File identification method and device

Abstract

The present application provides a file identification method and device, relating to the field of security technology. The method comprises the following steps: performing file identification on a received file to be identified; when the file to be identified is a file of a set type, extracting a file header from the file to be identified; performing a hash calculation on the target information in the file header to obtain a local hash value; matching the local hash value with a virus hash feature library, wherein the virus hash feature library includes a characteristic hash value of a virus; and when a match is successful, confirming that the file to be identified is a virus file. Using the above method, the accuracy of virus detection results is improved without occupying a large amount of memory when performing virus detection on files passing through a network device.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a file identification method and device. Background Art

[0002] Deep Packet Inspection (DPI) is a security mechanism that detects and controls network traffic passing through network devices based on application-layer information. Amidst increasingly complex network security threats, many malicious activities (such as worms, spam, and vulnerabilities) are hidden within the application-layer payload of data packets. Traditional security protection technologies, which rely solely on network and transport-layer security detection, are no longer able to meet network security requirements. Therefore, network devices must have DPI capabilities to detect and control network application-layer information, thereby ensuring data security and improving network security.

[0003] Currently, antivirus detection primarily relies on pattern matching and full-text hashing to detect virus files transmitted over the network. Pattern matching uses static signature scanning technology to detect malicious files, but this method requires configuring a large number of signature rules, which results in a high memory usage and places higher demands on network devices. Furthermore, as the number of rules increases, the antivirus engine becomes larger, leading to cache misses and thus affecting device throughput. Full-text hashing, on the other hand, provides a strong guarantee for file integrity. If packets are out of order during file transmission, this can lead to errors in file hash calculations, affecting the accuracy of virus file detection results.

[0004] Therefore, how to improve the accuracy of virus detection results when performing virus identification on files passing through network devices without occupying a large amount of memory is one of the technical issues worth considering. Summary of the Invention

[0005] In view of this, the present application provides a file identification method and apparatus for improving the accuracy of virus detection results when performing virus detection on files passing through a network device without occupying a large amount of memory.

[0006] Specifically, this application is implemented through the following technical solutions:

[0007] According to a first aspect of the present application, a file identification method is provided, comprising:

[0008] Performing file identification on the received file to be identified;

[0009] When the file to be identified is a file of a set type, a file header is extracted from the file to be identified;

[0010] Performing hash calculation on the target information in the file header to obtain a local hash value;

[0011] Matching the local hash value with a virus hash feature library, wherein the virus hash feature library includes characteristic hash values ​​of viruses;

[0012] When the match is successful, it is confirmed that the file to be identified is a virus file.

[0013] Optionally, the file to be identified includes an executable file under the Windows operating system; the file header includes an image file header and an optional image header;

[0014] Performing a hash calculation on the target information in the file header to obtain a local hash value includes:

[0015] Performing hash calculation on the image file header to obtain an intermediate hash value;

[0016] extracting target optional image header information matching the machine type code from the optional image header according to the machine type code;

[0017] A hash calculation is performed based on the intermediate hash value and the target optional image header information to obtain the local hash value.

[0018] Optionally, the file identification method provided in this embodiment further includes:

[0019] When the match is unsuccessful, pattern string feature matching is performed on the file to be identified to identify whether the file to be identified is a virus file.

[0020] Optionally, the file identification method provided in this embodiment further includes:

[0021] When the local hash value fails to match the virus hash feature library, or when the file to be identified is not identified as a virus file when the pattern string feature matching is performed on the file to be identified, then when the file to be identified is a complete file, a full-text hash calculation is performed on the file to be identified to obtain a hash result, and whether the file to be identified is a virus file is identified based on the hash result.

[0022] Optionally, extracting a file header from the file to be identified includes:

[0023] The file to be identified is disassembled using a file parsing plug-in corresponding to the set type to extract a file header from the file to be identified.

[0024] According to a second aspect of the present application, there is provided a file identification device, comprising:

[0025] An identification module is used to identify the received file to be identified;

[0026] an extraction module, configured to extract a file header from the file to be identified when the file to be identified is a file of a set type;

[0027] A hash calculation module, configured to perform hash calculation on the target information in the file header to obtain a local hash value;

[0028] A first matching module, configured to match the local hash value with a virus hash feature library, wherein the virus hash feature library includes characteristic hash values ​​of viruses;

[0029] The confirmation module is configured to confirm that the file to be identified is a virus file when the matching result of the first matching module is a successful match.

[0030] Optionally, the file to be identified includes an executable file under the Windows operating system; the file header includes an image file header and an optional image header;

[0031] The hash calculation module is specifically configured to perform a hash calculation on the image file header to obtain an intermediate hash value; extract target optional image header information that matches the machine type code from the optional image header according to the machine type code; and perform a hash calculation based on the intermediate hash value and the target optional image header information to obtain the local hash value.

[0032] Optionally, the file identification device provided in this embodiment further includes:

[0033] The second matching module is configured to perform pattern string feature matching on the file to be identified to identify whether the file to be identified is a virus file when the matching result of the first matching module is unsuccessful.

[0034] Optionally, the file identification device provided in this embodiment further includes:

[0035] The third matching module is used to, when the matching result of the first matching module is unsuccessful matching, or the matching result of the second matching module is that the file to be identified is not identified as a virus file, and when the file to be identified is a complete file, perform a full-text hash calculation on the file to be identified to obtain a hash result, and identify whether the file to be identified is a virus file according to the hash result.

[0036] Optionally, the extraction module is specifically configured to utilize a file parsing plug-in corresponding to the set type to perform a disassembly process on the file to be identified, so as to extract a file header from the file to be identified.

[0037] According to the third aspect of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores a computer program that can be executed by the processor, and the processor is prompted by the computer program to execute the method provided in the first aspect of the embodiment of the present application.

[0038] According to the fourth aspect of the present application, a machine-readable storage medium is provided, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the method provided in the first aspect of the embodiment of the present application.

[0039] Beneficial effects of the embodiments of the present application:

[0040] In the file identification method and device provided by the embodiment of the present application, after performing file identification on the received file to be identified, when it is identified that the file to be identified is a file of a set type, the file header is extracted from the file to be identified; then the target information in the file header is hashed to obtain a local hash value; the local hash value is matched with the virus hash feature library; when the match is successful, the file to be identified is confirmed to be a virus file. This embodiment only needs to perform a local hash calculation on the file header of the file to be identified, and then the local hash result obtained based on the local hash calculation can be matched with the virus hash feature library to identify whether the file to be identified is a virus file. In this way, when performing virus detection on files passing through the network device, not only does it not need to occupy a large amount of memory, but it also improves the accuracy of the virus detection results. In addition, since it is not necessary to perform a hash calculation based on the entire file to be identified, the recognition speed of file identification is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flowchart of a file identification method provided by an embodiment of the present application;

[0042] Figure 2 This is a schematic diagram of the structure of a file recognition device provided in an embodiment of the present application;

[0043] Figure 3 This is a hardware structure diagram of an electronic device for implementing a file recognition method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] Exemplary embodiments are described in detail herein, with examples illustrated in the accompanying drawings. When the following description refers to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatuses and methods consistent with certain aspects of the present application.

[0045] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms "a," "the," and "the" used in this application are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the corresponding listed items.

[0046] It should be understood that although the terms first, second, third, etc. may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0047] The file identification method provided by this application is described in detail below.

[0048] See also Figure 1 , Figure 1 This is a flowchart of a file identification method provided by the present application. The method can be applied to a network security device, which can be, but is not limited to, a firewall or other device. When the network security device implements the method, the following steps may be included:

[0049] S101: Perform file identification on the received file to be identified.

[0050] In this step, when the traffic enters the network security device, the files transmitted in the traffic will be identified. For the convenience of description, the above-mentioned transmitted files can be referred to as the above-mentioned files to be identified.

[0051] Optionally, before identifying the file to be identified, application identification may be performed on the traffic. When an application of a set protocol is identified, step S101 is executed again, ie, file identification is performed on the file to be identified that complies with the application of the set protocol.

[0052] Specifically, for some scenarios that only require application control, when the application corresponding to the data flow is identified, it may be indicated that the data flow of the application is safe to a certain extent, and there is no need to perform deep packet inspection processing, thereby improving packet processing performance and saving packet processing time to a certain extent. In this scenario, in order to further improve the security of data flows entering the network, this embodiment proposes to perform deep packet inspection after identifying the application. Figure 1 The process shown.

[0053] In addition, there may be situations in other scenarios where application identification is required. In order to adapt to the actual needs of other scenarios, application identification is performed first, and then execution is performed after application identification, while making the smallest possible changes to the implementation process of other scenarios. Figure 1 The process shown.

[0054] It should be noted that the above-mentioned setting protocol can be, but is not limited to, http and FTP (File Transfer Protocol) and the like.

[0055] S102: When the file to be identified is a file of a set type, extract a file header from the file to be identified.

[0056] In this step, after identifying the file type of the file to be identified, since some types of executable files in the traffic account for a large proportion of the traffic, viruses generally invade such files. In order to ensure the security of the file and the security of the network, this application will set the file type of the file that needs virus identification. When the file type of the file to be identified is the above file type, it indicates that virus detection needs to be performed on the file to be identified, and the file header is extracted from the file to be identified.

[0057] S103: Perform hash calculation on the target information in the file header to obtain a local hash value.

[0058] In this step, the target information is characteristic information used for virus identification, that is, this type of characteristic information may change due to the virus. Based on this, the target information of the file header is extracted, and then the target information is hashed to obtain the local hash value.

[0059] S104: Match the local hash value with a virus hash feature library.

[0060] The virus hash feature library includes the virus's feature hash value.

[0061] In this step, in order to identify whether there is a virus in the file, the present application will pre-configure a virus signature library, hash the virus signatures of the currently existing viruses, thereby obtaining a virus signature hash value, and then generating a virus hash signature library. On this basis, when the local hash value is matched with the virus hash signature library, if the virus hash signature library includes the local hash value, it is confirmed that the local hash value successfully matches the virus hash signature library, and step S105 is executed, that is, the file to be identified is a virus file; if the virus hash signature library does not include the local hash value, it is confirmed that the local hash value does not match the virus hash signature library.

[0062] It should be noted that the above-mentioned virus hash feature library can be dynamically updated. As viruses increase, the virus features of the newly added viruses are hashed to obtain the feature hash values ​​of the newly added viruses, and then the feature hash values ​​are updated to the virus hash feature library.

[0063] It is worth noting that the above-mentioned virus hash feature library can also include the virus identifier of the virus, that is, the virus hash feature library records the correspondence between the virus identifier and the virus feature. In this way, when matching the local hash value with the virus hash feature library, it is not only possible to identify whether the file to be identified contains a virus, but also to identify what type of virus it is. Specifically, after confirming that the local hash value is in the virus hash feature library, it is confirmed that the file to be identified contains a virus. At the same time, based on the correspondence between the virus identifier and the virus feature, the virus identifier of the virus in the file to be identified can be determined. In this way, not only can the accuracy of the virus identification result be improved, but also when the virus identification result is displayed to the user, it can also facilitate the user to execute effective countermeasures based on the identified virus.

[0064] S105: When the match is successful, it is confirmed that the file to be identified is a virus file.

[0065] By implementing the above-mentioned file identification method of the present application, after performing file identification on the received file to be identified, when the file to be identified is identified as a file of a set type, the file header is extracted from the file to be identified; then the target information in the file header is hashed to obtain a local hash value; the local hash value is matched with the virus hash feature library; when the match is successful, the file to be identified is confirmed to be a virus file. This embodiment only needs to perform a local hash calculation on the file header of the file to be identified, and then the local hash result obtained based on the local hash calculation can be matched with the virus hash feature library to identify whether the file to be identified is a virus file. In this way, when performing virus detection on files passing through network devices, not only does it not require a large amount of memory, but it also improves the accuracy of the virus detection results. In addition, since it is not necessary to perform a hash calculation based on the entire file to be identified, the recognition speed of file identification is improved.

[0066] Optionally, the files to be identified may be, but are not limited to, executable files, office files, compressed files, and the like.

[0067] Optionally, the above-mentioned setting type can be, but is not limited to, a PE executable file under the Windows operating system. Based on this, the above-mentioned file header includes an image file header and an optional image header. Based on this, step S103 can be performed according to the following process: performing a hash calculation on the image file header to obtain an intermediate hash value; extracting target optional image header information that matches the machine type code from the optional image header based on the machine type code; and performing a hash calculation based on the intermediate hash value and the target optional image header information to obtain the local hash value.

[0068] Optionally, step S102 may be performed according to the following process: using a file parsing plug-in corresponding to the set type to disassemble the file to be identified, so as to extract a file header from the file to be identified.

[0069] Specifically, the file parsing plug-in corresponding to the file to be identified can be used to disassemble the file to be identified. When the file type of the identified file to be identified is a PE executable file of the PE type, the mapping file header and the optional image header can be parsed when the PE executable file is parsed and identified using the file parsing plug-in of the PE executable file.

[0070] On this basis, since the traffic of the network security device continuously enters the network security device, the identification of the file to be identified must also be carried out continuously. That is, according to the order of the content in the message header, the image file header will be identified first. When other contents of the message header of the file to be identified are subsequently received, the optional image header will continue to be identified. In view of this, when performing hash calculation, the content in the parsed image file header will first be hashed to obtain an intermediate hash value. After the optional image header is identified, a secondary hash calculation will be performed based on the intermediate hash value and the extracted optional image header to obtain a local hash value.

[0071] It is worth noting that since the bit widths of the machine type codes supported by the virus are different, the target optional image header for secondary hashing must be selected based on the bit width of the machine type code. That is, when parsing the image file header, the machine type code will be parsed from the image file header. On this basis, after extracting the optional image header, the target optional image header information that is consistent with the bit width of the aforementioned parsed machine type code can be extracted from the optional image header. Then, a hash calculation is performed based on the intermediate hash value and the target optional impact header information to obtain a local hash value, thereby adapting to the machine type code supported by the virus, and then based on the local hash value, it is possible to accurately identify whether the file to be identified is a virus file.

[0072] Optionally, based on any of the above embodiments, in this embodiment, when no match is successful, pattern string feature matching is performed on the file to be identified to identify whether the file to be identified is a virus file.

[0073] Specifically, when the local hash value is not matched successfully, it can be confirmed to a certain extent that the file to be identified is not a virus file. In order to perform virus detection on the file to be identified more carefully, this embodiment proposes to perform pattern string feature matching on the file to be identified to further confirm whether the file to be identified is a virus file, thereby further improving the virus identification result of the file to be identified.

[0074] It should be noted that the method based on pattern string feature matching can be implemented with reference to the currently provided method, and this embodiment does not limit this.

[0075] Furthermore, when the local hash value fails to match the virus hash feature library, or when the file to be identified is not identified as a virus file when pattern string feature matching is performed on the file to be identified, then when the file to be identified is a complete file, a full-text hash calculation is performed on the file to be identified to obtain a hash result, and whether the file to be identified is a virus file is identified based on the hash result.

[0076] Specifically, when the matching result between the local hash value and the virus hash feature library is unsuccessful, in order to more accurately identify viruses in the file to be identified, this embodiment proposes to confirm whether the current file to be identified is complete. If the current file to be identified is a complete file, a hash calculation is performed on the file to be identified to obtain a hash result, and then whether the file to be identified is a virus file is confirmed based on the hash result, thereby further improving the accuracy of the virus detection results of the file.

[0077] When the matching result of the pattern string feature matching is unsuccessful, it indicates that the results based on the local hash value and the pattern string feature matching are both unsuccessful. In this embodiment, it is proposed to confirm whether the current file to be identified is complete. If the current file to be identified is a complete file, a hash calculation is performed on the file to be identified to obtain a hash result, and then whether the file to be identified is a virus file is confirmed based on the hash result, thereby further improving the accuracy of the virus detection result of the file.

[0078] It should be noted that virus identification based on a complete file to be identified can be implemented according to the currently provided method, and this embodiment does not limit this.

[0079] Optionally, when performing hash calculation, the message digest MD5 algorithm and the like may be used but is not limited to being used.

[0080] It should be noted that the image file header parsed above may include, but is not limited to, a machine type code Machine, the number of segments in the file to be identified, the size of an optional image header, and the like.

[0081] When the above-mentioned file to be identified is a PE executable file, the extracted file header can be recorded as PE Fileheader. On this basis, when the PE executable file is disassembled using the file parsing plug-in corresponding to the PE executable file, in addition to the image file header and optional image header, the DOS header, DOS STUB, PE signature and other information can also be disassembled.

[0082] First, the contents of the image file header are introduced as follows:

[0083] The machine type identification code is denoted as Machine. Each CPU has a unique Machine code, which may include, but is not limited to, 32-bit, 64-bit, etc. For example, the Machine code compatible with a 32-bit Intel x86 chip is 14C.

[0084] The number of segments in the above-mentioned file to be identified is recorded as Number Of Sections, which indicates the number of sections in the file, that is, the number of sections in the PE file, such as the number of data, text and other sections in the PE section table.

[0085] The size of the optional image header is recorded as Size Of Optional Header, the size of the structure optional image header PEOption Header.

[0086] The optional image header is denoted as PE Option Header, and its structure is IMAGE_OPTIONAL_HEADER32. The optional image header has 9 main members, specifically:

[0087] The magic word, Magic, is used to indicate that the type of the file to be identified is PE type, 32-bit or 64-bit.

[0088] Address Of Entry Point is the program entry address, indicating the starting address of the code that the program first executes.

[0089] Image Base is the image base address, the actual address location of the PE file's mapping in the memory space, indicating the file's priority loading address (the virtual memory range of a 32-bit process is: 0~7FFFFFFF).

[0090] Section Alignment is the memory alignment granularity, that is, the alignment granularity when the PE file is mapped to memory. File Alignment is the disk alignment granularity, that is, the alignment granularity when the PE file is stored on disk. The former specifies the smallest unit of section in memory, and the latter specifies the smallest unit of section in disk files.

[0091] Size Of Image: The total size of the PE file image in memory, which specifies the size of the space occupied by the PE Image in virtual memory.

[0092] Size Of Headers is the size of the entire PE header, including the DOS header + PE marker + standard PE header + optional PE header + section table.

[0093] Subsystem is the subsystem used by the user interface, which distinguishes system driver files from ordinary executable files.

[0094] Number Of Rva And Size is the number of directory entries, which specifies the number of Data Directory arrays.

[0095] Data Directory, an array of data directory table IMAGE_DATA_DIRECTORY structures.

[0096] It should be noted that a virus file can be determined based on information such as the program entry address, section structure address, timestamp, and the size of the space occupied by the PE image in the virtual memory.

[0097] By using the file identification method provided by any embodiment of the present application, even if it is insensitive to local file modifications, when a virus file mutates (such as a code segment changes or additional data changes), the file header information of the file is fixed. Therefore, similar mutant viruses can be detected by the same rule, thereby improving the practicality and versatility of the file identification method provided by the present application. In addition, in order to reduce the false alarm rate, when analyzing massive samples to extract local hash rules, rules that are prone to false alarms, such as PE shelling, packaging, and infection, are eliminated, and the removed parts can be supplemented by full-text hashing and pattern string feature matching for detection, thereby further improving the accuracy of file identification.

[0098] At this point, by adopting the file identification method provided by any embodiment of the present application, the local hash calculation method has a certain degree of merging rate. Compared with the full-text hash algorithm, the local hash algorithm of the present application can cover a large number of virus samples and reduce memory usage.

[0099] In addition, for the local hash matching method, since the information of the PE file of interest is in the file header, only the first several bytes of the PE file need to be calculated and processed. There is no need to calculate and match the hash of the entire text, or perform AC matching on the entire file. This greatly reduces CPU usage and, at the same time, significantly improves file recognition performance.

[0100] Furthermore, since the local hash can be calculated for the first packet in most scenarios, the recognition rate can be improved by using any of the file recognition methods provided in this application without reorganization in the case of message disorder, including IP layer disorder, TCP disorder, application layer disorder, etc.

[0101] Based on the same inventive concept, the present application also provides a file identification device corresponding to the above-mentioned file identification method. The implementation of the file identification device can be specifically referred to the above-mentioned description of the file identification method, and will not be discussed here one by one.

[0102] See also Figure 2 , Figure 2 A file identification device provided by an exemplary embodiment of the present application is provided in a network security device, and includes:

[0103] Identification module 201, used to perform file identification on the received file to be identified;

[0104] The extraction module 202 is configured to extract a file header from the file to be identified when the file to be identified is a file of a set type;

[0105] A hash calculation module 203 is configured to perform a hash calculation on the target information in the file header to obtain a local hash value;

[0106] A first matching module 204 is configured to match the local hash value with a virus hash feature library, wherein the virus hash feature library includes characteristic hash values ​​of viruses;

[0107] The confirmation module 205 is configured to confirm that the file to be identified is a virus file when the matching result of the first matching module is a successful match.

[0108] Optionally, based on the above embodiment, the file to be identified in this embodiment includes an executable file under the Windows operating system; the file header includes an image file header and an optional image header;

[0109] On this basis, the hash calculation module 203 is specifically used to perform hash calculation on the image file header to obtain an intermediate hash value; extract target optional image header information that matches the machine type code from the optional image header according to the machine type code; and perform hash calculation based on the intermediate hash value and the target optional image header information to obtain the local hash value.

[0110] Optionally, based on any of the above embodiments, the file identification device provided in this embodiment further includes:

[0111] The second matching module (not shown in the figure) is used to perform pattern string feature matching on the file to be identified to identify whether the file to be identified is a virus file when the matching result of the first matching module is unsuccessful.

[0112] Furthermore, the message processing device provided in this embodiment further includes:

[0113] The third matching module (not shown in the figure) is used to, when the matching result of the first matching module 204 is unsuccessful matching, or the matching result of the second matching module (not shown in the figure) is that the file to be identified is not identified as a virus file, then when the file to be identified is a complete file, perform a full-text hash calculation on the file to be identified to obtain a hash result, and identify whether the file to be identified is a virus file according to the hash result.

[0114] Optionally, based on any of the above embodiments, the extraction module 202 is specifically configured to use a file parsing plug-in corresponding to the set type to disassemble the file to be identified, so as to extract a file header from the file to be identified.

[0115] In the file identification device provided by any embodiment of the present application, after performing file identification on the received file to be identified, when it is identified that the file to be identified is a file of a set type, the file header is extracted from the file to be identified; then the target information in the file header is hashed to obtain a local hash value; the local hash value is matched with the virus hash feature library; when the match is successful, the file to be identified is confirmed to be a virus file. This embodiment only needs to perform a local hash calculation on the file header of the file to be identified, and then the local hash result obtained based on the local hash calculation can be matched with the virus hash feature library to identify whether the file to be identified is a virus file. In this way, when performing virus detection on files passing through the network device, not only does it not need to occupy a large amount of memory, but it also improves the accuracy of the virus detection results. In addition, since it is not necessary to perform a hash calculation based on the entire file to be identified, the recognition speed of file identification is improved.

[0116] Based on the same inventive concept, an embodiment of the present application provides an electronic device, which can be, but is not limited to, the above-mentioned network security device. Figure 3 As shown, the electronic device includes a processor 301 and a machine-readable storage medium 302. The machine-readable storage medium 302 stores a computer program executable by the processor 301. The computer program prompts the processor 301 to execute the file identification method provided in any embodiment of the present application. In addition, the electronic device also includes a communication interface 303 and a communication bus 304. The processor 301, the communication interface 303, and the machine-readable storage medium 302 communicate with each other via the communication bus 304.

[0117] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0118] The communication interface is used for communication between the above electronic device and other devices.

[0119] The machine-readable storage medium 302 may be a memory, which may include random access memory (RAM), DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may be at least one storage device located remotely from the processor.

[0120] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, and discrete hardware components.

[0121] As for the electronic device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0122] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0123] The implementation process of the functions and effects of each unit / module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0124] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the units / modules described as separate components may or may not be physically separated, and the components displayed as units / modules may or may not be physical units / modules, that is, they may be located in one place, or they may be distributed over multiple network units / modules. Some or all of the units / modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0125] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A file identification method, characterized in that: include: Performing file identification on the received file to be identified; When the file to be identified is a file of a set type, a file header is extracted from the file to be identified; Performing hash calculation on the target information in the file header to obtain a local hash value; Matching the local hash value with a virus hash feature library, wherein the virus hash feature library includes characteristic hash values ​​of viruses; If the match is successful, the file to be identified is confirmed to be a virus file; The files to be identified include executable files under the Windows operating system; The file header includes an image file header and an optional image header; Performing a hash calculation on the target information in the file header to obtain a local hash value includes: Performing hash calculation on the image file header to obtain an intermediate hash value; extracting target optional image header information matching the machine type code from the optional image header according to the machine type code; A hash calculation is performed based on the intermediate hash value and the target optional image header information to obtain the local hash value.

2. The method according to claim 1, characterized in that Also includes: When the match is unsuccessful, pattern string feature matching is performed on the file to be identified to identify whether the file to be identified is a virus file.

3. The method according to claim 2, characterized in that Also includes: When the local hash value fails to match the virus hash feature library, or when the file to be identified is not identified as a virus file when the pattern string feature matching is performed on the file to be identified, then when the file to be identified is a complete file, a full-text hash calculation is performed on the file to be identified to obtain a hash result, and whether the file to be identified is a virus file is identified based on the hash result.

4. The method according to claim 1, wherein Extracting a file header from the file to be identified includes: The file to be identified is disassembled using a file parsing plug-in corresponding to the set type to extract a file header from the file to be identified.

5. A file recognition device, characterized in that: include: An identification module is used to identify the received file to be identified; an extraction module, configured to extract a file header from the file to be identified when the file to be identified is a file of a set type; A hash calculation module, configured to perform hash calculation on the target information in the file header to obtain a local hash value; A first matching module, configured to match the local hash value with a virus hash feature library, wherein the virus hash feature library includes characteristic hash values ​​of viruses; a confirmation module, configured to confirm that the file to be identified is a virus file when the matching result of the first matching module is a successful match; The file to be identified includes an executable file under the Windows operating system; the file header includes an image file header and an optional image header; The hash calculation module is specifically used to perform hash calculation on the image file header to obtain an intermediate hash value; According to the machine type code, target optional image header information matching the machine type code is extracted from the optional image header; and hash calculation is performed based on the intermediate hash value and the target optional image header information to obtain the local hash value.

6. The device according to claim 5, characterized in that Also includes: The second matching module is configured to perform pattern string feature matching on the file to be identified to identify whether the file to be identified is a virus file when the matching result of the first matching module is unsuccessful.

7. The device according to claim 6, characterized in that Also includes: The third matching module is used to, when the matching result of the first matching module is unsuccessful matching, or the matching result of the second matching module is that the file to be identified is not identified as a virus file, and when the file to be identified is a complete file, perform a full-text hash calculation on the file to be identified to obtain a hash result, and identify whether the file to be identified is a virus file according to the hash result.

8. The device according to claim 5, characterized in that The extraction module is specifically configured to utilize the file parsing plug-in corresponding to the set type to perform a disassembly process on the file to be identified, so as to extract the file header from the file to be identified.

Images