Noise reduction method and device based on virtual machine identification, equipment and storage medium

Abstract

The application belongs to the technical field of network security, and discloses a virtual machine identification-based noise reduction method, device, equipment and storage medium. The method obtains terminal hardware identification information, terminal environment information and file paths corresponding to each suspected test machine sample in a suspected test machine sample set; performs virtual machine identification according to the terminal hardware identification information, the terminal environment information and the file paths to obtain a virtual machine identification result; and performs noise reduction processing on the suspected test machine sample set according to the virtual machine identification result. Since the virtual machine identification is performed in multiple dimensions according to the terminal hardware identification information, the terminal environment information and the file paths, the virtual machine can be accurately identified and the virtual machine identification result can be obtained. Then, the noise reduction processing is performed on the suspected test machine sample set according to the virtual machine identification result. The samples with a low possibility of being test machine samples are removed, so that the loss of computing resources is reduced, the sample analysis speed is improved, and the sample analysis difficulty is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a noise reduction method, apparatus, device, and storage medium based on virtual machine identification. Background Technology

[0002] During the testing and confrontation process between Advanced Persistent Threat (APT) actors and secure endpoint products, APT actors will install the endpoint product and test the ability of their malicious tools to counter the secure endpoint product, thereby assessing the feasibility of the next attack deployment.

[0003] During the confrontation process, advanced threat actors will continuously expose their own habitual characteristics. Therefore, by extracting, identifying and organizing such logs to form a knowledge base, and using multi-dimensional methods to quickly associate and confirm past or ongoing test confrontation activities, it is possible to quickly identify advanced threat actors and predict their next attack trends.

[0004] However, in the process of confronting advanced threat actors, the captured suspected test machine sample data usually contains a large number of noisy samples, that is, the suspected test machine samples contain a large number of normal user data samples. If all of them are analyzed, it will waste a lot of computing resources and greatly increase the difficulty of analysis. Therefore, it is necessary to perform data denoising on the captured suspected test machine samples to eliminate noisy samples.

[0005] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main objective of this invention is to provide a noise reduction method, apparatus, device, and storage medium based on virtual machine identification, aiming to solve the technical problem of how to perform data noise reduction on captured suspected test machine samples in order to eliminate noisy samples.

[0007] To achieve the above objectives, the present invention provides a noise reduction method based on virtual machine identification, the method comprising the following steps:

[0008] Obtain the terminal hardware identification information, terminal environment information, and file path corresponding to each suspected test machine sample in the suspected test machine sample set;

[0009] Virtual machine identification is performed based on the terminal hardware identification information, the terminal environment information, and the file path to obtain the virtual machine identification result;

[0010] The suspected test machine sample set is subjected to noise reduction processing based on the virtual machine identification results.

[0011] Optionally, the step of identifying the virtual machine based on the terminal hardware identification information, the terminal environment information, and the file path to obtain the virtual machine identification result includes:

[0012] Virtual machine identification is performed based on the terminal hardware identification information to obtain hardware identification results;

[0013] Based on the terminal environment information, virtual machine identification is performed to obtain the terminal environment identification result;

[0014] The virtual machine is identified based on the file path to obtain the file path identification result;

[0015] The virtual machine identification result is determined based on the hardware identifier identification result, the terminal environment identification result, and the file path identification result.

[0016] Optionally, the step of performing virtual machine identification based on the terminal hardware identification information to obtain the hardware identification result includes:

[0017] The corresponding hardware manufacturer information is determined based on the terminal hardware identification information;

[0018] The hardware identification result is determined based on the hardware manufacturer information.

[0019] Optionally, the step of determining the hardware identifier recognition result based on the hardware manufacturer information includes:

[0020] Business operation information is obtained based on the hardware manufacturer information, and the manufacturer type of the hardware manufacturer is determined based on the business operation information;

[0021] When the vendor type is a virtual machine vendor, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain the hardware identification result;

[0022] When the manufacturer type is a router manufacturer or an unknown manufacturer, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user in order to obtain the hardware identification result.

[0023] Optionally, the step of performing virtual machine identification based on the terminal environment information to obtain the terminal environment identification result includes:

[0024] Obtain the terminal process and terminal hardware information from the terminal environment information;

[0025] Virtual machine identification is performed based on the terminal process to obtain the process identification result;

[0026] Virtual machine identification is performed based on the terminal hardware information to obtain hardware identification results;

[0027] The terminal environment identification result is determined based on the process identification result and the hardware identification result.

[0028] Optionally, the step of performing virtual machine identification based on the terminal hardware information to obtain hardware identification results includes:

[0029] Obtain the terminal hardware model information and terminal hardware performance information from the terminal hardware information;

[0030] Determine the standard hardware performance information of the corresponding terminal hardware based on the terminal hardware model information;

[0031] The hardware identification result is determined based on the terminal hardware performance information and the standard hardware performance information.

[0032] Optionally, the step of determining the hardware identification result based on the terminal hardware performance information and the standard hardware performance information includes:

[0033] The terminal hardware performance score is determined based on the terminal hardware performance information, and the standard hardware performance score is determined based on the standard hardware performance information.

[0034] When the difference between the terminal hardware performance score and the standard hardware performance score is greater than a preset threshold, the user corresponding to the suspected test machine sample is determined to be a virtual machine user in order to obtain the hardware identification result.

[0035] When the difference between the terminal hardware performance score and the standard hardware performance score is less than or equal to a preset threshold, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user, so as to obtain the hardware identification result.

[0036] Optionally, the step of performing virtual machine identification based on the terminal process to obtain the process identification result includes:

[0037] When the terminal process contains virtual machine characteristic processes, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain the process identification result;

[0038] When no virtual machine characteristic process exists in the terminal process, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user to obtain the process identification result.

[0039] Optionally, the step of performing virtual machine identification based on the file path to obtain the file path identification result includes:

[0040] The file path is matched with the virtual machine feature path to obtain the path matching result;

[0041] When a virtual machine characteristic path exists in the file path, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain the file path identification result;

[0042] If no virtual machine characteristic path exists in the file path, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user to obtain the file path identification result.

[0043] Optionally, before the step of obtaining the terminal hardware identification information, terminal environment information, and file path corresponding to each suspected test machine sample in the suspected test machine sample set, the method further includes:

[0044] Obtain the virtual machine file path for each virtual machine sample in the virtual machine sample set;

[0045] Extract the characteristic paths from the virtual machine file paths, and construct the virtual machine characteristic paths based on the characteristic paths.

[0046] Optionally, the step of determining the virtual machine identification result based on the hardware identifier identification result, the terminal environment identification result, and the file path identification result includes:

[0047] If any of the hardware identifier identification results, terminal environment identification results, and file path identification results indicate that the user corresponding to the suspected test machine sample is a virtual machine user, then the virtual machine identification result is determined to be the user corresponding to the suspected test machine sample as a virtual machine user.

[0048] Optionally, the step of performing noise reduction processing on the suspected test machine sample set based on the virtual machine identification result includes:

[0049] The suspected test machine samples in the suspected test machine sample set whose users are not virtual machine users are marked as noise samples;

[0050] Remove the suspected test machine samples marked as noise samples from the suspected test machine sample set.

[0051] Furthermore, to achieve the above objectives, the present invention also proposes a noise reduction device based on virtual machine identification, the device comprising:

[0052] The information acquisition module is used to acquire the terminal hardware identification information, terminal environment information and file path corresponding to each suspected test machine sample in the suspected test machine sample set;

[0053] The virtual machine identification module is used to identify the virtual machine based on the terminal hardware identification information, the terminal environment information and the file path, and obtain the virtual machine identification result.

[0054] The data noise reduction module is used to perform noise reduction processing on the suspected test machine sample set based on the virtual machine identification results.

[0055] Optionally, the virtual machine identification module is further configured to perform virtual machine identification based on the terminal hardware identification information to obtain a hardware identification result; perform virtual machine identification based on the terminal environment information to obtain a terminal environment identification result; perform virtual machine identification based on the file path to obtain a file path identification result; and determine a virtual machine identification result based on the hardware identification result, the terminal environment identification result, and the file path identification result.

[0056] Optionally, the virtual machine identification module is further configured to determine the corresponding hardware manufacturer information based on the terminal hardware identification information; and to determine the hardware identification result based on the hardware manufacturer information.

[0057] Optionally, the virtual machine identification module is further configured to acquire terminal process and terminal hardware information from the terminal environment information; perform virtual machine identification based on the terminal process to obtain process identification results; perform virtual machine identification based on the terminal hardware information to obtain hardware identification results; and determine terminal environment identification results based on the process identification results and the hardware identification results.

[0058] Optionally, the virtual machine identification module is further configured to match the file path with the virtual machine feature path to obtain a path matching result; when the virtual machine feature path exists in the file path, the user corresponding to the suspected test machine sample is determined to be a virtual machine user to obtain a file path identification result; when the virtual machine feature path does not exist in the file path, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user to obtain a file path identification result.

[0059] Optionally, the information acquisition module is further configured to acquire the virtual machine file paths of each virtual machine sample in the virtual machine sample set; extract the feature paths in the virtual machine file paths; and construct virtual machine feature paths based on the feature paths.

[0060] Furthermore, to achieve the above objectives, the present invention also proposes a noise reduction device based on virtual machine identification, the noise reduction device based on virtual machine identification comprising: a memory, a processor, and a noise reduction program based on virtual machine identification stored in the memory and executable on the processor, wherein when the noise reduction program based on virtual machine identification is executed by the processor, it implements the steps of the noise reduction method based on virtual machine identification as described in any of the above claims.

[0061] Furthermore, to achieve the above objectives, the present invention also proposes a computer-readable storage medium storing a noise reduction program based on virtual machine identification, wherein the noise reduction program based on virtual machine identification, when executed, implements the steps of the noise reduction method based on virtual machine identification as described in any of the preceding claims.

[0062] This invention acquires the terminal hardware identification information, terminal environment information, and file path corresponding to each suspected test machine sample in a suspected test machine sample set; performs virtual machine identification based on the terminal hardware identification information, terminal environment information, and file path to obtain virtual machine identification results; and performs noise reduction processing on the suspected test machine sample set based on the virtual machine identification results. Because virtual machine identification is performed based on multiple dimensions such as terminal hardware identification information, terminal environment information, and file path, virtual machines can be accurately identified and virtual machine identification results can be obtained. Then, noise reduction processing is performed on the suspected test machine sample set based on the virtual machine identification results to remove samples with low probability of being test machine samples, thereby reducing the consumption of computing resources, improving the sample analysis speed, and reducing the sample analysis difficulty. Attached Figure Description

[0063] Figure 1 This is a schematic diagram of the structure of an electronic device in the hardware operating environment involved in the embodiments of the present invention;

[0064] Figure 2 This is a flowchart illustrating the first embodiment of the noise reduction method based on virtual machine recognition according to the present invention;

[0065] Figure 3 This is a flowchart illustrating the second embodiment of the noise reduction method based on virtual machine recognition of the present invention;

[0066] Figure 4 This is a flowchart illustrating the third embodiment of the noise reduction method based on virtual machine recognition of the present invention;

[0067] Figure 5 This is a structural block diagram of the first embodiment of the noise reduction device based on virtual machine recognition of the present invention.

[0068] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0069] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0070] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a noise reduction device based on virtual machine identification in the hardware operating environment involved in the embodiments of the present invention.

[0071] like Figure 1 As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0072] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0073] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a network communication module, a user interface module, and a noise reduction program based on virtual machine recognition.

[0074] exist Figure 1 In the electronic device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and memory 1005 in the electronic device of the present invention can be set in the noise reduction device based on virtual machine recognition. The electronic device calls the noise reduction program based on virtual machine recognition stored in the memory 1005 through the processor 1001 and executes the noise reduction method based on virtual machine recognition provided in the embodiment of the present invention.

[0075] This invention provides a noise reduction method based on virtual machine identification, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of a noise reduction method based on virtual machine recognition according to the present invention.

[0076] In this embodiment, the noise reduction method based on virtual machine identification includes the following steps:

[0077] Step S10: Obtain the terminal hardware identification information, terminal environment information, and file path corresponding to each suspected test machine sample in the suspected test machine sample set;

[0078] It should be noted that the execution subject of this embodiment can be the noise reduction device based on virtual machine recognition. The noise reduction device based on virtual machine recognition can be a personal computer, server, cloud server or other electronic device, or other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment and the following embodiments, the noise reduction device based on virtual machine recognition is used as an example to illustrate the noise reduction method based on virtual machine recognition of the present invention.

[0079] It should be noted that users who install and use secure endpoint products on their terminals are called endpoint users, while users who install and use secure endpoint products on their terminals for testing and adversarial purposes are called test machine users, or simply test machines. Suspected test machine samples are data samples collected from the terminals of endpoint users suspected of engaging in adversarial testing behavior. A suspected test machine sample set is a collection of samples constructed by combining multiple suspected test machine samples. Terminal hardware identification information can be the Media Access Control Address (MAC address) or other unique hardware identifiers. Terminal environment information can include graphics card information, memory information, processor CPU information, etc., and the file path is the path to the terminal's stored files.

[0080] Step S20: Perform virtual machine identification based on the terminal hardware identification information, the terminal environment information, and the file path to obtain the virtual machine identification result;

[0081] It should be noted that users who install and use secure endpoint products in a virtual machine environment are considered virtual machine users, while users who install and use secure endpoint products in a non-virtual machine environment are considered non-virtual machine users. Virtual machine identification results include: users corresponding to suspected test machine samples are considered test machine users, and users corresponding to suspected test machine samples are considered non-test machine users. During the testing and confrontation between advanced threat actors and secure endpoint products, advanced threat actors will install secure endpoint products and test their malicious tools' ability to counter these products. Since the vast majority of advanced threat actors install secure endpoint products in virtual environments, i.e., virtual machines, analysis of endpoint hardware identification information, endpoint environment information, and file paths can identify whether the secure endpoint product corresponding to a suspected test machine sample is installed in a virtual machine. This allows us to determine whether the user corresponding to the suspected test machine sample is a virtual machine user, thus obtaining the virtual machine identification result.

[0082] Step S30: Perform noise reduction processing on the suspected test machine sample set based on the virtual machine identification results.

[0083] It should be noted that since most advanced threat actors install security endpoints in virtual machines, if the security endpoint corresponding to a suspected test machine sample is not installed in a virtual machine, that is, the user corresponding to the suspected test machine sample is a non-virtual machine user, then the probability that the user corresponding to the suspected test machine sample is a test machine user is low. Therefore, noise reduction processing can be performed on the suspected test machine sample set based on the virtual machine identification results to remove suspected test machine samples that are less likely to be test machines.

[0084] Furthermore, to improve the noise reduction processing speed, the step of performing noise reduction processing on the suspected test machine sample set based on the virtual machine identification result in this embodiment can be as follows:

[0085] Suspected test machine samples whose users are not virtual machine users are marked as noise samples in the suspected test machine sample set; suspected test machine samples marked as noise samples are removed from the suspected test machine sample set.

[0086] It should be noted that processing collections generally involves traversal. However, directly modifying the collection data during traversal can lead to issues such as collection index anomalies, resulting in missed or accidental deletions. Furthermore, excessive operations during traversal significantly reduce processing efficiency. Therefore, it is advisable to first mark each suspected test machine sample in the suspected test machine sample set using the virtual machine identification results, designating the samples that need to be removed as noise samples. Then, after traversal is complete, all suspected test machine samples marked as noise samples in the suspected test machine sample set can be removed uniformly, which can improve processing speed.

[0087] This embodiment acquires the terminal hardware identification information, terminal environment information, and file path corresponding to each suspected test machine sample in the suspected test machine sample set; performs virtual machine identification based on the terminal hardware identification information, terminal environment information, and file path to obtain virtual machine identification results; and performs noise reduction processing on the suspected test machine sample set based on the virtual machine identification results. Since virtual machine identification is performed based on multiple dimensions such as terminal hardware identification information, terminal environment information, and file path, virtual machines can be accurately identified and virtual machine identification results can be obtained. Then, noise reduction processing is performed on the suspected test machine sample set based on the virtual machine identification results to remove samples with low probability of being test machine samples, thereby reducing the consumption of computing resources, improving the sample analysis speed, and reducing the sample analysis difficulty.

[0088] refer to Figure 3 , Figure 3 This is a flowchart illustrating a second embodiment of a noise reduction method based on virtual machine identification according to the present invention.

[0089] Based on the first embodiment described above, step S20 of the noise reduction method based on virtual machine recognition in this embodiment specifically includes:

[0090] Step S201: Perform virtual machine identification based on the terminal hardware identification information to obtain hardware identification results;

[0091] It should be noted that the hardware identification results include: the user corresponding to the suspected test machine sample is a virtual machine user, and the user corresponding to the suspected test machine sample is a non-virtual machine user. Relevant information can be queried through the terminal hardware identification information, and the retrieved information can be analyzed to determine whether the user corresponding to the suspected test machine sample is a virtual machine user.

[0092] Furthermore, in order to identify whether the user corresponding to the suspected test machine sample is a virtual machine user based on the terminal hardware identification information, this embodiment performs virtual machine identification based on the terminal hardware identification information to obtain the hardware identification result. The step can be as follows:

[0093] The corresponding hardware manufacturer information is determined based on the terminal hardware identification information; the hardware identification result is determined based on the hardware manufacturer information.

[0094] It should be noted that by querying the terminal hardware identification information, the hardware manufacturer that produces the hardware can be obtained. By analyzing the hardware manufacturer information, it is possible to determine whether the user corresponding to the suspected test machine sample is a virtual machine user, thus obtaining the hardware identification result.

[0095] Furthermore, in order to determine whether the user corresponding to the suspected test machine sample is a virtual machine user based on the hardware manufacturer information, the step of determining the hardware identifier recognition result based on the hardware manufacturer information in this embodiment can be as follows:

[0096] Business information is obtained based on hardware manufacturer information, and the manufacturer type of the hardware manufacturer is determined based on the business information. When the manufacturer type is a virtual machine manufacturer, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain the hardware identification result. When the manufacturer type is a router manufacturer or an unknown manufacturer, the user corresponding to the suspected test machine sample is identified as a non-virtual machine user to obtain the hardware identification result.

[0097] It should be noted that hardware manufacturer information may include details such as the manufacturer's business scope, main products sold, and business operations. Therefore, business operations information can be obtained from the hardware manufacturer information. Based on the different business operations of the hardware manufacturer, such as whether they provide virtual machine products or routing equipment, the hardware manufacturer can be classified into virtual machine manufacturers, routing manufacturers, and unknown manufacturers. Based on the different manufacturer types obtained, it can be determined whether the user corresponding to the suspected test machine sample is a virtual machine user, thus obtaining the hardware identification result.

[0098] Step S202: Perform virtual machine identification based on the terminal environment information to obtain the terminal environment identification result;

[0099] It should be noted that the terminal environment identification results include: users corresponding to suspected test machine samples who are virtual machine users and users corresponding to suspected test machine samples who are non-virtual machine users. Terminal environment information may include: terminal processes and terminal hardware information.

[0100] Furthermore, in order to determine whether the user corresponding to the suspected test machine sample is a virtual machine user by analyzing the terminal environment information, this embodiment performs virtual machine identification based on the terminal environment information to obtain the terminal environment identification result. The step can be as follows:

[0101] The system retrieves terminal process and hardware information from the terminal environment information; performs virtual machine identification based on the terminal process to obtain process identification results; performs virtual machine identification based on the terminal hardware information to obtain hardware identification results; and determines the terminal environment identification result based on the process identification results and hardware identification results.

[0102] It should be noted that both process identification results and hardware identification results include: users corresponding to suspected test machine samples are virtual machine users and users corresponding to suspected test machine samples are non-virtual machine users.

[0103] In practical use, the terminal environment identification result can be obtained by fusing the process identification result and the hardware identification result. For example, if either the process identification result or the hardware identification result indicates that the user corresponding to the suspected test machine sample is a virtual machine user, then the terminal environment identification result indicates that the user corresponding to the suspected test machine sample is a virtual machine user.

[0104] The terminal environment identification result can also be obtained by acquiring process identification results and hardware identification results sequentially. If either identification result first determines that the user corresponding to the suspected test machine sample is a virtual machine user, then the terminal environment identification result is determined to be the user corresponding to the suspected test machine sample as a virtual machine user, and the other identification result is no longer acquired. For example, if the process identification result is acquired first and the process identification result indicates that the user corresponding to the suspected test machine sample is a virtual machine user, then the terminal environment identification result is determined to be the user corresponding to the suspected test machine sample as a virtual machine user, and the hardware identification result is no longer acquired.

[0105] Furthermore, in order to analyze the terminal process and obtain the process identification result, this embodiment performs virtual machine identification based on the terminal process to obtain the process identification result. The steps can be as follows:

[0106] When a virtual machine-characteristic process exists in the terminal process, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain the process identification result; when no virtual machine-characteristic process exists in the terminal process, the user corresponding to the suspected test machine sample is identified as a non-virtual machine user to obtain the process identification result.

[0107] It should be noted that virtual machine characteristic processes are system processes unique to virtual machines. They can be extracted by analyzing various types of virtual machine system processes, such as vmtoolsd.exe and vmacthlp.exe. Therefore, when a virtual machine characteristic process exists in the terminal process, the user corresponding to the suspected test machine sample can be determined to be a virtual machine user, thus obtaining the process identification result. Conversely, when a virtual machine characteristic process does not exist in the terminal process, the user corresponding to the suspected test machine sample can be determined to be a non-virtual machine user, thus obtaining the process identification result.

[0108] Furthermore, in order to obtain hardware identification results based on terminal hardware information, this embodiment performs virtual machine identification based on the terminal hardware information to obtain hardware identification results. The step can be as follows:

[0109] Obtain the terminal hardware model information and terminal hardware performance information from the terminal hardware information; determine the standard hardware performance information of the corresponding terminal hardware based on the terminal hardware model information; determine the hardware identification result based on the terminal hardware performance information and the standard hardware performance information.

[0110] It should be noted that terminal hardware information may include hardware information such as terminal graphics card information and terminal processor CPU information. Terminal hardware model information may include hardware production time information, hardware manufacturer information, and hardware model information. Terminal hardware performance information may include memory size information, core count information, and computing speed information, depending on the terminal hardware. Standard hardware performance information may be industry-standard hardware performance information for hardware production, and may include standard memory size information, standard core count information, and standard computing speed information, depending on the hardware.

[0111] It should be noted that when a virtual machine runs on a physical machine, it can generally only use part of the physical machine's performance. Therefore, it is possible to obtain the terminal hardware model information and terminal hardware performance information, query the corresponding standard hardware performance information through the terminal hardware model information, and analyze and compare the standard hardware performance information and the terminal hardware performance information to obtain the analysis and comparison results. Based on the analysis and comparison results, it is possible to determine whether the user corresponding to the suspected test machine sample is a virtual machine user, so as to obtain the terminal environment identification result.

[0112] Furthermore, in order to determine the hardware identification result based on the terminal hardware performance information and the standard hardware performance information, the step of determining the hardware identification result based on the terminal hardware performance information and the standard hardware performance information in this embodiment can be:

[0113] The terminal hardware performance score is determined based on the terminal hardware performance information, and the standard hardware performance score is determined based on the standard hardware performance information. When the difference between the terminal hardware performance score and the standard hardware performance score is greater than a preset threshold, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain the hardware identification result. When the difference between the terminal hardware performance score and the standard hardware performance score is less than or equal to the preset threshold, the user corresponding to the suspected test machine sample is identified as a non-virtual machine user to obtain the hardware identification result.

[0114] It should be noted that due to various factors during the production process, the final hardware performance information of the terminal hardware will have a certain error compared with the actual standard hardware performance information. Therefore, the corresponding terminal hardware performance score can be determined based on the terminal hardware performance information, and the standard hardware performance score can be determined based on the standard hardware performance information. A preset threshold is set, and the performance score difference between the terminal hardware performance score and the standard hardware performance score is calculated. The performance score difference is compared with the preset threshold, and the comparison result is used to determine whether the user corresponding to the suspected test machine sample is a virtual machine user, so as to obtain the hardware identification result.

[0115] For example: Obtain the hardware performance information of the terminal CPU and the standard hardware performance information corresponding to the terminal CPU model. Calculate the terminal hardware performance score as 80 and the standard hardware performance score as 110 based on the number of CPU cores and frequency. The preset threshold is 10. Then, 110-80=30>10. This allows us to determine the user corresponding to the suspected test machine sample as a virtual machine user, thus obtaining the hardware identification result.

[0116] Step S203: Perform virtual machine identification based on the file path to obtain the file path identification result;

[0117] It should be noted that the file path identification results include: the user corresponding to the suspected test machine sample is a virtual machine user, and the user corresponding to the suspected test machine sample is a non-virtual machine user. The file paths of a virtual machine during runtime will differ somewhat from those of an actual physical machine. Some virtual machine characteristic paths are unique to virtual machines. Therefore, by analyzing the file paths, it is possible to determine whether the user corresponding to the suspected test machine sample is a virtual machine user, thus obtaining the file path identification results.

[0118] Furthermore, in order to determine whether the user corresponding to the suspected test machine sample is a virtual machine user based on the file path, this embodiment performs virtual machine identification based on the file path to obtain the file path identification result. The step can be as follows:

[0119] The file path is matched with the virtual machine feature path to obtain the path matching result. When the virtual machine feature path exists in the file path, the user corresponding to the suspected test machine sample is determined to be a virtual machine user to obtain the file path identification result. When the virtual machine feature path does not exist in the file path, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user to obtain the file path identification result.

[0120] It should be noted that the matching of file path and virtual machine feature path is a fuzzy matching. That is, when the file path contains virtual machine feature path (such as \VMware\, \VirtualBox\, etc.), the user corresponding to the suspected test machine sample can be identified as a virtual machine user, so as to obtain the file path identification result.

[0121] For example, if the file paths are AAA, BBB, and CAA, and the virtual machine characteristic paths are C and D, and the file path CAA contains the virtual machine characteristic path C, then the user corresponding to the suspected test machine sample can be identified as a virtual machine user to obtain the file path identification result.

[0122] Step S204: Determine the virtual machine identification result based on the hardware identifier identification result, the terminal environment identification result, and the file path identification result.

[0123] It should be noted that the virtual machine identification results include: users corresponding to suspected test machine samples who are virtual machine users and users corresponding to suspected test machine samples who are non-virtual machine users. The virtual machine identification results are obtained by combining hardware identifier identification results, terminal environment identification results, and file path identification results.

[0124] It should be noted that the hardware identification results, terminal environment identification results, and file path identification results can be obtained simultaneously and then fused after all three identification results are obtained, or an execution sequence can be generated and executed sequentially. The process can stop and confirm that the user corresponding to the suspected test machine sample is a virtual machine user when any identification result indicates that the user corresponding to the suspected test machine sample is a virtual machine user.

[0125] Furthermore, to illustrate how to fuse the hardware identifier recognition result, terminal environment recognition result, and file path recognition result after they have all been obtained, this embodiment describes the following steps for determining the virtual machine recognition result based on the hardware identifier recognition result, the terminal environment recognition result, and the file path recognition result:

[0126] If any of the hardware identification results, terminal environment identification results, or file path identification results indicate that the user corresponding to the suspected test machine sample is a virtual machine user, then the virtual machine identification result is determined to be the user corresponding to the suspected test machine sample.

[0127] It should be noted that if the identification results of the hardware identifier, terminal environment, and file path indicate that the user corresponding to the suspected test machine sample is a virtual machine user, it means that the virtual machine identification has been successful. Therefore, it can be directly determined that the user corresponding to the suspected test machine sample is a virtual machine user.

[0128] This embodiment identifies a virtual machine based on the terminal hardware identification information to obtain a hardware identification result; identifies a virtual machine based on the terminal environment information to obtain a terminal environment identification result; identifies a virtual machine based on the file path to obtain a file path identification result; and determines a virtual machine identification result based on the hardware identification result, the terminal environment identification result, and the file path identification result. By performing virtual machine identification from multiple dimensions—terminal hardware identification information, terminal environment information, and file path—and then fusing these results to determine the final virtual machine identification result, virtual machine identification can be performed quickly and accurately to obtain the virtual machine identification result.

[0129] refer to Figure 4 , Figure 4 This is a flowchart illustrating a third embodiment of a noise reduction method based on virtual machine identification according to the present invention.

[0130] Based on the second embodiment described above, before step S10 of the noise reduction method based on virtual machine recognition in this embodiment, the method further includes:

[0131] Step S01: Obtain the virtual machine file path of each virtual machine sample in the virtual machine sample set;

[0132] It should be noted that virtual machine samples are data samples collected from the terminals of users who have been identified as virtual machine users. The virtual machine sample set is a collection of samples composed of multiple virtual machine samples, and the virtual machine file path is the file path obtained from the virtual machine samples.

[0133] Step S02: Extract the feature paths from the virtual machine file paths, and construct the virtual machine feature paths based on the feature paths.

[0134] It should be noted that the feature path is a file path unique to the virtual machine, that is, a file path that does not exist in the terminal of an ordinary user. The virtual machine feature path can be obtained by extracting the feature paths of each virtual machine sample in the virtual machine sample set and then performing cluster analysis on the feature paths.

[0135] This embodiment analyzes the virtual machine file paths of each virtual machine sample in the virtual machine sample set, extracts the feature paths in the virtual machine file paths, and constructs virtual machine feature paths based on the analysis of the feature paths. This makes the identification of virtual machines based on file paths more accurate and comprehensive, and improves the reliability of identifying virtual machines by file paths.

[0136] Furthermore, this embodiment of the invention also proposes a storage medium storing a noise reduction program based on virtual machine recognition. When the noise reduction program based on virtual machine recognition is executed by a processor, it implements the steps of the noise reduction method based on virtual machine recognition as described above.

[0137] Reference Figure 5 , Figure 5 This is a structural block diagram of the first embodiment of the noise reduction device based on virtual machine recognition of the present invention.

[0138] like Figure 5 As shown, the noise reduction device based on virtual machine identification proposed in this embodiment of the invention includes:

[0139] The information acquisition module 501 is used to acquire the terminal hardware identification information, terminal environment information and file path corresponding to each suspected test machine sample in the suspected test machine sample set.

[0140] The virtual machine identification module 502 is used to identify the virtual machine based on the terminal hardware identification information, the terminal environment information and the file path, and obtain the virtual machine identification result.

[0141] The data noise reduction module 503 is used to perform noise reduction processing on the suspected test machine sample set based on the virtual machine identification result.

[0142] This embodiment acquires the terminal hardware identification information, terminal environment information, and file path corresponding to each suspected test machine sample in the suspected test machine sample set; performs virtual machine identification based on the terminal hardware identification information, terminal environment information, and file path to obtain virtual machine identification results; and performs noise reduction processing on the suspected test machine sample set based on the virtual machine identification results. Since virtual machine identification is performed based on multiple dimensions such as terminal hardware identification information, terminal environment information, and file path, virtual machines can be accurately identified and virtual machine identification results can be obtained. Then, noise reduction processing is performed on the suspected test machine sample set based on the virtual machine identification results to remove samples with low probability of being test machine samples, thereby reducing the consumption of computing resources, improving the sample analysis speed, and reducing the sample analysis difficulty.

[0143] Furthermore, the virtual machine identification module 502 is also used to perform virtual machine identification based on the terminal hardware identification information to obtain a hardware identification result; perform virtual machine identification based on the terminal environment information to obtain a terminal environment identification result; perform virtual machine identification based on the file path to obtain a file path identification result; and determine the virtual machine identification result based on the hardware identification result, the terminal environment identification result, and the file path identification result.

[0144] Furthermore, the virtual machine identification module 502 is also used to determine the corresponding hardware manufacturer information based on the terminal hardware identification information; and to determine the hardware identification result based on the hardware manufacturer information.

[0145] Furthermore, the virtual machine identification module 502 is also used to obtain business information based on the hardware manufacturer information, and determine the manufacturer type of the hardware manufacturer based on the business information; when the manufacturer type is a virtual machine manufacturer, the user corresponding to the suspected test machine sample is determined to be a virtual machine user, so as to obtain a hardware identification result; when the manufacturer type is a router manufacturer or an unknown manufacturer, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user, so as to obtain a hardware identification result.

[0146] Furthermore, the virtual machine identification module 502 is also used to obtain terminal process and terminal hardware information in the terminal environment information; perform virtual machine identification based on the terminal process to obtain process identification results; perform virtual machine identification based on the terminal hardware information to obtain hardware identification results; and determine terminal environment identification results based on the process identification results and the hardware identification results.

[0147] Furthermore, the virtual machine identification module 502 is also used to obtain the terminal hardware model information and terminal hardware performance information in the terminal hardware information; determine the standard hardware performance information of the corresponding terminal hardware based on the terminal hardware model information; and determine the hardware identification result based on the terminal hardware performance information and the standard hardware performance information.

[0148] Furthermore, the virtual machine identification module 502 is also used to determine a terminal hardware performance score based on the terminal hardware performance information, and to determine a standard hardware performance score based on the standard hardware performance information; when the difference between the terminal hardware performance score and the standard hardware performance score is greater than a preset threshold, the user corresponding to the suspected test machine sample is identified as a virtual machine user to obtain a hardware identification result; when the difference between the terminal hardware performance score and the standard hardware performance score is less than or equal to the preset threshold, the user corresponding to the suspected test machine sample is identified as a non-virtual machine user to obtain a hardware identification result.

[0149] Furthermore, the virtual machine identification module 502 is also used to determine the user corresponding to the suspected test machine sample as a virtual machine user when the terminal process has a virtual machine characteristic process, so as to obtain a process identification result; and to determine the user corresponding to the suspected test machine sample as a non-virtual machine user when the terminal process does not have a virtual machine characteristic process, so as to obtain a process identification result.

[0150] Furthermore, the virtual machine identification module 502 is also used to match the file path with the virtual machine feature path to obtain a path matching result; when the virtual machine feature path exists in the file path, the user corresponding to the suspected test machine sample is determined to be a virtual machine user to obtain a file path identification result; when the virtual machine feature path does not exist in the file path, the user corresponding to the suspected test machine sample is determined to be a non-virtual machine user to obtain a file path identification result.

[0151] Furthermore, the information acquisition module 501 is also used to acquire the virtual machine file paths of each virtual machine sample in the virtual machine sample set; extract the feature paths in the virtual machine file paths; and construct virtual machine feature paths based on the feature paths.

[0152] Furthermore, the virtual machine identification module 502 is also used to determine that the user corresponding to the suspected test machine sample is a virtual machine user when there is an identification result that indicates the user is a virtual machine user among the hardware identification result, the terminal environment identification result, and the file path identification result.

[0153] Furthermore, the data noise reduction module 503 is also used to mark suspected test machine samples whose users are not virtual machine users in the suspected test machine sample set as noise samples; and to remove the suspected test machine samples marked as noise samples in the suspected test machine sample set.

[0154] It should be understood that the above are merely illustrative examples and do not constitute any limitation on the technical solutions of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any restrictions on this.

[0155] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0156] In addition, for technical details not described in detail in this embodiment, please refer to the noise reduction method based on virtual machine identification provided in any embodiment of the present invention, which will not be repeated here.

[0157] Furthermore, it should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0158] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0159] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0160] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for noise reduction based on virtual machine identification, the method comprising: The virtual machine identification-based noise reduction method comprises the following steps: Obtain terminal hardware identification information, terminal environment information and file paths corresponding to each suspected test machine sample in a suspected test machine sample set; Perform virtual machine identification according to the terminal hardware identification information, the terminal environment information and the file paths to obtain a virtual machine identification result; Perform noise reduction processing on the suspected test machine sample set according to the virtual machine identification result.

2. The method of claim 1, wherein, The step of performing virtual machine identification according to the terminal hardware identification information to obtain a hardware identification result comprises the following steps: Determine corresponding hardware manufacturer information according to the terminal hardware identification information; Determine a hardware identification result according to the hardware manufacturer information. The step of determining a hardware identification result according to the hardware manufacturer information comprises the following steps: Obtain business information according to the hardware manufacturer information, and determine a manufacturer type of the hardware manufacturer according to the business information; 3. The method of claim 2, wherein, When the manufacturer type is a virtual machine manufacturer, determine that a user corresponding to the suspected test machine sample is a virtual machine user to obtain the hardware identification result; When the manufacturer type is a routing manufacturer or an unknown manufacturer, determine that the user corresponding to the suspected test machine sample is a non-virtual machine user to obtain the hardware identification result. The step of performing virtual machine identification according to the terminal environment information to obtain a terminal environment identification result comprises the following steps:

4. The method of claim 3, wherein, Obtain terminal process and terminal hardware information in the terminal environment information; Perform virtual machine identification according to the terminal process to obtain a process identification result; Perform virtual machine identification according to the terminal hardware information to obtain a hardware identification result; Determine a terminal environment identification result according to the process identification result and the hardware identification result.

5. The method of claim 2, wherein, The step of performing virtual machine identification according to the terminal hardware information to obtain a hardware identification result comprises the following steps: Obtain terminal hardware model information and terminal hardware performance information in the terminal hardware information; Determine standard hardware performance information of terminal hardware corresponding to the terminal hardware model information; Determine a hardware identification result according to the terminal hardware performance information and the standard hardware performance information. The step of determining a hardware identification result according to the terminal hardware performance information and the standard hardware performance information comprises the following steps:

6. The method of claim 5, wherein, Determine a terminal hardware performance score according to the terminal hardware performance information, and determine a standard hardware performance score according to the standard hardware performance information; Determine a hardware identification result according to the terminal hardware performance score and the standard hardware performance score. ​ ​ 7. The method of claim 6, wherein, ​ ​ When the performance score difference between the terminal hardware performance score and the standard hardware performance score is greater than a preset threshold, the user corresponding to the suspected test machine sample is determined as a virtual machine user to obtain a hardware recognition result; When the performance score difference between the terminal hardware performance score and the standard hardware performance score is less than or equal to a preset threshold, the user corresponding to the suspected test machine sample is determined as a non-virtual machine user to obtain a hardware recognition result.

8. The method of claim 5, wherein, The step of performing virtual machine identification according to the terminal process to obtain a process recognition result comprises: When the terminal process has a virtual machine characteristic process, the user corresponding to the suspected test machine sample is determined as a virtual machine user to obtain a process recognition result; When the terminal process does not have a virtual machine characteristic process, the user corresponding to the suspected test machine sample is determined as a non-virtual machine user to obtain a process recognition result.

9. The method of claim 2, wherein, The step of performing virtual machine identification according to the file path to obtain a file path recognition result comprises: matching the file path with a virtual machine characteristic path to obtain a path matching result; When the file path has a virtual machine characteristic path, the user corresponding to the suspected test machine sample is determined as a virtual machine user to obtain a file path recognition result; When the file path does not have a virtual machine characteristic path, the user corresponding to the suspected test machine sample is determined as a non-virtual machine user to obtain a file path recognition result.

10. The method of claim 9, wherein, Before the step of obtaining terminal hardware identification information, terminal environment information and a file path corresponding to each suspected test machine sample in a suspected test machine sample set, the method further comprises: obtaining a virtual machine file path of each virtual machine sample in a virtual machine sample set; extracting a characteristic path in the virtual machine file path, and constructing a virtual machine characteristic path according to the characteristic path.

11. The method of claim 2, wherein, The step of determining a virtual machine recognition result according to the hardware identification result, the terminal environment recognition result and the file path recognition result comprises: When the hardware identification result, the terminal environment recognition result and the file path recognition result have a recognition result that the user corresponding to the suspected test machine sample is a virtual machine user, it is determined that the virtual machine recognition result is that the user corresponding to the suspected test machine sample is a virtual machine user.

12. The method of claim 1, wherein, The step of performing noise reduction processing on the suspected test machine sample set according to the virtual machine recognition result comprises: labeling suspected test machine samples corresponding to users that are non-virtual machine users in the suspected test machine sample set as noise samples; removing suspected test machine samples corresponding to users that are labeled as noise samples in the suspected test machine sample set.

13. A noise reduction device based on virtual machine recognition, characterized in that, The noise reduction device based on virtual machine identification comprises: an information acquisition module configured to obtain terminal hardware identification information, terminal environment information and a file path corresponding to each suspected test machine sample in a suspected test machine sample set; a virtual machine identification module configured to perform virtual machine identification according to the terminal hardware identification information, the terminal environment information and the file path to obtain a virtual machine recognition result; a data noise reduction module configured to perform noise reduction processing on the suspected test machine sample set according to the virtual machine recognition result.

14. The virtual machine identification based noise reduction apparatus of claim 13, wherein, The virtual machine identification module is further configured to identify a virtual machine according to the terminal hardware identification information, to obtain a hardware identification result; identify a virtual machine according to the terminal environment information, to obtain a terminal environment identification result; identify a virtual machine according to the file path, to obtain a file path identification result; and determine a virtual machine identification result according to the hardware identification result, the terminal environment identification result and the file path identification result.

15. The virtual machine identification based noise reduction apparatus of claim 14, wherein, The virtual machine identification module is further configured to determine corresponding hardware manufacturer information according to the terminal hardware identification information; and determine a hardware identification result according to the hardware manufacturer information.

16. The virtual machine identification based noise reduction apparatus of claim 14, wherein, The virtual machine identification module is further configured to obtain terminal processes and terminal hardware information in the terminal environment information; identify a virtual machine according to the terminal processes, to obtain a process identification result; identify a virtual machine according to the terminal hardware information, to obtain a hardware identification result; and determine a terminal environment identification result according to the process identification result and the hardware identification result.

17. The virtual machine identification based noise reduction apparatus of claim 14, wherein, The virtual machine identification module is further configured to match the file path with a virtual machine feature path, to obtain a path matching result; when the file path contains a virtual machine feature path, determine a user corresponding to the suspected test machine sample as a virtual machine user, to obtain a file path identification result; and when the file path does not contain a virtual machine feature path, determine the user corresponding to the suspected test machine sample as a non-virtual machine user, to obtain a file path identification result.

18. The virtual machine identification based noise reduction apparatus of claim 14, wherein, The information acquisition module is further configured to acquire virtual machine file paths of each virtual machine sample in a virtual machine sample set; extract a feature path in the virtual machine file path; and construct a virtual machine feature path according to the feature path.

19. A noise reduction device based on virtual machine identification, comprising: The virtual machine identification-based noise reduction device comprises a memory, a processor and a virtual machine identification-based noise reduction program stored in the memory and executable on the processor, and the virtual machine identification-based noise reduction program, when executed by the processor, implements the steps of the virtual machine identification-based noise reduction method according to any one of claims 1-12.

20. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a virtual machine identification-based noise reduction program, and the virtual machine identification-based noise reduction program, when executed, implements the steps of the virtual machine identification-based noise reduction method according to any one of claims 1-12.

Images