File detection method, device, equipment and computer-readable storage medium

Abstract

The present application provides a file detection method, apparatus, device and computer-readable storage medium, which converts character data in a fuzzy hash value corresponding to a file to be tested into numerical data, performs a query in a malicious sample file database based on the numerical data, and then determines whether the file to be tested is a malicious file based on the query result. Since the query speed for numerical data in the database is faster than the query speed for character data, the query speed and efficiency are improved, thereby improving the detection speed of the file to be tested, and can quickly determine whether the file to be tested is a malicious file.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a file detection method, device, equipment and computer-readable storage medium. Background Art

[0002] With the rapid development of the Internet, threats on the Internet are emerging in an endless stream, and the number of malicious files is growing. How to quickly determine whether a file is a malicious file has always been the focus and difficulty of network security research. At present, before judging whether a certain file to be tested is a malicious file, it is necessary to count the fuzzy hash values ​​of a large number of malicious sample files, and then store these fuzzy hash values ​​in a database. When it is necessary to detect whether a certain file to be tested is a malicious file, the fuzzy hash value of the file to be tested is usually directly used to query the database, and then the query result is used to determine whether the file to be tested is a malicious file. Due to the slow query speed, it is difficult to quickly determine whether the file to be tested is a malicious file. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a file detection method, apparatus, device and computer-readable storage medium, so as to solve the problem in the prior art that when it is necessary to determine whether a file to be tested is a malicious file, it is necessary to query in a database storing fuzzy hash values ​​corresponding to malicious sample files according to the fuzzy hash value of the file to be tested, resulting in a slow query speed and difficulty in quickly determining whether the file to be tested is a malicious file.

[0004] The present application provides a file detection method, the method comprising:

[0005] Get the fuzzy hash value corresponding to the file to be tested;

[0006] Numerically converting the character data in the fuzzy hash value to obtain numeric data;

[0007] According to the numerical data, a target malicious sample file that meets the preset conditions is searched in a preset malicious sample file database; the malicious sample file database stores a correspondence between each malicious sample file and the numerical data, and the numerical data corresponding to each malicious sample file is data obtained by numerically processing the character data in the fuzzy hash value corresponding to the malicious sample file; the preset conditions include: there are at least N identical values ​​between the numerical data corresponding to the malicious sample file and the numerical data corresponding to the file to be tested; N is an integer greater than or equal to 1;

[0008] Determine whether the file to be tested is a malicious file based on the query result.

[0009] In the above implementation process, the character data in the fuzzy hash value corresponding to the file to be tested is converted into numerical data, and a query is performed in the malicious sample file database based on the numerical data, and then it is determined whether the file to be tested is a malicious file based on the query result. Since the query speed for numerical data in the database is faster than the query speed for character data, the query speed and efficiency are improved, thereby improving the detection speed of the file to be tested, and it can quickly determine whether the file to be tested is a malicious file.

[0010] Furthermore, the malicious sample file database also stores a correspondence between each malicious sample file and a fragmentation parameter, and the fuzzy hash value corresponding to the malicious sample file is a value calculated based on the fragmentation parameter corresponding to the malicious sample file;

[0011] The step of obtaining the fuzzy hash value corresponding to the file to be tested includes:

[0012] Determine the slice parameters corresponding to the file to be tested;

[0013] Slice the file to be tested according to the slicing parameters, calculate a slicing hash value corresponding to each slicing, and calculate a fuzzy hash value corresponding to the file to be tested according to each slicing hash value;

[0014] The step of searching a preset malicious sample file database for a target malicious sample file that meets a preset condition according to the numerical data includes:

[0015] According to the slicing parameters corresponding to the file to be tested and the numerical data corresponding to the file to be tested, a target malicious sample file that meets preset conditions is queried in a preset malicious sample file database; the preset conditions also include: the slicing parameters corresponding to the malicious sample file and the slicing parameters corresponding to the file to be tested satisfy a preset multiple relationship.

[0016] In the above implementation process, the database is queried for malicious sample files whose numerical data meet the requirements according to the numerical data corresponding to the file to be tested, and the database is queried for malicious sample files whose sharding parameters meet the requirements according to the sharding parameters corresponding to the file to be tested. The malicious sample files that meet both conditions are used as target malicious sample files, so that the queried target malicious sample files have a higher matching degree with the file to be tested, thereby ensuring the accuracy of the detection results.

[0017] Furthermore, the slicing the file to be tested according to the slicing parameters and calculating the fuzzy hash value corresponding to the file to be tested in the corresponding slicing includes:

[0018] Divide the file to be tested into n pieces and n / 2 pieces respectively, and calculate the fuzzy hash values ​​corresponding to the file to be tested when the file is divided into n pieces and n / 2 pieces, where n represents the slice parameter corresponding to the file to be tested;

[0019] The fuzzy hash value corresponding to the malicious sample file includes the fuzzy hash values ​​corresponding to each of the malicious sample file when the malicious sample file is divided into m pieces and m / 2 pieces, where m represents a piece parameter corresponding to the malicious sample file;

[0020] The preset multiple relationship includes at least one of the following relationships:

[0021] m=n, m=2n, m=n / 2.

[0022] In the above implementation process, the file to be tested is divided into n pieces and n / 2 pieces respectively, and the fuzzy hash values ​​corresponding to the file to be tested when being divided into n pieces and n / 2 pieces are calculated. Since the query is performed in the malicious sample database according to the numerical data corresponding to the two fuzzy hash values, the accuracy of the query result is improved, thereby ensuring the accuracy of the detection result.

[0023] Further, when the target malicious sample file corresponding to the file to be tested is queried, judging whether the file to be tested is a malicious file according to the query result includes:

[0024] Calculating the file similarity between the file to be tested and each of the queried target malicious sample files;

[0025] When the file similarity is greater than or equal to a preset file similarity threshold, the file to be tested is determined to be a malicious file.

[0026] In the above implementation process, since it is necessary to further calculate the file similarity between the file to be tested and each target malicious sample file, when it is determined that the file similarity between the file to be tested and a certain target malicious sample file is greater than or equal to a preset file similarity threshold, the file to be tested is determined to be a malicious file, thereby further ensuring the accuracy of the detection result.

[0027] Further, the calculating the similarity between the file to be tested and each of the target malicious sample files queried includes: calculating the numerical data similarity between the numerical data corresponding to the file to be tested and the numerical data corresponding to each of the target malicious sample files, and using the numerical data similarity as the file similarity;

[0028] or,

[0029] The malicious sample data database also stores the correspondence between each malicious sample file and the fuzzy hash value. The calculating the similarity between the file to be tested and each of the queried target malicious sample files includes: calculating the hash value similarity between the fuzzy hash value corresponding to the file to be tested and the fuzzy hash value corresponding to each of the target malicious sample files, and using the hash value similarity as the file similarity.

[0030] In the above implementation process, on the one hand, the numerical data similarity between the file to be tested and each target malicious sample file can be calculated, and whether the file to be tested is a malicious file can be judged based on the numerical data similarity, and the calculation speed and efficiency are higher; on the other hand, the hash value similarity between the file to be tested and each target malicious sample file can be calculated, and whether the file to be tested is a malicious file can be judged based on the hash value similarity, and the detection result is more accurate.

[0031] Furthermore, the malicious sample file database also stores a correspondence between each malicious sample file and the classification family to which it belongs. After determining that the file to be tested is a malicious file, the method further includes:

[0032] Determine the target classification family corresponding to each classified malicious sample file from the malicious sample file database; the classified malicious sample file is a file in the target malicious sample file whose file similarity with the file to be tested is greater than or equal to a preset file similarity threshold;

[0033] The classification family to which the file to be tested belongs is determined from the target classification family.

[0034] In the above implementation process, when the file to be tested is determined to be a malicious file, the classification family to which the file to be tested belongs can be determined from the classification families corresponding to each classified malicious sample file, so that the type of the malicious file can be identified.

[0035] Further, the step of determining the classification family to which the file to be tested belongs from the target classification family includes:

[0036] Counting the number of malicious sample files of the classification in each target classification family;

[0037] The target classification family with the largest number of corresponding classified malicious sample files is used as the classification family to which the file to be tested belongs.

[0038] In the above implementation process, the target classification family with the largest number of corresponding classified malicious sample files is used as the classification family to which the file to be tested belongs, so that the type of malicious file can be accurately identified.

[0039] The present application also provides a file detection device, including:

[0040] An acquisition module is used to obtain the fuzzy hash value corresponding to the file to be tested;

[0041] A numerical processing module, used for numerically processing the character data in the fuzzy hash value to obtain numerical data;

[0042] A query module is used to query a preset malicious sample file database for a target malicious sample file that meets a preset condition according to the numerical data; the malicious sample file database stores a correspondence between each malicious sample file and the numerical data, and the numerical data corresponding to each malicious sample file is data obtained by numerically processing the character data in the fuzzy hash value corresponding to the malicious sample file; the preset condition includes: there are at least N identical numerical values ​​between the numerical data corresponding to the malicious sample file and the numerical data corresponding to the file to be tested; N is an integer greater than or equal to 1;

[0043] The judgment module is used to judge whether the file to be tested is a malicious file according to the query result.

[0044] An embodiment of the present application further provides a device, including a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to implement any one of the above methods.

[0045] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, any one of the above methods is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A flowchart of a file detection method provided in Example 1 of the present application;

[0048] Figure 2 A schematic diagram of a process for setting up a malicious sample file database provided in Embodiment 1 of the present application;

[0049] Figure 3 A flowchart of a file detection method provided in Example 2 of the present application;

[0050] Figure 4A schematic diagram of the structure of a file detection device provided in Example 3 of the present application;

[0051] Figure 5 This is a schematic diagram of the structure of the device provided in Example 4 of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0053] It should be noted that the descriptions involving "first", "second", etc. in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0054] In the description of the present invention, it should be understood that the numerical labels before the steps do not identify the order of executing the steps, but are only used to facilitate the description of the present invention and distinguish each step, and therefore cannot be understood as a limitation of the present invention.

[0055] A number of embodiments will be provided below to specifically introduce a file detection method, apparatus, device, and computer-readable storage medium.

[0056] Embodiment 1:

[0057] In order to solve the problem in the prior art that when it is necessary to determine whether a file to be tested is a malicious file, it is necessary to query the database storing the fuzzy hash values ​​corresponding to the malicious sample files according to the fuzzy hash value of the file to be tested, resulting in a slow query speed and difficulty in quickly determining whether the file to be tested is a malicious file. The present application embodiment provides a file detection method. Figure 1 As shown, the method may include the following steps.

[0058] S11: Obtain the fuzzy hash value corresponding to the file to be tested.

[0059] It can be understood that the file to be tested in step S11 can be any type of file, such as an application file, a document file, a video file, etc.

[0060] In step S11, the sharding parameters corresponding to the file to be tested can be first determined, and then the file to be tested can be sharded according to the sharding parameters, and the sharding hash value corresponding to each shard can be calculated, and the fuzzy hash value corresponding to the file to be tested can be calculated according to each sharding hash value. In this embodiment, the sharding parameters of the file to be tested can be determined with reference to the existing sharding parameter determination method. When the determined sharding parameter is n, the file to be tested can be divided into n pieces, or n / 2 pieces, or 2n pieces, etc. according to the preset sharding rules, and then the sharding hash value corresponding to each shard can be calculated, and the fuzzy hash value corresponding to the file to be tested when the file to be tested is divided into n pieces, n / 2 pieces or 2n pieces can be calculated according to each sharding hash value.

[0061] For example, in some embodiments, when the file to be tested is divided into n pieces, the piece hash value corresponding to each piece can be calculated based on the hash algorithm, and the piece hash values ​​can be spliced ​​to obtain the fuzzy hash value corresponding to the file to be tested when it is divided into n pieces. For other actual piece values, such as n / 2 and 2n, the method of calculating the corresponding fuzzy hash value refers to the above process and will not be repeated here. In some other embodiments, the piece hash value corresponding to each piece can be compressed and mapped, that is, each piece hash value can be compressed shorter, for example, only the lowest 6 bits of the piece hash value result can be taken and represented by an ASCII character, and then the compressed values ​​can be spliced ​​together to obtain the fuzzy hash value corresponding to the file to be tested.

[0062] S12: converting the character data in the fuzzy hash value into numerical data to obtain numerical data.

[0063] Generally speaking, the fuzzy hash value obtained based on the fuzzy hash algorithm is a character string. Step S12 is essentially to perform numerical processing on the character string, and convert part or all of the characters in the character string into numerical data.

[0064] Specifically, the fuzzy hash value corresponding to the file to be tested can be disassembled according to the preset disassembly rules to obtain the disassembled hash value, and each disassembled hash value can be numerically processed to obtain the corresponding numerical data. The specific disassembly rules can be flexibly set by the developer according to the actual application situation. For example, it can be set to: starting from the first character of the fuzzy hash value, every M consecutive characters, the fuzzy hash value is split once at the corresponding position, so that multiple disassembled hash values ​​can be obtained. For example, if the fuzzy hash value corresponding to the file to be tested is abcdefghijk, and the value of M is 7, then the two disassembled hash values ​​of "abcdefg" and "hijk" can be disassembled, and each disassembled hash value is numerically processed to obtain two numerical data, such as "3" and "5". It should be noted that in some other embodiments, the above disassembly step may not exist, and the character data in the fuzzy hash value can be directly converted to numerical values. For example, starting from the first character of the fuzzy hash value, K consecutive characters can be used as units to perform corresponding numerical processing.

[0065] The numerical data in this embodiment can be real data or integer data, such as int data, short data, or long data. Converting the character data in the fuzzy hash value into integer data for querying in the database can greatly improve the query speed and efficiency.

[0066] S13: Querying a preset malicious sample file database for a target malicious sample file that meets preset conditions according to the numerical data.

[0067] Here, the malicious sample file database is first introduced. The malicious sample file database in this embodiment stores the correspondence between each malicious sample file and numerical data, and the numerical data corresponding to each malicious sample file is the data obtained by numerically processing the character data in the fuzzy hash value corresponding to the malicious sample file.

[0068] In this embodiment, before step S13, the malicious sample file database may be set. For the setting steps, please refer to Figure 2 As shown, the following steps may be specifically included:

[0069] S21: Obtain malicious sample files.

[0070] In this embodiment, a large number of malicious sample files can be obtained from the virustotal virus database. In some other embodiments, information on the classification family corresponding to the malicious sample files can also be obtained. It should be noted that the malicious sample files obtained in this embodiment can be unpacked files.

[0071] S22: Determine the fuzzy hash value corresponding to each malicious sample file.

[0072] S23: converting the character data in each fuzzy hash value into numerical data to obtain numerical data.

[0073] The specific process of step S22 and step S23 can refer to the above introduction of step S11 and step S12, which will not be repeated here.

[0074] S24: Writing the correspondence between each malicious sample file and the numerical data into the malicious sample file database.

[0075] The preset conditions in step S13 include: there are at least N identical values ​​between the numerical data corresponding to the malicious sample file and the numerical data corresponding to the file to be tested; wherein N is an integer greater than or equal to 1; the specific value of N can be flexibly set by the developer. That is to say, there are at least N identical values ​​between the numerical data of the queried target malicious sample file and the numerical data corresponding to the file to be tested, which can ensure that the queried target malicious sample file and the file to be tested have a certain degree of similarity.

[0076] It should be noted that in some other embodiments, the malicious sample file database may also store the correspondence between each malicious sample file and the fragmentation parameter, and the fuzzy hash value corresponding to the malicious sample file is a value calculated based on the fragmentation parameter corresponding to the malicious sample file.

[0077] At this time, it is also possible to query the malicious sample file database based on the slicing parameters of the file to be tested. Specifically, the target malicious sample file that meets the preset conditions can be queried in the preset malicious sample file database according to the slicing parameters corresponding to the file to be tested and the numerical data corresponding to the file to be tested; the preset conditions also include: the slicing parameters corresponding to the malicious sample file and the slicing parameters corresponding to the file to be tested satisfy a preset multiple relationship. In other words, there are at least N identical values ​​between the numerical data of the queried target malicious sample file and the numerical data corresponding to the file to be tested, and the slicing parameters of the queried target malicious sample file and the slicing parameters corresponding to the file to be tested also satisfy a preset multiple relationship. In this way, it can be ensured that the similarity between the queried target malicious sample file and the file to be tested is higher. Compared with fuzzy hash values, sharding parameters usually occupy less byte space and are more conducive to query. Therefore, it is understandable that a query can be first performed in the malicious sample file database based on the sharding parameters of the file to be tested to find malicious sample files whose sharding parameters and the sharding parameters corresponding to the file to be tested meet a preset multiple relationship. Then, a query is performed from this part of the malicious sample files to find target malicious sample files whose numerical data corresponding to the fuzzy hash value and the numerical data corresponding to the fuzzy hash value of the file to be tested have at least N identical numerical values. In this way, there is no need to query the numerical data corresponding to the fuzzy hash value in the entire malicious sample file database, which greatly improves the query speed and thus improves the detection efficiency.

[0078] It should be noted that the sharding parameters corresponding to the malicious sample files can be stored in the malicious file sample database in the form of numerical data. Before querying, the sharding parameters corresponding to the file to be tested can be digitized and converted into corresponding numerical data, and then queried in the malicious sample file database based on the numerical data corresponding to the sharding parameters to find out the target malicious sample files whose sharding parameters satisfy a preset multiple relationship, so as to further improve the query speed.

[0079] S14: Determine whether the file to be tested is a malicious file according to the query result.

[0080] In some embodiments, when a target malicious sample file corresponding to the file to be tested is queried, the file to be tested is determined to be a malicious file. In other embodiments, when a target malicious sample file corresponding to the file to be tested is queried, the file to be tested can be further detected and judged based on the target malicious sample file to confirm whether the file to be tested is a malicious file. For example, the file similarity between the file to be tested and each of the queried target malicious sample files can be calculated. When a certain file similarity is greater than or equal to a preset file similarity threshold, the file to be tested is determined to be a malicious file.

[0081] This embodiment provides two methods for calculating file similarity:

[0082] The first method is to calculate the numerical data similarity between the numerical data corresponding to the file to be tested and the numerical data corresponding to each target malicious sample file, and use the numerical data similarity as the file similarity.

[0083] The second method is to calculate the hash value similarity between the fuzzy hash value corresponding to the file to be tested and the fuzzy hash value corresponding to each target malicious sample file, and use the hash value similarity as the file similarity.

[0084] For the second calculation method mentioned above, in order to improve the speed of calculating similarity, the malicious sample data database can also store the correspondence between each malicious sample file and the fuzzy hash value. When calculating the hash value similarity, the fuzzy hash value corresponding to the corresponding target malicious sample file can be retrieved from the malicious sample data database.

[0085] In order to determine the classification family to which a malicious file belongs, the malicious sample file database may also store the correspondence between each malicious sample file and the classification family to which it belongs. In the file detection method provided in this embodiment, after determining that the file to be tested is a malicious file, target malicious sample files having a file similarity with the file to be tested that is greater than or equal to a preset file similarity threshold may be screened out as classified malicious sample files, the target classification family corresponding to each classified malicious sample file is determined, and then the classification family to which the file to be tested belongs is determined from the target classification family.

[0086] In this embodiment, the number of classified malicious sample files in each target classification family can be counted, and the target classification family with the largest number of corresponding classified malicious sample files is used as the classification family to which the file to be tested belongs. When there are multiple target classification families with the largest number of corresponding classified malicious sample files, for each target classification family, the file similarities between the corresponding classified malicious sample files and the file to be tested can be added to obtain the corresponding total file similarity value, and the target classification family with the largest total file similarity value is used as the classification family to which the file to be tested belongs.

[0087] It is understandable that in some other embodiments, the classification malicious sample files may not be screened, and the classification family corresponding to each target malicious sample file may be directly determined, and this part of the classification family is used as the target classification family, and the classification family to which the file to be tested belongs is determined from the target classification family.

[0088] The file detection method provided in the embodiment of the present application realizes rapid detection of malicious files by converting the character data in the fuzzy hash value corresponding to the file to be tested into numerical data, and querying the malicious sample file database based on the numerical data, and then judging whether the file to be tested is a malicious file based on the query result, thereby realizing rapid detection of malicious files and being able to quickly determine whether the file to be tested is a malicious file.

[0089] Embodiment 2:

[0090] In order to better understand the solution provided by this application, this embodiment provides a more specific file detection method, see Figure 3 As shown, the following steps may be included:

[0091] S31: Obtain the sharding parameters and fuzzy hash values ​​corresponding to the file to be tested through pydeep or ssdeep.

[0092] In step S31, the fuzzy hash values ​​corresponding to the file to be tested are h(n) and h(n / 2), where n represents the fragmentation parameter of the file to be tested, h(n) represents the fuzzy hash value corresponding to when the file to be tested is divided into n fragments, and h(n / 2) represents the fuzzy hash value corresponding to when the file to be tested is divided into n / 2 fragments.

[0093] S32: converting the character data in the fuzzy hash value into numerical data to obtain numerical data.

[0094] In step S32, h(n / 2) and h(n) may be converted into corresponding numerical data, for example, into long type numbers.

[0095] S33: Query the malicious sample file database for target malicious sample files where m=n, or m=2n, or m=n / 2 and there are at least N target malicious sample files with the same numerical data as the numerical data corresponding to the file to be tested.

[0096] m represents the sharding parameter corresponding to the malicious sample file. It should be noted that the malicious sample file database in this embodiment can be a structured database or a distributed database. The malicious sample file database stores the correspondence between each malicious sample file and the corresponding sharding parameter, the correspondence between each malicious sample file and the classification family, and the correspondence between each malicious sample file and the corresponding numerical data, which is the data obtained by digitizing the character data in the fuzzy hash value corresponding to the malicious sample file.

[0097] It is understandable that before step S33, the malicious sample file database may be set. Here is a brief introduction to the setting process:

[0098] First, a large number of malicious sample files with classification family information labels can be obtained, and then for each malicious sample file, the corresponding sharding parameters and fuzzy hash values ​​of the malicious sample file can be obtained through pydeep or ssdeep. The fuzzy hash values ​​corresponding to the malicious sample files are h(m) and h(m / 2), where m represents the sharding parameters of the malicious sample file, h(m) represents the corresponding fuzzy hash value when the malicious sample file is divided into m pieces, and h(m / 2) represents the corresponding fuzzy hash value when the malicious sample file is divided into m / 2 pieces. The character data in the fuzzy hash value corresponding to the malicious sample file is numerically processed to obtain numerical data, and then the corresponding relationship between each malicious sample file and the numerical data, the corresponding relationship between each malicious sample file and the sharding parameters, and the corresponding relationship between each malicious sample file and the classification family information are written into the malicious sample file database. Specifically, for each malicious sample file, its corresponding md5 value can be calculated and used as its own identity, and the identity is associated and stored with the corresponding sharding parameters, classification family information, and numerical data.

[0099] S34: Calculate the file similarity between the file to be tested and each of the queried target malicious sample files.

[0100] S35: When a certain file similarity is greater than or equal to a preset file similarity threshold, the file to be tested is determined to be a malicious file, and target malicious sample files whose file similarity is greater than or equal to the preset file similarity threshold are screened out as classified malicious sample files.

[0101] S36: Determine the target classification family corresponding to each classification malicious sample file.

[0102] S37: Count the number of classified malicious sample files in each target classification family.

[0103] S38: The target classification family with the largest number of corresponding classified malicious sample files is used as the classification family to which the file to be tested belongs.

[0104] It should be noted that, in order to ensure the accuracy of the detection results, in some embodiments, the target classification family with the largest number of corresponding classified malicious sample files and the number of files greater than a preset number threshold can be used as the classification family to which the file to be tested belongs. For example, the preset number threshold can be set to 3. If the number of classified malicious sample files corresponding to the target classification family with the largest number of corresponding classified malicious sample files is less than the preset number threshold, other methods can be used to determine the classification family to which the file to be tested belongs.

[0105] Embodiment three:

[0106] This application embodiment provides a file detection device, see Figure 4 As shown, including:

[0107] The acquisition module 41 is used to obtain the fuzzy hash value corresponding to the file to be tested.

[0108] The numerical processing module 42 is used to perform numerical processing on the character data in the fuzzy hash value to obtain numerical data.

[0109] The query module 43 is used to query the preset malicious sample file database for target malicious sample files that meet the preset conditions according to the numerical data. The malicious sample file database stores the correspondence between each malicious sample file and the numerical data, and the numerical data corresponding to each malicious sample file is the data obtained by numerically processing the character data in the fuzzy hash value corresponding to the malicious sample file; the preset conditions include: there are at least N identical numerical values ​​between the numerical data corresponding to the malicious sample file and the numerical data corresponding to the file to be tested; N is an integer greater than or equal to 1.

[0110] The judgment module 44 is used to judge whether the file to be tested is a malicious file according to the query result.

[0111] In an exemplary embodiment, the acquisition module 41 is used to determine the sharding parameters corresponding to the file to be tested, and then segment the file to be tested according to the sharding parameters. When the determined sharding parameter is n, the file to be tested can be divided into n pieces, or n / 2 pieces, or 2n pieces, etc. according to a preset sharding rule, and then the fuzzy hash value corresponding to the file to be tested under the corresponding sharding is calculated.

[0112] In an exemplary embodiment, the malicious sample file database also stores the corresponding relationship between each malicious sample file and the slice parameter, and the fuzzy hash value corresponding to the malicious sample file is a value calculated based on the slice parameter corresponding to the malicious sample file. The query module 43 is used to query the target malicious sample file that meets the preset conditions in the preset malicious sample file database according to the slice parameter corresponding to the file to be tested and the numerical data corresponding to the file to be tested. At this time, the preset conditions also include: the slice parameter corresponding to the malicious sample file and the slice parameter corresponding to the file to be tested satisfy the preset multiple relationship, that is, there are at least N identical values ​​between the numerical data of the target malicious sample file queried and the numerical data corresponding to the file to be tested, and the slice parameter of the target malicious sample file queried and the slice parameter corresponding to the file to be tested also satisfy the preset multiple relationship. In this way, it can be ensured that the similarity between the queried target malicious sample file and the file to be tested is higher.

[0113] In an exemplary embodiment, the judgment module 44 is also used to perform further detection and judgment on the file to be tested based on the target malicious sample file when a target malicious sample file corresponding to the file to be tested is queried, so as to confirm whether the file to be tested is a malicious file. For example, the file similarity between the file to be tested and each of the queried target malicious sample files can be calculated. When a certain file similarity is greater than or equal to a preset file similarity threshold, the file to be tested is determined to be a malicious file.

[0114] In an exemplary embodiment, the malicious sample file database may also store the correspondence between each malicious sample file and the classification family to which it belongs. The judgment module 44 is also used to screen out target malicious sample files whose file similarity with the file to be tested is greater than or equal to a preset file similarity threshold as classified malicious sample files, determine the target classification family corresponding to each classified malicious sample file, and then determine the classification family to which the file to be tested belongs from the target classification family.

[0115] The file detection device provided in the embodiment of the present application has the same implementation principle and technical effects as those of the corresponding method embodiment described above. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding contents in the method embodiment described above, and no further details will be given here.

[0116] Embodiment 4:

[0117] Based on the same inventive concept, the present application embodiment provides a device, see Figure 5 As shown, it includes a processor 501 and a memory 502, wherein the memory 502 stores a computer program, and the processor 501 executes the computer program to implement the steps of the method in the above-mentioned embodiment 1 and embodiment 2, which will not be repeated here.

[0118] It should be noted that the device in this embodiment can be a PC (Personal Computer), a mobile phone, a tablet computer, a laptop computer, a virtual host, etc. It can also be a rack server, a blade server, a tower server or a cabinet server (including an independent server or a server cluster composed of multiple servers), etc.

[0119] Understandably, Figure 5 The structure shown is for illustration only, and the device may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations shown.

[0120] The processor 501 may be an integrated circuit chip with signal processing capabilities. The processor 501 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It may implement or execute various methods, steps and logic block diagrams disclosed in the embodiments of the present application.

[0121] The memory 502 may include but is not limited to random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0122] This embodiment also provides a computer-readable storage medium, such as a floppy disk, a CD, a hard disk, a flash memory, a USB flash disk, an SD (Secure Digital Memory Card) card, an MMC (Multimedia Card) card, etc., in which one or more programs for implementing the above steps are stored. The one or more programs can be executed by one or more processors to implement the steps of the method in the above-mentioned embodiment 1 and embodiment 2, which will not be repeated here.

[0123] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0124] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method.

[0125] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A file detection method, characterized in that: include: Get the fuzzy hash value corresponding to the file to be tested; Numerically converting the character data in the fuzzy hash value to obtain numeric data; According to the numerical data, a target malicious sample file that meets the preset conditions is searched in a preset malicious sample file database; the malicious sample file database stores a correspondence between each malicious sample file and the numerical data, and the numerical data corresponding to each malicious sample file is data obtained by numerically processing the character data in the fuzzy hash value corresponding to the malicious sample file; the preset conditions include: there are at least N identical values ​​between the numerical data corresponding to the malicious sample file and the numerical data corresponding to the file to be tested; N is an integer greater than or equal to 1; Determine whether the file to be tested is a malicious file according to the query result; The malicious sample file database further stores a correspondence between each malicious sample file and a fragmentation parameter, and the fuzzy hash value corresponding to the malicious sample file is a value calculated based on the fragmentation parameter corresponding to the malicious sample file; The step of obtaining the fuzzy hash value corresponding to the file to be tested includes: Determine the slice parameters corresponding to the file to be tested; Slice the file to be tested according to the slicing parameters, calculate a slicing hash value corresponding to each slicing, and calculate a fuzzy hash value corresponding to the file to be tested according to each slicing hash value; The step of searching a preset malicious sample file database for a target malicious sample file that meets a preset condition according to the numerical data includes: According to the slicing parameters corresponding to the file to be tested and the numerical data corresponding to the file to be tested, a target malicious sample file that meets preset conditions is queried in a preset malicious sample file database; the preset conditions also include: the slicing parameters corresponding to the malicious sample file and the slicing parameters corresponding to the file to be tested satisfy a preset multiple relationship.

2. The file detection method according to claim 1, characterized in that: The step of slicing the file to be tested according to the slicing parameters and calculating the fuzzy hash value corresponding to the file to be tested under the corresponding slicing includes: Divide the file to be tested into n pieces and n / 2 pieces respectively, and calculate the fuzzy hash values ​​corresponding to the file to be tested when the file is divided into n pieces and n / 2 pieces, where n represents the slice parameter corresponding to the file to be tested; The fuzzy hash value corresponding to the malicious sample file includes the fuzzy hash values ​​corresponding to each of the malicious sample file when the malicious sample file is divided into m pieces and m / 2 pieces, where m represents a piece parameter corresponding to the malicious sample file; The preset multiple relationship includes at least one of the following relationships: m=n, m=2n, m=n / 2.

3. The file detection method according to claim 1, characterized in that: When the target malicious sample file corresponding to the file to be tested is found, judging whether the file to be tested is a malicious file according to the query result includes: Calculating the file similarity between the file to be tested and each of the queried target malicious sample files; When the file similarity is greater than or equal to a preset file similarity threshold, the file to be tested is determined to be a malicious file.

4. The file detection method according to claim 3, characterized in that: The calculating the similarity between the file to be tested and each of the target malicious sample files queried includes: calculating the numerical data similarity between the numerical data corresponding to the file to be tested and the numerical data corresponding to each of the target malicious sample files, and using the numerical data similarity as the file similarity; or, The malicious sample file database also stores the correspondence between each malicious sample file and the fuzzy hash value. The calculating the similarity between the file to be tested and each of the queried target malicious sample files includes: calculating the hash value similarity between the fuzzy hash value corresponding to the file to be tested and the fuzzy hash value corresponding to each of the target malicious sample files, and using the hash value similarity as the file similarity.

5. The file detection method according to claim 3 or 4, characterized in that: The malicious sample file database also stores a correspondence between each malicious sample file and the classification family to which it belongs. After determining that the file to be tested is a malicious file, the method further includes: Determine the target classification family corresponding to each classified malicious sample file from the malicious sample file database; the classified malicious sample file is a file in the target malicious sample file whose file similarity with the file to be tested is greater than or equal to a preset file similarity threshold; The classification family to which the file to be tested belongs is determined from the target classification family.

6. The file detection method according to claim 5, characterized in that: The step of determining the classification family to which the file to be tested belongs from the target classification family includes: Counting the number of malicious sample files of the classification in each target classification family; The target classification family with the largest number of corresponding classified malicious sample files is used as the classification family to which the file to be tested belongs.

7. A file detection device, characterized in that: include: An acquisition module is used to obtain the fuzzy hash value corresponding to the file to be tested; A numerical processing module, used for numerically processing the character data in the fuzzy hash value to obtain numerical data; A query module is used to query a preset malicious sample file database for a target malicious sample file that meets a preset condition according to the numerical data; the malicious sample file database stores a correspondence between each malicious sample file and the numerical data, and the numerical data corresponding to each malicious sample file is data obtained by numerically processing the character data in the fuzzy hash value corresponding to the malicious sample file; the preset condition includes: there are at least N identical numerical values ​​between the numerical data corresponding to the malicious sample file and the numerical data corresponding to the file to be tested; N is an integer greater than or equal to 1; A judgment module, used to judge whether the file to be tested is a malicious file according to the query result; The malicious sample file database also stores a correspondence between each malicious sample file and a fragmentation parameter, and the fuzzy hash value corresponding to the malicious sample file is a value calculated based on the fragmentation parameter corresponding to the malicious sample file; The acquisition module is specifically used to determine the sharding parameters corresponding to the file to be tested; slice the file to be tested according to the sharding parameters, and calculate the sharding hash value corresponding to each shard, and calculate the fuzzy hash value corresponding to the file to be tested according to each sharding hash value; The query module is specifically used to query a preset malicious sample file database for a target malicious sample file that meets preset conditions according to the slice parameters corresponding to the file to be tested and the numerical data corresponding to the file to be tested; the preset conditions also include: the slice parameters corresponding to the malicious sample file and the slice parameters corresponding to the file to be tested satisfy a preset multiple relationship.

8. A device, characterized in that The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by at least one processor, the method according to any one of claims 1 to 6 is implemented.

Images