Information detection method and device, electronic device and computer readable storage medium

Abstract

The present invention proposes an information detection method and device, an electronic device and a computer-readable storage medium, the method comprising: identifying a target algorithm in a sample file; obtaining the algorithm parameters and parameter address of the target algorithm at the algorithm address of the target algorithm in the sample file; simulating and running the target algorithm based on the algorithm type, algorithm parameters and parameter address of the target algorithm to obtain a simulation result; and using a predetermined detection method to detect whether the simulation result is abnormal. The technical solution of the present invention can quickly and effectively detect the security of sample files, facilitate accurate identification of malicious codes, and protect computer network security.

Description

[Technical field]

[0001] The present invention relates to the field of computer network security technology, and in particular to an information detection method and device, an electronic device and a computer-readable storage medium. [Background technology]

[0002] With the rapid development of the Internet, network security incidents emerge in an endless stream, and computer network security is always in danger. In this regard, malicious code can be detected by identifying malicious code signatures and / or by heuristic detection technology. However, this method is difficult to effectively identify malicious code in complex situations such as malicious code dynamically obtaining function addresses and malicious code deliberately obfuscating function names. In addition, in order to avoid malicious code being detected, attackers often disguise malicious code through encryption algorithms to avoid conventional security detection. If you want to fully detect these situations, manual detection is often required, which is time-consuming and laborious.

[0003] Therefore, how to comprehensively and effectively detect malicious code has become a technical problem that needs to be solved urgently. [Summary of the invention]

[0004] The embodiments of the present invention provide an information detection method and device, an electronic device and a computer-readable storage medium, which are intended to solve the technical problem that malicious code detection methods in related technologies cannot fully and effectively detect malicious code.

[0005] In a first aspect, an embodiment of the present invention provides an information detection method, comprising: identifying a target algorithm in a sample file; obtaining algorithm parameters and parameter address of the target algorithm at the algorithm address of the target algorithm in the sample file; simulating and running the target algorithm based on the algorithm type, algorithm parameters and parameter address of the target algorithm to obtain simulation results; and using a predetermined detection method to detect whether the simulation result is abnormal.

[0006] In the above embodiment of the present invention, optionally, a target algorithm in a sample file is identified based on a preset algorithm feature library, wherein the algorithm feature library includes YARA rules, function entry feature values ​​of the preset algorithm in an open source algorithm library, and associated codes of the preset algorithm.

[0007] In the above embodiment of the present invention, optionally, before identifying the target algorithm in the sample file based on the preset algorithm feature library, it also includes: for each preset algorithm, according to the algorithm feature value of the preset algorithm, the algorithm feature of the preset algorithm used by the known malware family, and the machine code generated by the preset algorithm under different compilation conditions when it is open source, generating a YARA rule corresponding to the preset algorithm.

[0008] In the above embodiment of the present invention, optionally, the step of identifying the target algorithm in the sample file based on the preset algorithm feature library includes: detecting whether the sample file conforms to the YARA rule in the algorithm feature library; when the sample file conforms to any of the YARA rules in the algorithm feature library, determining that the target algorithm in the sample file is the preset algorithm corresponding to the YARA rule; and / or; the step of identifying the target algorithm in the sample file based on the preset algorithm feature library includes: detecting whether the sample file has a target feature value that matches the function entry feature value in the algorithm feature library; when the target feature value that matches the function entry feature value is detected, determining the preset algorithm to which the function entry feature value belongs as the target algorithm in the sample file; and / or; the step of identifying the target algorithm in the sample file based on the preset algorithm feature library includes: simulating the execution of the associated code of the preset algorithm in the algorithm feature library on the sample file; if the result obtained by executing the associated code is valid data with identifiable content, determining the preset algorithm to which the associated code belongs as the target algorithm in the sample file.

[0009] In the above embodiment of the present invention, optionally, the predetermined detection method is used to detect whether the simulation result is abnormal, including: if the data type of the simulation result includes a string type, when it is detected that the simulation result has a sensitive field, or when it is detected that the weighted sum of multiple sensitive fields in the simulation result is greater than or equal to a specified threshold, determining that the simulation result is abnormal.

[0010] In the above embodiment of the present invention, optionally, the predetermined detection method is used to detect whether the simulation result is abnormal, including: if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, determining that the simulation result is abnormal; if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, and the simulation result includes an encryption algorithm, executing the step of identifying the target algorithm in the sample file to identify the encryption algorithm in the simulation result.

[0011] In the above embodiment of the present invention, optionally, the step of using a predetermined detection method to detect whether the simulation result is abnormal includes: if the data type of the simulation result includes a PE type, using the simulation result as a sample file, and executing the step of identifying the target algorithm in the sample file.

[0012] In the above embodiment of the present invention, optionally, the step of using a predetermined detection method to detect whether the simulation result is abnormal includes: if the data type of the simulation result includes an address type, jumping to the target address indicated by the simulation result, using the data at the target address as a sample file, and executing the step of identifying the target algorithm in the sample file.

[0013] In a second aspect, an embodiment of the present invention provides an information detection device, comprising: a target algorithm identification unit, used to identify a target algorithm in a sample file; a disassembly unit, used to obtain algorithm parameters and parameter addresses of the target algorithm at the algorithm address of the target algorithm in the sample file; a simulation detection unit, used to simulate and run the target algorithm based on the algorithm type, algorithm parameters and parameter address of the target algorithm to obtain a simulation result; and an abnormality judgment unit, used to use a predetermined detection method to detect whether the simulation result is abnormal.

[0014] In the above embodiment of the present invention, optionally, a target algorithm in a sample file is identified based on a preset algorithm feature library, wherein the algorithm feature library includes YARA rules, function entry feature values ​​of the preset algorithm in an open source algorithm library, and associated codes of the preset algorithm.

[0015] In the above embodiment of the present invention, optionally, it also includes: a YARA rule generation unit, which is used to generate a YARA rule corresponding to each preset algorithm according to the algorithm feature value of the preset algorithm, the algorithm feature of the preset algorithm used by the known malware family, and the machine code generated by the preset algorithm under different compilation conditions when it is open source, before the target algorithm identification unit identifies the target algorithm in the sample file.

[0016] In the above embodiment of the present invention, optionally, the target algorithm identification unit is used to: detect whether the sample file conforms to the YARA rules in the algorithm feature library; when the sample file conforms to any of the YARA rules in the algorithm feature library, determine that the target algorithm in the sample file is the preset algorithm corresponding to the YARA rule; and / or; detect whether the sample file has a target feature value that matches the function entry feature value in the algorithm feature library; when the target feature value that matches the function entry feature value is detected, determine the preset algorithm to which the function entry feature value belongs as the target algorithm in the sample file; and / or; simulate the execution of the associated code of the preset algorithm in the algorithm feature library on the sample file; if the result of executing the associated code is valid data with identifiable content, determine the preset algorithm to which the associated code belongs as the target algorithm in the sample file.

[0017] In the above embodiment of the present invention, optionally, the abnormality judgment unit is used to: if the data type of the simulation result includes a string type, when it is detected that the simulation result has a sensitive field, or when it is detected that the weighted sum of multiple sensitive fields in the simulation result is greater than or equal to a specified threshold, determine that the simulation result is abnormal.

[0018] In the above embodiment of the present invention, optionally, the abnormality judgment unit is used to: if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, determine that the simulation result is abnormal; if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, and the simulation result includes an encryption algorithm, execute the target algorithm identification unit, and identify the encryption algorithm in the simulation result through the target algorithm identification unit.

[0019] In the above embodiment of the present invention, optionally, the exception judgment unit is used to: if the data type of the simulation result includes a PE type, use the simulation result as a sample file, execute the target algorithm identification unit, and identify the target algorithm in the sample file through the target algorithm identification unit.

[0020] In the above embodiment of the present invention, optionally, the exception judgment unit is used to: if the data type of the simulation result includes an address type, jump to the target address indicated by the simulation result, use the data at the target address as a sample file, execute the target algorithm identification unit, and identify the target algorithm in the sample file through the target algorithm identification unit.

[0021] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute any of the methods described in the first aspect above.

[0022] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method flow described in any one of the first aspects above.

[0023] The above technical solution, in order to solve the technical problem that the malicious code detection method in the related art cannot fully and effectively detect the malicious code, can identify it from the sample file, and perform simulation operation outside the sample file to obtain the simulation result, so that in the subsequent steps, it can be determined whether the sample file is abnormal and whether it includes malicious code by judging the simulation result. In this way, no matter whether the algorithm and its related data in the sample file are encrypted or how they are encrypted, their security can be tested by calling them out and running them in simulation, avoiding the situation where the malicious code cannot be effectively detected due to the limitation of the sample file itself, and can quickly and effectively detect the security of the sample file, which is convenient for accurately identifying malicious code and protecting the security of computer network.

Brief Description of the Drawings

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flow chart of an information detection method according to an embodiment of the present invention is shown;

[0026] Figure 2 A block diagram of an information detection device according to an embodiment of the present invention is shown;

[0027] Figure 3 A block diagram of an electronic device according to an embodiment of the present invention is shown. [Specific implementation method]

[0028] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0029] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0031] Figure 1 A flow chart of an information detection method according to an embodiment of the present invention is shown.

[0032] like Figure 1 As shown, the process of the information detection method according to an embodiment of the present invention includes:

[0033] Step 102: Identify the target algorithm in the sample file.

[0034] In this embodiment, the target algorithm in the sample file is identified based on a preset algorithm feature library, which stores algorithm features of multiple algorithms, all of which are easily used by malicious code and difficult to be identified by conventional malicious code detection methods. These algorithms include but are not limited to encryption algorithms such as AES, RC4, and Blowfish.

[0035] Matching and verifying the content of the sample file based on the algorithm features in the algorithm feature library helps to identify whether the sample file uses the algorithm corresponding to these algorithm features. If the sample file is identified to include the algorithm features in the algorithm feature library, it is determined that the sample file uses the algorithm corresponding to the algorithm feature and has the possibility of carrying malicious code, so further detection steps can be entered to verify the security of the sample file.

[0036] The algorithm feature library includes YARA rules, function entry feature values ​​of the preset algorithm in the open source algorithm library, and algorithm features such as associated codes of the preset algorithm. Of course, before step 102, algorithm features corresponding to multiple preset algorithms can be set for the algorithm feature library.

[0037] In one possible design, the method of setting YARA rules for the algorithm feature library includes: for each preset algorithm, according to the algorithm feature value of the preset algorithm, the algorithm features of the preset algorithm used by the known malware family, and the machine code generated by the preset algorithm under different compilation conditions when the preset algorithm is open source, generating the YARA rules corresponding to the preset algorithm.

[0038] YARA rules are used to describe the rules within an algorithm. Algorithms that are easily used by malicious code often have their own unique YARA rules. Therefore, using the YARA rules of algorithms that are easily used by malicious code as algorithm features helps to identify whether a sample file involves the algorithm, thereby facilitating the determination of whether the sample file contains malicious code.

[0039] Different preset algorithms use different YARA rules. For any preset algorithm that needs to be included in the algorithm feature library, the YARA rules of the preset algorithm can be generated based on the algorithm feature value of the preset algorithm, the algorithm features of the preset algorithm used by known malware families, and the machine code generated by the preset algorithm under different compilation conditions when it is open source. These data can express the actual rules of the preset algorithm. The YARA rules finally generated are composed of a series of strings and a Boolean expression.

[0040] On this basis, step 102 includes: detecting whether the sample file complies with the YARA rule in the algorithm feature library; when the sample file complies with any of the YARA rules in the algorithm feature library, determining that the target algorithm in the sample file is a preset algorithm corresponding to the YARA rule.

[0041] When identifying the target algorithm in the sample file based on the preset algorithm feature library, the YARA rule can be used as one of the detection criteria. Specifically, the sample file is detected to see if it conforms to the YARA rule in the algorithm feature library. If it conforms to any YARA rule in the algorithm feature library, it means that the sample file includes the preset algorithm corresponding to the YARA rule. At this time, the preset algorithm is determined as the target algorithm. Therefore, the YARA rules in the algorithm feature library can be used to effectively identify the target algorithm in the sample file that is easily used by malicious code, so as to further detect whether the sample file is abnormal and whether it contains malicious code.

[0042] In a possible design, when identifying a target algorithm in a sample file based on a preset algorithm feature library, a function entry feature value of the preset algorithm in the open source algorithm library may be used as one of the detection criteria.

[0043] Specifically, step 102 includes: detecting whether the sample file contains a target feature value that matches the function entry feature value in the algorithm feature library; when a target feature value that matches the function entry feature value is detected, determining the preset algorithm to which the function entry feature value belongs as the target algorithm in the sample file.

[0044] If a target feature value matching the function entry feature value is detected, it means that the sample file has the algorithm feature given in the algorithm feature library, and also includes the target algorithm corresponding to the algorithm feature. At this point, the target algorithm in the sample file that is easily used by malicious code is effectively identified, which facilitates further detection of whether the sample file is abnormal and whether it contains malicious code.

[0045] In a possible design, when identifying a target algorithm in a sample file based on a preset algorithm feature library, an associated code of the preset algorithm may be used as one of the detection criteria.

[0046] Specifically, step 102 includes: simulating the execution of the associated code of the preset algorithm in the algorithm feature library on the sample file; if the result of executing the associated code is valid data with identifiable content, determining the preset algorithm to which the associated code belongs as the target algorithm in the sample file.

[0047] The association code of the preset algorithm refers to the code that executes a specific function in the preset algorithm, and this specific function is often easily exploited by malicious code. For example, the association code can be set as the code used for large number operations. Therefore, when the sample file is detected to have the association code of the preset algorithm, the association code can be executed. If the obtained content is not garbled, but valid data with identifiable content, it means that the association code is indeed used in the sample file, and therefore it does have the preset algorithm corresponding to the association code. In this way, it means that the sample file has the possibility of being exploited by malicious code to execute the specific function of the preset algorithm. Therefore, it is necessary to further detect whether the sample file is abnormal.

[0048] In the above, any one of the algorithm features such as YARA rules, the function entry feature value of the preset algorithm in the open source algorithm library, and the associated code of the preset algorithm can be used as a condition for identifying the target algorithm in the sample file, or two or three of them can be combined as the condition for identifying the target algorithm in the sample file to obtain a more accurate target algorithm identification result.

[0049] Step 104: According to the algorithm address of the target algorithm in the sample file, obtain the algorithm parameters and parameter address of the target algorithm at the algorithm address.

[0050] In this embodiment, the algorithm parameters and parameter addresses of the target algorithm are obtained at the algorithm address using a disassembly engine. The disassembly engine is used to reversely process the code using assembly instructions, which is equivalent to decoding. Therefore, after the target algorithm is determined in the sample file, the content at the algorithm address of the target algorithm in the sample file can be processed by the disassembly engine to parse out the algorithm parameters and parameter addresses of the target algorithm indicated by the content at the algorithm address.

[0051] Step 106: Based on the algorithm type, algorithm parameters and parameter addresses of the target algorithm, simulate and run the target algorithm to obtain simulation results.

[0052] Step 108: Using a predetermined detection method corresponding to the data type of the simulation result, detect whether the simulation result is abnormal.

[0053] At this point, the algorithm type of the target algorithm is known, and the algorithm parameters and parameter addresses of the target algorithm are also known. Therefore, the target algorithm can be simulated and run to obtain the simulation results of the running results in the sample file.

[0054] For algorithms that are easily used by malicious code and difficult to be identified by conventional malicious code detection methods, especially encryption algorithms, this technical solution can identify them from sample files and perform simulations outside the sample files to obtain simulation results, so that in subsequent steps, it can be determined whether the sample files are abnormal and whether they include malicious code by judging the simulation results. In this way, regardless of whether the algorithms and related data in the sample files are encrypted or how they are encrypted, their security can be tested by calling them out and running them in simulation, avoiding the situation where malicious code cannot be effectively detected due to the limitations of the sample files themselves, and can quickly and effectively detect the security of sample files, facilitating accurate identification of malicious code and protecting computer network security.

[0055] In one possible design, if the data type of the simulation result includes a string type, when it is detected that the simulation result has a sensitive field, or when it is detected that the weighted sum of multiple sensitive fields in the simulation result is greater than or equal to a specified threshold, the simulation result is determined to be abnormal.

[0056] At this time, fields that have been used by the malicious code or are used frequently, or fields obtained after the malicious code is executed, can be set as sensitive fields.

[0057] If it is detected that the simulation result has a sensitive field, it can be determined that the simulation result comes from malicious code. At this time, the simulation result is determined to be abnormal, and the sample file is determined to contain malicious code and insufficient security.

[0058] In addition, due to the diversity of fields, in some cases, simply detecting a number of sensitive fields does not mean that the simulation results are absolutely abnormal. At this time, for sensitive fields with higher frequency of malicious code use, higher weights can be set. Then, the weighted sum of multiple sensitive fields in the simulation results is calculated. If the sum is greater than or equal to the specified threshold, the simulation results are determined to be abnormal, and the sample file is determined to contain malicious code and is not secure enough. The specified threshold is the lowest value of the weighted sum of multiple sensitive fields when the simulation results are abnormal.

[0059] In a possible design, if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, the simulation result is determined to be abnormal. The preset malicious code feature code is a feature code that is necessarily carried in the malicious code or after the malicious code is executed. If the simulation result includes the preset malicious code feature code, it means that the simulation result is malicious code, or is obtained by executing the malicious code. Therefore, the simulation result is determined to be abnormal, and it is determined that the sample file contains malicious code and is not secure enough.

[0060] In another possible design, if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, and the simulation result includes an encryption algorithm, the step of identifying the target algorithm in the sample file is returned to identify the encryption algorithm in the simulation result based on the preset algorithm feature library.

[0061] At this time, if the simulation result includes a preset malicious code feature code, it means that the simulation result may be malicious code, or may be obtained by executing malicious code. In this regard, a further judgment step is entered, that is, whether the simulation result includes an encryption algorithm. If it does, the process returns to step 104 and the present technical solution is reapplied to the encryption algorithm, which is equivalent to verifying the simulation result as a new sample file until a conclusion is drawn as to whether the simulation result is abnormal.

[0062] In a possible design, if the data type of the simulation result includes a PE (Portable Executable) type, the simulation result is used as a sample file, and the step of identifying the target algorithm in the sample file is returned.

[0063] PE (Portable Executable) type files refer to portable executable files. Such files have the functions of continued execution and migration, and are likely to be used by malicious code. Since they are likely to be used by malicious code, they may contain various algorithms such as encryption algorithms to execute the functions required by the malicious code. Therefore, when the data type of the simulation result includes the PE type, return to step 104 and verify the simulation result as a new sample file until a conclusion is drawn as to whether the simulation result is abnormal.

[0064] In a possible design, if the data type of the simulation result includes an address type, jump to the target address indicated by the simulation result, use the data at the target address as a sample file, and return to the step of identifying the target algorithm in the sample file.

[0065] After jumping to the target address indicated by the simulation result, a new file may be stored at the target address. At this time, the data at the target address is used as a new sample file for verification until a conclusion is drawn as to whether the simulation result is abnormal.

[0066] In summary, the security of sample files can be tested by externalizing their contents and running them in a simulated manner, thus avoiding the situation where malicious code cannot be effectively detected due to the limitations of the sample files themselves. The security of sample files can be tested quickly and effectively, facilitating accurate identification of malicious code and protecting computer network security.

[0067] Figure 2 A block diagram of an information detection device according to an embodiment of the present invention is shown.

[0068] like Figure 2 As shown, an information detection device 200 according to an embodiment of the present invention includes: a target algorithm identification unit 202, used to identify a target algorithm in a sample file; a disassembly unit 204, used to obtain algorithm parameters and parameter addresses of the target algorithm at the algorithm address of the target algorithm in the sample file; a simulation detection unit 206, used to simulate and run the target algorithm based on the algorithm type, algorithm parameters and parameter address of the target algorithm to obtain a simulation result; and an abnormality judgment unit 208, used to use a predetermined detection method to detect whether the simulation result is abnormal.

[0069] In the above embodiment of the present invention, optionally, a target algorithm in a sample file is identified based on a preset algorithm feature library, wherein the algorithm feature library includes YARA rules, function entry feature values ​​of the preset algorithm in an open source algorithm library, and associated codes of the preset algorithm.

[0070] In the above embodiment of the present invention, optionally, it also includes: a YARA rule generation unit, which is used to generate a YARA rule corresponding to the preset algorithm for each preset algorithm according to the algorithm feature value of the preset algorithm, the algorithm feature of the preset algorithm used by the known malware family, and the machine code generated by the preset algorithm under different compilation conditions when the preset algorithm is open source, before the target algorithm identification unit 202 identifies the target algorithm in the sample file; and / or; detect whether the sample file conforms to the YARA rules in the algorithm feature library; when the sample file conforms to any of the YARA rules in the algorithm feature library, determine that the target algorithm in the sample file is the preset algorithm corresponding to the YARA rule; and / or; detect whether the sample file has a target feature value that matches the function entry feature value in the algorithm feature library; when the target feature value that matches the function entry feature value is detected, determine the preset algorithm to which the function entry feature value belongs as the target algorithm in the sample file.

[0071] In the above embodiment of the present invention, optionally, the target algorithm identification unit 202 is used to: simulate the execution of the associated code of the preset algorithm in the algorithm feature library on the sample file; if the result of executing the associated code is valid data whose content can be identified, then the preset algorithm to which the associated code belongs is determined as the target algorithm in the sample file.

[0072] In the above embodiment of the present invention, optionally, the abnormality judgment unit 208 is used to: if the data type of the simulation result includes a string type, when it is detected that the simulation result has a sensitive field, or when it is detected that the weighted sum of multiple sensitive fields in the simulation result is greater than or equal to a specified threshold, determine that the simulation result is abnormal.

[0073] In the above embodiment of the present invention, optionally, the exception judgment unit 208 is used to: if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, determine that the simulation result is abnormal; if the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, and the simulation result includes an encryption algorithm, return to the target algorithm identification unit, and identify the encryption algorithm in the simulation result through the target algorithm identification unit.

[0074] In the above embodiment of the present invention, optionally, the exception judgment unit 208 is used to: if the data type of the simulation result includes a PE type, use the simulation result as a sample file, return it to the target algorithm identification unit, and identify the target algorithm in the sample file through the target algorithm identification unit.

[0075] In the above embodiment of the present invention, optionally, the exception judgment unit 208 is used to: if the data type of the simulation result includes an address type, jump to the target address indicated by the simulation result, use the data at the target address as a sample file, return to the target algorithm identification unit, and identify the target algorithm in the sample file through the target algorithm identification unit.

[0076] The information detection device 200 uses any of the solutions described in the above embodiments, and therefore has all the above technical effects, which will not be described in detail here.

[0077] Figure 3 A block diagram of an electronic device is shown according to an embodiment of the present invention.

[0078] like Figure 3 As shown, an electronic device 300 of an embodiment of the present invention includes at least one memory 302; and a processor 304 in communication with the at least one memory 302; wherein the memory stores instructions executable by the at least one processor 304, and the instructions are configured to execute the solution described in any of the above embodiments. Therefore, the electronic device 300 has the same technical effects as any of the above embodiments, and will not be described in detail here.

[0079] The electronic devices of the embodiments of the present invention exist in various forms, including but not limited to:

[0080] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0081] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0082] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0083] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc.

[0084] (5) Other electronic devices with data interaction functions.

[0085] In addition, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method flow described in any of the above embodiments.

[0086] The above describes the technical solution of the present invention in detail in combination with the accompanying drawings. Through the technical solution of the present invention, it can be identified from the sample file, and a simulation is performed outside the sample file to obtain a simulation result, so that in the subsequent steps, it can be determined whether the sample file is abnormal and whether it includes malicious code by judging the simulation result. In this way, no matter whether the algorithm and its related data in the sample file are encrypted or how they are encrypted, their security can be tested by calling them out and running them in simulation, avoiding the situation where the malicious code cannot be effectively detected due to the limitations of the sample file itself, and can quickly and effectively detect the security of the sample file, facilitating accurate identification of malicious code and protecting computer network security.

[0087] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0088] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0089] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0090] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0091] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (Processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0092] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. An information detection method, characterized in that: include: Identify the target algorithm in the sample file; According to the algorithm address of the target algorithm in the sample file, acquiring the algorithm parameters and parameter address of the target algorithm at the algorithm address; Based on the algorithm type, algorithm parameters and parameter addresses of the target algorithm, outside the sample file, simulate and run the target algorithm to obtain simulation results; Using a predetermined detection method to detect whether the simulation result is abnormal; Obtaining algorithm parameters and parameter addresses of the target algorithm at the algorithm address using a disassembly engine; Based on the preset algorithm feature library, identify the target algorithm in the sample file; The algorithm feature library includes YARA rules, function entry feature values ​​of preset algorithms in the open source algorithm library, and associated codes of the preset algorithms; The steps to identify the target algorithm in the sample file include: Detecting whether the sample file complies with the YARA rules in the algorithm feature library; When the sample file conforms to any of the YARA rules in the algorithm feature library, determining that the target algorithm in the sample file is a preset algorithm corresponding to the YARA rule; Detecting whether the sample file has a target feature value that matches the function entry feature value in the algorithm feature library; When a target feature value matching the function entry feature value is detected, determining the preset algorithm to which the function entry feature value belongs as the target algorithm in the sample file; Simulating and executing the associated code of the preset algorithm in the algorithm feature library on the sample file; If the result obtained by executing the association code is valid data with identifiable content, the preset algorithm to which the association code belongs is determined as the target algorithm in the sample file.

2. The information detection method according to claim 1, characterized in that: Before identifying the target algorithm in the sample file based on the preset algorithm feature library, the method further includes: For each preset algorithm, a YARA rule corresponding to the preset algorithm is generated according to the algorithm feature value of the preset algorithm, the algorithm features of the preset algorithm used by known malware families, and the machine code generated by the preset algorithm under different compilation conditions when it is open source.

3. The information detection method according to claim 1, characterized in that: The adopting a predetermined detection method to detect whether the simulation result is abnormal includes: If the data type of the simulation result includes a string type, when it is detected that the simulation result has a sensitive field, or when it is detected that the weighted sum of multiple sensitive fields in the simulation result is greater than or equal to a specified threshold, the simulation result is determined to be abnormal.

4. The information detection method according to claim 1, characterized in that: The adopting a predetermined detection method to detect whether the simulation result is abnormal includes: If the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code feature code, determining that the simulation result is abnormal; If the data type of the simulation result includes a code type, when it is detected that the simulation result includes a preset malicious code signature, and the simulation result includes an encryption algorithm, the step of identifying the target algorithm in the sample file is executed to identify the encryption algorithm in the simulation result.

5. The information detection method according to claim 1, characterized in that: The adopting a predetermined detection method to detect whether the simulation result is abnormal includes: If the data type of the simulation result includes a PE type, the simulation result is used as a sample file, and the step of identifying the target algorithm in the sample file is performed.

6. The information detection method according to claim 1, characterized in that: The adopting a predetermined detection method to detect whether the simulation result is abnormal includes: If the data type of the simulation result includes an address type, jump to the target address indicated by the simulation result, use the data at the target address as a sample file, and execute the step of identifying the target algorithm in the sample file.

7. An information detection device, characterized in that: include: A target algorithm identification unit, which identifies the target algorithm in the sample file; A disassembly unit, configured to obtain, according to an algorithm address of the target algorithm in the sample file, an algorithm parameter and a parameter address of the target algorithm at the algorithm address; A simulation detection unit, configured to simulate and run the target algorithm outside the sample file based on the algorithm type, algorithm parameters and parameter address of the target algorithm to obtain a simulation result; An abnormality judgment unit, used to detect whether the simulation result is abnormal by using a predetermined detection method; A disassembly unit, configured to obtain algorithm parameters and parameter addresses of the target algorithm at the algorithm address using a disassembly engine; The target algorithm identification unit is further used to identify the target algorithm in the sample file based on a preset algorithm feature library; The algorithm feature library includes YARA rules, function entry feature values ​​of preset algorithms in the open source algorithm library, and associated codes of the preset algorithms; The steps to identify the target algorithm in the sample file include: Detecting whether the sample file complies with the YARA rules in the algorithm feature library; When the sample file conforms to any of the YARA rules in the algorithm feature library, determining that the target algorithm in the sample file is a preset algorithm corresponding to the YARA rule; Detecting whether the sample file has a target feature value that matches the function entry feature value in the algorithm feature library; When a target feature value matching the function entry feature value is detected, determining the preset algorithm to which the function entry feature value belongs as the target algorithm in the sample file; Simulating and executing the associated code of the preset algorithm in the algorithm feature library on the sample file; If the result obtained by executing the association code is valid data with identifiable content, the preset algorithm to which the association code belongs is determined as the target algorithm in the sample file.

8. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions executable by the at least one processor, wherein the instructions are configured to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are used to execute the method process according to any one of claims 1 to 6.

Images