Methods, devices, and related products for combating malicious applications

Abstract

This application provides a method, apparatus, and related products for combating malicious applications. The method includes: obtaining a startup detection instruction to launch an application monitoring layer and an application detection layer according to the startup detection instruction; the successfully launched application monitoring layer monitoring the target application and generating a monitoring sample dataset; the successfully launched application detection layer launching a sandbox within it, tracking the behavior of the target application based on the monitoring sample dataset, generating a behavioral feature sequence, and determining whether the target application is a malicious or benign application based on the behavioral feature sequence.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to a method, apparatus and related products for combating malicious applications. Background Technology

[0002] With the rapid development of the Internet, users can easily obtain information from it. However, the Internet's openness makes users vulnerable to attacks from malicious applications. Moreover, these malicious applications often engage in countermeasures to avoid being monitored. Therefore, how to counter malicious applications has become an urgent technical problem to be solved. Summary of the Invention

[0003] In view of the above problems, this application provides a method, apparatus and related products for combating malicious applications.

[0004] The embodiments of this application disclose the following technical solutions:

[0005] A method for combating malicious applications, comprising:

[0006] Behavior tracking is performed on the monitoring sample dataset generated by monitoring the target application to identify the target application to be monitored as a malicious application.

[0007] If the application to be monitored is found to be malicious, a sandbox set in the application protection layer is launched to combat the malicious application.

[0008] Optionally, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's monitoring of function calls in response to the application being monitored being a malicious application.

[0009] Optionally, the step of responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to counteract the malicious application includes: responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to counteract the malicious application's monitoring of document operations.

[0010] Optionally, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being identified as a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's memory access monitoring in response to the application being monitored being identified as a malicious application.

[0011] Optionally, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's data transmission and reception monitoring in response to the application being monitored being a malicious application.

[0012] Optionally, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's attempts to monitor the environment in response to the application being monitored being a malicious application.

[0013] Optionally, the step of tracking behavior based on the monitoring sample dataset generated from monitoring the target application to identify malicious applications includes:

[0014] Obtain a startup detection command, and start the application monitoring layer and the application detection layer according to the startup detection command;

[0015] The successfully started application monitoring layer monitors the target application and generates a monitoring sample dataset;

[0016] The successfully launched application detection layer starts the sandbox set within it. Based on the monitoring sample dataset, it tracks the behavior of the target application to be monitored and generates a behavioral feature sequence. Based on the behavioral feature sequence, it determines whether the target application to be monitored is a malicious application or a benign application.

[0017] A device for combating malicious applications, comprising:

[0018] The malicious detection unit is used to track the behavior of the target application being monitored based on the monitoring sample dataset generated by monitoring the target application, and to identify the target application being monitored as a malicious application.

[0019] The countermeasure unit is used to activate a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application.

[0020] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's monitoring of function calls.

[0021] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's operation monitoring of the document.

[0022] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's memory access monitoring.

[0023] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's data transmission and reception monitoring.

[0024] Optionally, the countermeasure unit is specifically used to activate a sandbox set in the application protection layer to counteract the malicious application's environmental monitoring in response to the application being identified as a malicious application.

[0025] Optionally, the malicious detection unit is specifically used for:

[0026] Obtain a startup detection command, and start the application monitoring layer and the application detection layer according to the startup detection command;

[0027] The successfully started application monitoring layer monitors the target application and generates a monitoring sample dataset;

[0028] The successfully launched application detection layer starts the sandbox set within it. Based on the monitoring sample dataset, it tracks the behavior of the target application to be monitored and generates a behavioral feature sequence. Based on the behavioral feature sequence, it determines whether the target application to be monitored is a malicious application or a benign application.

[0029] An electronic device includes a memory and a processor, wherein the memory stores a computer-executable program, and the processor is configured to execute the computer-executable program to implement the method described in any one of the embodiments of this application.

[0030] A computer storage medium storing a computer-executable program, wherein the computer-executable program, when run, implements the method described in any one of the embodiments of this application.

[0031] In this embodiment, behavior tracking is performed based on the monitoring sample dataset generated by monitoring the target application to be monitored, and the target application to be monitored that is a malicious application is identified; in response to the application to be monitored being a malicious application, a sandbox set in the application protection layer is activated to counteract the malicious application, thereby realizing the counteracting of malicious applications, ensuring the monitoring of malicious applications, and thus ensuring data security. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating the method for combating malicious applications in Embodiment 1 of this application;

[0034] Figure 2 This is a schematic diagram of the structure of the anti-malicious application device in Embodiment 2 of this application;

[0035] Figure 3 This is a schematic diagram of the electronic device structure in Embodiment 3 of this application;

[0036] Figure 4 This is a schematic diagram of the hardware structure of the electronic device in Embodiment 4 of this application. Detailed Implementation

[0037] Implementing any technical solution of the embodiments of this application does not necessarily require achieving all of the above advantages at the same time.

[0038] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] In this embodiment, behavior tracking is performed based on the monitoring sample dataset generated by monitoring the target application to be monitored, and the target application to be monitored that is a malicious application is identified; in response to the application to be monitored being a malicious application, a sandbox set in the application protection layer is activated to counteract the malicious application, thereby realizing the counteracting of malicious applications, ensuring the monitoring of malicious applications, and thus ensuring data security.

[0040] Figure 1 An exemplary flowchart illustrating a method for combating malicious applications according to an embodiment of this application is shown. Figure 1 As shown, the execution entity can be a backend server, which can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0041] like Figure 1 As shown, methods for combating malicious applications include:

[0042] S101. Based on the monitoring sample dataset generated by monitoring the target application to be monitored, conduct behavior tracking to identify the target application to be monitored as a malicious application.

[0043] In this embodiment, the step of tracking behavior based on the monitoring sample dataset generated from monitoring the target application to identify malicious applications includes:

[0044] S111. Obtain a startup detection instruction to start the application monitoring layer and the application detection layer according to the startup detection instruction;

[0045] S121. The successfully started application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset.

[0046] Optionally, in this embodiment, obtaining the startup detection command to start the application monitoring layer and the application detection layer according to the startup detection command includes: obtaining the startup detection command through the detection control layer set on the monitoring end, and starting the application monitoring layer and the application detection layer according to the startup detection command.

[0047] Optionally, the detection control layer is located in the cloud to receive the start detection command transmitted from the configured API interface, while the application monitoring layer and application detection layer are located on the monitoring terminal where the target application to be monitored resides. This monitoring terminal can be any electronic device, such as a mobile terminal or a server.

[0048] Optionally, the detection control layer is provided with a command execution module and a sandbox startup module to start the application monitoring layer according to the command execution module and start the application detection layer according to the sandbox startup module. This allows for simultaneous control of the startup of the application monitoring layer and the application detection layer, preventing the application detection layer from failing to start while the application monitoring layer starts successfully, thus avoiding the application detection layer being unable to process the monitoring sample dataset in a timely manner to track the behavior of the target application being monitored.

[0049] In this embodiment, the successful startup of the application monitoring layer to monitor the target application and generate a monitoring sample dataset can include at least one of the following scenarios:

[0050] (I) Scenario 1

[0051] Optionally, the successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the functions called by each target application to be monitored based on the interface function call monitoring unit in the application monitoring layer, so as to form a subset of function call monitoring samples and add it to the monitoring sample dataset.

[0052] In this embodiment, the function includes at least one of system functions, library functions, and kernel functions.

[0053] Specifically, by monitoring the instructions that call a function, the address space pointed to by that instruction can be determined, thereby quickly identifying whether the called function is a system function, a library function, or a kernel function.

[0054] Specifically, a piece of embedded code can be written and inserted into a system function, library function, or kernel function. By reporting the process information of the processes running these functions, including the process name and process ID, and further by storing the parameters in the registers that hold the function's input parameters, the instructions that call the function can be monitored to determine the address space pointed to by the instruction, thereby quickly determining whether the called function is a system function, library function, or kernel function.

[0055] (II) Scenario Two

[0056] Optionally, the successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the files operated by each target application to be monitored based on the file operation monitoring unit in the application monitoring layer, so as to form a subset of file operation monitoring samples and add it to the monitoring sample dataset.

[0057] In this embodiment, file operations include adding, deleting, modifying, and querying. Specifically, in order to reduce the amount of data processing, operations on only specific files can be monitored, such as files with a high security level or files whose corruption would have a significant impact.

[0058] Specifically, the file operation monitoring unit in the application monitoring layer reads the file directory to be monitored by calling the WatchService interface to bind the WatchService interface and the file directory, so as to monitor the operation events of files in the file directory, thereby realizing the monitoring of files operated by each application, thus improving the accuracy and real-time performance of monitoring.

[0059] (III) Scenario 3

[0060] Optionally, the successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the memory access of each target application to be monitored based on the memory access monitoring unit in the application monitoring layer, so as to form a subset of memory access monitoring samples and add it to the monitoring sample dataset.

[0061] Specifically, the access includes memory file reading and memory file parsing. Specifically, memory access by each target application can be monitored by capturing memory images, thereby reducing the difficulty of memory monitoring. Specifically, segmented monitoring can be achieved by setting breakpoints in the memory image to monitor the memory access of each target application.

[0062] (iv) Situation 4

[0063] Optionally, the successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the data sending and receiving behavior of each target application to be monitored based on the data sending and receiving monitoring unit in the application monitoring layer, so as to form a subset of sending and receiving behavior monitoring samples and add it to the monitoring sample dataset.

[0064] Specifically, the data transmission and reception monitoring unit monitors the data transmission and reception behavior of each target application in the form of events, so as to form a subset of transmission and reception behavior monitoring samples and add them to the monitoring sample dataset, thereby improving processing efficiency and avoiding data backlog.

[0065] (V) Situation 5

[0066] Optionally, the successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the environment in which each target application to be monitored operates based on the environmental change monitoring unit in the application monitoring layer, so as to form an environmental change monitoring sample subset and add it to the monitoring sample dataset.

[0067] The environment includes whether the corresponding user is a legitimate user, changes in processes and services, etc.

[0068] Here, the aforementioned monitoring sample dataset can be stored in a relational database, or it can be vectorized in a similar way and stored in a vectorized database, thereby improving the real-time nature of data acquisition and the efficiency of data processing.

[0069] The interface function call monitoring unit, file operation monitoring unit, memory access monitoring unit, data transmission and reception monitoring unit, and environmental change monitoring unit can be deployed on the monitored end to reduce data transmission latency.

[0070] S131. The successfully launched application detection layer starts the sandbox set within it, tracks the behavior of the target application to be monitored based on the monitoring sample dataset, generates a behavior feature sequence, and determines whether the target application to be monitored is a malicious application or a benign application based on the behavior feature sequence.

[0071] Optionally, the successfully launched application detection layer starts a sandbox within it, and tracks the behavior of the target application to be monitored based on the monitoring sample dataset to generate a behavior feature sequence, including: the successfully launched application detection layer starts a sandbox within it, extracts behavior features from the monitoring sample dataset, and tracks the behavior of the target application to be monitored based on the extracted behavior features to generate a behavior feature sequence.

[0072] Optionally, determining whether the target application to be monitored is a malicious application or a benign application based on the behavioral feature sequence includes: scoring the maliciousness of the target application to be monitored based on the behavioral feature sequence to determine whether the target application to be monitored is a malicious application or a benign application; or, performing binary classification on the target application to be monitored based on the behavioral feature sequence to determine whether the target application to be monitored is a malicious application or a benign application.

[0073] Specifically, the monitoring sample dataset can be stored in a vector database, thereby enabling direct extraction of behavioral features based on the vector database and rapid generation of behavioral feature sequences.

[0074] Specifically, for example, the deviation of each feature in the statistical behavioral feature sequence from the expected feature is calculated, and then these deviations are weighted and averaged to obtain a weighted average. If the weighted average is greater than the set weighted average threshold, the corresponding application is considered malicious; otherwise, it is considered non-malicious.

[0075] In this embodiment, an application profile can be formed by detecting the application.

[0076] Specifically, the detection model analyzes the scenarios described in (I) to (V) above to determine function call characteristics, file operation characteristics, memory access characteristics, data transmission and reception characteristics, and environmental change characteristics. Based on these characteristics, key-value pairs are formed with the application, and each characteristic is scored. All scores are weighted and averaged to obtain a score for the application. This score is then compared with a set score threshold (range) to determine the application's malicious evaluation value. For example, the Euclidean distance between the application's score and the set score threshold (range) is directly used as the application's malicious evaluation value. The smaller the malicious evaluation value, the higher the application's security.

[0077] S102. In response to the fact that the application to be monitored is a malicious application, a sandbox set in the application protection layer is launched to counteract the malicious application.

[0078] Corresponding to scenarios one to five of the above application monitoring layer monitoring the target application and generating a monitoring sample dataset, when performing adversarial processing in step S102, each of scenarios one to five is processed respectively, so that the malicious application continues to perform the behaviors of scenarios one to five within the monitoring range, so as to continue monitoring its behavior, and finally, when it is determined to be a malicious application, security processing is performed.

[0079] Specifically, in this embodiment, step S102, which involves activating a sandbox set in the application protection layer to combat the malicious application, includes at least one of the following situations:

[0080] Scenario 1:

[0081] Optionally, in this embodiment, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's function call monitoring in response to the application being monitored being a malicious application.

[0082] Scenario 2:

[0083] Optionally, in this embodiment, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's monitoring of document operations.

[0084] Scenario 3:

[0085] Optionally, in this embodiment, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's memory access monitoring in response to the application being monitored being a malicious application.

[0086] Scenario 4:

[0087] Optionally, in this embodiment, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's data transmission and reception monitoring in response to the application being monitored being a malicious application.

[0088] Scenario 5:

[0089] Optionally, in this embodiment, the step of activating a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application includes: activating a sandbox set in the application protection layer to counteract the malicious application's attempts to monitor the environment in response to the application being monitored being a malicious application.

[0090] Referring to the different types of adversarial processing described above, these adversarial processing methods are divided into five categories. Therefore, when performing these adversarial processing methods, a pre-trained adversarial processing model can be used, which is suitable for different types of surveillance. This adversarial processing model can be, for example, a neural network model. The neural network model can be trained using sample data that has generated the aforementioned different surveillance adversarial processes.

[0091] Here, in the above embodiments, the anti-interference processing of the application is equivalent to canceling or suspending the anti-interference behavior of the malicious application against the above-mentioned monitoring methods, so that these malicious applications continue to be within the scope of monitoring.

[0092] In this embodiment, considering that malicious applications will engage in corresponding countermeasures to resist the aforementioned monitoring, which would greatly increase the information entropy of the malicious application, the system extracts features of the countermeasures of the malicious application and calculates the information entropy based on the extracted features. The extracted features include the name of the malicious application, the process ID of the malicious application, the runtime lifecycle of the malicious application, and the stubs of the malicious application.

[0093] In specific calculations, information entropy can be calculated based on a weighted average, and the weights can be allocated according to the influence of the features.

[0094] When dealing with malicious applications, they can be isolated.

[0095] Figure 2 This is a schematic diagram of the structure of a device for combating malicious applications, according to an embodiment of this application. Figure 2 As shown, it includes:

[0096] The malicious detection unit 201 is used to perform behavior tracking based on the monitoring sample dataset generated by monitoring the target application to be monitored, and to identify the target application to be monitored as a malicious application.

[0097] The countermeasure unit 201 is used to activate a sandbox set in the application protection layer to counteract the malicious application in response to the application being monitored being a malicious application.

[0098] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's monitoring of function calls.

[0099] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's operation monitoring of the document.

[0100] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's memory access monitoring.

[0101] Optionally, the countermeasure unit is specifically used to, in response to the application to be monitored being a malicious application, activate a sandbox set in the application protection layer to counteract the malicious application's data transmission and reception monitoring.

[0102] Optionally, the countermeasure unit is specifically used to activate a sandbox set in the application protection layer to counteract the malicious application's environmental monitoring in response to the application being identified as a malicious application.

[0103] Optionally, the malicious detection unit is specifically used for:

[0104] Obtain a startup detection command, and start the application monitoring layer and the application detection layer according to the startup detection command;

[0105] The successfully started application monitoring layer monitors the target application and generates a monitoring sample dataset;

[0106] The successfully launched application detection layer starts the sandbox set within it. Based on the monitoring sample dataset, it tracks the behavior of the target application to be monitored and generates a behavioral feature sequence. Based on the behavioral feature sequence, it determines whether the target application to be monitored is a malicious application or a benign application.

[0107] Optionally, the malicious detection unit includes:

[0108] The detection startup unit is used to obtain a startup detection instruction, and to start the application monitoring layer and the application detection layer according to the startup detection instruction;

[0109] The data monitoring unit is used to enable the successfully started application monitoring layer to monitor the target application and generate a monitoring sample dataset.

[0110] The tracking unit is used to enable the successfully launched application detection layer to start the sandbox set within it, and to track the behavior of the target application to be monitored based on the monitoring sample dataset, generate a behavior feature sequence, and determine whether the target application to be monitored is a malicious application or a benign application based on the behavior feature sequence.

[0111] An electronic device, characterized in that it comprises: a memory and a processor, wherein the memory stores a computer-executable program, and the processor is configured to execute the computer-executable program to implement the method according to any one of claims 1-7.

[0112] A computer storage medium, characterized in that the computer storage medium stores a computer executable program, which, when run, implements the method according to any one of claims 1-7.

[0113] Figure 3 This is a schematic diagram of the electronic device in Embodiment 3 of this application. Figure 3As shown, the execution entity can be a background server. The method includes: a memory 301 and a processor 302. The memory stores a computer-executable program, and the processor is used to execute the computer-executable program to implement the method described in any embodiment of this application.

[0114] Figure 4 This is a schematic diagram of the hardware structure of the electronic device in Embodiment 4 of this application. Figure 4 As shown, the hardware structure of the electronic device may include: a processor 401, a communication interface 402, a computer-readable medium 403, and a communication bus 404.

[0115] The processor 401, communication interface 402, and computer-readable medium 403 communicate with each other through communication bus 404.

[0116] Optionally, the communication interface 402 can be an interface of a communication module, such as the interface of a GSM module;

[0117] Specifically, the processor 401 can be configured to run an executable program stored in the memory, thereby executing all or part of the processing steps of any of the above method embodiments.

[0118] Processor 401 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0119] The electronic devices in this application embodiments exist in various forms, including but not limited to:

[0120] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0121] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0122] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes audio and video players (such as iPods), handheld game consoles, e-book readers, as well as smart toys and portable car navigation devices.

[0123] (4) Server: A device that provides computing services. The components of a server include a processor 710, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability and manageability.

[0124] (5) Other electronic devices with data interaction functions.

[0125] This application also provides a computer storage medium storing a computer executable program, which, when run, implements the methods described in any embodiment of this application.

[0126] This application also provides a data system that includes the electronic device described in any embodiment of this application.

[0127] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and system embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components indicated as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0128] The above description is only one specific embodiment of this application, but the protection scope of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application.

Claims

1. A method for combating malicious applications, characterized in that, include: Based on the monitoring sample dataset generated from monitoring the target application, behavior tracking is performed to identify the target application to be monitored as a malicious application, including: The detection control layer obtains a startup detection command to start the application monitoring layer and the application detection layer according to the startup detection command. The detection control layer is equipped with a command execution module and a sandbox startup module to start the application monitoring layer according to the command execution module and the application detection layer according to the sandbox startup module, so as to simultaneously control the startup of the application monitoring layer and the application detection layer. The detection control layer is set in the cloud to obtain the startup detection command transmitted from the configured API interface. The application monitoring layer and the application detection layer are set on the monitoring terminal where the target application to be monitored is located. The successfully started application monitoring layer monitors the target application and generates a monitoring sample dataset, which exists in a relational database or a vectorized database. The successfully launched application detection layer starts the sandbox set within it, extracts behavioral features from the monitored sample dataset, and tracks the behavior of the target application to be monitored based on the extracted behavioral features, generating a behavioral feature sequence. The features in the feature sequence include function call features, file operation features, memory access features, data transmission and reception features, and environmental change features, so as to determine whether the target application to be monitored is a malicious application or a benign application based on the behavioral feature sequence. In response to the detection that the application to be monitored is a malicious application, a sandbox set in the application protection layer is launched to counteract the malicious application. Counteracting the malicious application means canceling or terminating the malicious application's counteracting behavior against monitoring.

2. The method according to claim 1, characterized in that, The successfully launched application monitoring layer monitors the target application and generates a monitoring sample dataset, including: monitoring the functions called by each target application based on the interface function call monitoring unit in the application monitoring layer, forming a subset of function call monitoring samples and adding it to the monitoring sample dataset. The function includes at least one of library functions and kernel functions. The interface function call monitoring unit is located on the monitored end. The interface function call monitoring unit based on the application monitoring layer monitors the functions called by each target application to be monitored, including: compiling embedded code and inserting it into the library function or kernel function; reporting process information including process name and process number of the running function; and saving the parameters in the register of the function input parameters to monitor the instructions for calling the function and determine the address space pointed to by the instructions to determine whether the called function is a library function or a kernel function. The step of responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application, including: responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application's function call monitoring based on a pre-trained adversarial processing model.

3. The method according to claim 2, characterized in that, The successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the files operated by each target application to be monitored based on the file operation monitoring unit in the application monitoring layer, so as to form a subset of file operation monitoring samples and add it to the monitoring sample dataset; The file operations include adding, deleting, modifying, and querying. The file operation monitoring unit is located on the monitored end. The file operation monitoring unit based on the application monitoring layer monitors the files operated by each target application. This includes: the file operation monitoring unit in the application monitoring layer reads the file directory to be monitored by calling the WatchService interface to bind the WatchService interface and the file directory, so as to monitor the events of file operations in the file directory and realize the monitoring of files operated by each application. The step of responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to counteract the malicious application includes: responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to counteract the malicious application's file operation monitoring based on a pre-trained adversarial processing model.

4. The method according to claim 3, characterized in that, The successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the memory access of each target application to be monitored based on the memory access monitoring unit in the application monitoring layer, so as to form a subset of memory access monitoring samples and add it to the monitoring sample dataset; The access includes memory file reading and memory file parsing. The memory access monitoring unit is located on the monitored end. The memory access monitoring unit based on the application monitoring layer monitors the memory accessed by each target application to be monitored, including: segmented monitoring by capturing the memory image at the memory image entry breakpoint to monitor the memory accessed by each target application to be monitored. The step of responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application, including: responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application's memory access monitoring based on a pre-trained adversarial processing model.

5. The method according to claim 4, characterized in that, The successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the data sending and receiving behavior of each target application to be monitored based on the data sending and receiving monitoring unit in the application monitoring layer, so as to form a subset of sending and receiving behavior monitoring samples and add it to the monitoring sample dataset; The data transmission and reception monitoring unit is located at the monitored end. The data transmission and reception monitoring unit monitors the data transmission and reception behavior of each target application to be monitored in the form of events, so as to form a subset of the data transmission and reception behavior monitoring samples and add it to the monitoring sample dataset. The step of responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application, including: responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application for data transmission and reception monitoring based on a pre-trained adversarial processing model.

6. The method according to claim 5, characterized in that, The successfully launched application monitoring layer monitors the target application to be monitored and generates a monitoring sample dataset, including: monitoring the environment in which each target application to be monitored operates based on the environmental change monitoring unit in the application monitoring layer, so as to form an environmental change monitoring sample subset and add it to the monitoring sample dataset; The environment includes whether the corresponding user is a legitimate user, changes in processes and services, and the environment change monitoring unit is located on the monitored end; The step of responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application includes: responding to the application to be monitored being a malicious application by activating a sandbox set in the application protection layer to perform adversarial processing on the malicious application against environmental monitoring based on a pre-trained adversarial processing model.

7. A device for combating malicious applications, characterized in that, include: The malicious detection unit is used to track behavior based on the monitoring sample dataset generated during the monitoring of the target application, and to identify the target application that is a malicious application, including: The detection startup unit is used to obtain startup detection instructions through the detection control layer, and to start the application monitoring layer and the application detection layer according to the startup detection instructions. The detection control layer is provided with a command execution module and a sandbox startup module, to start the application monitoring layer according to the command execution module and the application detection layer according to the sandbox startup module, so as to simultaneously control the startup of the application monitoring layer and the application detection layer. The detection control layer is set in the cloud to obtain startup detection instructions transmitted from the configured API interface. The application monitoring layer and the application detection layer are set on the monitoring terminal where the target application to be monitored is located. The data monitoring unit is used to enable the successfully launched application monitoring layer to monitor the target application and generate a monitoring sample dataset, which exists in a relational database or a vectorized database. The tracking unit is used to enable the successfully launched application detection layer to start the sandbox set within it, extract behavioral features from the monitoring sample dataset, and track the behavior of the target application to be monitored based on the extracted behavioral features, generating a behavioral feature sequence. The features in the feature sequence include function call features, file operation features, memory access features, data transmission and reception features, and environmental change features, so as to determine whether the target application to be monitored is a malicious application or a benign application based on the behavioral feature sequence. The countermeasure unit is used to respond to the fact that the application to be monitored is a malicious application, and to launch a sandbox set in the application protection layer to counteract the malicious application. The countermeasure is to cancel or stop the malicious application's countermeasure behavior against monitoring.

8. The apparatus according to claim 7, characterized in that, The data monitoring unit is used to monitor the functions called by each target application based on the interface function call monitoring unit in the application monitoring layer, so as to form a subset of function call monitoring samples and add it to the monitoring sample dataset. The function includes at least one of library functions and kernel functions. The interface function call monitoring unit is located on the monitored end. The interface function call monitoring unit based on the application monitoring layer monitors the functions called by each target application to be monitored, including: compiling embedded code and inserting it into the library function or kernel function; reporting process information including process name and process number of the running function; and saving the parameters in the register of the function input parameters to monitor the instructions for calling the function and determine the address space pointed to by the instructions to determine whether the called function is a library function or a kernel function. The adversarial unit is specifically used to respond to the fact that the application to be monitored is a malicious application, and to activate the sandbox set in the application protection layer to perform adversarial processing on the malicious application's function call monitoring based on a pre-trained adversarial processing model.

9. The apparatus according to claim 8, characterized in that, The data monitoring unit is used to monitor the files operated by each target application based on the file operation monitoring unit in the application monitoring layer, so as to form a subset of file operation monitoring samples and add it to the monitoring sample dataset. The file operations include adding, deleting, modifying, and querying. The file operation monitoring unit is located on the monitored end. The file operation monitoring unit based on the application monitoring layer monitors the files operated by each target application. This includes: the file operation monitoring unit in the application monitoring layer reads the file directory to be monitored by calling the WatchService interface to bind the WatchService interface and the file directory, so as to monitor the events of file operations in the file directory and realize the monitoring of files operated by each application. The adversarial unit is specifically used to respond to the fact that the application to be monitored is a malicious application, and to activate the sandbox set in the application protection layer to perform adversarial processing on the malicious application's file operation monitoring based on a pre-trained adversarial processing model.

10. The apparatus according to claim 9, characterized in that, The data monitoring unit is used to monitor the memory access of each target application based on the memory access monitoring unit in the application monitoring layer, so as to form a subset of memory access monitoring samples and add it to the monitoring sample dataset. The access includes memory file reading and memory file parsing. The memory access monitoring unit is located on the monitored end. The memory access monitoring unit based on the application monitoring layer monitors the memory accessed by each target application to be monitored, including: segmented monitoring by capturing the memory image at the memory image entry breakpoint to monitor the memory accessed by each target application to be monitored. The adversarial unit is specifically used to respond to the fact that the application to be monitored is a malicious application, and to activate the sandbox set in the application protection layer to perform adversarial processing on the malicious application's memory access monitoring based on a pre-trained adversarial processing model.

11. The apparatus according to claim 10, characterized in that, The data monitoring unit is used to monitor the data sending and receiving behavior of each target application to be monitored, based on the data sending and receiving monitoring unit in the application monitoring layer, to form a subset of sending and receiving behavior monitoring samples and add it to the monitoring sample dataset. The data transmission and reception monitoring unit is located at the monitored end. The data transmission and reception monitoring unit monitors the data transmission and reception behavior of each target application to be monitored in the form of events, so as to form a subset of the data transmission and reception behavior monitoring samples and add it to the monitoring sample dataset. The adversarial unit is specifically used to respond to the fact that the application to be monitored is a malicious application, and to activate the sandbox set in the application protection layer to perform adversarial processing on the malicious application for data transmission and reception monitoring based on the pre-trained adversarial processing model.

12. The apparatus according to claim 11, characterized in that, The data monitoring unit is used to monitor the environment in which each target application operates, based on the environmental change monitoring unit in the application monitoring layer, to form a subset of environmental change monitoring samples and add it to the monitoring sample dataset. The environment includes whether the corresponding user is a legitimate user, changes in processes and services, and the environment change monitoring unit is located on the monitored end; The adversarial unit is specifically used to respond to the fact that the application to be monitored is a malicious application, and to activate the sandbox set in the application protection layer to perform adversarial processing on the malicious application against environmental monitoring based on a pre-trained adversarial processing model.

13. An electronic device, characterized in that, include: A memory and a processor, wherein the memory stores a computer-executable program, and the processor is configured to execute the computer-executable program to implement the method of any one of claims 1-6.

14. A computer storage medium, characterized in that, The computer storage medium stores a computer-executable program, which, when run, implements the method described in any one of claims 1-6.

Images