preset classification model to identify whether the target file is a secure file according to the file feature vector of the target file; the first preset classification model is pre-trained and generated based on the file feature vectors of each sample file.

[0112] It can be seen that the present application uses features that can reflect keywords and their defined positions in files to construct a feature set, and performs model training based on the difference in the frequency of occurrence of the above features in secure files and non-secure files. The first preset classification model generated by the training can then be used to accurately identify secure files, thereby effectively improving the accuracy of the recognition results of secure files and ensuring the safety of file use.

[0113] As a specific embodiment, the method for identifying a secure file provided in the embodiment of the present application is based on the above content, wherein the sample file includes a secure sample file and a non-secure sample file; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file;

[0114] For each first-category feature, the difference between the frequency of the first keyword defined at the first definition position in the security sample file and the frequency of the first keyword defined at the first definition position in the non-security sample file is greater than a first preset threshold;

[0115] Accordingly, the frequency of each feature in the detection feature set in the target file includes:

[0116] For each first-category feature, the frequency of the first keyword being defined at the first definition position in the target document is detected.

[0117] Specifically, the first type of feature in this embodiment combines the first keyword and the first definition position of the first keyword in the file. Among them, the combination of the first keyword and its definition position can be spliced, interspersed, etc., and the first type of feature can be specifically a string structure. Taking the splicing method as an example, if the frequency of occurrence of a first keyword "aaa" in the "DOS_HEADER" of a non-safe file and the frequency of occurrence in the same position of a safe file are greater than the first preset threshold, then a first type of feature generated by splicing can be recorded as "DOS_HEADER.aaa".

[0118] It should be noted that the first keyword in this application generally refers to a class of keywords whose frequency difference in the secure file and the non-secure file is greater than the first preset threshold, rather than a specific keyword, and its corresponding first definition position is also a general reference. The size of the first preset threshold can be set by those skilled in the art.

[0119] The construction process of the first type of features can be specifically as follows: first determine all keywords to form a keyword thesaurus. Then determine the frequency of each keyword appearing in each file part of each sample file. Taking all the safe sample files as the discussion object, the frequency of each keyword appearing in each file part is counted (the average value can be taken specifically), and the keyword space position information matrix of the safe sample files is obtained. Similarly, taking all the non-safe sample files as the discussion object, the keyword space position information matrix of the non-safe sample files is obtained. By comparing these two keyword space position information matrices, the keyword whose difference is greater than the first preset threshold can be found, so that it can be determined as the first keyword, and then the corresponding first type of features are constructed.

[0120] Among them, the rows of these two keyword space position information matrices are used to represent different keywords, and the columns are used to represent the definition positions of the keywords in the security sample files or non-security sample files (i.e., different file locations). The values ​​in the matrices are the average number of times the corresponding keywords appear at the corresponding definition positions.

[0121] As a specific embodiment, the security document identification method provided in the embodiment of the present application is based on the above content, and the feature set further includes: a second type of feature consisting of a second keyword;

[0122] For each second type of feature, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold;

[0123] Accordingly, the frequency of each feature in the detection feature set appearing in the target file also includes:

[0124] For each second-category feature, the frequency of the second keyword appearing in the target document is detected.

[0125] Specifically, the second type of features in this embodiment only reflects the second keyword that is significantly different between secure files and non-secure files. That is, the second type of features does not limit the definition position of the keyword, and secure files can be identified based on the frequency difference of the second keyword from the macro perspective of the entire file.

[0126] As a specific embodiment, the security document identification method provided in the embodiment of the present application is based on the above content, and the feature set further includes: a third type of feature consisting of a third defined position;

[0127] For each third type of feature, the frequency of the third definition position appearing in the safe sample file is greater than the frequency of the third definition position appearing in the non-safe sample file, and the difference is greater than a third preset threshold;

[0128] Accordingly, the frequency of each feature in the detection feature set in the target file includes:

[0129] For each third type of feature, the frequency of the third definition position appearing in the target file is detected.

[0130] Specifically, different files may include different file parts and have different definition positions. Therefore, the third type of features in the embodiment of the present application is based on the difference in file structure between secure files and non-secure files to identify secure files.

[0131] Similarly, the second keyword and the third definition position mentioned above are also general terms.

[0132] It should also be noted that each feature of the feature set in this application can be one or more of the three categories of features mentioned above. For example, each feature in the feature set can specifically be the first category of features mentioned above; or, each feature in the feature set specifically includes the first category of features + the second category of features mentioned above; or, each feature in the feature set specifically includes the first category of features + the third category of features mentioned above; or, each feature in the feature set specifically includes the second category of features + the third category of features mentioned above; or, see Figure 2 , each feature of the feature set specifically includes the above-mentioned first category features + second category features + third category features.

[0133] See also Figure 3 , Figure 3 A flow chart of a method for training and generating a first preset classification model disclosed in an embodiment of the present application.

[0134] As a specific embodiment, Figure 3 As shown, the training process of the first preset classification model may specifically include the following steps:

[0135] S201: For each sample file, detect the frequency of occurrence of each feature in the feature set in the sample file.

[0136] S202: Construct a file feature vector of the sample file according to the frequency of occurrence of each feature in the sample file.

[0137] S203: Taking the file feature vector of each sample file as input and taking the known label of each sample file as output, whether it is a safe file, a first preset classification model is trained and generated.

[0138] Specifically, the first preset classification model can be implemented based on a model such as a neural network. During its training process, the frequency of features appearing in each sample file can be determined first, and then a file feature vector of each sample file can be constructed to serve as a model input, and a label of whether each sample file is a safe file can be used as the output of the model, and the first preset classification model can be obtained based on multiple trainings of a large amount of data.

[0139] See also Figure 4 As shown, the embodiment of the present application discloses another method for identifying a security document, which mainly includes:

[0140] S301: Obtain a feature set and a semantic vector corresponding to each feature in the feature set; the feature set can reflect keywords and their defined positions in the file.

[0141] Specifically, based on the aforementioned security document recognition method, the security document recognition method provided in this embodiment further performs semantic processing on each feature in the feature set after obtaining the feature set to obtain a semantic vector corresponding to each feature.

[0142] Since there is no semantic information recorded between the features in the feature set and the correlation information between the features is missing, the present application also specifically obtains the semantic vector corresponding to each feature based on semantic analysis processing, so as to obtain the file feature vector based on the semantic vector that increases the connection between the features, thereby improving the accuracy and sufficiency of the file feature vector in expressing the file features, and thus improving the recognition accuracy of the file.

[0143] Moreover, the process of generating semantic vectors through semantic analysis is usually a dimensionality reduction process, which can effectively simplify the data volume of file feature vectors and improve the speed of file recognition processing.

[0144] Moreover, when training the classification model, since the dimension of the file feature vector corresponding to each sample file becomes smaller, the number of samples required for training will also decrease accordingly, thereby reducing the number of sample files required for the training process and alleviating the burden of the number of sample files in the training process.

[0145] S302: Detecting features belonging to the feature set in the target file, and using the features in the target file as target features.

[0146] S303: Combine the semantic vectors corresponding to the target features to calculate the file feature vector of the target file.

[0147] Specifically, this embodiment generates a file feature vector of the target file based on the semantic vector of each target feature.

[0148] Specifically, the file feature vector can be calculated by superimposing the semantic vectors of each target feature. In this way, the calculation process can be specifically expressed as:

[0149]

[0150] Wherein, vector(i) is the semantic vector of feature i; N is the total number of features appearing in the target file; and Vector(sample) is the file feature vector of the target file. However, the present application is not limited to the superposition combination method, and those skilled in the art may adopt other combination methods.

[0151] S304: calling a second preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file; the second preset classification model is generated and trained in advance based on the file feature vectors of each sample file.

[0152] Specifically, based on the file feature vectors of each sample file obtained through semantic analysis processing, this embodiment pre-trains and generates a second preset classification model. The second preset classification model performs identification based on the file feature vector of the input target file, and can output a judgment result on whether the target file is a safe file.

[0153] For the contents similar to those in the above embodiments in the security document identification method provided in this embodiment, please refer to the above detailed description, which will not be repeated here.

[0154] It can be seen that the embodiment of the present application uses features that can reflect keywords and the positions of keywords defined in the file to construct a feature set, and then constructs a file feature vector of the file based on the semantic vector of each feature obtained by semantic analysis, and uses the difference in file feature vectors between secure files and non-secure files to perform model training, thereby achieving accurate identification of secure files. The present application effectively improves the accuracy of the identification results of secure files from both the feature construction and semantic processing levels, ensuring the security of file use.

[0155] As a specific embodiment, the method for identifying a secure file provided in the embodiment of the present application is based on the above content, wherein the sample file includes a secure sample file and a non-secure sample file; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file;

[0156] For each first-category feature, the difference between the frequency of the first keyword defined at the first definition position in the security sample file and the frequency of the first keyword defined at the first definition position in the non-security sample file is greater than a first preset threshold.

[0157] As a specific embodiment, the security document identification method provided in the embodiment of the present application is based on the above content, and the feature set further includes: a second type of feature consisting of a second keyword;

[0158] For each second-category feature, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold.

[0159] As a specific embodiment, the security document identification method provided in the embodiment of the present application is based on the above content, and the feature set further includes: a third type of feature consisting of a third defined position;

[0160] For each third type of feature, the frequency of the third definition position appearing in the safe sample file is greater than the third preset threshold compared to the frequency of the third definition position appearing in the non-safe sample file.

[0161] As a specific embodiment, the security document recognition method provided in the embodiment of the present application is based on the above content, and the process of generating the semantic vector corresponding to each feature includes:

[0162] Statistically generate a frequency matrix of the sample file with respect to the feature set; the frequency matrix records the frequency of occurrence of each feature in each sample file;

[0163] The frequency matrix is ​​semantically analyzed to generate semantic vectors corresponding to each feature.

[0164] Specifically, the rows of the frequency matrix represent different features, the columns of the frequency matrix represent different sample files, and the values ​​in the frequency matrix are the frequencies of occurrence of the corresponding features in the corresponding sample files. For the first type of features, the corresponding matrix value is the frequency of the corresponding first keyword being defined in the first definition position in the sample file; for the second type of features, the corresponding matrix value is the total frequency of the corresponding second keyword appearing in the sample file; for the third type of features, the corresponding matrix value is the frequency of occurrence of the corresponding third definition position in the sample file.

[0165] Specifically, if there are 500,000 feature strings and 2 million sample files (1 million safe sample files and 1 million unsafe sample files), the frequency matrix is ​​a matrix of size 500,000 × 2 million. The semantic analysis algorithm is used to perform semantic analysis on the frequency matrix, thereby obtaining a semantic matrix, in which each row represents the semantic vector of the corresponding feature.

[0166] Among them, the semantic analysis algorithms that can be used include but are not limited to LSI (Latent Semantic Indexing), LSA (Latent Semantic Analysis), PLSA (Probabilistic Latent Semantic Analysis), LDA (Latent Dirichlet Allocation), etc.

[0167] It should be further explained that, as mentioned above, the process of semantic analysis is often carried out in conjunction with the use of dimensionality reduction algorithms. Common dimensionality reduction algorithms such as PCA (Principal Component Analysis) and SVD (Singular Value Decomposition) can obtain a semantic matrix of lower dimensionality by performing matrix decomposition.

[0168] For example, for a frequency matrix of 500,000 × 2 million, a low-dimensional semantic matrix of 500,000 × 500 can be obtained through dimensionality reduction processing in semantic analysis, which is convenient for subsequent calculation processes. Semantic vectors, like traditional vector space models, use vectors to represent words and documents. The difference is that semantic vectors map words and documents to a low-dimensional latent semantic space, reduce the dimension of sample features, discover potential semantic dimensions from text, and remove some "noise" in the original vector space.

[0169] See also Figure 5 , Figure 5 A flow chart of a method for training and generating a second preset classification model disclosed in an embodiment of the present application.

[0170] As a specific embodiment, see Figure 5 , the training process of the second preset classification model mainly includes the following steps:

[0171] S401: For each sample file, determine each feature belonging to a feature set that appears in the sample file according to a frequency matrix.

[0172] S402: Combine the semantic vectors of the features appearing in the sample file to calculate a file feature vector of the sample file.

[0173] S403: Taking the file feature vector of each sample file as input and taking the known label of each sample file as output, whether it is a safe file, a second preset classification model is trained and generated.

[0174] It is easy to understand that the generation process of the file feature vector of each sample file is similar to that of the file feature vector of the target file, and the superposition calculation method can also be used.

[0175] See also Figure 6 As shown, the embodiment of the present application discloses a security document identification device, which mainly includes:

[0176] An acquisition module 501 is used to acquire a feature set, which can reflect the keywords and the definition positions of the keywords in the file;

[0177] A detection module 502 is used to detect the frequency of each feature in the feature set appearing in the target file;

[0178] A calculation module 503, used to construct a file feature vector of the target file according to the frequency of occurrence of each feature in the target file;

[0179] An identification module 504 is used to call a first preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file;

[0180] The training module 505 is used to generate a first preset classification model based on the file feature vector training of each sample file in advance.

[0181] It can be seen that the security file identification device disclosed in the embodiment of the present application uses features that can reflect keywords and the defined positions of keywords in files to construct a feature set, and performs model training based on the difference in the frequency of occurrence of the above features in security files and non-security files. Then, the first preset classification model generated by the training can be used to realize accurate identification of security files, which effectively improves the accuracy of the identification results of security files and ensures the safety of file use.

[0182] For the specific content of the above-mentioned security document identification device, please refer to the detailed introduction of the security document identification method mentioned above, which will not be repeated here.

[0183] As a specific embodiment, the security file identification device provided in the embodiment of the present application is based on the above content, the sample file includes a security sample file and a non-security sample file; the feature set includes: a first type of feature generated by combining the first keyword and the first keyword at the first defined position of the file;

[0184] For each first-category feature, the difference between the frequency of the first keyword defined at the first definition position in the security sample file and the frequency of the first keyword defined at the first definition position in the non-security sample file is greater than a first preset threshold;

[0185] Accordingly, the detection module 502 is specifically used for:

[0186] For each first-category feature, the frequency of the first keyword being defined at the first definition position in the target document is detected.

[0187] As a specific embodiment, the security document identification device provided in the embodiment of the present application is based on the above content, and the feature set further includes: a second type of feature consisting of a second keyword;

[0188] For each second type of feature, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold;

[0189] Accordingly, the detection module 502 is specifically used for:

[0190] For each second-category feature, the frequency of the second keyword appearing in the target document is detected.

[0191] As a specific embodiment, the security document identification device provided in the embodiment of the present application is based on the above content, and the feature set further includes: a third type of feature composed of a third defined position;

[0192] For each third type of feature, the frequency of the third definition position appearing in the safe sample file is greater than the frequency of the third definition position appearing in the non-safe sample file, and the difference is greater than a third preset threshold;

[0193] Accordingly, the detection module 502 is specifically used for:

[0194] For each third type of feature, the frequency of the third definition position appearing in the target file is detected.

[0195] As a specific embodiment, the security document recognition device provided in the embodiment of the present application is based on the above content, and the training module 505 is specifically used for:

[0196] For each sample file, the frequency of each feature in the feature set appearing in the sample file is detected; a file feature vector of the sample file is constructed according to the frequency of each feature appearing in the sample file; and a first preset classification model is trained and generated using the file feature vector of each sample file as input and the known label of each sample file as output as to determine whether it is a safe file.

[0197] See also Figure 7 As shown, the embodiment of the present application also discloses another security document identification device, which mainly includes:

[0198] The acquisition module 601 is used to acquire a feature set and a semantic vector corresponding to each feature in the feature set; the feature set can reflect the keyword and the definition position of the keyword in the file;

[0199] A detection module 602 is used to detect features belonging to a feature set in a target file, and use the features in the target file as target features;

[0200] A calculation module 603, used for combining semantic vectors corresponding to target features to calculate a file feature vector of a target file;

[0201] An identification module 604 is used to call a second preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file;

[0202] The training module 605 is used to generate a second preset classification model based on the file feature vector training of each sample file in advance.

[0203] It can be seen that the security file identification device disclosed in the embodiment of the present application uses features that can reflect keywords and the positions of keywords defined in the file to construct a feature set, and then constructs a file feature vector of the file based on the semantic vector of each feature obtained by semantic analysis, and uses the difference in file feature vectors between security files and non-security files to perform model training, thereby achieving accurate identification of security files. The present application effectively improves the accuracy of the identification results of security files from both the feature construction and semantic processing levels, and ensures the safety of file use.

[0204] For the specific content of the above-mentioned security document identification device, please refer to the detailed introduction of the security document identification method mentioned above, which will not be repeated here.

[0205] As a specific embodiment, the security file identification device provided in the embodiment of the present application is based on the above content, the sample file includes a security sample file and a non-security sample file; the feature set includes: a first type of feature generated by combining the first keyword and the first keyword at the first defined position of the file;

[0206] For each first-category feature, the difference between the frequency of the first keyword defined at the first definition position in the security sample file and the frequency of the first keyword defined at the first definition position in the non-security sample file is greater than a first preset threshold.

[0207] As a specific embodiment, the security document identification device provided in the embodiment of the present application is based on the above content, and the feature set further includes: a second type of feature consisting of a second keyword;

[0208] For each second-category feature, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold.

[0209] As a specific embodiment, the security document identification device provided in the embodiment of the present application is based on the above content, and the feature set further includes: a third type of feature composed of a third defined position;

[0210] For each third type of feature, the frequency of the third definition position appearing in the safe sample file is greater than the third preset threshold compared to the frequency of the third definition position appearing in the non-safe sample file.

[0211] As a specific embodiment, the security document identification device provided in the embodiment of the present application is based on the above content, and the acquisition module 601 is specifically used for:

[0212] The frequency matrix of the sample file with respect to the feature set is statistically generated; the frequency matrix records the frequency of occurrence of each feature in each sample file; and the frequency matrix is ​​semantically analyzed to generate a semantic vector corresponding to each feature.

[0213] Optionally, the training module 605 is specifically used for:

[0214] For each sample file, the features belonging to the feature set that appear in the sample file are determined according to the frequency matrix; the semantic vectors of the features that appear in the sample file are combined to calculate the file feature vector of the sample file; and a second preset classification model is trained and generated with the file feature vector of each sample file as input and the known label of each sample file as output as to whether it is a safe file.

[0215] See also Figure 8 As shown, the embodiment of the present application discloses an electronic device, including:

[0216] Memory 701, used for storing computer programs;

[0217] The processor 702 is configured to execute the computer program to implement the steps of any security document identification method as described above.

[0218] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the steps of any of the security file identification methods described above.

[0219] For specific contents of the above-mentioned electronic device and computer-readable storage medium, please refer to the detailed introduction of the aforementioned method for identifying security documents, which will not be repeated here.

[0220] In this application, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0221] It should also be noted that, in this application document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. In addition, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0222] The technical solution provided by the present application is described in detail above. The principle and implementation method of the present application are described in detail using specific examples herein, and the description of the above embodiments is only used to help understand the method and core idea of ​​the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principle of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A method for identifying a security document, characterized in that: include: Obtain a feature set and a semantic vector corresponding to each feature in the feature set; The feature set can reflect the keywords and the definition positions of the keywords in the document; The generation process of the semantic vector corresponding to each feature includes: statistically generating a frequency matrix of the sample file with respect to the feature set; the frequency matrix records the occurrence frequency of each feature in each sample file; and semantically analyzing the frequency matrix to generate the semantic vector corresponding to each feature. Detecting features belonging to the feature set that appear in the target file in the target file, and using the features that appear in the target file as target features; Combining the semantic vectors corresponding to the target features to calculate a file feature vector of the target file; A second preset classification model is called to identify whether the target file is a safe file according to a file feature vector of the target file; the second preset classification model is generated in advance based on the file feature vector training of each sample file.

2. The identification method according to claim 1, characterized in that: The sample files include security sample files and non-security sample files; the feature set includes: a first type of feature generated by combining a first keyword and the first keyword at a first defined position of the file; For each of the first-category features, a difference between a frequency of the first keyword being defined at the first definition position in the security sample file and a frequency of the first keyword being defined at the first definition position in the non-security sample file is greater than a first preset threshold.

3. The identification method according to claim 2, characterized in that: The feature set also includes: a second type of features consisting of a second keyword; For each of the second-category features, the difference between the frequency of the second keyword appearing in the safe sample file and the frequency of the second keyword appearing in the non-safe sample file is greater than a second preset threshold.

4. The identification method according to claim 3, characterized in that: The feature set also includes: a third type of features consisting of a third defined position; For each of the third type of features, the frequency of the third definition position appearing in the security sample file is greater than a third preset threshold compared to the frequency of the third definition position appearing in the non-security sample file.

5. The identification method according to any one of claims 1 to 4, characterized in that: The training process of the second preset classification model is as follows: For each sample file, determining, according to the frequency matrix, each feature belonging to the feature set that appears in the sample file; Combining the semantic vectors of the features appearing in the sample file to calculate a file feature vector of the sample file; The second preset classification model is trained and generated by taking the file feature vector of each of the sample files as input and taking the known label of each of the sample files as output whether it is a safe file.

6. A security document recognition device, characterized in that: include: An acquisition module, used to acquire a feature set and a semantic vector corresponding to each feature in the feature set; the feature set can reflect the keywords and the definition position of the keywords in the file; The generation process of the semantic vector corresponding to each feature includes: statistically generating a frequency matrix of the sample file with respect to the feature set; the frequency matrix records the occurrence frequency of each feature in each sample file; and semantically analyzing the frequency matrix to generate the semantic vector corresponding to each feature. A detection module, used for detecting features belonging to the feature set that appear in the target file, and taking the features that appear in the target file as target features; A calculation module, used for combining the semantic vectors corresponding to the target features to calculate the file feature vector of the target file; an identification module, configured to call a second preset classification model to identify whether the target file is a safe file according to a file feature vector of the target file; The training module is used to generate the second preset classification model based on the file feature vector training of each sample file in advance.

7. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the steps of the identification method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it is used to implement the steps of the identification method according to any one of claims 1 to 5.

Images