Malicious file detection method, device, equipment and medium

Abstract

The present disclosure relates to a method, device, equipment and medium for detecting malicious files, wherein the method for detecting malicious files comprises: obtaining a compressed file; decompressing the compressed file to obtain multiple derivative files; detecting the derivative files to obtain the maliciousness of the derivative files; and taking the maximum value of the maliciousness of the multiple derivative files as the maliciousness of the compressed file. According to the embodiments of the present disclosure, the maliciousness of the compressed file can be accurately assessed, so that the user can subsequently execute a processing strategy for the compressed file according to the maliciousness of the compressed file.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to a method, device, equipment and medium for detecting malicious files. Background Art

[0002] At present, many malicious files such as Trojans and hard disk bombs use compressed files to bundle programs to disguise themselves, reducing the chance of being detected during the spread process, making users more susceptible to network infection. It can be seen that it is particularly important to detect whether a compressed file is a malicious file.

[0003] However, there is currently no solution for judging the maliciousness of compressed files. How to judge the maliciousness of compressed files has become a problem that needs to be solved urgently. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a malicious file detection method, device, equipment and storage medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a method for detecting malicious files, including:

[0006] Get the compressed file;

[0007] Decompress the compressed file to obtain multiple derivative files;

[0008] Detect the derivative files to obtain the maliciousness of the derivative files;

[0009] The maximum value of the maliciousness levels of the multiple derivative files is used as the maliciousness level of the compressed file.

[0010] In a second aspect, an embodiment of the present disclosure provides a malicious file detection device, including:

[0011] A first acquisition module, used to acquire a compressed file;

[0012] A decompression module is used to decompress the compressed file to obtain multiple derivative files;

[0013] The first detection module is used to detect the derivative files and obtain the maliciousness of the derivative files;

[0014] The first determination module is used to take the maximum value of the maliciousness levels of the multiple derivative files as the maliciousness level of the compressed file.

[0015] In a fourth aspect, an embodiment of the present disclosure provides an electronic device, including:

[0016] processor;

[0017] A memory for storing executable instructions;

[0018] The processor is used to read executable instructions from the memory and execute the executable instructions to implement the method as described in the first aspect.

[0019] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method described in the first aspect is implemented.

[0020] Compared with the existing solutions, the technical solution provided by the embodiments of the present disclosure has the following advantages:

[0021] The malicious file detection method, device, equipment and medium provided by the embodiments of the present disclosure can obtain a compressed file, decompress the compressed file to obtain multiple derivative files, detect the derivative files, obtain the maliciousness of the derivative files, and use the maximum value of the maliciousness of the multiple derivative files as the maliciousness of the compressed file. In this way, the purpose of determining whether the compressed file is a malicious file can be achieved, and the maximum value of the maliciousness of all the derivative files contained in the compressed file is used as the maliciousness of the compressed file, which can accurately assess the maliciousness of the compressed file, so that the user can subsequently execute a processing strategy for the compressed file according to the maliciousness of the compressed file. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the existing acceleration solutions, the drawings required for use in the description of the embodiments or the existing acceleration solutions are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] Figure 1 is a flow chart of a malicious file detection method provided by an embodiment of the present disclosure;

[0025] Figure 2 is a schematic diagram of a hierarchical structure of a compressed file provided by an embodiment of the present invention;

[0026] Figure 3 and Figure 4 is a schematic diagram of a detection report provided by an embodiment of the present disclosure;

[0027] Figure 5 is a schematic diagram of a hierarchical structure of another compressed file provided by an embodiment of the present invention;

[0028] Figure 6 and Figure 7 is another detection report schematic diagram provided by an embodiment of the present disclosure;

[0029] Figure 8 is a schematic diagram of a hierarchical structure of another compressed file provided by an embodiment of the present invention;

[0030] Fig. 9 is a schematic diagram of a file list of derivative files to be detected provided by an embodiment of the present invention;

[0031] Fig.10 , Fig.11 ,and Fig.12 It is another detection report schematic diagram provided by an embodiment of the present disclosure;

[0032] Fig.13 It is a flowchart of a malicious file detection process provided by an embodiment of the present disclosure;

[0033] Fig.14 It is a structural schematic diagram of a malicious file detection device provided by an embodiment of the present disclosure;

[0034] Fig.15 It is a structural schematic diagram of an electronic device in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0035] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0036] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0037] Figure 1 1 is a flowchart of a malicious file detection method provided by an embodiment of the present disclosure, and the method can be performed by an electronic device. The electronic device can be exemplarily understood as a device with computing functions such as a mobile phone, a tablet computer, a laptop computer, a desktop computer, a smart TV, etc. Figure 1 As shown, the method provided in this embodiment includes the following steps:

[0038] S110: Obtain a compressed file.

[0039] In the disclosed embodiment, when a user wants to know whether a compressed file is a malicious compressed file, the compressed file can be detected by an electronic device. Specifically, the electronic device can first obtain the compressed file to be detected, and then decompress the compressed file. When the compressed file is successfully decompressed, the decompressed derivative file can be detected to obtain the maliciousness of the derivative file, and the maximum value of the maliciousness of multiple derivative files is used as the maliciousness of the compressed file. When the compressed file fails to be decompressed, the compressed file as a whole can be treated as a file for detection. At this time, the maliciousness obtained by the detection is the maliciousness of the compressed file.

[0040] In some embodiments, the malicious file detection method can be implemented in a virtual analysis machine that highly simulates the real environment, thus not affecting the real environment.

[0041] Specifically, the compressed file may be a local file, or a file sent by other electronic devices through wired communication or wireless communication, which is not limited in the present disclosure.

[0042] Specifically, the compressed file may be an encrypted file or a non-encrypted file, and the present disclosure does not limit this.

[0043] Specifically, the compressed file may include a compressed file of an application program, such as a compressed file of office software or a compressed file of game software, etc. The compressed file may also include a compressed file of a multimedia program, such as a compressed file containing multiple audio and video files, a compressed file containing multiple photos, etc. The present disclosure does not limit this.

[0044] Specifically, the file format types of compressed files may include rar, zip, zlib, gz, 7z, bz, bz2, cab, ace, jar, msi, rpm, tar, tgz, uue, xz, xar, z, arj, lzh, etc., but are not limited to these.

[0045] S120: Decompress the compressed file to obtain multiple derivative files.

[0046] Specifically, the derivative files are files extracted from the compressed file. The number of derivative files in the compressed file and the file type of each derivative file depend on the files before the compressed file is compressed.

[0047] In some embodiments, the compressed file may be an encrypted compressed file.

[0048] At this time, if the electronic device has obtained the password corresponding to the compressed file before S120, the electronic device can decompress the compressed file according to the password.

[0049] If the electronic device has not obtained the password corresponding to the compressed file before S120, the electronic device may try to decompress the compressed file according to each password in the built-in conventional password table.

[0050] It is understandable that some compressed file providers encrypt compressed files to prevent users from accidentally opening compressed files after obtaining them. Some passwords commonly used by compressed file providers can be placed in the conventional password table in the electronic device. In this way, when the user does not provide the password for the encrypted compressed file, the electronic device can try to decompress the compressed file according to the passwords in the built-in conventional password table, thereby increasing the probability of successful decompression of the encrypted compressed file.

[0051] In other embodiments, the compressed file may be a non-encrypted compressed file.

[0052] At this time, the electronic device can directly decompress the obtained compressed file.

[0053] Specifically, there are two results after the electronic device decompresses the compressed file.

[0054] In some embodiments, if the electronic device successfully decompresses the compressed file and obtains a plurality of derivative files, the electronic device may subsequently detect the derivative files.

[0055] In other implementations, if the electronic device fails to decompress the file, the compressed file as a whole may be subsequently detected as one file.

[0056] S130: Detect the derivative files to obtain the maliciousness level of the derivative files.

[0057] Specifically, the specific implementation method for detecting the derivative files can be set by those skilled in the art according to the actual situation, and is not limited here. For example, static analysis method, dynamic analysis method, or hybrid analysis method based on machine learning can be adopted, but it is not limited thereto.

[0058] Optionally, each derivative file may be subjected to in-depth dynamic analysis and detection to obtain the maliciousness level of the derivative file.

[0059] It is understandable that by performing dynamic behavior analysis on derivative files, not only malicious files in a known range can be detected, but also malicious files in an unknown range can be detected, making it difficult for malicious compressed files to escape and improving the ability to detect unknown threats.

[0060] S140: Taking the maximum value of the maliciousness levels of the multiple derivative files as the maliciousness level of the compressed file.

[0061] Specifically, there are many specific implementations of S140, and typical examples are described below, but they do not constitute a limitation to the present disclosure.

[0062] In some embodiments, S140 may include: after the electronic device completes the detection of all derivative files, sorting the maliciousness of all derivative files from large to small, and taking the maliciousness of the file ranked first as the maliciousness of the compressed file.

[0063] In some other embodiments, S140 may include: S141. In the process of detecting the derivative files one by one, taking the maximum value of the maliciousness levels of the detected derivative files as the maliciousness level of the compressed file in real time.

[0064] Specifically, S141 may include: S1411, set the initial value of the maliciousness of the compressed file to 0, and set i=1; S1412, after the electronic device completes the detection of the i-th derivative file, obtains the maliciousness of the i-th derivative file, and when it is detected that the maliciousness of the i-th derivative file is greater than the maliciousness of the compressed file, the maliciousness of the i-th derivative file is used as the maliciousness of the compressed file, and when it is detected that the maliciousness of the i-th derivative file is less than or equal to the maliciousness of the compressed file, the maliciousness of the compressed file is not updated; S1413, set i=i+1; repeat S1412 and S1413 until i=N+1, where 1≤i≤N, N is the total number of derivative files, and i and N are both positive integers.

[0065] Optionally, the method for detecting malicious compressed files also includes: updating the detection flag in real time during the process of detecting derivative files one by one; wherein the detection flag is used to indicate whether the detection of all derivative files has been completed; and sending the maliciousness level and detection flag of the compressed file to the linkage device in real time.

[0066] Specifically, the linked device may be an electronic device equipped with a detection device for malicious detection files.

[0067] Specifically, the specific form of the detection flag can be set by those skilled in the art according to actual conditions, and is not limited here. For example, 0 can be used to indicate that the detection of all derivative files has not been completed, and 1 can be used to indicate that the detection of all derivative files has been completed. But it is not limited to this.

[0068] Specifically, after completing S1412 for each derivative file, the detection flag is updated, and the maliciousness of the compressed file and the detection flag are sent to the linkage device. In this way, the linkage device can know the detection progress of the derivative file in real time. And the linkage device can make corresponding strategies according to the maliciousness of the compressed file in time by receiving the maliciousness of the compressed file in real time, such as continuing transmission, blocking session, refusing to receive, etc., but it is not limited to this.

[0069] It is understandable that, compared to using the minimum value of the maliciousness of multiple derivative files, or the average value of the maliciousness of multiple derivative files, as the maliciousness of the compressed file, in the embodiment of the present disclosure, by detecting the derivative files and applying the detection results to the compressed files to which they belong, it is achieved that the maximum value of the maliciousness of multiple derivative files is used as the maliciousness of the compressed file. It should be understood by those skilled in the art that the more malicious the derivative files are, the more likely they are to attack the user's electronic device, and as long as the compressed file contains a derivative file with a high maliciousness, the more likely the compressed file is to attack the user's electronic device. By using the maximum value of the maliciousness of multiple derivative files as the maliciousness of the compressed file, as long as the compressed file contains a derivative file with a high maliciousness, the maliciousness of the compressed file can be evaluated as high, thereby achieving the effect of accurately judging the maliciousness of the compressed file.

[0070] The malicious file detection method, device, equipment and medium provided by the embodiments of the present disclosure can obtain a compressed file, decompress the compressed file to obtain multiple derivative files, detect the derivative files, obtain the maliciousness of the derivative files, and use the maximum value of the maliciousness of the multiple derivative files as the maliciousness of the compressed file. In this way, the purpose of determining whether the compressed file is a malicious file can be achieved, and the maximum value of the maliciousness of all the derivative files contained in the compressed file is used as the maliciousness of the compressed file, which can accurately assess the maliciousness of the compressed file, so that the user can subsequently execute a processing strategy for the compressed file according to the maliciousness of the compressed file.

[0071] In another embodiment of the present disclosure, the method for detecting malicious compressed files also includes, before detecting the derivative files to obtain the maliciousness level of the derivative files, determining the total number of derivative files; when it is detected that the total number is greater than a first preset threshold, selecting at least one derivative file from multiple derivative files to obtain at least one derivative file to be detected; wherein, detecting the derivative files to obtain the maliciousness level of the derivative files includes: detecting the derivative files to be detected to obtain the maliciousness level of the derivative files to be detected; taking the maximum value among the maliciousness levels of multiple derivative files as the maliciousness level of the compressed file includes: taking the maximum value among the maliciousness levels of at least one derivative file to be detected as the maliciousness level of the compressed file.

[0072] Specifically, the specific value of the first preset threshold can be set by those skilled in the art according to actual conditions and is not limited here.

[0073] In some embodiments of the present disclosure, when the total number of derivative files is greater than a first preset threshold, it indicates that the number of derivative files is relatively large.

[0074] At this time, at least one derivative file can be selected from multiple derivative files to obtain at least one derivative file to be detected, and then the derivative file to be detected is detected. Other derivative files other than the derivative file to be detected are no longer detected. In this way, the number of derivative files to be detected can be reduced, thereby shortening the time required for detection, improving the overall detection efficiency of compressed files, and reducing unnecessary detection consumption.

[0075] Specifically, there are many specific implementation methods for selecting at least one derivative file from multiple derivative files. Typical examples will be described in detail later and will not be described here in detail.

[0076] Specifically, for the selected derivative files to be detected, the specific implementation method of "detecting the derivative files to be detected to obtain the maliciousness of the derivative files to be detected; taking the maximum value of the maliciousness of at least one derivative file to be detected as the maliciousness of the compressed file" is similar to that of "detecting the derivative files to obtain the maliciousness of the derivative files; taking the maximum value of the maliciousness of the derivative files as the maliciousness of the compressed file" for all derivative files, and will not be repeated here.

[0077] In some embodiments of the present disclosure, when the total number of derivative files is less than or equal to the first preset threshold, it indicates that the number of derivative files is small.

[0078] At this time, all derivative files can be used as derivative files to be detected, that is, each derivative file can be detected. The specific implementation method for determining the maliciousness of the compressed file can be found in the previous text and will not be repeated here. In this way, any derivative file can be detected to prevent malicious derivative files from escaping detection and improve detection accuracy.

[0079] In another embodiment of the present disclosure, selecting at least one derivative file from multiple derivative files to obtain at least one derivative file to be detected may include: determining the file type of each derivative file; and taking a derivative file whose file type belongs to a preset detection file type as a derivative file to be detected.

[0080] Specifically, the specific type of the preset detection file type can be set by those skilled in the art according to actual conditions, and is not limited here. For example, a large number of malicious files can be used as samples to determine the file type of each malicious file; the number of malicious files contained in different file types can be counted; and the first second preset number of file types containing the largest number of malicious files can be used as the preset detection file type. However, it is not limited to this.

[0081] It is understandable that the preset detection file types include common malicious file types, and detecting derivative files belonging to the preset detection file types can reduce the possibility of missing malicious derivative files.

[0082] In another embodiment of the present disclosure, selecting at least one derivative file from multiple derivative files to obtain at least one derivative file to be detected includes: configuring a detection weight for each derivative file; and selecting at least one derivative file from multiple derivative files according to the detection weight of each derivative file to obtain at least one derivative file to be detected.

[0083] Specifically, the detection weight is used to characterize the degree to which the derivative file needs to be detected. The larger the detection weight, the more the derivative file needs to be detected.

[0084] In some embodiments, configuring a detection weight for each derivative file may include: determining a file type of the derivative file; and determining a detection weight for the derivative file according to the file type of the derivative file based on an association between the file type and the detection weight.

[0085] Specifically, the association between file type and detection weight can be pre-stored in the electronic device. The method for determining the association between file type and detection weight can be set by those skilled in the art according to actual conditions, and is not limited here. For example, a large number of malicious files can be used as samples; the file type of each malicious file is determined; the number of malicious files contained in different file types is counted; according to the rule that the greater the number of malicious files contained in a file type, the greater its detection weight, the detection weight is configured for each file type to obtain the association between file type and detection weight.

[0086] It can be understood that by determining the detection weight of a derivative file based on the correlation between the file type and the detection weight, when the file type of the derivative file belongs to the type of a common malicious file, its detection weight is higher, thereby increasing the probability of detecting it, thereby reducing the possibility of missing detection of malicious derivative files.

[0087] In some embodiments, at least one derivative file is selected from multiple derivative files based on the detection weights of each derivative file to obtain at least one derivative file to be detected, including: sorting the detection weights of each derivative file in ascending order; and determining the derivative files corresponding to the first first preset number of detection weights as the derivative files to be detected.

[0088] Specifically, the specific value of the first preset number can be set by those skilled in the art according to actual conditions and is not limited here.

[0089] It can be understood that by determining the derivative files corresponding to the first preset number of detection weights as the derivative files to be detected, the derivative files with higher detection weights can be determined as the derivative files to be detected, thereby reducing the possibility of missing malicious derivative files.

[0090] In other embodiments, at least one derivative file is selected from multiple derivative files based on the detection weight of each derivative file to obtain at least one derivative file to be detected, including: a detection weight for each derivative file; and a derivative file whose detection weight is greater than a preset detection weight threshold is determined as a derivative file to be detected.

[0091] Specifically, the specific value of the preset detection weight threshold can be set by those skilled in the art according to actual conditions and is not limited here.

[0092] It can be understood that by determining derivative files with detection weights greater than a preset detection weight threshold as derivative files to be detected, derivative files with higher detection weights can be determined as derivative files to be detected, thereby reducing the possibility of missing malicious derivative files.

[0093] In another embodiment of the present disclosure, after obtaining the compressed file, the method further includes: if it is detected that the decompression of the compressed file fails, taking the entire compressed file as a file to be detected; and detecting the file to be detected to obtain the maliciousness level of the compressed file.

[0094] Specifically, when the decompression of a compressed file fails, the compressed file as a whole can be detected as one file. In this case, the maliciousness level obtained by the detection is the maliciousness level of the compressed file. In this way, even if the compressed file is successfully decompressed, the maliciousness level of the compressed file can be judged, thereby improving the user experience.

[0095] In another embodiment of the present disclosure, the method for detecting malicious compressed files further includes: after the detection of each derivative file is completed, sending a detection report to the linkage device.

[0096] Optionally, the detection report may include file information of the derived file (e.g., file name, file type, etc.), maliciousness of the derived file, and maliciousness of the compressed file. However, it is not limited thereto. In this way, the detection result of the compressed file can be presented to the user intuitively, and the detection result of the compressed file can be made more convincing, thereby improving the user experience and the credibility of the determination result.

[0097] For example, Figure 2 It is a schematic diagram of the hierarchical structure of a compressed file provided by an embodiment of the present invention. Figure 3 and Figure 4 is a schematic diagram of a test report provided by an embodiment of the present disclosure. Figure 2 The compressed file includes 3 derivative files, 2 white sample derivative files in the first-level directory and 1 malicious derivative file in the second-level directory. Figure 3 and Figure 4, the detection report of the compressed file shows that the two derivative files in the secondary directory are malicious derivative files, which is the same as the situation where the compressed file contains malicious derivative files. It can be seen that the detection process is not interfered by the white sample derivative files. At the same time, the specific detection results and risk behavior list of each derivative file can be displayed in detail, which is convenient for users to trace and issue report details.

[0098] For example, Figure 5 It is a schematic diagram of the hierarchical structure of another compressed file provided by an embodiment of the present invention. Figure 6 and Figure 7 is another detection report schematic diagram provided by the embodiment of the present disclosure. Figure 5 The compressed file contains a white sample derivative file in the second level directory, and no files in other directories. Figure 6 and Figure 7 ,The detection report of the compressed file shows that a derivative file in the secondary directory is a white sample derivative file, which does not include malicious derivative files, which is the same as the situation where the compressed file contains malicious derivative files.

[0099] For example, Figure 8 It is a schematic diagram of the hierarchical structure of another compressed file provided by an embodiment of the present invention. Fig. 9 It is a schematic diagram of a file list of derivative files to be detected provided by an embodiment of the present invention. Fig.10 , Fig.11 ,and Fig.12 is another detection report schematic diagram provided by the embodiment of the present disclosure. Figure 8 , the compressed file contains a large number of derivative files, the derivative file types include exe, pdf, dll, txt, etc. The derivative files with the top N detection weights are taken as the derivative files to be detected, such as Fig. 9 The test report is as shown. Fig.13 , Fig.14 and Fig.15 shown.

[0100] In another embodiment of the present disclosure, the method for detecting malicious compressed files further includes: after the compressed file is detected as a whole as one file, sending a detection report to the linkage device.

[0101] Specifically, the detection report may include prompt information of compressed file decompression failure and the maliciousness of the compressed file. However, it is not limited to this. In this way, the detection result of the compressed file can be presented to the user intuitively, and the detection result of the compressed file can be made more convincing, thereby improving the user experience and the credibility of the judgment result.

[0102] Below, the malicious file detection method provided by the embodiment of the present disclosure will be described in detail based on a specific example.

[0103] Fig.13 is a flowchart of a malicious file detection process provided by an embodiment of the present disclosure. Fig.13 , the malicious file detection process specifically includes the following steps:

[0104] S13010. Obtain a compressed file.

[0105] S13020, check whether the compressed file is encrypted. If yes, execute S13030; if no, execute S13060.

[0106] S13030: Check whether the user has configured a password. If yes, execute S13040; if no, execute S13050.

[0107] S13040. Decompress the compressed file according to the password configured by the user.

[0108] S13050. Decompress the compressed file according to each password in the built-in conventional password table.

[0109] S13060. Decompress the compressed file directly.

[0110] S13070: Check whether the compressed file is successfully decompressed. If yes, execute S13080; if no, execute S13150.

[0111] S13080. Determine the total number of derivative files.

[0112] S13090: Check whether the total number of derivative files is greater than a first preset threshold. If so, execute S13100; if not, execute S13120.

[0113] S13100. Configure a detection weight for each derivative file.

[0114] S13110. Sort the detection weights of the derivative files in ascending order, and determine the derivative files corresponding to the first preset number of detection weights as the derivative files to be detected.

[0115] S13120. Treat all derivative files as derivative files to be detected.

[0116] S13130. In the process of detecting the derivative files to be detected one by one, the maximum value of the maliciousness levels of the detected derivative files to be detected is used in real time as the maliciousness level of the compressed file.

[0117] S13140. Send the maliciousness level and detection flag of the compressed file to the linkage device in real time.

[0118] S13150. Use the entire compressed file as the file to be detected.

[0119] The malicious compressed file detection method provided by the embodiment of the present invention can perform malicious file detection on compressed files without limiting the compression level, so as to achieve the purpose of accurately identifying whether the compressed file is a malicious file; the ability of the derivative file result to act on the main file is used to shield the attacker's obfuscation operation; the detection priority of the derivative file type is formulated to reduce the detection consumption of non-malicious files and improve the detection efficiency of compressed files; the detection results of malicious programs are provided in a timely manner to facilitate rapid linkage, and detailed detection results are provided asynchronously to facilitate users to provide strong detection evidence.

[0120] Fig.14 1 is a schematic diagram of a malicious file detection device provided by an embodiment of the present disclosure. The malicious file detection device can be understood as the above electronic device or a part of the functional modules in the above electronic device. Fig.14 As shown, the malicious file detection device 1400 includes:

[0121] A first acquisition module 1410 is used to acquire a compressed file;

[0122] A decompression module 1420, configured to decompress the compressed file to obtain a plurality of derivative files;

[0123] The first detection module 1430 is used to detect the derivative file and obtain the maliciousness level of the derivative file;

[0124] The first determination module 1440 is configured to use the maximum value of the maliciousness levels of the multiple derivative files as the maliciousness level of the compressed file.

[0125] The malicious file detection device provided by the embodiment of the present disclosure can obtain a compressed file, decompress the compressed file, obtain multiple derivative files, detect the derivative files, obtain the maliciousness of the derivative files, and use the maximum value of the maliciousness of the multiple derivative files as the maliciousness of the compressed file. In this way, the purpose of determining whether the compressed file is a malicious file can be achieved, and the maximum value of the maliciousness of all the derivative files contained in the compressed file is used as the maliciousness of the compressed file, which can accurately assess the maliciousness of the compressed file, so that the user can subsequently execute a processing strategy for the compressed file according to the maliciousness of the compressed file.

[0126] In some other embodiments of the present disclosure, the device further includes:

[0127] A second determination module is used to determine the total number of derivative files before detecting the derivative files to obtain the maliciousness of the derivative files;

[0128] A selection module, configured to select at least one derivative file from the plurality of derivative files to obtain at least one derivative file to be detected when it is detected that the total number is greater than a first preset threshold;

[0129] The first detection module 1430 is specifically used to detect the derivative file to be detected and obtain the maliciousness level of the derivative file to be detected;

[0130] The first determination module 1440 is specifically configured to use the maximum value of the maliciousness level of at least one derivative file to be detected as the maliciousness level of the compressed file.

[0131] In some other embodiments of the present disclosure, the selection module may include:

[0132] Configuration submodule, used to configure detection weights for each derivative file;

[0133] The selection submodule is used to select at least one derivative file from multiple derivative files according to the detection weight of each derivative file, so as to obtain at least one derivative file to be detected.

[0134] In some other embodiments of the present disclosure, the configuration submodule may include:

[0135] A first determining unit, used to determine the file type of the derived file;

[0136] The second determining unit is used to determine the detection weight of the derivative file according to the file type of the derivative file based on the association relationship between the file type and the detection weight.

[0137] In some other embodiments of the present disclosure, the selection submodule may include:

[0138] A sorting unit, used for sorting the detection weights of each derivative file in ascending order;

[0139] The selection unit is used to determine the derivative files corresponding to the first preset number of detection weights as the derivative files to be detected.

[0140] In some other embodiments of the present disclosure, the first determination module 1440 specifically includes: in the process of detecting the derivative files one by one, taking the maximum value of the maliciousness of the detected derivative files as the maliciousness of the compressed file in real time.

[0141] In some other embodiments of the present disclosure, the device further includes:

[0142] An update module, used to update the detection flag in real time during the process of detecting the derivative files one by one; wherein the detection flag is used to indicate whether the detection of all the derivative files has been completed;

[0143] The sending module is used to send the maliciousness level and detection flag of the compressed file to the linkage device in real time.

[0144] In some other embodiments of the present disclosure, the device further includes:

[0145] A third determination module is used to, after obtaining the compressed file, if it is detected that the decompression of the compressed file fails, use the entire compressed file as a file to be detected;

[0146] The second detection module is used to detect the file to be detected and obtain the maliciousness level of the compressed file.

[0147] The device provided in this embodiment can perform the above Figure 1 and Fig.13 The method of any embodiment has similar execution mode and beneficial effects, which will not be described in detail here.

[0148] For example, Fig.15 Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Fig.15 , which shows a schematic diagram of the structure of an electronic device 1500 suitable for implementing the embodiment of the present disclosure. The electronic device 1500 in the embodiment of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.15 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0149] like Fig.15 As shown, the electronic device 1500 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 1501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1502 or a program loaded from a storage device 1508 into a random access memory (RAM) 1503. In the RAM 1503, various programs and data required for the operation of the electronic device 1500 are also stored. The processing device 1501, the ROM 1502, and the RAM 1503 are connected to each other via a bus 1504. An input / output (I / O) interface 1505 is also connected to the bus 1504.

[0150] Typically, the following devices may be connected to the I / O interface 1505: an input device 1506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1508 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1509. The communication device 1509 may allow the electronic device 1500 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.15 The electronic device 1500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0151] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 1509, or installed from a storage device 1508, or installed from a ROM 1502. When the computer program is executed by the processing device 1501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0152] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0153] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0154] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0155] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: obtains a compressed file; decompresses the compressed file to obtain multiple derivative files; detects the derivative files to obtain the maliciousness level of the derivative files; and uses the maximum value of the maliciousness levels of the multiple derivative files as the maliciousness level of the compressed file.

[0156] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0157] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0158] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0159] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0160] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0161] The present disclosure also provides a computer-readable storage medium in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned Figure 1 and Fig.13 The method of any embodiment has similar execution mode and beneficial effects, which will not be described in detail here.

[0162] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0163] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting malicious files, characterized in that: include: Get the compressed file; Decompressing the compressed file to obtain multiple derivative files; determining the total number of said derivative files; When it is detected that the total number is greater than a first preset threshold, at least one derivative file is selected from the multiple derivative files to obtain at least one derivative file to be detected, wherein the selecting at least one derivative file from the multiple derivative files to obtain at least one derivative file to be detected includes: determining the file type of each derivative file, and taking a derivative file whose file type belongs to a preset detection file type as a derivative file to be detected, wherein the preset detection file type is determined in the following manner: taking multiple malicious files as samples, determining the file type of each malicious file, counting the number of malicious files contained in different file types, and taking the first second preset number of file types containing the largest number of malicious files as the preset detection file type; Detecting the derivative file to be detected to obtain the maliciousness level of the derivative file to be detected; The maximum value among the maliciousness levels of the at least one derivative file to be detected is used as the maliciousness level of the compressed file.

2. The method according to claim 1, characterized in that The step of selecting at least one derivative file from the plurality of derivative files to obtain at least one derivative file to be detected comprises: configuring a detection weight for each of the derivative files; At least one derivative file is selected from the multiple derivative files according to the detection weight of each derivative file to obtain at least one derivative file to be detected.

3. The method according to claim 2, characterized in that Configuring a detection weight for each of the derivative files includes: determining a file type of the derived file; Based on the association between the file type and the detection weight, the detection weight of the derivative file is determined according to the file type of the derivative file.

4. The method according to claim 2, characterized in that: According to the detection weight of each of the derivative files, at least one derivative file is selected from the multiple derivative files to obtain at least one derivative file to be detected, including: The detection weights of the derivative files are sorted in ascending order; The derivative files corresponding to the first preset number of detection weights are determined as the derivative files to be detected.

5. The method according to claim 1, characterized in that The taking the maximum value of the maliciousness levels of the plurality of derivative files as the maliciousness level of the compressed file comprises: In the process of detecting the derivative files one by one, the maximum value of the maliciousness levels of the detected derivative files is taken in real time as the maliciousness level of the compressed file.

6. The method according to claim 5, characterized in that Also includes: In the process of detecting the derivative files one by one, the detection flag is updated in real time; wherein the detection flag is used to indicate whether the detection of all the derivative files has been completed; The maliciousness level of the compressed file and the detection flag are sent to the linkage device in real time.

7. The method according to claim 1, characterized in that After obtaining the compressed file, the method further includes: If it is detected that the decompression of the compressed file fails, the compressed file as a whole is used as a file to be detected; The file to be detected is detected to obtain the maliciousness level of the compressed file.

8. A malicious file detection device, characterized in that: include: A first acquisition module, used to acquire a compressed file; A decompression module, used for decompressing the compressed file to obtain multiple derivative files; A second determination module, used to determine the total number of the derivative files; A selection module, configured to select at least one derivative file from the multiple derivative files to obtain at least one derivative file to be detected when it is detected that the total number is greater than a first preset threshold, wherein the selecting at least one derivative file from the multiple derivative files to obtain at least one derivative file to be detected includes: determining the file type of each derivative file, and taking a derivative file whose file type belongs to a preset detection file type as the derivative file to be detected, wherein the preset detection file type is determined in the following manner: taking multiple malicious files as samples, determining the file type of each malicious file, counting the number of malicious files contained in different file types, and taking the first second preset number of file types containing the largest number of malicious files as the preset detection file type; A first detection module, used to detect the derivative file to be detected and obtain the maliciousness level of the derivative file to be detected; The first determination module is configured to use the maximum value of the maliciousness levels of the at least one derivative file to be detected as the maliciousness level of the compressed file.

9. An electronic device, characterized in that: include: processor; A memory for storing executable instructions; The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the malicious file detection method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the processor implements the malicious file detection method according to any one of claims 1 to 7.

Images