Method and device for detecting software

Abstract

Provided are a method and apparatus for detecting software, relating to the field of information security. The method comprises: segmenting a binary sequence of the software to be detected to obtain multiple subsequences; obtaining a statistical value for each subsequence based on the binary code in each of the multiple subsequences; analyzing the statistical value for each of the multiple subsequences to obtain features of the software to be detected; and detecting the software to be detected based on the features of the software to be detected and a pre-acquired feature library of target software, wherein the feature library of the target software includes features of each target software in at least one target software. By introducing a statistical method, the features of the software to be detected are extracted based on the statistical value of each subsequence in all subsequences of the software to be detected, and determining whether the software to be detected is the target software based on the features of the target software in the pre-constructed feature library of the target software, the interference caused by packers or variants on the detection can be reduced, thereby improving the detection accuracy.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method and device for detecting software. Background Art

[0002] With the development of Internet technology, while the efficiency of data exchange has been greatly improved, the rampant spread of a large number of malicious software has also made information security issues more prominent, and the detection of malicious software has become increasingly urgent.

[0003] Currently, malware detection methods include static detection methods. Static detection methods are usually implemented through signature matching and other methods. The technical implementation is relatively simple, but malware that uses packers or variants will interfere with the detection and analysis of static detection methods. In this case, the accuracy of using traditional static detection methods is not high. Summary of the Invention

[0004] The present application provides a method and apparatus for detecting software, which introduces statistical methods to extract features of the software to be tested and the target software, thereby reducing the interference of packers or variants on detection and improving detection accuracy.

[0005] In a first aspect, the present application provides a method for detecting software, the method comprising: segmenting a binary sequence of the software to be detected to obtain multiple subsequences; obtaining a statistical value of each subsequence based on the binary code in each subsequence in the multiple subsequences; analyzing the statistical value of each subsequence in the multiple subsequences to obtain features of the software to be detected; detecting the software to be detected based on the features of the software to be detected and a feature library of target software acquired in advance, the feature library of the target software including features of each target software in at least one target software.

[0006] Based on the above scheme, the binary sequence of the software to be detected is segmented to obtain multiple subsequences, and by introducing a statistical method, the features of the software to be detected are extracted based on the statistical value of each subsequence in all the subsequences of the software to be detected. Based on the features of the target software in the pre-built target software feature library, it is determined whether the software to be detected is the target software. This can reduce the interference caused by packers or variants on detection, thereby improving the detection accuracy.

[0007] Optionally, segmenting the binary sequence of the software to be detected to obtain a plurality of subsequences includes segmenting the binary sequence of the software to be detected with n bytes as a fixed length to obtain the plurality of subsequences, where n is a positive integer.

[0008] Optionally, the statistical value includes a first statistical value and / or a second statistical value; wherein, the first statistical value is the number of valid values ​​in a subsequence; the second statistical value is the number of valid values ​​in a subsequence whose previous digit is an invalid value, wherein the valid values ​​and the invalid values ​​are predefined values.

[0009] Optionally, the statistical value includes the first statistical value and the second statistical value, and the analyzing the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected includes: obtaining the coordinate points corresponding to the statistical value of each subsequence based on the first statistical value and the second statistical value of each subsequence of the software to be detected; and performing cluster analysis on the coordinate points corresponding to the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected.

[0010] Optionally, obtaining the coordinate points corresponding to the statistical values ​​of each subsequence based on the first statistical value and the second statistical value of each subsequence of the software to be detected includes: normalizing the first statistical value and the second statistical value of each subsequence in the multiple subsequences to obtain the normalized first statistical value and the normalized second statistical value; and converting the normalized first statistical value and the normalized second statistical value corresponding to each subsequence in the multiple subsequences into coordinate points.

[0011] Optionally, the detecting of the software to be detected based on the features of the software to be detected and the feature library of the target software acquired in advance includes: determining, based on the features of the software to be detected and the feature library of the target software, the similarity between the features of the software to be detected and the features of each target software in the feature library of the target software; and determining that the software to be detected is the target software when the similarity between the features of the software to be detected and the features of one or more target software in the feature library of the target software is greater than or equal to a preset threshold.

[0012] Optionally, the feature library of the target software also includes a target software type corresponding to each target software in the at least one target software; and the method also includes: when it is determined that the software to be detected is the target software, outputting the target software type corresponding to the target software with the highest similarity to the features of the software to be detected.

[0013] Optionally, the target software types include: adware, spyware, ransomware, browser hijacking software, behavior recording software and forced installation software.

[0014] In a second aspect, the present application provides a device for detecting software, which includes: a segmentation module, a statistics module, an analysis module and a detection module, wherein the segmentation module is used to segment the binary sequence of the software to be detected to obtain multiple subsequences; the statistics module is used to obtain the statistical value of each subsequence based on the binary code in each subsequence in the multiple subsequences; the analysis module is used to analyze the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected; the detection module is used to detect the software to be detected based on the characteristics of the software to be detected and a feature library of target software acquired in advance, wherein the feature library of target software includes the characteristics of each target software in at least one target software.

[0015] In a third aspect, the present application provides a software detection device, comprising a processor coupled to a memory and configured to execute a computer program in the memory to implement the method in the first aspect and any possible implementation of the first aspect.

[0016] Optionally, the detection software device may further include a memory for storing computer-readable instructions, and the processor reads the computer-readable instructions so that the detection software device can implement the method described in the above-mentioned first aspect and any possible implementation of the first aspect.

[0017] Optionally, the apparatus for detecting software may further include a communication interface, which is used for the apparatus to communicate with other devices. Exemplarily, the communication interface may be a transceiver, circuit, bus, module or other types of communication interfaces.

[0018] In a fourth aspect, the present application provides a chip system comprising at least one processor for supporting the implementation of the functions involved in the above-mentioned first aspect and any possible implementation of the first aspect, for example, processing the data involved in the above-mentioned method.

[0019] In one possible design, the chip system further includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0020] The chip system may be composed of chips, or may include chips and other discrete devices.

[0021] In a fifth aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by a computer, the computer implements the method in the first aspect and any possible implementation of the first aspect.

[0022] In a sixth aspect, the present application provides a computer program product, comprising: a computer program (also referred to as code, or instructions), which, when run, enables the method in the above-mentioned first aspect and any possible implementation of the first aspect to be executed.

[0023] It should be understood that the second to sixth aspects of the present application correspond to the technical solutions of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding feasible implementation methods are similar and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of an application scenario of the method for detecting software provided in an embodiment of the present application;

[0025] Figure 2 A schematic flow chart of a method for detecting software provided in an embodiment of the present application;

[0026] Figure 3 A schematic block diagram of a software detection device provided in an embodiment of the present application;

[0027] Figure 4 A schematic block diagram of another device for detecting software provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solution in this application will be described below with reference to the accompanying drawings.

[0029] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0030] To facilitate understanding of the embodiments of the present application, some terms or words involved in the present application are briefly explained below.

[0031] Malware: Also known as "rogue software," malware refers to software that is installed and run on a user's computer or other terminal without explicit user notification or permission, thereby infringing upon the user's legitimate rights and interests.

[0032] Based on different characteristics and hazards, malware can be divided into adware, spyware, ransomware, browser hijacking software, behavior recording software, and forced installation software.

[0033] Adware refers to software that is downloaded and installed on a user's terminal device without the user's permission, and that seeks profit through pop-up advertisements or other means. Spyware refers to software that can install backdoor programs on a user's terminal device without the user's knowledge to collect user information. Ransomware refers to software that harasses, intimidates, or even kidnaps user files, rendering user data assets or computing resources inoperable, and then demands a ransom from the user. User data assets may include documents, emails, databases, source code, images, compressed files, and other data. The ransom may be in the form of real money, Bitcoin, or other virtual currencies. Browser hijacking refers to software that tampers with a user's browser through browser plug-ins, browser helper objects, or browser hijacking, causing the user's browser to be improperly configured and forcibly redirected to certain websites. Behavior recording software refers to software that records a user's terminal device usage habits, web browsing habits, and other personal behavior without the user's permission, and steals and analyzes the user's private data. Forced installation software refers to software that forcibly installs other non-included independent software on the user's terminal device without the user's permission.

[0034] With the development of Internet technology, while the efficiency of data exchange has been greatly improved, the rampant spread of a large number of malicious software has also made information security issues more prominent, and the detection of malicious software has become increasingly urgent.

[0035] Malware's anomalous behavior is somewhat recognizable. Examples include forced installation, pop-up ads, and malicious collection of user information. Currently, identifying anomalous malware behavior primarily relies on computers. Traditional malware detection methods can be categorized as static or dynamic, depending on whether they focus on the malware's runtime state. Static detection typically uses signature matching and is technically simpler to implement. However, malware often employs methods such as packers or variants, which alter the order of certain binary sequences within the software's binary files, thus interfering with detection and analysis. For example, before being packed or mutated, a portion of the binary sequence in the malware is "00110100". Currently known detection technologies can determine whether the software to be tested is malware by detecting whether the binary sequence exists in the software to be tested. However, after the malware is packed or mutated, the binary sequence may be transformed into "00011100", that is, the binary data on the third and fourth bits of the binary sequence "00110100" before being packed or mutated are swapped with the binary data on the fifth and sixth bits, resulting in the binary sequence "00011100" after being packed or mutated. In this case, the use of traditional feature codes, feature matching, etc. will cause misjudgment and fail to detect that the malware after being packed or mutated is malware, resulting in a low detection accuracy problem.

[0036] In response to the above problems, the embodiments of the present application propose a method and device for detecting software, which segments the binary sequence of the software to be detected into multiple subsequences, and extracts the software to be detected based on the statistical value of each subsequence in all the subsequences of the software to be detected by introducing a statistical method. Then, based on the features of the target software in a pre-built feature library of the target software, it is determined whether the software to be detected is the target software. This can reduce the interference caused by packers or variants on the detection, thereby improving the detection accuracy.

[0037] It should be noted that the method and apparatus for detecting software provided in the embodiments of the present application can be applied to the field of information security, or to any field other than the field of information security, and the present application does not limit this.

[0038] Figure 1 Schematic diagram of an application scenario of the method for detecting software provided in an embodiment of the present application.

[0039] The application scenarios of the method for detecting software provided in the embodiments of the present application may include a device for detecting software, such as Figure 1As shown, the figure shows a user and a computer 110. Computer 110 can be an example of a software detection device. In response to user operations, computer 110 can obtain a binary file of the software to be detected. The binary file contains a binary sequence. Computer 110 can process the binary sequence of the software to be detected to obtain features of the software to be detected. Based on the features of the software to be detected and a pre-acquired malware feature library, computer 110 can detect the software to be detected.

[0040] It should be understood that in actual application scenarios, the device for detecting software includes but is not limited to a computer. For example, a server can also be an example of a device for detecting software. As long as the equipment or device can implement the method for detecting software provided in the embodiments of the present application by running a program, it can be an example of a device for detecting software. This application does not limit this.

[0041] Figure 2 This is a schematic flowchart of a method for detecting software provided in an embodiment of the present application.

[0042] like Figure 2 As shown, the method 200 for detecting software includes steps 210 to 240. The method 200 can be executed by a device for detecting software. The following uses a computer as an example of a device for detecting software to describe steps 210 to 240 in detail.

[0043] In step 210 , the computer segments the binary sequence of the software to be detected to obtain multiple subsequences.

[0044] As mentioned above, the computer can obtain the binary file of the software to be detected in response to the user's operation. For example, the computer can use a known tool for reading the binary file of the software to be detected in response to the user's operation to read the binary file of the software to be detected specified by the user.

[0045] A binary file contains a binary sequence. After obtaining the binary file of the software to be tested, the computer can segment the binary sequence in the binary file of the software to be tested to obtain multiple subsequences. The lengths of the subsequences in the obtained multiple subsequences can be the same or different, and this application does not limit this.

[0046] In one possible implementation, a computer segments the binary sequence of the software to be tested into segments of a fixed length of n bytes to obtain multiple subsequences, where n is a positive integer.

[0047] It can be understood that one byte is equal to eight bits, that is, the computer can segment the binary sequence of the software to be tested with a fixed length of 8 bits, such as 8 bits, 16 bits, 32 bits, 64 bits, 128 bits or 256 bits, which is an integer multiple of 8, and then obtain at least one binary subsequence with a length of 8 bits, such as 8 bits, 16 bits, 32 bits, 64 bits, 128 bits or 256 bits, which is an integer multiple of 8.

[0048] It should be noted that in this implementation, if the last subsequence does not reach the fixed length of the segment, it can be discarded. For example, if the fixed length of a segment is one byte, or 8 bits, and the last subsequence after segmentation contains only 5 bits, which does not reach the fixed length of 8 bits, the last 5-bit subsequence can be discarded.

[0049] In step 220 , the computer obtains a statistical value of each subsequence based on the binary code in each subsequence of the plurality of subsequences.

[0050] After obtaining the multiple subsequences, the computer can obtain a statistical value of each subsequence in the multiple subsequences based on a pre-set statistical rule.

[0051] In a possible implementation, the statistical value may include a first statistical value and / or a second statistical value.

[0052] The first statistical value may be the number of valid values ​​in a subsequence, and the second statistical value may be the number of valid values ​​preceded by an invalid value in a subsequence. Valid values ​​and invalid values ​​are predefined values.

[0053] For example, assuming that "1" in a binary sequence is predefined as a valid value and "0" as an invalid value, the first statistical value may be the number of "1"s in a subsequence, and the second statistical value may be the number of "01"s in a subsequence; assuming that "0" in a binary sequence is predefined as a valid value and "1" as an invalid value, the first statistical value may be the number of "0"s in a subsequence, and the second statistical value may be the number of "10"s in a subsequence. This application is not limited to this.

[0054] It is understood that the maximum value of the first statistical value is the length of the subsequence. For example, if the length of each subsequence is 8 bits, the maximum value of the first statistical value is 8, and the minimum value is 0. That is, if the value of each bit in a subsequence is a valid value, the first statistical value is 8; if the value of each bit in a subsequence is an invalid value, the first statistical value is 0.

[0055] It is also understandable that the maximum value of the second statistical value is half the length of the subsequence. For example, if the length of each subsequence is eight bits, the maximum value of the second statistical value is 4 and the minimum value is 0. That is, if there are at most four valid values ​​in a subsequence and the previous bit of each valid value is always an invalid value, the second statistical value is 4. If the value of each bit in a subsequence is either an invalid value or a valid value, or if the value of the first bit in a subsequence is a valid value and the values ​​of all remaining bits are invalid values, the second statistical value is 0.

[0056] In some possible implementations, the statistical value may include a statistical value obtained by performing statistics on some other sequence features in each subsequence of the software to be detected.

[0057] For example, the statistical value may include a third statistical value. The third statistical value may be the number of invalid values ​​in a subsequence whose preceding digit is a valid value; or the third statistical value may be the number of valid values ​​in a subsequence whose preceding and succeeding digits are both invalid values; or the third statistical value may be the number of invalid values ​​in a subsequence whose preceding and succeeding digits are both valid values, etc., which are not limited in this application.

[0058] In step 230 , the computer analyzes the statistical value of each subsequence in the plurality of subsequences to obtain the characteristics of the software to be detected.

[0059] After obtaining the statistical value of each subsequence of the binary sequence of the software to be detected, the computer may analyze the statistical values ​​of all subsequences of the binary sequence of the software to be detected, thereby obtaining the characteristics of the software to be detected.

[0060] The characteristics of the software to be detected are related to the statistical value of each subsequence.

[0061] In some possible implementations, the statistical values ​​of all subsequences of the software under test may be analyzed and counted to obtain multiple statistical values, which are then used as features of the software under test.

[0062] For example, the statistical value includes a first statistical value. The computer can analyze the number of subsequences in all subsequences corresponding to the software to be detected whose first statistical value is between 0 and 4, the number of subsequences whose first statistical value is between 5 and 8, the number of subsequences whose first statistical value is between 9 and 12, the number of subsequences whose first statistical value is between 13 and 16, and so on, and then obtain the distribution of the characteristics of the software to be detected for the first statistical value, that is, obtain the characteristics of the software to be detected.

[0063] For example, the statistical value includes a second statistical value. The computer can analyze the number of subsequences in all subsequences corresponding to the software to be detected whose second statistical value is between 0 and 2, the number of subsequences whose second statistical value is between 3 and 4, the number of subsequences whose second statistical value is between 5 and 6, the number of subsequences whose second statistical value is between 7 and 8, and so on, and then obtain the distribution of the characteristics of the software to be detected for the second statistical value, that is, obtain the characteristics of the software to be detected.

[0064] In some other possible implementations, cluster analysis may be performed on the statistical values ​​of all subsequences of the software to be tested to obtain the characteristics of the software to be tested.

[0065] It should be understood that the features of the software to be tested may be obtained in different forms depending on the clustering algorithm used, and this application does not limit this.

[0066] In one possible implementation, the statistical value includes a first statistical value and a second statistical value. The computer can obtain the coordinate points corresponding to the statistical value of each subsequence of the software to be detected based on the first statistical value and the second statistical value of each subsequence of the software to be detected; and perform cluster analysis on the coordinate points corresponding to the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected.

[0067] Exemplarily, the computer may process the first statistical value and the second statistical value corresponding to each subsequence of the software to be tested to obtain the coordinate point corresponding to each subsequence, wherein the first statistical value of each subsequence may be the horizontal coordinate, and the second statistical value may be the vertical coordinate; or, the first statistical value of each subsequence may be the vertical coordinate, and the second statistical value may be the horizontal coordinate, which is not limited in this application.

[0068] Optionally, the computer may further normalize the first statistical value and the second statistical value of each subsequence in the multiple subsequences to obtain a normalized first statistical value and a normalized second statistical value; and convert the normalized first statistical value and the normalized second statistical value corresponding to each subsequence in the multiple subsequences into coordinate points.

[0069] The first statistical value and the second statistical value are normalized, that is, the first statistical value and the second statistical value are converted into numbers between 0 and 1.

[0070] By way of example and not limitation, assuming that the length of each subsequence is 8 bits, the first statistical value is normalized, that is, the first statistical value of each subsequence is divided by 8, to obtain the normalized first statistical value of each subsequence; without loss of generality, the second statistical value is normalized, that is, the second statistical value of each subsequence is divided by 4 (obtained from 8 / 2), to obtain the normalized second statistical value of each subsequence.

[0071] It should be understood that the normalized first statistical value of each subsequence can be the horizontal axis, and the normalized second statistical value of the same subsequence can be the vertical axis; alternatively, the normalized first statistical value of each subsequence can be the vertical axis, and the normalized second statistical value of the same subsequence can be the horizontal axis, which is not limited in this application.

[0072] After obtaining the coordinate points corresponding to each subsequence, the computer can use a clustering algorithm to perform cluster analysis on the coordinate points corresponding to the statistical values ​​of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected.

[0073] Exemplarily, the clustering algorithm can be, for example, a K-means clustering algorithm. The computer can use the coordinate points corresponding to all subsequences of the software to be detected as the input data set of the K-means clustering algorithm, and initialize a value of K and K (K ≥ 1) coordinate points, where the K coordinate points serve as the center points of the initialized K clusters. After continuous iterative updates, the coordinates of the center points of the final several clusters are obtained. The number of center points obtained represents the number of clusters obtained. Therefore, the number of clusters obtained using the K-means clustering algorithm and the coordinates of the center points of these clusters can be used as features of the software to be detected and can be used for subsequent software detection.

[0074] In step 240 , the computer detects the software to be detected based on the features of the software to be detected and the pre-acquired feature library of the target software.

[0075] The target software feature library includes features of each target software in at least one target software.

[0076] It should be noted that the target software mentioned here may include but is not limited to the malware mentioned above, the characteristics of the target software may include but are not limited to the characteristics of the malware, and the feature library of the target software may include but is not limited to the feature library of the malware.

[0077] It should be understood that the process of acquiring the characteristics of the target software is similar to the process of acquiring the characteristics of the software to be detected described above, and for the sake of brevity, it will not be repeated here.

[0078] The computer detects the software to be detected based on the features of the software to be detected and the feature library of the target software acquired in advance. It can be understood that after obtaining the features of the software to be detected and the feature library of the target software, the computer can match the features of the software to be detected with the features of each target software included in the feature library of the target software. If the features of the software to be detected successfully match the features of one or more target software in the feature library of the target software, it can be determined that the software to be detected is the target software.

[0079] In one possible implementation, the computer may determine, based on the features of the software to be detected and the feature library of the target software, the similarity between the features of the software to be detected and the features of each target software in at least one target software in the feature library of the target software; if the similarity between the features of the software to be detected and the features of one or more target software in the feature library of the target software is greater than or equal to a preset threshold, the software to be detected is determined to be the target software.

[0080] As an example and not a limitation, you can first determine whether the number of clusters of the software to be detected is the same as the number of clusters of one or more target software in the feature library of the target software. If the number of clusters of the software to be detected is different from the number of clusters of any target software in the feature library of the target software, then you can determine that the software to be detected is non-malware; if the number of clusters of the software to be detected is the same as the number of clusters of one or more target software in the feature library of the target software, then you can first determine the similarity between the features of the software to be detected and the features of the one or more target software, and then determine the target software with the highest similarity between the software to be detected and the one or more target software, and then determine whether the value of the highest similarity is greater than or equal to a preset threshold. If the value of the highest similarity is greater than or equal to the preset threshold, then determine that the software to be detected is target software; if the value of the highest similarity is less than the first threshold, then determine that the software to be detected is non-target software.

[0081] As an example and not a limitation, the similarity between clusters can be recorded as the first similarity, and the similarity between the features of the software can be recorded as the second similarity. A possible implementation method for determining the similarity between the features of the software to be detected and the features of any target software is to first calculate the distance (e.g., Euclidean distance) between the center point of each cluster of the software to be detected and the center point of each cluster of the target software, and based on a predetermined correspondence between the distance and the first similarity, respectively determine the similarity between each cluster of the software to be detected and each cluster of the target software, and then average the obtained first similarities between each cluster of the software to be detected and each cluster of the target software to obtain a first similarity mean, and based on a predetermined correspondence between the first similarity mean and the second similarity, determine the second similarity between the features of the software to be detected and the features of the target software.

[0082] Exemplarily, it is assumed that the features of the software to be tested and the features of the target software are obtained by using the K-means clustering algorithm; it is further assumed that the features of the software to be tested include 4 clusters and the coordinates of the center points of the corresponding 4 clusters, and the feature library of the target software includes the features of 3 target software, among which the features of target software #1 include 5 clusters and the coordinates of the center points of the corresponding 5 clusters, and the features of target software #2 and the features of target software #3 respectively include 4 clusters and the coordinates of the center points of the corresponding 4 clusters; in this case, it can be determined that the second similarity between the features of the software to be tested and the features of target software #1 is lower than the second similarity with the features of target software #2 and the features of target software #3, and then it can be determined which of the second similarities between the features of the software to be tested and the features of target software #2 and the features of target software #3 is the highest.

[0083] For the sake of convenience, the center points of the four clusters of the software to be tested are recorded as center point 1 to center point 4, the center points of the four clusters of target software #2 are recorded as center point 5 to center point 8, and the center points of the four clusters of target software #3 are recorded as center point 9 to center point 12.

[0084] The computer may respectively calculate the distances between the center points of the four clusters of the software to be detected and the center points of the four clusters of the target software #2 and the center points of the four clusters of the target software #3. That is, the distances between center point 1 and center point 5, center point 6, center point 7 and center point 8 are calculated respectively; the distances between center point 2 and center point 5, center point 6, center point 7 and center point 8 are calculated respectively; the distances between center point 3 and center point 5, center point 6, center point 7 and center point 8 are calculated respectively; the distances between center point 4 and center point 5, center point 6, center point 7 and center point 8 are calculated respectively; in this way, 16 distances can be obtained, and based on these 16 distances and the correspondence between the preset distances and the first similarities, 16 first similarities are determined, and then the 16 first similarities are averaged to obtain the first similarity mean between the software to be detected and the target software #2, and then based on the first similarity mean and the correspondence between the preset first similarity mean and the second similarity, the second similarity between the features of the software to be detected and the features of the target software #2 is determined.

[0085] Without loss of generality, the second similarity between the features of the software to be detected and the features of target software #3 can be calculated by referring to the above process of calculating the second similarity between the features of the software to be detected and the features of target software #2.

[0086] The highest second similarity is determined from the second similarities between the features of the software to be tested and the features of target software #2, and the second similarities between the features of the software to be tested and the features of target software #3. Assuming that the second similarity between the features of the software to be tested and the features of target software #2 is higher than the second similarity between the features of the software to be tested and the features of target software #3, it is determined whether the second similarity between the features of the software to be tested and the features of target software #2 is greater than or equal to a preset threshold. If the second similarity between the features of the software to be tested and the features of target software #2 is greater than or equal to the preset threshold, the software to be tested can be determined to be the target software; if the second similarity between the features of the software to be tested and the features of target software #2 is less than the preset threshold, the software to be tested can be determined to be non-target software.

[0087] In one possible implementation, the feature library of the target software may further include a target software type corresponding to each target software in at least one target software; and method 200 may further include: when it is determined that the software to be detected is the target software, outputting the target software type corresponding to the target software having the highest similarity with the features of the software to be detected.

[0088] Among them, target software types include but are not limited to adware, spyware, ransomware, browser hijacking software, behavior recording software and forced installation software.

[0089] Exemplarily, assuming that the second similarity between the features of the software to be detected and the features of target software #2 is the highest, and the second similarity between the features of the software to be detected and the features of target software #2 is greater than or equal to a preset threshold, and the target software type of target software #2 is advertising software, then it can be determined that the software to be detected is target software, and "advertising software" can be output to inform the user that the software to be detected is target software and that the software to be detected may be advertising software.

[0090] Based on the above scheme, the binary sequence of the software to be detected is segmented to obtain multiple subsequences, and by introducing a statistical method, the characteristics of the software to be detected are extracted based on the statistical value of each subsequence in all the subsequences of the software to be detected. The characteristics of the target software in the pre-built feature library of the target software are used as a basis to determine whether the software to be detected is the target software. This can reduce the interference caused by the packer or variant on the detection, and thus improve the detection accuracy. In addition, based on the spatial scale of the original data, the binary sequence in the binary file of the software is segmented, which reduces the requirements for the computing power and computing resources of the device or equipment, so that devices or equipment with general computing power can also quickly realize the extraction of software features, the construction of the feature library of the target software and the detection of the software to be detected.

[0091] Figure 3 It is a schematic block diagram of a device for detecting software provided in an embodiment of the present application.

[0092] like Figure 3 As shown, the software detection device 300 may include: a segmentation module 310, a statistics module 320, an analysis module 330, and a detection module 340. The software detection device 300 may be used to implement the functions of the computer in the above-mentioned method 200, wherein the segmentation module 310 may be used to segment the binary sequence of the software to be detected to obtain multiple subsequences; the statistics module 320 may be used to obtain a statistical value of each subsequence based on the binary code in each subsequence in the multiple subsequences; the analysis module 330 may be used to analyze the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected; and the detection module 340 may be used to detect the software to be detected based on the characteristics of the software to be detected and a pre-acquired feature library of target software, wherein the feature library of target software includes the characteristics of each target software in at least one target software.

[0093] Optionally, the segmentation module 310 may be configured to segment the binary sequence of the software to be detected with n bytes as a fixed length to obtain the multiple subsequences, where n is a positive integer.

[0094] Optionally, the statistical value includes a first statistical value and / or a second statistical value; wherein, the first statistical value is the number of valid values ​​in a subsequence; the second statistical value is the number of valid values ​​in a subsequence whose previous digit is an invalid value, wherein the valid values ​​and the invalid values ​​are predefined values.

[0095] Optionally, the statistical value includes the first statistical value and the second statistical value, and the analysis module 330 can be used to obtain the coordinate points corresponding to the statistical value of each subsequence based on the first statistical value and the second statistical value of each subsequence of the software to be detected; perform cluster analysis on the coordinate points corresponding to the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected.

[0096] Optionally, the analysis module 330 can be specifically configured to normalize the first statistical value and the second statistical value of each subsequence in the multiple subsequences to obtain a normalized first statistical value and a normalized second statistical value; and convert the normalized first statistical value and the normalized second statistical value corresponding to each subsequence in the multiple subsequences into coordinate points.

[0097] Optionally, the detection module 340 can be used to determine the similarity between the characteristics of the software to be detected and the characteristics of each target software in the feature library of the target software based on the characteristics of the software to be detected and the feature library of the target software; when the similarity between the characteristics of the software to be detected and the characteristics of one or more target software in the feature library of the target software is greater than or equal to a preset threshold, the software to be detected is determined to be the target software.

[0098] Optionally, the feature library of the target software also includes the target software type corresponding to each target software in the at least one target software; the detection module 340 can also be used to output the target software type corresponding to the target software with the highest similarity to the features of the software to be detected when it is determined that the software to be detected is the target software.

[0099] Optionally, the target software types include: adware, spyware, ransomware, browser hijacking software, behavior recording software and forced installation software.

[0100] It should be understood that Figure 3 The module division of the detection software device is only exemplary. In actual applications, different functional modules can be divided according to different functional requirements. This application does not impose any restrictions on the division form and number of functional modules in actual applications, and Figure 3 This does not limit the present application in any way.

[0101] Figure 4It is a schematic block diagram of another device for detecting software provided in an embodiment of the present application.

[0102] The detection software device 400 can be used to implement the functions of the computer in the above method 200. The detection software device 400 can be a chip system. In the embodiment of the present application, the chip system can be composed of a chip, or can include a chip and other discrete devices.

[0103] like Figure 4 As shown, the device 400 for detecting software may include at least one processor 410, which is used to implement the functions of the computer in the method 200 provided in the embodiment of the present application.

[0104] Exemplarily, when the software detection apparatus 400 is used to implement the method 200 provided in an embodiment of the present application, the processor 410 may be configured to segment a binary sequence of the software to be detected to obtain multiple subsequences; obtain statistical values ​​for each subsequence based on the binary code in each of the multiple subsequences; analyze the statistical values ​​for each of the multiple subsequences to obtain features of the software to be detected; and detect the software to be detected based on the features of the software to be detected and a pre-acquired feature library of target software, where the feature library of target software includes features of each target software in at least one target software. For details, please refer to the detailed description in the method example and will not be repeated here.

[0105] The device 400 for detecting software may further include at least one memory 420, which may be used to store program instructions and data, etc. The memory 420 is coupled to the processor 410. The coupling in the embodiment of the present application is an indirect coupling or communication connection between devices, units or modules, which may be electrical, mechanical or other forms, and is used for information exchange between devices, units or modules. The processor 410 may operate in conjunction with the memory 420. The processor 410 may execute program instructions stored in the memory 420. At least one of the at least one memory may be included in the processor.

[0106] The detection software device 400 may also include a communication interface 430 for communicating with other devices via a transmission medium, so that the detection software device 400 can communicate with other devices. The communication interface 430 may be, for example, a transceiver, an interface, a bus, a circuit, or a device capable of transmitting and receiving functions. The processor 410 may use the communication interface 430 to transmit and receive data and / or information, and to implement Figure 2 The method 200 executed by the computer in the corresponding embodiment.

[0107] The specific connection medium between the processor 410, the memory 420 and the communication interface 430 is not limited in the embodiment of the present application. Figure 4 The processor 410, the memory 420 and the communication interface 430 are connected via a bus 440. The bus 440 is connected to the Figure 4 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0108] The present application also provides a chip system, which includes at least one processor for implementing the above Figure 2 The functions involved in the computer-implemented method described in the illustrated embodiments.

[0109] In one possible design, the chip system further includes a memory, which is used to store program instructions and data, and the memory is located inside or outside the processor.

[0110] The chip system can be composed of chips, or can include chips and other discrete devices.

[0111] The present application also provides a computer program product, which includes: a computer program (also referred to as code or instruction), which, when executed, causes a computer to execute the following Figure 2 The method of the embodiment shown.

[0112] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program (also referred to as code or instruction). When the computer program is executed, the computer executes the following Figure 2 The method of the embodiment shown.

[0113] It should be understood that the processor in the embodiments of the present application can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned method embodiment can be completed by hardware integrated logic circuits in the processor or by software instructions. The above-mentioned processor can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory, and the processor reads the information in the memory and, in conjunction with its hardware, completes the steps of the above-mentioned method.

[0114] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0115] The terms "unit," "module," and the like used in this specification may be used to refer to a computer-related entity, hardware, firmware, a combination of hardware and software, software, or software in execution.

[0116] Those skilled in the art will appreciate that the various illustrative logical blocks and steps described in conjunction with the embodiments disclosed herein can be implemented using electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. In the several embodiments provided in this application, it should be understood that the disclosed devices, equipment, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the module division is only a logical function division. In actual implementation, there may be other division methods, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not implemented. In addition, the coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of devices or modules, and can be electrical, mechanical, or other forms.

[0117] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected to achieve the purpose of the present embodiment according to actual needs.

[0118] In addition, the functional modules in the various embodiments of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more units may be integrated into one module.

[0119] In the above embodiments, the functions of each functional module can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions (programs). When the computer program instructions (program) are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a digital versatile disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0120] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a ROM, a RAM, a magnetic disk, or an optical disk.

[0121] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A method for detecting software, characterized in that: The method comprises: Segment the binary sequence of the software to be detected to obtain multiple subsequences; obtaining a statistical value of each subsequence based on a binary code in each subsequence of the plurality of subsequences; Analyzing the statistical value of each subsequence in the plurality of subsequences to obtain the characteristics of the software to be detected; Detecting the software to be detected based on the features of the software to be detected and a pre-acquired feature library of target software, wherein the feature library of target software includes features of each target software in at least one target software; The statistical value includes a first statistical value and / or a second statistical value; wherein the first statistical value is the number of valid values ​​in a subsequence; the second statistical value is the number of valid values ​​whose previous digit is an invalid value in a subsequence, wherein the valid values ​​and the invalid values ​​are predefined values; The statistical value includes the first statistical value and the second statistical value, The analyzing the statistical value of each subsequence in the plurality of subsequences to obtain the characteristics of the software to be detected includes: Based on the first statistical value and the second statistical value of each subsequence of the software to be detected, obtaining a coordinate point corresponding to the statistical value of each subsequence; Cluster analysis is performed on the coordinate points corresponding to the statistical value of each subsequence in the multiple subsequences to obtain the characteristics of the software to be detected.

2. The method according to claim 1, wherein The binary sequence of the software to be detected is segmented to obtain multiple subsequences, including: The binary sequence of the software to be detected is segmented with n bytes as a fixed length to obtain the multiple subsequences, where n is a positive integer.

3. The method according to claim 1, wherein The obtaining, based on the first statistical value and the second statistical value of each subsequence of the software to be detected, a coordinate point corresponding to the statistical value of each subsequence includes: Normalizing the first statistical value and the second statistical value of each subsequence in the multiple subsequences to obtain a normalized first statistical value and a normalized second statistical value; The normalized first statistical value and the normalized second statistical value corresponding to each subsequence in the multiple subsequences are converted into coordinate points.

4. The method according to claim 1, wherein The detecting of the software to be detected based on the features of the software to be detected and the pre-acquired feature library of the target software includes: Determining, based on the features of the software to be detected and the feature library of the target software, a similarity between the features of the software to be detected and the features of each target software in the at least one target software in the feature library of the target software; When the similarity between the feature of the software to be detected and the features of one or more target software in the feature library of the target software is greater than or equal to a preset threshold, the software to be detected is determined to be the target software.

5. The method according to claim 1, wherein The target software feature library further includes a target software type corresponding to each target software in the at least one target software; as well as The method further comprises: When it is determined that the software to be detected is the target software, the target software type corresponding to the target software having the highest similarity to the features of the software to be detected is output.

6. The method according to claim 5, wherein The target software types include: adware, spyware, ransomware, browser hijacking software, behavior recording software and forced installation software.

7. A device for detecting software, characterized in that: The device comprises: A segmentation module is used to segment the binary sequence of the software to be detected into multiple subsequences; a statistical module, configured to obtain a statistical value of each subsequence based on a binary code in each subsequence of the plurality of subsequences; an analysis module, configured to analyze the statistical value of each subsequence in the plurality of subsequences to obtain features of the software to be detected; a detection module, configured to detect the software to be detected based on features of the software to be detected and a pre-acquired feature library of target software, wherein the feature library of target software includes features of each target software in at least one target software; The statistical value includes a first statistical value and / or a second statistical value; wherein the first statistical value is the number of valid values ​​in a subsequence; the second statistical value is the number of valid values ​​whose previous digit is an invalid value in a subsequence, wherein the valid values ​​and the invalid values ​​are predefined values; The statistical value includes the first statistical value and the second statistical value, The analysis module is specifically configured to obtain, based on the first statistical value and the second statistical value of each subsequence of the software to be detected, coordinate points corresponding to the statistical value of each subsequence; and perform cluster analysis on the coordinate points corresponding to the statistical value of each subsequence in the multiple subsequences to obtain features of the software to be detected.

8. A device for detecting software, characterized in that: The method comprises a processor configured to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The method comprises a computer program which, when running on a computer, causes the computer to perform the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The invention comprises a computer program which, when being executed, causes a computer to execute the method according to any one of claims 1 to 6.

Images