Sample retrace method and device, electronic device, and storage medium

Abstract

The present application provides a sample retrace method and apparatus, an electronic device, and a computer-readable storage medium. The method includes: generating retrace configuration information in response to a retrace instruction; wherein the retrace configuration information includes a sample screening strategy, wherein the sample screening strategy is used to screen out samples whose scan results are expected to change; based on the sample screening strategy, screening out multiple historical samples; and scanning each of the screened historical samples to obtain a scan result corresponding to each historical sample. The present application solution can accurately screen out historical samples whose scan results may change, and can complete the retrace task while using fewer computing resources.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a sample retrace method and device, an electronic device, and a computer-readable storage medium. Background Art

[0002] The cloud control platform collects sample data through client applications and runs it through the antivirus module to determine whether it contains viruses, thereby generating scan results. When the antivirus module is updated or the virus database is upgraded, virus identification rules may change. In this case, the scan results of historical samples may also change. Samples previously identified as common may now be classified as viruses under the new virus identification rules, and vice versa. Therefore, the cloud control platform needs to rescan historical samples for which scan results have already been obtained, re-scanning them to obtain the scan results under the new rules.

[0003] Related technologies, limited by the platform's computing power, often can't perform a comprehensive retrieval of all historical samples in a short period of time. Typically, retrieval is limited to historical samples that appeared shortly before the rule change or were popular within a short period. This retrieval strategy can't accurately identify historical samples whose scan results may have changed, and it ignores a large number of historical samples that appeared earlier, making it impossible to obtain accurate scan results. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a sample retracement method and device, an electronic device, and a computer-readable storage medium for accurately screening out historical samples whose scanning results may change, and completing the retracement task with less computing resource usage.

[0005] In one aspect, the present application provides a sample retrace method, comprising:

[0006] In response to the retrace instruction, generating retrace configuration information; wherein the retrace configuration information includes a sample screening strategy, the sample screening strategy is used to screen out samples whose scan results are expected to change;

[0007] Based on the sample screening strategy, screening out multiple historical samples;

[0008] Scan each filtered historical sample to obtain a scanning result corresponding to each historical sample.

[0009] In one embodiment, the screening of multiple historical samples based on the sample screening strategy includes:

[0010] Obtain the multiple historical samples according to the sample storage path in the sample screening strategy; or,

[0011] The plurality of historical samples are searched and obtained based on the screening conditions in the sample screening strategy through the sample search function of Morpheus.

[0012] In one embodiment, the sample screening strategy is used to screen samples based on one or more of the following dimensions: sample type, hazard level, sample name keywords, sample reporting time, source, and popularity parameters.

[0013] In one embodiment, the method further comprises:

[0014] When the number of the plurality of historical samples is greater than an upper limit threshold specified by the sample screening strategy, constructing a screening feature based on a sample parameter of each historical sample;

[0015] For each historical sample, the screening features of the historical sample are processed according to the scoring model to obtain a score for the historical sample; wherein the score is positively correlated with the probability of the expected change in the scan result;

[0016] The historical samples whose score rankings are below the upper limit threshold are filtered out to select the multiple historical samples.

[0017] In one embodiment, scanning each filtered historical sample to obtain a scanning result corresponding to each historical sample includes:

[0018] When the number of the plurality of historical samples is greater than an upper limit threshold value specified by the sample screening strategy, dividing the plurality of historical samples into a plurality of batches according to the upper limit threshold value;

[0019] For each batch of historical samples, the historical samples in the batch are scanned separately to obtain the scanning results corresponding to each historical sample in the batch.

[0020] In one embodiment, the retrace configuration information includes a designated identifier;

[0021] Scanning each filtered historical sample to obtain a scanning result corresponding to each historical sample includes:

[0022] Scan each historical sample according to the designated identifier to obtain a scanning result of each historical sample in the designated identifier; and / or,

[0023] The retrace configuration information includes a retrace triggering strategy;

[0024] Before screening out a plurality of historical samples based on the sample screening strategy, the method further includes:

[0025] Determine whether the retrace trigger condition indicated by the retrace trigger strategy is met, and if so, perform the step of screening out multiple historical samples based on the sample screening strategy.

[0026] In one embodiment, the retrace configuration information includes a scan result processing strategy;

[0027] After obtaining the scanning result corresponding to each historical sample, the method further includes:

[0028] According to the scanning result processing strategy, the scanning results of all historical samples are stored and processed accordingly.

[0029] In one embodiment, generating retrace configuration information in response to a retrace instruction includes:

[0030] In response to the retrace instruction, displaying a preset configuration interface;

[0031] A sample screening strategy inputted / selected in the preset configuration interface is received, and the retrace configuration information is generated based on the sample screening strategy.

[0032] On the other hand, the present application also provides a sample retrace device, comprising:

[0033] A generating module, configured to generate retrace configuration information in response to a retrace instruction; wherein the retrace configuration information includes a sample screening strategy, the sample screening strategy being configured to screen out samples for which a scan result is expected to change;

[0034] A screening module, configured to screen out a plurality of historical samples based on the sample screening strategy;

[0035] The scanning module is used to scan each filtered historical sample to obtain a scanning result corresponding to each historical sample.

[0036] Furthermore, the present application also provides an electronic device, comprising:

[0037] processor;

[0038] a memory for storing processor-executable instructions;

[0039] Wherein, the processor is configured to execute the above-mentioned sample retrace method.

[0040] In addition, the present application also provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by a processor to implement the above-mentioned sample retrace method.

[0041] In the present application, after generating retrace configuration information in response to a retrace instruction, a plurality of historical samples can be screened according to a sample screening strategy in the retrace configuration information for screening samples for which changes in scan results are expected, and a retrace task can be performed on the historical samples using a designated identifier in the retrace configuration information.

[0042] According to the sample screening strategy, historical samples whose scanning results may change can be accurately screened out, and the retracement task can be performed when the retracement workload is small. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments of the present application.

[0044] Figure 1 A schematic diagram of an application scenario of a sample retrace method provided in an embodiment of the present application;

[0045] Figure 2 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application;

[0046] Figure 3 A flow chart of a sample retrace method according to an embodiment of the present application;

[0047] Figure 4 A flowchart of a method for screening historical samples provided in one embodiment of the present application;

[0048] Figure 5 A block diagram of a sample retrace device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0050] Similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0051] Figure 1 Schematic diagram of the application scenario of the sample retrace method provided in the embodiment of the present application. Figure 1As shown, the application scenario includes a client 20 and a server 30; the client 20 can be a user terminal such as a host, mobile phone, tablet computer, etc., used to initiate a retrace instruction to the server 30; the server 30 can be a server, server cluster or cloud computing center equipped with a cloud control operating platform, which can respond to the retrace instruction, generate retrace configuration information, and execute the retrace task with the retrace configuration information.

[0052] like Figure 2 As shown, this embodiment provides an electronic device 1, including: at least one processor 11 and a memory 12, Figure 2 In the example, a processor 11 is used. Processor 11 and memory 12 are connected via bus 10. Memory 12 stores instructions executable by processor 11. Processor 11 executes these instructions, enabling electronic device 1 to perform all or part of the method described in the following embodiments. In one embodiment, electronic device 1 may be the aforementioned server 30, configured to perform the sample retrace method.

[0053] The memory 12 can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0054] The present application also provides a computer-readable storage medium, which stores a computer program. The computer program can be executed by the processor 11 to complete the sample retrace method provided in the present application.

[0055] See also Figure 3 , is a flow chart of a sample retrace method provided in an embodiment of the present application, such as Figure 3 As shown, the method may include the following steps 310 to 330.

[0056] Step 310: In response to the retrace instruction, generate retrace configuration information; wherein the retrace configuration information includes a sample screening strategy, and the sample screening strategy is used to screen out samples whose scan results are expected to change.

[0057] The retrace instruction is used to instruct the server to generate retrace configuration information and execute the retrace task according to the retrace configuration information. The retrace instruction can be reported by the client connected to the server implementing the solution of the present application.

[0058] Sample filtering strategies are used to filter historical samples that require rescanning. Sample filtering strategies can be based on filtering conditions in one or more dimensions to select samples whose scan results are expected to change.

[0059] When the server receives the retrace instruction, it can parse the sample screening strategy and generate the retrace configuration information corresponding to the retrace task.

[0060] Step 320: Based on the sample screening strategy, multiple historical samples are screened out.

[0061] After generating the retrace configuration information for the retrace task, when executing the retrace task, the server can filter the historical samples of the cloud control operation platform based on the sample filtering strategy to obtain historical samples that meet the sample filtering strategy.

[0062] The sample screening strategy can filter historical samples based on restrictions such as sample data type, keywords, and hazard level.

[0063] Exemplarily, the hazard level identified by the identifier for the sample data can be 10, 20, 30, 50, 60, or 70. Sample data with hazard levels of 10 and 20 are identified as ordinary samples and are added to the whitelist; sample data with hazard levels of 50, 60, and 70 are identified as viruses and are added to the blacklist; sample data with a hazard level of 30 is added to the gray list, which is between the whitelist and the blacklist.

[0064] When the scan back task needs to rescan historical samples that were previously identified as viruses, the server can select historical samples with a hazard level of 50, 60, or 70 based on the sample screening strategy.

[0065] When the retracement task requires rescanning historical samples that were previously identified as common samples, the server can select historical samples with hazard levels of 10 or 20 based on the sample screening strategy.

[0066] For example, when the scan back task is a full scan back, the server can select all historical samples according to the sample screening strategy.

[0067] Step 330: Scan each filtered historical sample to obtain a scanning result corresponding to each historical sample.

[0068] After filtering out the historical samples, the server can scan each historical sample.

[0069] After scanning each historical sample, the corresponding scan results for all historical samples are obtained. This scan result can indicate whether the historical sample is a virus. For any historical sample, the scan result generated by the retracement may be the same or different from the previously detected scan result. If the scan result changes, the retracement scan result is used as the actual scan result of the historical sample.

[0070] For example, the scanning results may include the hazard level of historical samples. If the hazard level obtained by scanning back any historical sample is higher than the hazard level detected previously, it means that a new virus has been discovered; if the hazard level obtained by scanning back any historical sample is lower than the hazard level detected previously, it means that a false alarm has been discovered.

[0071] Through the above measures, the sample screening strategy can be parsed from the retrace configuration information corresponding to the retrace task, and the historical samples can be accurately screened using the sample screening strategy used to screen out samples that are expected to change, so that the screened historical samples can be rescanned, and when the retrace workload is small, the historical samples whose scan results are most likely to change can be determined.

[0072] In one embodiment, the sample screening strategy is used to screen samples based on one or more of the following dimensions: sample type, hazard level, sample name keywords, sample reporting time, source, and popularity parameters. Here, the sample type indicates the file type of the historical sample; the hazard level can be derived from the previous scan results of the historical sample; the sample name keywords are the keywords in the name; the sample reporting time is the time when the historical sample was reported to the cloud control operation platform; the source can be the reporting party of the historical sample or the storage path of the historical sample; and the popularity parameters can be PV (Page View) or UV (Unique Visitor).

[0073] When the sample screening strategy may include screening conditions in at least two dimensions, the server may perform screening processing according to the screening conditions in each dimension, thereby obtaining multiple historical samples.

[0074] For example, a sample filtering strategy includes a filter condition corresponding to the popularity parameter, "Filter historical samples with page views greater than 1000," and a filter condition corresponding to the sample reporting time, "Filter historical samples reported within the past week." Using this sample filtering strategy, the server can filter out historical samples reported within the past week with page views greater than 1000.

[0075] The sample screening strategy can indicate the execution order of the screening conditions corresponding to each dimension. The server performs screening processing based on the screening conditions corresponding to the dimension in turn according to the execution order to complete the screening of historical samples.

[0076] Obtaining historical samples by combining multiple screening conditions can make the retrace range more accurate. In this way, when the computing resources for executing the retrace task are limited, historical samples whose scanning results may change can be rescanned as much as possible, greatly reducing the computing resources occupied by the retrace task.

[0077] In one embodiment, the sample screening strategy includes a sample storage path, indicating that historical samples in the sample storage path are to be re-scanned. Here, the sample storage path may be an HDFS (Hadoop Distributed File System) path on the server side.

[0078] When filtering out historical samples based on the sample filtering strategy, the server can parse the sample storage path from the sample filtering strategy and read multiple historical samples from the sample storage path.

[0079] In one embodiment, the sample screening strategy includes screening conditions corresponding to one or more of the aforementioned dimensions.

[0080] When filtering out historical samples based on a sample filtering strategy, the server can parse the filtering conditions from the sample filtering strategy, and use the sample search function of NVIDIA Morpheus to search based on the filtering conditions, thereby searching for multiple historical samples.

[0081] In one embodiment, the sample screening strategy includes an upper threshold for the number of samples that can be processed by one retrace task.

[0082] After the server has filtered out multiple historical samples, it can count the number of historical samples and determine whether the number of samples is greater than the upper limit threshold specified by the sample filtering policy.

[0083] On the one hand, if the number of samples is not greater than the upper limit threshold, the server can directly rescan all the filtered historical samples later.

[0084] On the other hand, if the number of samples exceeds the upper threshold, the server can divide the historical samples into batches based on the upper threshold. A separate retrace task is executed for each batch of historical samples. When executing the retrace task, the server can scan each historical sample within the batch and obtain a scan result for each historical sample within the batch.

[0085] For example, if the number of historical samples is 10,000 and the sample screening policy specifies an upper threshold of 1,000, the server can divide the 10,000 historical samples into batches of 1,000, resulting in 10 batches of historical samples. For each of the 10 batches of historical samples, the server can execute 10 retrace tasks, scanning each batch of historical samples during each retrace task, to obtain scan results for the batches of historical samples. After 10 retrace tasks, the server can obtain scan results for all filtered historical samples.

[0086] In one embodiment, the sample screening strategy includes an upper threshold for the number of samples that can be processed by one retrace task.

[0087] After filtering out multiple historical samples, the server can count the number of historical samples and determine whether the number of samples exceeds the upper limit threshold specified by the sample filtering policy. On the one hand, if the number of samples does not exceed the upper limit threshold, the server can subsequently rescan all filtered historical samples. On the other hand, if the sample data exceeds the upper limit threshold, further filtering of the filtered historical samples can be performed.

[0088] See also Figure 4 , is a flow chart of a historical sample screening method provided in an embodiment of the present application, which may include steps 410 to 430.

[0089] Step 410: When the sample quantity of the plurality of historical samples is greater than the upper limit threshold specified by the sample screening strategy, a screening feature is constructed based on the sample parameters of each historical sample.

[0090] The server can construct a screening feature based on the sample parameters of each historical sample. Sample parameters can include PV, sample type, hazard level, sample reporting time, etc. The server can process multiple sample parameters using one-hot encoding to obtain a screening feature, which can be a multidimensional vector.

[0091] Step 420: For each historical sample, the screening features of the historical sample are processed according to the scoring model to obtain a score for the historical sample; wherein the score is positively correlated with the probability of the expected change in the scanning result.

[0092] Step 430: Filter out historical samples whose score rankings are below the upper limit threshold, and select multiple historical samples.

[0093] For each historical sample, the server can process the sample's screening features according to a scoring model to derive a score for the sample. The scoring model can be trained using a machine learning model (e.g., a logistic regression model) using sample screening features with added scoring labels. Sample screening features can be extracted from a large amount of sample data. Scoring labels indicate the importance of the sample data and are positively correlated with the probability of a change in the scan results. These labels can be manually added.

[0094] After obtaining the score of each historical sample, the server can sort all the scores from highest to lowest to obtain the score ranking of all historical samples. The server can filter out historical samples with scores below the upper limit threshold to obtain the historical samples with the highest scores within the upper limit threshold.

[0095] For example, if the number of historical samples (10,000) exceeds the upper threshold of 1,000 in the sample screening strategy, screening features are constructed for each of the 10,000 historical samples, and scores are determined based on the screening features. After sorting the 10,000 scores, historical samples ranked after 1,000 are filtered to obtain the 1,000 highest-scoring historical samples.

[0096] Through the above measures, the historical samples that need the most attention can be screened out through the scoring model, thereby narrowing the processing scope of the retracement task. Subsequently, the historical samples whose scan results have changed can be rescanned more accurately.

[0097] In one embodiment, the retrace configuration information may include a designated identifier, which may be an identifier determined by the retrace instruction and used to scan the selected historical samples.

[0098] Identifiers can include static identifiers (such as antivirus software) and dynamic identifiers (such as the Red Raindrop APT scanning engine). The cloud control operating platform on the server can provide a variety of optional identifiers.

[0099] In this case, when executing the retrace task, the server may scan each historical sample according to the designated identifier, thereby obtaining the scanning result of each historical sample in the designated identifier.

[0100] For example, if the designated identifier is a static identifier, the server can directly test the historical samples based on the static identifier to obtain the scan results. If the designated identifier is a dynamic identifier, the server can run the historical samples in the sandbox provided by the dynamic identifier and determine the scan results based on the run results.

[0101] In one embodiment, the retrace instruction includes a retrace trigger policy. In this case, the retrace configuration information includes the retrace trigger policy. The retrace trigger policy is used to indicate the triggering conditions for the retrace task. The retrace trigger policy may include scheduled execution and non-scheduled execution. For example, scheduled execution may include executing the retrace task with a period of months, weeks, days, or hours. Non-scheduled execution may include manually triggering the execution of the retrace task, or triggering the execution of the retrace task via an interface.

[0102] Before filtering historical samples based on the sample filtering strategy, the server can determine whether the retrace trigger condition indicated by the retrace trigger strategy is met. On the one hand, if not, no processing is performed. On the other hand, if yes, the steps of filtering historical samples can be continued.

[0103] For example, if the scanback trigger policy instructs the server to execute a scanback task upon receiving a trigger command, the server can monitor the client for instructions and begin screening historical samples upon receiving the trigger command. For example, the scanback trigger command is triggered by an external interface, and the interface is called when the virus identification rules change. In this case, when the antivirus module version is updated or the virus database is upgraded, the server can initiate the scanback task, thereby promptly updating the scan results for historical samples.

[0104] Through the above measures, the server can execute a retrace task when the retrace trigger policy is met. After receiving a retrace instruction once, it can subsequently perform retrace tasks when the retrace trigger policy indicated by the retrace instruction is met multiple times. This eliminates the need to repeatedly receive retrace instructions to perform multiple retrace tasks under the same retrace requirement.

[0105] In one embodiment, the retrace task editing instruction includes a scan result processing strategy. In this case, the retrace configuration newly includes the scan result processing strategy.

[0106] In this embodiment, after the server obtains the scanning result of each historical sample, it can store and process the scanning results of all historical samples accordingly according to the scanning and result processing strategy. Here, the processing method can be to return the scanning result to the reporting party of the historical sample, or to clear the historical sample, etc. Exemplarily, when the retracement task is a black retracement (re-scanning historical samples with a high hazard level), the scanning result processing strategy indicates that the scanning result is written directly to NVIDIAmorpheus, and the server can write the scanning result of the retracement task to morpheus. Exemplarily, the retracement task requires query and statistical services, and the scanning result processing strategy indicates that the scanning result is written to a temporary storage space, so as to facilitate query and statistics of the scanning results in the temporary storage space.

[0107] In one embodiment, the cloud control operating platform carried by the server can provide the client with a configuration page for the retrace task.

[0108] After the client sends a retrace instruction to the server, the server can respond to the retrace instruction and display the above-mentioned configuration page to the client. After the user logs in to the configuration page through the client, he can enter the sample screening strategy in the configuration interface, or select the sample screening strategy in the configuration page. In this case, the server can receive the sample screening strategy entered or selected in the configuration interface, and can generate the retrace configuration information based on the above-mentioned sample screening strategy, so as to perform the retrace task with the retrace configuration information in the future. In addition, the user can also select one or more platform-provided identifiers on the configuration page as the designated identifier for the retrace task. The same identifier may include multiple versions. In this case, the user can specify the version when selecting the designated identifier. The user can also configure the relevant parameters of the retrace task (such as scanning time), retrace trigger strategy, etc. on the configuration page. After the client sends all the configuration contents to the server, the server can generate the retrace configuration information based on all the configuration contents.

[0109] Through the above measures, the retracement requirements are abstracted and integrated on the configuration page, avoiding the high cost of different users developing sample retracement platforms separately and improving the processing efficiency of retracement tasks.

[0110] Figure 5 FIG. 1 is a block diagram of a sample retrace device according to an embodiment of the present invention. Figure 5 As shown, the device may include:

[0111] A generating module 510 is configured to generate retrace configuration information in response to a retrace instruction; wherein the retrace configuration information includes a sample screening strategy, the sample screening strategy being configured to screen out samples for which a scan result is expected to change;

[0112] A screening module 520 is configured to screen out a plurality of historical samples based on the sample screening strategy;

[0113] The scanning module 530 is configured to scan each filtered historical sample to obtain a scanning result corresponding to each historical sample.

[0114] The implementation process of the functions and effects of each module in the above device is specifically described in the implementation process of the corresponding steps in the above sample retrace method, which will not be repeated here.

[0115] In several embodiments provided in this application, the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a portion of code, and the module, program segment, or a portion of code contains one or more executable instructions for implementing the specified logical functions. In some alternative implementations, the functions marked in the boxes may also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes may actually be executed substantially in parallel, or they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, may be implemented using a dedicated hardware-based system that performs the specified functions or actions, or may be implemented using a combination of dedicated hardware and computer instructions.

[0116] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0117] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A sample retrace method, characterized in that: include: In response to the retrace instruction, generating retrace configuration information; wherein the retrace configuration information includes a sample screening strategy, the sample screening strategy is used to screen out samples whose scan results are expected to change; Based on the sample screening strategy, screening out multiple historical samples; Scan each filtered historical sample to obtain a scanning result corresponding to each historical sample; The retrace configuration information includes a designated identifier, and the designated identifier includes a static identifier and a dynamic identifier; Scanning each filtered historical sample to obtain a scanning result corresponding to each historical sample includes: The static identifier directly detects each historical sample to obtain a scanning result; The dynamic identifier runs each historical sample in the sandbox and determines the scanning result based on the running result.

2. The method according to claim 1, characterized in that The method of screening out multiple historical samples based on the sample screening strategy includes: Obtain the multiple historical samples according to the sample storage path in the sample screening strategy; or, The plurality of historical samples are searched and obtained based on the screening conditions in the sample screening strategy through the sample search function of Morpheus.

3. The method according to claim 1, characterized in that The sample screening strategy is used to screen samples based on one or more of the following dimensions: sample type, hazard level, sample name keywords, sample reporting time, source, and popularity parameters.

4. The method according to claim 2, characterized in that The method further comprises: When the number of the plurality of historical samples is greater than an upper limit threshold specified by the sample screening strategy, constructing a screening feature based on a sample parameter of each historical sample; For each historical sample, the screening features of the historical sample are processed according to the scoring model to obtain a score for the historical sample; wherein the score is positively correlated with the probability of the expected change in the scan result; The historical samples whose score rankings are below the upper limit threshold are filtered out to select the multiple historical samples.

5. The method according to claim 2, characterized in that Scanning each filtered historical sample to obtain a scanning result corresponding to each historical sample includes: When the number of the plurality of historical samples is greater than an upper limit threshold value specified by the sample screening strategy, dividing the plurality of historical samples into a plurality of batches according to the upper limit threshold value; For each batch of historical samples, the historical samples in the batch are scanned separately to obtain the scanning results corresponding to each historical sample in the batch.

6. The method according to claim 1, characterized in that Scanning each filtered historical sample to obtain a scanning result corresponding to each historical sample includes: Scan each historical sample according to the designated identifier to obtain a scanning result of each historical sample in the designated identifier; and / or, The retrace configuration information includes a retrace triggering strategy; Before screening out a plurality of historical samples based on the sample screening strategy, the method further includes: Determine whether the retrace trigger condition indicated by the retrace trigger strategy is met, and if so, perform the step of screening out multiple historical samples based on the sample screening strategy.

7. The method according to claim 1, characterized in that The retrace configuration information includes a scan result processing strategy; After obtaining the scanning result corresponding to each historical sample, the method further includes: According to the scanning result processing strategy, the scanning results of all historical samples are stored and processed accordingly.

8. The method according to claim 1, characterized in that The generating of retrace configuration information in response to the retrace instruction includes: In response to the retrace instruction, displaying a preset configuration interface; A sample screening strategy inputted / selected in the preset configuration interface is received, and the retrace configuration information is generated based on the sample screening strategy.

9. A sample retrace device, characterized in that: include: A generating module, configured to generate retrace configuration information in response to a retrace instruction; wherein the retrace configuration information includes a sample screening strategy, the sample screening strategy being configured to screen out samples for which a scan result is expected to change; A screening module, configured to screen out a plurality of historical samples based on the sample screening strategy; A scanning module is used to scan each filtered historical sample and obtain the scanning result corresponding to each historical sample; The retrace configuration information includes a designated identifier, and the designated identifier includes a static identifier and a dynamic identifier; Scanning each filtered historical sample to obtain a scanning result corresponding to each historical sample includes: The static identifier directly detects each historical sample to obtain a scanning result; The dynamic identifier runs each historical sample in the sandbox and determines the scanning result based on the running result.

10. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the sample retrace method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and the computer program can be executed by a processor to implement the sample retrace method according to any one of claims 1 to 8.

Images