Document processing methods, apparatus, electronic devices, and computer-readable media

Abstract

This disclosure discloses file processing methods, apparatus, electronic devices, and computer-readable media. One specific implementation of the method includes: in response to the creation of a target process, running a target shell file corresponding to the target process within a pre-created virtual container to determine a first executable program file included in the target shell file; generating a merged program file based on the first and second executable program files; performing instruction conversion processing on the target shell file and the second executable program file; performing grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image; inputting the first and second grayscale images into a pre-trained program detection network to generate a program detection result; and running the merged program file in the virtual container in response to the program detection result indicating that the merged program file is normal. This implementation ensures the stability of the vehicle system and the safety of vehicle operation.

Description

Technical Field

[0001] Embodiments of this disclosure relate to the field of computer technology, and more specifically to document processing methods, apparatus, electronic devices, and computer-readable media. Background Technology

[0002] As the brain of a vehicle, the in-vehicle infotainment system plays a crucial role in vehicle control. Currently, when processing files, in-vehicle infotainment systems typically do so by automatically calling up internal program files and executing the corresponding programs to achieve vehicle control.

[0003] However, when using the above method for file processing, the following technical problems usually arise:

[0004] First, when the vehicle's infotainment system is compromised, computer viruses often hide in program files. When these program files are executed directly, they can damage the vehicle's infotainment system, thereby affecting the safety of the vehicle.

[0005] Secondly, due to the diversity of computer viruses, it is difficult to detect new computer viruses in the vehicle system in a timely manner when the signature database is not updated, as this may affect the safety of vehicle operation. Summary of the Invention

[0006] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0007] Some embodiments of this disclosure provide document processing methods, apparatuses, electronic devices, and computer-readable media to address one or more of the technical problems mentioned in the background section above.

[0008] In a first aspect, some embodiments of this disclosure provide a file processing method, the method comprising: in response to the creation of a target process, running a target shell file corresponding to the target process in a pre-created virtual container to determine a first executable program file included in the target shell file; generating a merged program file based on the first executable program file and the second executable program file; performing instruction conversion processing on the target shell file and the second executable program file to generate an executable instruction set; performing grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image; inputting the first grayscale image and the second grayscale image into a pre-trained program detection network to generate a program detection result; and running the merged program file in the virtual container in response to the program detection result indicating that the merged program file is normal.

[0009] Secondly, some embodiments of this disclosure provide a file processing apparatus, comprising: a first running unit configured to, in response to the creation of a target process, run a target shell file corresponding to the target process within a pre-created virtual container to determine a first executable program file included in the target shell file; a generation unit configured to generate a merged program file based on the first and second executable program files; an instruction conversion processing unit configured to perform instruction conversion processing on the target shell file and the second executable program file to generate an executable instruction set; a grayscale processing unit configured to perform grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image; an input unit configured to input the first and second grayscale images into a pre-trained program detection network to generate a program detection result; and a second running unit configured to, in response to the program detection result indicating that the merged program file is normal, run the merged program file in the virtual container.

[0010] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0011] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0012] The above-described embodiments of this disclosure have the following beneficial effects: the file processing methods of some embodiments of this disclosure ensure the safety of vehicle operation. Specifically, the reason for the low safety of vehicle operation is that when the vehicle system is compromised, computer viruses often hide in program files. When the program files are directly executed, the vehicle system will be damaged, thereby affecting the safety of vehicle operation. Based on this, the file processing method of some embodiments of this disclosure firstly, in response to the existence of a target process being created, runs the target shell file corresponding to the target process in a pre-created virtual container to determine the first executable program file included in the target shell file. In reality, when a program file is executed, at least one process is often created. Therefore, by determining whether a process has been created, it is determined whether a program file is to be executed. In addition, by running the program file in the virtual container, even if the program file contains a computer virus, it will not affect the normal operation of the vehicle system. Secondly, a merged program file is generated based on the first and second executable program files. When program files are stored directly in the vehicle system, they are easily tampered with. By splitting the program file into a first executable program file and a second executable program file, and merging them only during program execution, the tamper resistance of the program file is improved. Then, instruction conversion processing is performed on the target shell file and the second executable program file. Next, the merged program file and the executable instruction set are respectively grayscaled to generate a first grayscale image and a second grayscale image. By converting the program file and instructions into images, the virus detection problem is transformed into an image recognition and classification problem. Furthermore, considering that although packing can protect program files from tampering, computer viruses often disguise themselves in the form of packing, this disclosure also considers processing the executable instruction set corresponding to the target shell file. Then, the first grayscale image and the second grayscale image are input into a pre-trained program detection network to generate program detection results. Finally, in response to the program detection results indicating that the merged program file is normal, the merged program file is run in the virtual container. This method enables the detection of program files, ensuring the stability of the vehicle's infotainment system and the safety of vehicle operation. Attached Figure Description

[0013] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0014] Figure 1 This is a schematic diagram illustrating an application scenario of a file processing method according to some embodiments of this disclosure;

[0015] Figure 2 This is a flowchart of some embodiments of the document processing method according to this disclosure;

[0016] Figure 3 This is a diagram illustrating the process list;

[0017] Figure 4 This is a schematic diagram of the first grayscale image;

[0018] Figure 5 This is a flowchart of some other embodiments of the document processing method according to this disclosure;

[0019] Figure 6 This is a schematic diagram illustrating the process of generating merged program files;

[0020] Figure 7 These are schematic diagrams of the structure of some embodiments of the document processing apparatus according to the present disclosure;

[0021] Figure 8 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0022] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0023] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0024] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0025] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0026] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0027] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0028] Figure 1 This is a schematic diagram illustrating an application scenario of a file processing method according to some embodiments of this disclosure.

[0029] exist Figure 1 In the application scenario, firstly, in response to the creation of a target process, the computing device 101 can run the target shell file 103 corresponding to the target process within a pre-created virtual container 102 to determine the first executable program file 104 included in the target shell file 103; secondly, the computing device 101 can generate a merged program file 106 based on the first executable program file 104 and the second executable program file 105; then, the computing device 101 can perform instruction conversion processing on the target shell file 103 and the second executable program file 105 to generate executable instructions. Set 107; then, computing device 101 can perform grayscale processing on the above-mentioned merged program file 106 and the above-mentioned executable instruction set 107 respectively to generate a first grayscale image 108 and a second grayscale image 109; in addition, computing device 101 can input the above-mentioned first grayscale image 108 and the above-mentioned second grayscale image 109 into a pre-trained program detection network 110 to generate a program detection result 111; finally, computing device 101 can respond to the above-mentioned program detection result 111 indicating that the above-mentioned merged program file 106 is normal, and run the above-mentioned merged program file 106 in the above-mentioned virtual container 102.

[0030] It should be noted that the aforementioned computing device 101 can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. When the computing device is software, it can be installed within the hardware devices listed above. It can be implemented as, for example, multiple software programs or software modules used to provide distributed services, or as a single software program or software module. No specific limitations are made here.

[0031] It should be understood that Figure 1 The number of computing devices shown is merely illustrative. Any number of computing devices can be used depending on implementation needs.

[0032] Continue to refer to Figure 2 The following flowchart 200 illustrates some embodiments of a document processing method according to the present disclosure. The document processing method includes the following steps:

[0033] Step 201: In response to the existence of a target process being created, run the target shell file corresponding to the target process in a pre-created virtual container to determine the first executable program file included in the target shell file.

[0034] In some embodiments, the execution body of the file processing method (e.g. Figure 1 The computing device 101 shown can, in response to the creation of the target process, run the target shell file corresponding to the target process within a pre-created virtual container to determine the first executable program file included in the target shell file. The target process can be a newly created process in a process list. The process list can include all processes currently running within the vehicle system. The executing entity can determine the existence of the target process by determining whether a newly created process exists in the process list. The virtual container can be a container running within the vehicle system. The executing entity can run the program file corresponding to the process within the virtual container. The target shell file can be a program file that created the target process and is protected by a packer. The target shell file can include: a first executable program file. The first executable program file can be a program file protected by a packer.

[0035] As an example, the above list of processes can be as follows: Figure 3 As shown, the process list may include: program name 301 and process number 302. Program name 301 can represent the name of the program that created the process. Process number 302 can represent the process number corresponding to the program. For example, the process number of the process corresponding to the program named "Program A" can be "108".

[0036] As another example, the target shell file can be shell code located outside the first executable program file. This shell code can be code used to protect the first executable program file. When the target shell file is executed, the shell code outside the first executable program file will be executed first, followed by the program code within the first executable program file. This avoids directly gaining control of the first executable program file, thereby protecting it.

[0037] Step 202: Generate a merged program file based on the first executable program file and the second executable program file.

[0038] In some embodiments, the executing entity may generate the merged program file based on the first executable program file and the second executable program file. The merged program file may be a complete program file corresponding to the application to be executed. The first executable program file and the second executable program file may be partial program files within the merged program file.

[0039] As an example, the executing entity can determine the merging order of the first and second executable program files based on their storage locations in external storage, in order to generate the merged program file. For instance, the storage location of the first executable program file in external storage could be "0x10400". The storage location of the second executable program file in external storage could be "0x20403". Therefore, the second executable program file can be appended to the end of the first executable program file to generate the merged program file.

[0040] Step 203: Perform instruction conversion processing on the target shell file and the second executable program file to generate an executable instruction set.

[0041] In some embodiments, the executing entity may perform instruction conversion processing on the target shell file and the second executable program file to generate the executable instruction set. The executable instructions in the executable instruction set may be computer-executable operation instructions. The executing entity may also perform assembly operations on the target shell file and the second executable program file to generate the executable instruction set.

[0042] Step 204: Perform grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image.

[0043] In some embodiments, the executing entity may perform grayscale processing on the merged program file and the executable instruction set respectively to generate the first grayscale image and the second grayscale image. The first grayscale image may be an image of the merged program file after grayscale processing. The second grayscale image may be an image of the executable instruction set after grayscale processing. Each pixel in the first grayscale image has the same three-channel color value. Each pixel in the second grayscale image has the same three-channel color value.

[0044] As an example, the aforementioned execution entity performs grayscale processing on the aforementioned merged program file and the aforementioned set of executable instructions respectively to generate the aforementioned first grayscale image and the aforementioned second grayscale image, which may include the following steps:

[0045] The first step is to read the data from the aforementioned merging program file and convert it into the color values ​​of the corresponding pixels in the aforementioned first grayscale image to generate the aforementioned first grayscale image.

[0046] For example, data in the merge program file can be encoded in ASCII (American Standard Code for Information Interchange). The data in the merge program file could be "ABCDEFGHIBBA…ADASJKLASA". The 12th data in the above merge program file could be "A", and its corresponding decimal value could be "65". Therefore, the color value corresponding to the 12th data "A" could be (R: 65, G: 65, B: 65). The width of the first grayscale image is fixed. For example, the width of the first grayscale image could be 200 pixels. Figure 4 The first grayscale image shown above, wherein the color value of the 12th pixel 401 in the first row of the first grayscale image can be (R: 65, G: 65, B: 65).

[0047] The second step is to determine the image width of the second grayscale image.

[0048] The image width of the second grayscale image can be the same as the instruction length of the longest executable instruction in the set of executable instructions.

[0049] For example, the executable instructions in the aforementioned set of executable instructions can be encoded in hexadecimal. The longest executable instruction in the aforementioned set of executable instructions could be "9BDBE3". Therefore, the image length of the aforementioned second grayscale image is "6" pixels.

[0050] The third step is to convert each executable instruction in the above set of executable instructions into the color value of the corresponding row in the second grayscale image.

[0051] For example, the executable instruction mentioned above could be "9BDB". The executable instruction mentioned above is the first instruction in the set of executable instructions mentioned above. Then the executable instruction mentioned above corresponds to the first row of pixels in the second grayscale image mentioned above. The color value of the first row of pixels in the second grayscale image mentioned above can be [(R:9, G:9, B:9), (R:11, G:11, B:11), (R:13, G:13, B:13), (R:11, G:11, B:11), (R:0, G:0, B:0), (R:0, G:0, B:0)].

[0052] Step 205: Input the first grayscale image and the second grayscale image into the pre-trained program detection network to generate program detection results.

[0053] In some embodiments, the executing entity may input the first grayscale image and the second grayscale image into the pre-trained program detection network to generate the program detection result. The program detection result can characterize whether the merged program file is functioning correctly.

[0054] As an example, the pre-trained program detection network mentioned above may include a first feature extraction network, a second feature extraction network, and a normalization layer. The first feature extraction network may be VGGNet (Very Deep Convolutional Networks). The second feature extraction network may be a CNN (Convolutional Neural Network). The program detection result may be "No abnormalities found in the program".

[0055] Step 206: In response to the program detection result indicating that the merged program file is normal, run the merged program file in the virtual container.

[0056] In some embodiments, the execution entity may run the merged program file in the virtual container in response to the program detection result indicating that the merged program file is normal.

[0057] The above-described embodiments of this disclosure have the following beneficial effects: the file processing methods of some embodiments of this disclosure ensure the safety of vehicle operation. Specifically, the reason for the low safety of vehicle operation is that when the vehicle system is compromised, computer viruses often hide in program files. When the program files are directly executed, the vehicle system will be damaged, thereby affecting the safety of vehicle operation. Based on this, the file processing method of some embodiments of this disclosure firstly, in response to the existence of a target process being created, runs the target shell file corresponding to the target process in a pre-created virtual container to determine the first executable program file included in the target shell file. In reality, when a program file is executed, at least one process is often created. Therefore, by determining whether a process has been created, it is determined whether a program file is to be executed. In addition, by running the program file in the virtual container, even if the program file contains a computer virus, it will not affect the normal operation of the vehicle system. Secondly, a merged program file is generated based on the first and second executable program files. When program files are stored directly in the vehicle system, they are easily tampered with. By splitting the program file into a first executable program file and a second executable program file, and merging them only during program execution, the tamper resistance of the program file is improved. Then, instruction conversion processing is performed on the target shell file and the second executable program file. Next, the merged program file and the executable instruction set are respectively grayscaled to generate a first grayscale image and a second grayscale image. By converting the program file and instructions into images, the virus detection problem is transformed into an image recognition and classification problem. Furthermore, considering that although packing can protect program files from tampering, computer viruses often disguise themselves in the form of packing, this disclosure also considers processing the executable instruction set corresponding to the target shell file. Then, the first grayscale image and the second grayscale image are input into a pre-trained program detection network to generate program detection results. Finally, in response to the program detection results indicating that the merged program file is normal, the merged program file is run in the virtual container. This method enables the detection of program files, ensuring the stability of the vehicle's infotainment system and the safety of vehicle operation.

[0058] Further reference Figure 5 This illustrates a flow 500 of another embodiment of the file processing method. The flow 500 of the file processing method includes the following steps:

[0059] Step 501: In response to the existence of a target process being created, run the target shell file corresponding to the target process in a pre-created virtual container to determine the first executable program file included in the target shell file.

[0060] In some embodiments, the specific implementation of step 501 and its resulting technical effects can be found in [reference needed]. Figure 2 Step 201 in the corresponding embodiments will not be repeated here.

[0061] Step 502: Decrypt the first program file verification identifier information and the second program file verification identifier information respectively to generate the first decryption identifier and the second decryption identifier.

[0062] In some embodiments, the execution body of the file processing method (e.g. Figure 1 The computing device 101 shown can decrypt the first program file verification identifier information and the second program file verification identifier information respectively to generate a first decryption identifier and a second decryption identifier. The first program file to be executed may include the first program file verification identifier information. The second program file to be executed may include the second program file verification identifier information.

[0063] As an example, firstly, the aforementioned execution entity can use a hash algorithm to determine the hash value of the merged file corresponding to the first and second executable program files. Then, it can use an encryption algorithm to encrypt the hash value to generate the verification identifier information for the first and second program files.

[0064] As another example, the aforementioned executing entity can decrypt the first program file verification identifier information and the second program file verification identifier information according to the decryption algorithm corresponding to the aforementioned encryption algorithm, so as to generate the first decryption identifier and the second decryption identifier.

[0065] Step 503: In response to determining that the first decryption identifier and the second decryption identifier are consistent, the first executable program file and the second executable program file are decrypted to generate the first decrypted program file and the second decrypted program file.

[0066] In some embodiments, the executing entity may, in response to determining that the first decryption identifier and the second decryption identifier are consistent, decrypt the first executable program file and the second executable program file to generate a first decrypted program file and a second decrypted program file. The encryption algorithms corresponding to the first executable program file, the second executable program file, the first program file verification identifier information, and the second program file verification identifier information are consistent. The executing entity may decrypt the first executable program file and the second executable program file according to the decryption algorithm corresponding to the encryption algorithm to generate the first decrypted program file and the second decrypted program file.

[0067] Step 504: Fill the target location in the second decryption program file with the first decryption program file to generate a merged program file.

[0068] In some embodiments, the executing entity may fill the first decryption program file into the target position in the second decryption program file to generate the merged program file.

[0069] As an example, such as Figure 6 The diagram illustrating the generation of the merged program file shows that the target location could be the starting address of the second decryption program file, the ending address of the second decryption program file, or even the location of missing data within the second decryption program file.

[0070] Step 505: Perform instruction conversion processing on the target shell file and the second executable program file to generate an executable instruction set.

[0071] In some embodiments, the specific implementation of step 505 and its resulting technical effects can be found in [reference needed]. Figure 2 Step 203 in the corresponding embodiments will not be repeated here.

[0072] Step 506: Perform grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image.

[0073] In some embodiments, the execution entity performs grayscale processing on the merged program file and the executable instruction set to generate the first grayscale image and the second grayscale image, which may include the following steps:

[0074] The first step is to convert the above-mentioned merging program file into binary data to generate a binary data sequence.

[0075] For example, the aforementioned execution entity can use the following code to convert the above-mentioned merging program file into binary data to generate a binary data sequence:

[0076] S = "Data"

[0077] BinData=".join(format(c,'b')for c in bytearray(S,"utf-8"))

[0078] Where S represents the content read from the above-mentioned merging program file, for example, it could be "Data". BinData represents the above-mentioned binary data sequence, for example, it could be "1000100110000111101001100001".

[0079] The second step is to segment the binary data in the above binary data sequence to generate a sub-binary data group sequence.

[0080] The aforementioned execution entity can segment the binary data in the aforementioned binary data sequence into sub-binary data group sequences with a preset length. The preset length can be 8.

[0081] For example, a binary data sequence could be "1000100110000111101001100001". The aforementioned sub-binary data group sequence could be ["10001001", "10000111", "10100110", "00010000"]. When the length of the segmented binary data is less than the preset length, zeros can be padded to the segmented binary data that is shorter than the preset length. For example, the segmented binary data could be "0001", and the resulting sub-binary data group padded with zeros could be "00010000". The execution entity can segment the binary data in the above binary data sequence using the following code, ensuring that the length of each sub-binary data group is consistent with the preset length:

[0082] BinList=[BinData[i:i+8]for i in range(0,len(BinData),8)]

[0083] if len(BinList[-1])<8:

[0084] BinList[-1]+=str("0"*(8-len(BinList[-1])))

[0085] Wherein, BinData represents the aforementioned binary data sequence. BinList represents the aforementioned sub-binary data group sequence.

[0086] The third step is to convert each sub-binary data group in the above sub-binary data group sequence into a color value to generate the first grayscale color value sequence.

[0087] For example, the aforementioned execution entity can use the following code to convert each sub-binary data group in the above sub-binary data group sequence into a color value to generate a first grayscale color value sequence:

[0088] ColorList=[int(bindata,2)for bindata in BinList]

[0089] Wherein, ColorList represents the first grayscale color value sequence mentioned above, and BinList represents the sub-binary data group sequence mentioned above. The obtained first grayscale color value sequence can be [137, 135, 166, 16].

[0090] The fourth step is to determine the image size of the first grayscale image based on the number of sub-binary data groups in the above sub-binary data group sequence, so as to generate the first image size information.

[0091] The first image size information described above can characterize the image size of the first grayscale image. The length and width of the first grayscale image are the same.

[0092] For example, the aforementioned executing entity can determine the size information of the first image using the following code:

[0093]

[0094] Where N can represent the number of sub-binary data groups in the above sub-binary data group sequence. ImageLen can characterize the length and width of the above first grayscale image. For example, the image size of the above first grayscale image can be [201×201].

[0095] Fifth step: Generate the first grayscale image based on the first grayscale color value sequence and the first image size information.

[0096] First, the executing entity can generate a first blank image based on the first image size information. The image size of the first blank image is the same as the image size of the first grayscale image. The color value of each pixel in the first blank image corresponds to white. Then, the executing entity can sequentially determine the first grayscale values ​​from the first grayscale color value sequence as the color values ​​of the pixels in the first blank image to generate the first grayscale image.

[0097] The sixth step is to convert each executable instruction in the above set of executable instructions into a binary data string, resulting in a sequence of binary data strings.

[0098] For example, the aforementioned execution entity can convert the above executable instructions into a binary data string using the following code:

[0099] Hex = "9BDBE3"

[0100] BinList=[bin(int(i,16))for i in Hex]

[0101] Here, Hex can represent the aforementioned executable instruction, which can be "9BDBE3". The generated binary data string can be "1001101111011011111011".

[0102] Step 7: Pad the length of each binary data string in the above binary data string sequence to generate a padded binary data string sequence.

[0103] First, the executing entity can determine the length of the longest binary data string in the binary data string sequence to obtain the target length. Then, the executing entity can pad the binary data strings in the binary data string sequence with 0s according to the target length, so that the length of the padded binary data string in the padded binary data string sequence is consistent with the target length.

[0104] Step 8: For each padded binary data string in the above padded binary data string sequence, perform the following processing steps:

[0105] The first sub-step involves performing fixed-length data segmentation on the padded binary data string to generate sub-binary data strings, resulting in a sequence of sub-binary data strings.

[0106] The length of the sub-binary data string in the above sub-binary data string sequence is 8.

[0107] For example, the padded binary data string could be "0110111111111100". At least one sub-binary data string could be "01101111" or "11111100".

[0108] For example, the padded binary data string could be "011011". The resulting sub-binary data string could be "01101100". When the length of the binary data string is less than 8 bytes, it can be padded with 0s to generate a sub-binary data string.

[0109] The second sub-step involves determining the color value group corresponding to the padded binary data string based on the aforementioned sub-binary data string sequence, in order to generate the second grayscale color value group.

[0110] The aforementioned executing entity can perform a decimal conversion on each sub-binary data in the aforementioned sub-binary data string sequence to generate a second grayscale color value, thus obtaining a second grayscale color value group.

[0111] For example, the sub-binary data string sequence could be ["01101111", "1111110011"]. The resulting second grayscale value group could be ["111", "252"].

[0112] The ninth step is to determine the image size of the second grayscale image based on the number of second grayscale values ​​in the obtained second grayscale value group sequence and the number of padded binary data strings in the above-mentioned padded binary data string sequence, so as to generate the second image size information.

[0113] Specifically, the executing entity can determine the number of padded binary data strings in the padded binary data string sequence as the length of the second grayscale image, and determine the number of second grayscale colors in any second grayscale color value group in the second grayscale color value group sequence as the width of the second grayscale image, so as to generate the second image size information.

[0114] For example, the second image size information mentioned above could be [200×200].

[0115] Step 10: Generate the second grayscale image based on the second grayscale value group sequence and the second image size information.

[0116] First, the executing entity can generate a second blank image based on the second image size information. The image size of the second blank image is the same as the image size of the second grayscale image. The color value of each pixel in the second blank image corresponds to white. Then, the executing entity can sequentially determine the second grayscale values ​​from the second grayscale color value group sequence as the color values ​​of the pixels in the second blank image to generate the second grayscale image.

[0117] Step 507: Input the first grayscale image and the second grayscale image into the pre-trained program detection network to generate program detection results.

[0118] In some embodiments, the execution entity can input the first grayscale image and the second grayscale image into the pre-trained program detection network to generate the program detection result. The program detection network may include: a first abnormal program detection network, a second abnormal program detection network, and a feature fusion network. The first abnormal program detection network may include: a first convolutional block, a second convolutional block, a third convolutional block, a fourth convolutional block, and a fifth convolutional block. The first and second convolutional blocks contain the same number of convolutional layers. The third, fourth, and fifth convolutional blocks contain the same number of convolutional layers. The second abnormal program detection network may include: a pooling layer, a sixth convolutional block, and a max-pooling layer. The feature fusion network may include: a first fully connected network, a second fully connected layer, a first normalization layer, a second normalization layer, and a fusion layer.

[0119] The execution entity inputs the first grayscale image and the second grayscale image into the pre-trained program detection network to generate the program detection result, which may include the following steps:

[0120] The first step is to input the first grayscale image into the first convolutional block to generate the first feature vector.

[0121] The second step is to input the first feature vector into the second convolutional block to generate the second feature vector.

[0122] The third step is to input the second feature vector into the third convolutional block to generate the third feature vector.

[0123] The fourth step is to input the third feature vector into the fourth convolutional block to generate the fourth feature vector.

[0124] The fifth step is to input the fourth feature vector into the fifth convolutional block to generate the fifth feature vector.

[0125] The sixth step is to input the second grayscale image into the convergence layer to generate a convergence feature vector.

[0126] The aforementioned aggregation layer can be a normalization layer.

[0127] Step 7: Input the above-mentioned converged feature vector into the above-mentioned sixth convolutional block to generate the sixth feature vector.

[0128] Step 8: Input the sixth feature vector into the max pooling layer to generate the seventh feature vector.

[0129] The ninth step is to input the five feature vectors mentioned above into the first fully connected network to generate the first candidate vector.

[0130] Step 10: Input the seventh feature vector into the second fully connected layer to generate the second candidate feature vector.

[0131] Step 11: Input the first candidate vector into the first normalization layer to generate the first candidate result.

[0132] Step 12: Input the second candidate feature vector into the second normalization layer to generate the second candidate result.

[0133] Step 13: Input the first candidate result and the second candidate result into the fusion layer to generate the program detection result.

[0134] The first candidate result represents the probability that the merged program file contains an abnormal program. The second candidate result represents the probability that the executable instruction set contains an abnormal program. For example, the first candidate result could be "0.98". The second candidate result could be "0.90". The resulting program detection result could be "0.94".

[0135] Step 507, as an inventive point of this disclosure, solves the second technical problem mentioned in the background: "Due to the diversity of computer viruses, when using signature comparison to discover computer viruses, it is difficult to detect new computer viruses in the vehicle system in a timely manner when the signature database is not updated, thus affecting the safety of vehicle operation." The reason why computer viruses cannot be effectively discovered is that, due to the diversity of computer viruses, when using signature comparison to discover computer viruses, it is difficult to detect new computer viruses in the vehicle system in a timely manner when the signature database is not updated. If the above problem is solved, computer viruses can be detected in a timely manner, thereby ensuring the safety of vehicle operation. To achieve this effect, this disclosure introduces a first abnormal program detection network and a second abnormal program detection network, considering the differences in file structure and content between packed and unpacked files. At the same time, computer viruses often conceal themselves by using packing. Therefore, this disclosure introduces a first abnormal program detection network and a second abnormal program detection network to extract features from the first grayscale image corresponding to the packed program file and the second grayscale image corresponding to the unpacked program file. This improves the feature extraction capability. Then, a feature fusion network is used to generate the final program detection result. This method eliminates the need for a signature database, significantly improving the accuracy of computer virus detection. This prevents computer viruses from harming the vehicle's infotainment system, thereby ensuring vehicle safety.

[0136] Step 508: In response to the program detection result indicating that the merged program file is normal, run the merged program file in the virtual container.

[0137] In some embodiments, the executing entity may run the merged program file in the virtual container in response to the program detection result indicating that the merged program file is normal. Specifically, a program detection result less than a target value can indicate that the merged program file is normal. For example, the target value could be 0.02.

[0138] from Figure 5 It can be seen that, with Figure 2Compared to the descriptions of some corresponding embodiments, this disclosure first achieves file visualization by performing grayscale conversion on the program file and the set of executable instructions, and then detects the program file through a program detection network. Furthermore, this disclosure introduces a first abnormal program detection network and a second abnormal program detection network, considering the differences in file structure and content between packed and unpacked files. Computer viruses often conceal themselves by using packing. Therefore, this disclosure extracts features from the first grayscale image corresponding to the packed program file and the second grayscale image corresponding to the unpacked program file by introducing the first and second abnormal program detection networks. This improves the feature extraction capability. Then, the final program detection result is generated through a feature fusion network. This method does not rely on a signature database, greatly improving the accuracy of computer virus detection. It avoids the harm that computer viruses can cause to the vehicle's infotainment system, thereby ensuring the safety of vehicle operation.

[0139] Further reference Figure 7 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of a file processing apparatus, which are similar to... Figure 2 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0140] like Figure 7 As shown, the file processing apparatus 700 in some embodiments includes: a first running unit 701, a generation unit 702, an instruction conversion processing unit 703, a grayscale processing unit 704, an input unit 705, and a second running unit 706. The system comprises the following components: a first execution unit 701, configured to run a target shell file corresponding to a target process within a pre-created virtual container in response to the creation of a target process, to determine the first executable program file included in the target shell file; a generation unit 702, configured to generate a merged program file based on the first and second executable program files; an instruction conversion processing unit 703, configured to perform instruction conversion processing on the target shell file and the second executable program file to generate an executable instruction set; a grayscale processing unit 704, configured to perform grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image; an input unit 705, configured to input the first and second grayscale images into a pre-trained program detection network to generate a program detection result; and a second execution unit 706, configured to run the merged program file in the virtual container in response to the program detection result indicating that the merged program file is normal.

[0141] It is understandable that the units described in the device 700 are related to the reference. Figure 2The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the device 700 and the units contained therein, and will not be repeated here.

[0142] The following is for reference. Figure 8 It illustrates electronic devices suitable for implementing some embodiments of the present disclosure (such as...). Figure 1 The diagram shows the structure of the computing device 101)800. Figure 8 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0143] like Figure 8 As shown, the electronic device 800 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 into a random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device 800. The processing device 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0144] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows electronic device 800 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 An electronic device 800 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 8 Each box shown can represent a device or multiple devices as needed.

[0145] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by the processing device 801, it performs the functions defined in the methods of some embodiments of this disclosure.

[0146] It should be noted that, in some embodiments of this disclosure, the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0147] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0148] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently without being assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: in response to the creation of a target process, run a target shell file corresponding to the target process within a pre-created virtual container to determine a first executable program file included in the target shell file; generate a merged program file based on the first and second executable program files; perform instruction conversion processing on the target shell file and the second executable program file to generate an executable instruction set; perform grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image; input the first and second grayscale images into a pre-trained program detection network to generate a program detection result; and, in response to the program detection result indicating that the merged program file is normal, run the merged program file in the virtual container.

[0149] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0150] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0151] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be located in a processor; for example, a processor may be described as including a first execution unit, a generation unit, an instruction conversion processing unit, a grayscale processing unit, an input unit, and a second execution unit. The names of these units do not necessarily limit the unit itself; for example, the first execution unit may also be described as "a unit that, in response to the creation of a target process, runs a target shell file corresponding to the target process within a pre-created virtual container to determine the first executable program file included in the target shell file."

[0152] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0153] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A file processing method, comprising: in response to the existence of a target process being created, running a target shell file corresponding to the target process in a pre-created virtual container to determine a first to-be-executed program file included in the target shell file, the target shell file being a shell code outside the first to-be-executed program file, the shell code being a code for protecting the first to-be-executed program file; generating a merged program file according to the first to-be-executed program file and a second to-be-executed program file, wherein the second to-be-executed program file is appended to the tail of the first to-be-executed program file, the merged program file being a complete program file corresponding to a to-be-executed application program, the first to-be-executed program file and the second to-be-executed program file being partial program files in the merged program file; performing instruction conversion processing on the target shell file and the second to-be-executed program file to generate an executable instruction set; respectively performing grayscale processing on the merged program file and the executable instruction set to generate a first grayscale image and a second grayscale image; inputting the first grayscale image and the second grayscale image into a pre-trained program detection network to generate a program detection result, wherein the program detection network comprises a first abnormal program detection network, a second abnormal program detection network, and a feature fusion network, comprising: inputting the first grayscale image into a first convolutional block to generate a first feature vector; inputting the first feature vector into a second convolutional block to generate a second feature vector; inputting the second feature vector into a third convolutional block to generate a third feature vector; inputting the third feature vector into a fourth convolutional block to generate a fourth feature vector; inputting the fourth feature vector into a fifth convolutional block to generate a fifth feature vector; inputting the second grayscale image into a convergence layer to generate a convergence feature vector; inputting the convergence feature vector into a sixth convolutional block to generate a sixth feature vector; inputting the sixth feature vector into a maximum pooling layer to generate a seventh feature vector; inputting the five feature vectors into a first fully connected network to generate a first candidate vector; inputting the seventh feature vector into a second fully connected layer to generate a second candidate feature vector; inputting the first candidate vector into a first normalization layer to generate a first candidate result; inputting the second candidate feature vector into a second normalization layer to generate a second candidate result; inputting the first candidate result and the second candidate result into a fusion layer to generate the program detection result; in response to the program detection result representing that the merged program file is normal, running the merged program file in the virtual container.

2. The method of claim 1, wherein, the first to-be-executed program file comprises first program file verification identification information, and the second to-be-executed program file comprises second program file verification identification information; and the generating of the merged program file according to the first to-be-executed program file and the second to-be-executed program file comprises: respectively performing decryption processing on the first program file verification identification information and the second program file verification identification information to generate first decrypted identification and second decrypted identification; In response to determining that the first decryption identifier and the second decryption identifier are consistent, performing decryption processing on the first to-be-executed program file and the second to-be-executed program file to generate a first decrypted program file and a second decrypted program file; filling the first decrypted program file into a target position in the second decrypted program file to generate the merged program file.

3. The method of claim 2, wherein, The grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image includes: converting the merged program file into binary data to generate a binary data sequence; segmenting the binary data in the binary data sequence to generate a sub-binary data group sequence; converting each sub-binary data group in the sub-binary data group sequence into a color value to generate a first grayscale color value sequence; determining an image size of the first grayscale image according to a number of sub-binary data groups in the sub-binary data group sequence to generate first image size information; generating the first grayscale image according to the first grayscale color value sequence and the first image size information.

4. The method of claim 3, wherein, The grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image further includes: converting each executable instruction in the executable instruction set into a binary data string to obtain a binary data string sequence; padding the data string length of each binary data string in the binary data string sequence to generate a padded binary data string sequence; for each padded binary data string in the padded binary data string sequence, performing the following processing steps: performing fixed-length data segmentation on the padded binary data string to generate a sub-binary data string to obtain a sub-binary data string sequence; determining a color value group corresponding to the padded binary data string according to the sub-binary data string sequence to generate a second grayscale color value group; determining an image size of the second grayscale image according to a number of second grayscale color values in the obtained second grayscale color value group sequence and a number of padded binary data strings in the padded binary data string sequence to generate second image size information; generating the second grayscale image according to the second grayscale color value group sequence and the second image size information.

5. A file processing apparatus, comprising: a first running unit configured to, in response to the existence of a target process being created, run a target shell file corresponding to the target process in a pre-created virtual container to determine a first to-be-executed program file included in the target shell file, the target shell file being a shell code outside the first to-be-executed program file, the shell code being a code for protecting the first to-be-executed program file; The generating unit is configured to generate a merged program file according to the first to-be-executed program file and the second to-be-executed program file, wherein the second to-be-executed program file is appended to the tail of the first to-be-executed program file, and the merged program file is a complete program file corresponding to a to-be-executed application program, and the first to-be-executed program file and the second to-be-executed program file are partial program files in the merged program file; The instruction conversion processing unit is configured to perform instruction conversion processing on the target shell file and the second to-be-executed program file to generate an executable instruction set; The grayscale processing unit is configured to perform grayscale processing on the merged program file and the executable instruction set respectively to generate a first grayscale image and a second grayscale image; The input unit is configured to input the first grayscale image and the second grayscale image into a pre-trained program detection network to generate a program detection result, wherein the program detection network comprises a first abnormal program detection network, a second abnormal program detection network, and a feature fusion network, and comprises: The first grayscale image is input into a first convolutional block to generate a first feature vector; The first feature vector is input into a second convolutional block to generate a second feature vector; The second feature vector is input into a third convolutional block to generate a third feature vector; The third feature vector is input into a fourth convolutional block to generate a fourth feature vector; The fourth feature vector is input into a fifth convolutional block to generate a fifth feature vector; The second grayscale image is input into a convergence layer to generate a convergence feature vector; The convergence feature vector is input into a sixth convolutional block to generate a sixth feature vector; The sixth feature vector is input into a maximum pooling layer to generate a seventh feature vector; The fifth feature vector is input into a first fully connected network to generate a first candidate vector; The seventh feature vector is input into a second fully connected layer to generate a second candidate feature vector; The first candidate vector is input into a first normalization layer to generate a first candidate result; The second candidate feature vector is input into a second normalization layer to generate a second candidate result; The first candidate result and the second candidate result are input into a fusion layer to generate the program detection result; The second running unit is configured to run the merged program file in the virtual container in response to the program detection result representing that the merged program file is normal.

6. An electronic device, comprising: one or more processors; storage having one or more programs stored thereon; when the one or more programs are executed by the one or more processors, the one or more processors implement the method of any one of claims 1-4.

7. A computer readable medium having stored thereon a computer program, wherein, The program is executed by the processor to implement the method of any one of claims 1-4.

Images