Method, device and electronic device for obtaining data analysis graph

Abstract

A method, device, and electronic device for obtaining a data analysis graph. The method includes: obtaining analysis results for N specified samples, extracting all entities corresponding to each specified sample from the analysis results, associating each entity with a preset identifier for the specified sample, establishing an association relationship between the preset identifier and each entity, and establishing a data analysis graph based on the association relationship between each preset identifier and each entity. Through the above method, entities corresponding to the analysis results of the specified sample are associated with the preset identifier, and a data analysis graph is established based on the association relationship between the entity and the preset identifier, thereby achieving multi-dimensional and multi-angle analysis of the specified sample.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, device and electronic device for obtaining a data analysis graph. Background Art

[0002] With the development of network technology, the number of malicious software is increasing. Malware is called malicious code. Malicious code includes: computer viruses (referred to as viruses), Trojan horses (referred to as Trojans), computer worms (referred to as worms), backdoors, logic bombs, etc. Malicious code will attack the user's device and attack other devices associated with the device through the code that has successfully invaded the user's device.

[0003] At present, when analyzing malicious code, the method adopted is to perform static analysis, dynamic analysis and intelligent analysis on the malicious code. Static analysis is to analyze the program instructions and structure of the malicious code to obtain static analysis results. The static analysis results include malicious code string entities, PE file entities, malicious program MD5 value entities, etc.; dynamic analysis is to simulate the process of software operation and generate dynamic analysis results based on the simulated software operation process. The dynamic analysis results include system call relationship entities, registry entities, file read and write entities, etc.; intelligent analysis is to collect a large amount of benign data and malicious data, train the model, and obtain intelligent analysis results. The intelligent analysis results include the association relationship entities of malicious sample data.

[0004] The second method is to detect whether the malicious code is in the threat intelligence data of the threat intelligence platform and obtain the analysis results of the threat intelligence platform. The analysis results of the threat intelligence platform include: vulnerability (Common Vulnerabilities & Exposures CVE) entity, fuzzy hash value (SSDeep) entity, file type (FileType) entity, etc.

[0005] Since the static analysis results, dynamic analysis results, intelligent analysis results and analysis results of the threat intelligence platform are stored in different places, the static analysis results, dynamic analysis results, intelligent analysis results and analysis results of the threat intelligence platform cannot be associated. Summary of the Invention

[0006] The present application provides a method, device and electronic device for obtaining a data analysis graph. By establishing an association relationship between an entity and a preset identifier, a data analysis graph is established. The association between each analysis result is displayed through the data analysis graph, thereby realizing multi-dimensional and multi-angle analysis of malicious code.

[0007] In a first aspect, the present application provides a method for obtaining a data analysis graph, the method comprising:

[0008] Obtain analysis results of N specified samples, and extract all entities corresponding to each specified sample from the analysis results, wherein the analysis results include one or more of static analysis results, dynamic analysis results, intelligent analysis results, and analysis results from a threat intelligence platform;

[0009] Associating the entities with the preset identifiers of the designated samples to which they belong, and establishing association relationships between the preset identifiers and the entities;

[0010] A data analysis graph is established based on the association between each preset identifier and each entity.

[0011] Through the method described above, the entities in the analysis results corresponding to multiple specified samples are associated with preset identifiers, and a data analysis map is established based on the association between the entities and the preset identifiers, thereby establishing an association between static analysis results, dynamic analysis results, intelligent analysis results and analysis results of the threat intelligence platform, realizing multi-dimensional and multi-angle analysis of malicious code.

[0012] In one possible design, all entities corresponding to each designated sample are extracted from the analysis results, including:

[0013] Detecting whether the security corpus contains the entity in the analysis result;

[0014] If so, directly extract the entity from the security corpus;

[0015] If not, the entity is placed in the safe corpus, and then the entity is extracted from the safe corpus.

[0016] In one possible design, before detecting whether the security corpus contains the entity in the analysis result, the following steps are included:

[0017] Detecting the existence of a predefined security corpus;

[0018] If yes, then the entities in the analysis result that are different from those in the security corpus are placed into the security prediction library;

[0019] If not, all entities corresponding to the analysis results are placed in the security corpus.

[0020] In one possible design, a data analysis graph is established based on the association between each preset identifier and each entity, including:

[0021] Entities corresponding to the same preset identifier are acquired, and a first association relationship between the same preset identifier and the entities is established.

[0022] Acquire each preset identifier corresponding to the same entity, and establish a second association relationship between the same entity and the each preset identifier;

[0023] A data analysis graph is established based on the first association relationship and the second association relationship.

[0024] In one possible design, after the data graph is established, it includes:

[0025] receiving a first instruction to display a portion of the data analysis graph, obtaining the data analysis graph of a specified area, and displaying the data analysis graph of the specified area;

[0026] A second instruction instructing to display all data analysis graphs is received, data analysis graphs of all regions are obtained, and the data analysis graphs of all regions are displayed.

[0027] In a second aspect, the present application provides a device for obtaining a data analysis graph, the device comprising:

[0028] An extraction module, configured to obtain analysis results of N specified samples and extract all entities corresponding to each specified sample from the analysis results;

[0029] An association module, configured to associate the entities with the preset identifiers of the designated samples to which they belong, and establish an association relationship between the preset identifiers and the entities;

[0030] The graph module is used to establish a data analysis graph based on the association between each preset identifier and each entity.

[0031] In one design, the extraction module is specifically used to detect whether the security corpus contains the entity in the analysis result. If so, the entity is directly extracted from the security corpus; if not, the entity is placed in the security corpus and then extracted from the security corpus.

[0032] In one design, the extraction module is also used to detect whether there is a predefined security corpus. If so, the entities in the analysis results that are different from those in the security corpus are placed in the security prediction library. If not, all entities corresponding to the analysis results are placed in the security corpus.

[0033] In one design, the graph module is specifically used to obtain each entity corresponding to the same preset identifier, establish a first association relationship between the same preset identifier and the each entity, obtain each preset identifier corresponding to the same entity, establish a second association relationship between the same entity and the each preset identifier, and establish a data analysis graph based on the first association relationship and the second association relationship.

[0034] In one design, the graph module is also used to receive a first instruction instructing to display part of the data analysis graph, obtain the data analysis graph of the specified area, and display the data analysis graph of the specified area, receive a second instruction instructing to display the entire data analysis graph, obtain the data analysis graph of the entire area, and display the data analysis graph of the entire area.

[0035] In a third aspect, the present application provides an electronic device, comprising:

[0036] Memory for storing computer programs;

[0037] The processor is used to implement the above-mentioned method steps for obtaining a data analysis graph when executing the computer program stored in the memory.

[0038] In a fourth aspect, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the computer program implements the above-mentioned method steps for obtaining a data analysis graph.

[0039] For each of the above-mentioned aspects from the first to the fourth aspects and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or various possible solutions in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 A flowchart of the steps of a method for obtaining a data analysis graph provided in this application;

[0041] Figure 2 A diagram showing the relationship between the network communication IP address provided for this application and the specified sample;

[0042] Figure 3 A diagram showing the relationship between the designated samples provided for this application and the network communication IP addresses and domain names;

[0043] Figure 4 Schematic diagram of the data analysis provided for this application;

[0044] Figure 5 A schematic diagram of the structure of a device for obtaining a data analysis graph provided in this application;

[0045] Figure 6 This is a schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent the following two situations: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0047] In previous technologies, when analyzing malicious code, the methods adopted were to perform static analysis, dynamic analysis, intelligent analysis, and analysis using a threat intelligence platform, thereby obtaining static analysis results, dynamic analysis results, intelligent analysis results, and analysis results from the threat intelligence platform. However, these analysis results have different data formats and are stored in different places, resulting in the independence of each type of analysis result, making it impossible to correlate the static analysis results, dynamic analysis results, intelligent analysis results, and analysis results from the threat intelligence platform.

[0048] In order to solve the above problems, the present application provides a method for obtaining a data analysis graph to realize the association of static analysis results, dynamic analysis results, intelligent analysis results, and analysis results of a threat intelligence platform, thereby achieving the purpose of multi-dimensional and multi-angle analysis of malicious code. Among them, the method and device described in the embodiments of the present application are based on the same technical concept. Since the principles of the problems solved by the method and the device are similar, the embodiments of the device and the method can refer to each other, and the repeated parts will not be repeated.

[0049] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0050] Reference Figure 1 This application provides a method for obtaining a data analysis graph. This method can associate static analysis results, dynamic analysis results, intelligent analysis results, and analysis results from a threat intelligence platform. The implementation process of this method is as follows:

[0051] Step S1: Obtain analysis results of N designated samples, and extract all entities corresponding to each designated sample from the analysis results.

[0052] In order to achieve multi-dimensional and multi-angle analysis of specified samples, it is necessary to first obtain N specified samples, where N is a positive integer. In the embodiment of the present application, the specified samples can be malicious code samples. The larger the number of N, the more specified samples are obtained, ensuring the diversity of the specified sample types and providing a basis for multi-dimensional analysis of the specified samples.

[0053] After obtaining N specified samples, data analysis is performed on each specified sample to obtain analysis results of each specified sample. In the embodiment of the present application, the data analysis method includes one or more of static analysis, dynamic analysis, intelligent analysis, and threat intelligence platform analysis, and the analysis results include one or more of static analysis results, dynamic analysis results, intelligent analysis results, and threat intelligence platform analysis results. Since the data analysis method is a technology well known to those skilled in the art, it is not explained in the embodiment of the present application.

[0054] After obtaining the analysis results of N specified samples, since the analysis results are composed of various entities, all entities corresponding to each specified sample can be extracted from the analysis results. In this application, the entity is the category name of the data analysis result.

[0055] It should be further explained that before extracting entities from the analysis results, in order to ensure that the extracted entities are entities in the analysis results of the specified sample, it is necessary to detect whether there is a predefined security corpus. The security corpus contains entities of various discovery results. If a security corpus exists, the entities in the analysis results that are different from those in the security corpus are placed in the security corpus. If there is no security corpus, all entities corresponding to the analysis results are placed in the security corpus.

[0056] After confirming that the security corpus is in place, it is necessary to detect whether the security corpus contains the entity in the analysis result. If the security corpus contains the entity in the analysis result, the entity is directly extracted from the security corpus. If the security corpus does not contain the entity in the analysis result, the entity is placed in the security corpus, and after the entity is placed in the security corpus, the entity is extracted from the security corpus.

[0057] Through the above method, a large number of specified samples and entities corresponding to the specified samples are obtained and entities are extracted from the security corpus, ensuring that the entity is in the security corpus, providing a large number of entities after data analysis, and ensuring the diversity of entity types.

[0058] Step S2: Associating the entities with the preset identifiers of the designated samples respectively, and establishing an association relationship between the preset identifiers and the entities.

[0059] After obtaining all entities corresponding to each specified sample, since the methods used to analyze the entities in each specified sample are different, the analysis results after the data analysis are independent of each other and do not affect each other. Therefore, the entities corresponding to the analysis results are also independent of each other and do not affect each other. The relationship between all entities in each specified sample is shown in Table 1. Table 1 is as follows:

[0060]

[0061] Table 1

[0062] In Table 1, each data analysis result corresponds to a different entity. Different entities have different formats and storage locations, and each entity is independent of each other. In the embodiment of the present application, there are many entities corresponding to each data analysis method. Only some of them are listed in Table 1. Since the focus of this application is not on the data analysis results, they will not be described in detail here.

[0063] In order to establish the relationship between the entities corresponding to each specified sample, all entities corresponding to each specified sample are associated with the same preset identifier, thereby establishing the association relationship between the preset identifier and the entity. The specified samples with the preset identifier are shown in Table 2:

[0064]

[0065] Table 2

[0066] In Table 2, the specified sample is marked with an MD5 value, and the entity in the specified sample is associated with the MD5. When the MD5 appears, it can be represented as the entity in Table 2. Table 2 only uses one specified sample as an example. For other specified samples, please refer to 2. No further explanation is given here.

[0067] In an embodiment of the present application, the preset identifier can be an MD5 value. When the MD5 value is the preset identifier, the preset identifier can be obtained by calculating the MD5 value of each specified sample. Since MD5 is unique, when the MD5 value is used as the preset identifier of each specified sample, each specified sample can be distinguished by the MD5 value.

[0068] It should be further explained that if dynamic analysis is used for a specific sample, since dynamic analysis simulates the actual operation of the software, when a user terminal communicates with other user terminals through the software, a network communication IP address will be generated. The network communication IP address records the IP addresses of other user terminals. When it is analyzed that there is a network threat in the communication between the user terminal and other user terminals, the network communication IP addresses of other user terminals and other user terminals will be recorded. For the dynamic analysis results, they can be marked by the network communication IP address. After marking with the network communication IP address, the specified sample corresponding to the same network communication IP address can be found, thereby obtaining more association relationships. The association relationships obtained after marking with the network communication IP address are as follows: Figure 2 As shown, Figure 2 This is a diagram showing the relationship between the network communication IP address and the specified sample. Figure 2 The lines between the network communication IP addresses and the specified samples represent the association relationships.

[0069] In actual applications, a specified sample has at least one network communication IP address. Therefore, a specified sample corresponds to multiple network communication IP addresses. When the specified sample is marked with a preset identifier, the preset identifier and the network communication IP address will form an association relationship. After obtaining the network communication IP address, the corresponding domain name can be obtained based on the network communication IP address. The association diagram between the network communication IP address, domain name and the specified sample is shown in the figure below. Figure 3 As shown, Figure 3 This is a diagram showing the relationship between network communication IP addresses and domain names and specified samples. Figure 3 The association relationship between the specified sample and the network communication IP address and domain name is listed in the figure. The number of association relationships is determined by the actual network communication IP address and domain name.

[0070] After establishing the association relationship between the preset identifier and each entity, the association relationship between the preset identifier and the entity and the entity corresponding to the specified sample are stored in the graph database, supporting existing commercial and open source graph databases.

[0071] Through the above method, each designated sample is given a preset identifier, and the entities in the designated sample are associated with the preset identifier, which solves the problem that the entities corresponding to different data analysis methods in each designated sample are not associated with each other.

[0072] Step S3: Create a data analysis graph based on the association between each preset identifier and each entity.

[0073] After each designated sample is given a preset identifier, the association relationship between all entities in each designated sample and the preset identifier is obtained. In order to solve the problem that the entities between each designated sample are not associated with each other, it is necessary to obtain each entity corresponding to the same preset identifier in each designated sample and establish a first association relationship between the same preset identifier and the entity. The association relationship between the same preset identifier and the entity is shown in Table 3:

[0074] Preset logo entity Specified sample-MD5 Malicious code strings, system call processes... ...... ......

[0075] Table 3

[0076] In Table 3, the malicious code string is the entity corresponding to the static analysis result, and the system call process is the entity corresponding to the dynamic analysis result. The two different entities establish an association relationship through the same preset identifier. Table 3 only lists the entities corresponding to the dynamic analysis results and the entities corresponding to the static analysis results that have no association relationship. In this application, there is at least one entity type that establishes an association relationship with the same preset identifier. For the association relationship between the entities corresponding to other data analysis results and the preset identifier, please refer to Table 3 and will not be described in detail here.

[0077] After establishing the first association relationship, the problem of the entities in each specified sample being unrelated to each other is solved. Since each specified sample is also unrelated to each other, it is necessary to establish an association relationship between each specified sample. Since the data analysis method adopted by each specified sample is universal, the entities in the analysis results obtained by the data analysis method have the same parts.

[0078] To establish an association relationship between each specified sample, it is necessary to obtain each preset identifier of the same entity, establish an association relationship between the same entity and the preset identifier, and record this association relationship as the second association relationship. The association relationship between the same entity and the preset identifier is shown in Table 4:

[0079]

[0080] Table 4

[0081] In Table 4, the malicious code string corresponds to three different entity identifiers. The relationship between other entities and preset identifiers is shown in Table 4 and will not be described in detail here.

[0082] After obtaining the first correlation and the second correlation, a data analysis graph is obtained according to the first correlation and the second correlation. The obtained data analysis graph is as follows: Figure 4 As shown, Figure 4 In the example, the association graphs between designated sample 1, designated sample 2, designated sample 3 and 9 entities are listed. The association graphs between other designated samples and entities can be referred to Figure 4We will not elaborate on this here. The data analysis graph shows the relationship between the specified sample and the entity, as well as the relationship between each specified sample.

[0083] After obtaining the data analysis map, when performing data analysis on a specified sample using the data analysis map, the data analysis map of the specified area can be obtained by a first instruction indicating display of part of the data analysis map, and the data analysis map of the specified area can be displayed, and the data analysis map of the entire area can be obtained by a second instruction indicating display of the entire data analysis map, and the data analysis map of the entire area can be displayed.

[0084] Through the above method, a first association relationship between unrelated entities in each specified sample and a second association relationship between each unrelated specified sample are established to obtain a data analysis graph, and the association relationship between the entity and the preset identifier is displayed in the form of a graph. The analysis results and the association relationship graph between the analysis results can be directly obtained through the data analysis graph, thereby realizing multi-dimensional and multi-angle analysis of the specified sample.

[0085] Based on the same inventive concept, the present application also provides a device for obtaining a data analysis graph, which is used to realize the association of static analysis results, dynamic analysis results, intelligent analysis results and analysis results of the threat intelligence platform, with reference to Figure 5 , the device comprises:

[0086] An extraction module 501 is configured to obtain analysis results of N designated samples and extract all entities corresponding to each designated sample from the analysis results;

[0087] An association module 502 is configured to associate the entities with the preset identifiers of the designated samples to which they belong, and to establish an association relationship between the preset identifiers and the entities;

[0088] The graph module 503 is used to establish a data analysis graph based on the association relationship between each preset identifier and each entity.

[0089] In one possible design, the extraction module 501 is specifically used to detect whether the security corpus contains the entity in the analysis result. If so, the entity is directly extracted from the security corpus; if not, the entity is placed in the security corpus and then extracted from the security corpus.

[0090] In one possible design, the extraction module 501 is also used to detect whether there is a predefined security corpus. If so, the entities in the analysis results that are different from those in the security corpus are placed in the security prediction library. If not, all entities corresponding to the analysis results are placed in the security corpus.

[0091] In one possible design, the graph module 503 is specifically used to obtain each entity corresponding to the same preset identifier, establish a first association relationship between the same preset identifier and the each entity, obtain each preset identifier corresponding to the same entity, establish a second association relationship between the same entity and the each preset identifier, and establish a data analysis graph based on the first association relationship and the second association relationship.

[0092] In one possible design, the graph module 503 is also used to receive a first instruction indicating display of a portion of the data analysis graph, obtain the data graph of a specified area, and display the data analysis graph of the specified area, receive a second instruction indicating display of the entire data analysis graph, obtain the data graph of the entire area, and display the data analysis graph of the entire area.

[0093] Based on the device provided by this application, the analysis results of N specified samples are obtained, and all entities corresponding to each specified sample are extracted from the analysis results, and the entities are respectively associated with the preset identifiers of the specified samples to which they belong, and an association relationship between the preset identifiers and each entity is established. According to the association relationship between each preset identifier and each entity, a data analysis map is established. Through the above-mentioned device, the entities corresponding to the analysis results of the specified samples are associated with the preset identifiers, and a data analysis map is established based on the association relationship between the entities and the preset identifiers. The static analysis results, dynamic analysis results, intelligent analysis results and the analysis results of the threat intelligence platform are associated, and the association relationship is displayed in the form of a data analysis map, thereby realizing multi-dimensional and multi-angle analysis of the specified samples.

[0094] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application, which can realize the function of the aforementioned device for obtaining a data analysis graph, referring to Figure 6 , the electronic device includes:

[0095] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 6 The diagram is represented by only one thick line, but this does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 may also be referred to as a controller, without limitation to the name.

[0096] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the method for obtaining a data analysis graph discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 5 The functions of each module in the device shown.

[0097] Among them, the processor 601 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 602 and calling data stored in the memory 602, the various functions of the device and processing data.

[0098] In one possible design, processor 601 may include one or more processing units. Processor 601 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily processes wireless communications. It is understood that the modem processor may not be integrated into processor 601. In some embodiments, processor 601 and memory 602 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0099] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of a method for obtaining a data analysis graph disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0100] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0101] By designing and programming the processor 601, the code corresponding to the method for obtaining a data analysis graph described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The embodiment shown is a step of obtaining a data analysis graph. How to design and program the processor 601 is a technique well known to those skilled in the art and will not be described in detail here.

[0102] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes a method for obtaining a data analysis graph discussed above.

[0103] In some possible embodiments, various aspects of the method for obtaining a data analysis graph provided by the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of a method for obtaining a data analysis graph according to various exemplary embodiments of the present application described above in this specification.

[0104] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0105] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0108] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for obtaining a data analysis graph, characterized in that: include: Obtain analysis results of N specified samples, and extract all entities corresponding to each specified sample from the analysis results, where N is a positive integer, and the analysis results include one or more of static analysis results, dynamic analysis results, intelligent analysis results, and analysis results from a threat intelligence platform; Associating the entities with the preset identifiers of the designated samples to which they belong, and establishing association relationships between the preset identifiers and the entities; Acquire entities corresponding to the same preset identifier, and establish a first association relationship between the same preset identifier and the entities; Acquire each preset identifier corresponding to the same entity, and establish a second association relationship between the same entity and the each preset identifier; A data analysis graph is established based on the first association relationship and the second association relationship.

2. The method according to claim 1, wherein Extract all entities corresponding to each specified sample from the analysis results, including: Detecting whether the security corpus contains the entity in the analysis result; If so, directly extract the entity from the security corpus; If not, the entity is placed in the safe corpus, and then the entity is extracted from the safe corpus.

3. The method according to claim 2, wherein Before detecting whether the security corpus contains the entity in the analysis result, the method includes: Detecting the existence of a predefined security corpus; If yes, then the entities in the analysis result that are different from those in the security corpus are placed into the security prediction library; If not, all entities corresponding to the analysis results are placed in the security corpus.

4. The method according to claim 1, wherein After establishing the data analysis map, including: receiving a first instruction to display a portion of the data analysis graph, obtaining the data analysis graph of a specified area, and displaying the data analysis graph of the specified area; A second instruction instructing to display all data analysis graphs is received, data analysis graphs of all regions are obtained, and the data analysis graphs of all regions are displayed.

5. A device for obtaining a data analysis graph, characterized in that: include: An extraction module, configured to obtain analysis results of N specified samples and extract all entities corresponding to each specified sample from the analysis results; An association module, configured to associate the entities with the preset identifiers of the designated samples to which they belong, and establish an association relationship between the preset identifiers and the entities; A graph module is used to obtain each entity corresponding to the same preset identifier, establish a first association relationship between the same preset identifier and the each entity, obtain each preset identifier corresponding to the same entity, establish a second association relationship between the same entity and the each preset identifier, and establish a data analysis graph based on the first association relationship and the second association relationship.

6. The device according to claim 5, characterized in that The extraction module is specifically used to detect whether the security corpus contains the entity in the analysis result. If so, the entity is directly extracted from the security corpus. If not, the entity is placed in the security corpus and then extracted from the security corpus.

7. The device according to claim 5, characterized in that The graph module is also used to receive a first instruction instructing to display part of the data analysis graph, obtain the data analysis graph of the specified area, and display the data analysis graph of the specified area, receive a second instruction instructing to display the entire data analysis graph, obtain the data analysis graph of the entire area, and display the data analysis graph of the entire area.

8. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the method steps described in any one of claims 1 to 4 when executing the computer program stored in the memory.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps according to any one of claims 1 to 4 are implemented.

Images