Similarity query method, database updating method, device and system

Abstract

The embodiments of the present application provide a similarity query method, database update method, device, and system. The similarity query method includes: extracting features from a file to be detected according to a first preset granularity to obtain a first target feature; performing a similarity query on the first target feature in a first feature database to determine whether a similar sample file to the file to be detected exists in the first feature database; if a similar sample file to the file to be detected does not exist in the first feature database, extracting features from the file to be detected according to a second preset granularity to obtain a second target feature; performing a similarity query on the second target feature in a second feature database to determine whether a similar sample file to the file to be detected exists in the second feature database. In this way, performing similarity queries at two preset granularities improves query accuracy and enables real-time updating of the database based on the query results, thereby improving the database's traceability analysis capabilities.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a similarity query method, a database update method, a device and a system. Background Art

[0002] With the rapid development of internet technology, a large number of files from unknown sources have appeared online. These include both legitimate files from open source communities and malicious files from malicious actors. Tracing and analyzing files from unknown sources can reveal information such as the file's type, purpose, and riskiness, thereby determining whether the file is malicious. It can also reveal the attack process and methods used by malicious files. Furthermore, based on this traced information, it is possible to locate the source of the attack or the attacker, playing a crucial role in curbing hacker attacks and improving network security systems.

[0003] Currently, manual analysis is often used to trace the origin of files. During this process, the structure, logic, and functionality of the code in two files are manually compared to determine whether the two samples belong to the same family or variant. However, this traceability method is not very accurate and is inefficient. Summary of the Invention

[0004] The present application provides a similarity query method, a database update method, an apparatus, and a system, which perform feature extraction and similarity query on files to be detected at two preset granularities, and can more accurately detect similar sample files to improve the accuracy of traceability analysis.

[0005] The technical solution of this application is achieved as follows:

[0006] In a first aspect, an embodiment of the present application provides a similarity query method, the method comprising:

[0007] Extracting features of the file to be inspected according to a first preset granularity to obtain a first target feature;

[0008] Performing a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database;

[0009] If there is no similar sample file to the file to be detected in the first feature database, extract features of the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity;

[0010] A similarity query is performed on the second target feature in a second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0011] In a second aspect, an embodiment of the present application provides a database updating method, wherein the database includes a first feature database and a second feature database, wherein the first feature database stores code features of each of a plurality of first sample files and code family information of each of the plurality of first sample files, and the second feature database stores content features of each of a plurality of second sample files; the method comprising:

[0012] Acquire a file to be detected, perform feature extraction on the file to be detected according to code granularity to obtain a first target feature, and perform feature extraction on the file to be detected according to content granularity to obtain a second target feature;

[0013] If similar sample files to the file to be detected do not exist in the first feature database, and similar sample files to the file to be detected exist in the second feature database, storing the first target feature and the code features of the similar sample files in the first feature database, and determining the code family to which the file to be detected belongs, so as to indicate the first target feature and the code features of the similar sample files in the first feature database;

[0014] When there is no similar sample file to the file to be detected in the first feature database and there is no similar sample file to the file to be detected in the second feature database, the second target feature is stored in the second feature database.

[0015] In a third aspect, an embodiment of the present application provides a similarity query device, which includes a first extraction unit, a first query unit, a second extraction unit, and a second query unit, wherein:

[0016] A first extraction unit is configured to extract features of the file to be detected according to a first preset granularity to obtain a first target feature;

[0017] a first query unit configured to perform a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database;

[0018] a second extraction unit configured to, if there is no similar sample file to the file to be detected in the first feature database, extract features of the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity;

[0019] The second query unit is configured to perform a similarity query on the second target feature in a second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0020] In a fourth aspect, an embodiment of the present application provides a database updating device, wherein the database includes a first feature database and a second feature database, wherein the first feature database stores code features of each of a plurality of first sample files and code family information of each of the plurality of first sample files, and the second feature database stores content features of each of the plurality of second sample files;

[0021] The database updating device includes an acquiring unit and an updating unit; wherein,

[0022] an acquisition unit configured to acquire a file to be detected, perform feature extraction on the file to be detected according to code granularity to obtain a first target feature, and perform feature extraction on the file to be detected according to content granularity to obtain a second target feature;

[0023] an updating unit configured to, if similar sample files to the file to be detected do not exist in the first feature database and similar sample files to the file to be detected exist in the second feature database, store the first target feature and the code features of the similar sample files together in the first feature database, and determine the code family to which the file to be detected belongs, so as to indicate the first target feature and the code features of the similar sample files in the first feature database;

[0024] The updating unit is further configured to store the second target feature into the second feature database if there is no similar sample file of the file to be detected in the first feature database and there is no similar sample file of the file to be detected in the second feature database.

[0025] In a fifth aspect, an embodiment of the present application provides a similarity query system, which at least includes the similarity query device as described in the third aspect.

[0026] In a sixth aspect, an embodiment of the present application provides a database update system, which includes at least the database update device as described in the fourth aspect.

[0027] The embodiment of the present application provides a similarity query method, a database update method, an apparatus and a system, the similarity query method comprising: extracting features of a file to be detected according to a first preset granularity to obtain a first target feature; performing a similarity query on the first target feature in a first feature database to determine whether a similar sample file of the file to be detected exists in the first feature database; if a similar sample file of the file to be detected does not exist in the first feature database, extracting features of the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity; performing a similarity query on the second target feature in the second feature database to determine whether a similar sample file of the file to be detected exists in the second feature database; the database update method comprising: obtaining a file to be detected, performing a similarity query on the first target feature in a first feature database to determine whether a similar sample file of the file to be detected exists in the second feature database; The code granularity is used to extract features from the file to be detected to obtain a first target feature, and the content granularity is used to extract features from the file to be detected to obtain a second target feature. If a similar sample file to the file to be detected does not exist in the first feature database, and a similar sample file to the file to be detected exists in the second feature database, the first target feature and the code features of the similar sample file are stored in the first feature database, and the code family to which the file to be detected belongs is determined to indicate the first target feature and the code features of the similar sample file in the first feature database. If a similar sample file to the file to be detected does not exist in the first feature database, and a similar sample file to the file to be detected does not exist in the second feature database, the second target feature is stored in the second feature database. In this way, two feature databases are established for two preset granularities, and then feature extraction and similarity query are performed on the file to be detected in turn, which can more accurately detect similar sample files to the file to be detected, thereby improving the accuracy of traceability analysis. In addition, the first target feature and the second target feature of the file to be detected are used to update the database, so that the number of features in the first feature database and the second feature database continues to increase, thereby enabling the first database and the second feature database to provide better traceability analysis capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of a similarity query method provided in an embodiment of the present application;

[0029] Figure 2 A flowchart of another similarity query method provided in an embodiment of the present application;

[0030] Figure 3 A flowchart of a database updating method provided in an embodiment of the present application;

[0031] Figure 4 A flowchart of another similarity query method provided in an embodiment of the present application;

[0032] Figure 5 A flowchart of another similarity query method provided in an embodiment of the present application;

[0033] Figure 6 A schematic diagram of the working process of a similarity query method provided in an embodiment of the present application;

[0034] Figure 7 A schematic diagram of the working process of a database updating method provided in an embodiment of the present application;

[0035] Figure 8 A schematic diagram of the structure of a similarity query device provided in an embodiment of the present application;

[0036] Figure 9 A schematic diagram of the hardware structure of a similarity query device provided in an embodiment of the present application;

[0037] Figure 10 A schematic diagram of the structure of a database updating device provided in an embodiment of the present application;

[0038] Figure 11 A schematic diagram of the hardware structure of a database updating device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0039] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. It should be understood that the specific embodiments described herein are only used to explain the related applications and are not intended to limit the applications. It should also be noted that for ease of description, only the parts relevant to the related applications are shown in the drawings.

[0040] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0041] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0042] It should be pointed out that the terms "first\second\third" involved in the embodiments of the present application are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0043] The professional terms involved in the embodiments of this application are explained as follows:

[0044] (1) Jaccard Similarity Coefficient: Also known as the Jaccard coefficient, it is used to compare the similarities and differences between finite sets of samples. The larger the Jaccard coefficient, the higher the sample similarity. Given two sets A and B, the Jaccard coefficient is defined as the ratio of the size of the intersection of A and B to the size of the union of A and B. The calculation method of the Jaccard coefficient is shown in Equation (1) or Equation (2).

[0045]

[0046]

[0047] Wherein, J(A, B) represents the Jaccard coefficient of set A and set B.

[0048] (2) Fuzzy hash algorithm: also known as content-segmentation-based fragmented hash algorithm, it is mainly used for file similarity comparison. The difference between fuzzy hash algorithm and hash algorithm is that hash algorithm uses the entire file as the domain to calculate the result, while fuzzy hash algorithm first divides the file into blocks, calculates the hash value of each block, and then compares the obtained series of hash values ​​with other hash values ​​using a comparison function to determine the degree of similarity.

[0049] (3) Control Flow Graph (CFG): Also known as a control flow graph, it is an abstract representation of a process or program. It is an abstract data structure used in compilers and maintained internally by the compiler. It represents all the paths that a program will traverse during execution. In other words, the control flow graph uses a graph to represent the possible execution flows of all basic blocks within a process and can also reflect the real-time execution process of a process.

[0050] (4) Basic block: A sequence of statements executed sequentially in the code. It has only one entry and one exit. The entry is the first statement in the block, and the exit is the last statement in the block. A basic block is entered only through its entry and exited only through its exit.

[0051] With the rapid development of internet technology, a large amount of software from unknown sources has appeared online. These include both legitimate files from open source communities and malicious files from malicious actors. Tracing back unknown files can reveal information such as the file's category and family, thereby determining whether the file is malicious. It can also reveal the target, process, and means of attack of malicious files. Furthermore, based on this traced information, it is possible to locate the source of the attack or the attacker, playing a vital role in curbing hacker attacks and improving network security systems.

[0052] Currently, manual analysis is often used to trace the origin of a sample. This process involves manually comparing the structure, logic, and functionality of the code in two samples to determine whether they belong to the same family or variant. Related technologies typically use rule matching when conducting source tracing analysis. Virus analysts first extract the malicious code of a family as rules, and then use these rules to determine the family.

[0053] However, both sample similarity comparison and extraction rules require analysts to have certain virus analysis capabilities, and sample analysis is time-consuming and labor-intensive, making it difficult to trace the source of large quantities of samples.

[0054] An embodiment of the present application provides a similarity query method, the basic idea of ​​which is: performing feature extraction on a file to be detected according to a first preset granularity to obtain a first target feature; performing a similarity query on the first target feature in a first feature database to determine whether a similar sample file of the file to be detected exists in the first feature database; if a similar sample file of the file to be detected does not exist in the first feature database, performing feature extraction on the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity; performing a similarity query on the second target feature in the second feature database to determine whether a similar sample file of the file to be detected exists in the second feature database; in this way, two feature databases are established for the two preset granularities respectively, and then feature extraction and similarity query are performed on the file to be detected in turn, so that similar sample files of the file to be detected can be detected more accurately, thereby improving the accuracy of traceability analysis.

[0055] The embodiment of the present application also provides a database update method, the basic idea of ​​which is to obtain a file to be detected, extract features of the file to be detected based on code granularity to obtain a first target feature, and extract features of the file to be detected based on content granularity to obtain a second target feature; if there is no similar sample file of the file to be detected in the first feature database, and there is a similar sample file of the file to be detected in the second feature database, the first target feature and the code features of the similar sample file are stored in the first feature database, and the code family to which the file to be detected belongs is determined to indicate the first target feature and the code features of the similar sample file in the first feature database; if there is no similar sample file of the file to be detected in the first feature database, and there is no similar sample file of the file to be detected in the second feature database, the second target feature is stored in the second feature database. In this way, the database is updated using the first target feature and the second target feature of the file to be detected, so that the number of features in the first feature database and the second feature database continues to increase, thereby enabling the first database and the second feature database to provide better traceability analysis capabilities.

[0056] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0057] In one embodiment of the present application, see Figure 1 , which shows a flow chart of a similarity query method provided by an embodiment of the present application. Figure 1 As shown, the method may include:

[0058] S101: Extract features from a file to be detected according to a first preset granularity to obtain a first target feature.

[0059] It should be noted that the embodiment of the present application provides a similarity query method, the purpose of which is to quickly find similar sample files of the file to be detected, thereby completing the traceability analysis of the file to be detected, so that the user can have a preliminary understanding of the file to be detected based on the similar sample files found, and timely grasp the family and other information to which the file to be detected belongs, thereby ultimately improving network security. The family described in this application is composed of a group of files with similar behaviors, which has the same meaning as the code family described later.

[0060] Therefore, for the file to be detected, it is necessary to perform feature extraction on it according to the first preset granularity to obtain the first target feature. Here, the file to be detected can include multiple file types, for example, the file to be detected can be an executable file (suffixed with .exe), a script file (suffixed with .txt), a command file (suffixed with .com), etc.

[0061] S102: Performing a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database.

[0062] It should be noted that the first target feature is subjected to similarity query in the first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database. Here, the first feature database stores code features of multiple first sample files at a first preset granularity.

[0063] To facilitate tracing, the first feature database stores corresponding information for tracing (such as the family to which it belongs), so that after determining the similar sample text, the family to which the similar sample file belongs can be further determined as the family of the file to be detected, so as to trace the file to be detected.

[0064] S103: When there is no similar sample file to the file to be detected in the first feature database, extract features of the file to be detected according to a second preset granularity to obtain a second target feature.

[0065] It should be noted that in related technologies, when performing traceability analysis on a file to be tested, only a single feature is generally used. However, in this case, the detection rate is not ideal. Therefore, in the embodiment of the present application, if it is impossible to use the first target feature to detect similar sample files of the file to be tested in the first feature database, it is necessary to perform feature extraction on the file to be tested based on a second preset granularity to obtain a second target feature of the file to be tested. Here, the second preset granularity is different from the first preset granularity.

[0066] S104: Perform a similarity query on the second target feature in a second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0067] It should be noted that the second target feature is subjected to similarity query in the second database to determine whether there is a similar sample file to the file to be detected in the second feature database. Here, the second database stores content features of multiple second sample files with respect to a second preset granularity.

[0068] To facilitate tracing, the second feature database stores corresponding information for tracing (such as the family to which it belongs), so that after determining the similar sample text, the family to which the similar sample file belongs can be further determined as the family of the file to be detected, so as to trace the source of the file to be detected.

[0069] Furthermore, in some implementations, the first preset granularity is a code granularity; and extracting features from the file to be detected according to the first preset granularity to obtain the first target feature may include:

[0070] Disassembling the file to be detected to obtain a code to be detected corresponding to the file to be detected; extracting features from the code to be detected to obtain a first target feature;

[0071] and / or,

[0072] The second preset granularity is the file content granularity; and extracting features from the file to be detected according to the second preset granularity to obtain the second target feature may include:

[0073] Obtaining content data of the file to be detected;

[0074] The second target feature is obtained according to the content data of the file to be detected.

[0075] The above content data is usually a binary file. Here, the second target feature is calculated for the binary file, such as traditional hash, fuzzy hash, etc.

[0076] It should be noted that the first preset granularity and the second preset granularity can be determined in combination according to the actual application environment. For example, the first preset granularity is the code granularity, and the second preset granularity is the text content granularity; or the first preset granularity is the code function granularity, and the second preset granularity is the code control flow granularity; or the first preset granularity is the code function granularity, and the second preset granularity is the text content granularity; or the first preset granularity is the text content granularity, and the second preset granularity is the code control flow granularity, and so on.

[0077] For the convenience of explanation, the subsequent explanation is given by taking the first preset granularity as code granularity and the second preset granularity as text content granularity as an example, but this does not constitute a specific limitation of the embodiments of the present application.

[0078] Since the first preset granularity refers to code granularity, the file to be tested needs to be disassembled to obtain the code to be tested. This code is then used for feature extraction to obtain the first target feature. Meanwhile, the second preset granularity refers to content granularity, so the content data of the file to be tested needs to be obtained to obtain the second target feature based on this content data.

[0079] In related technologies, the file to be tested and the sample file are generally compared based on a single granularity (usually content granularity). In this case, any change in the details of the file content (such as different address data, different format, different custom name) will cause content differences. If the content features used as the comparison template are more precise, the detection rate will be too low; if the content features used as the comparison template are relatively rough, the false detection rate will be too high, and it will be difficult to select appropriate template features.

[0080] The embodiments of this application introduce code granularity. Compared to text content granularity, code granularity features can more accurately indicate different file types. In other words, for different files of the same type, even if their text content varies, in order to achieve similar purposes, the functions and control flows they use must have certain similarities. Therefore, starting with code granularity can improve detection rate and accuracy.

[0081] In addition, the embodiment of the present application compares the file to be detected and the sample file at two levels, namely the first preset granularity and the second preset granularity, and can determine the sample characteristics of each level according to the characteristics of each level. Moreover, different levels can cooperate with each other to form a three-dimensional and comprehensive comparison system, thereby improving the detection effect.

[0082] The embodiment of the present application provides a similarity query method, which extracts features from a file to be detected according to a first preset granularity to obtain a first target feature; performs a similarity query on the first target feature in a first feature database to determine whether a similar sample file of the file to be detected exists in the first feature database; if a similar sample file of the file to be detected does not exist in the first feature database, extracts features from the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity; performs a similarity query on the second target feature in the second feature database to determine whether a similar sample file of the file to be detected exists in the second feature database. In this way, two feature databases are established for two preset granularities respectively, and then feature extraction and similarity query are performed on the file to be detected in turn, which can more accurately detect similar sample files of the file to be detected and improve the accuracy of traceability analysis; in addition, after detecting similar sample files of the file to be detected, information such as the code family and malicious code to which the file to be detected belongs can be obtained, which can more comprehensively provide malicious evidence for the file to be detected.

[0083] In the embodiment of the present application, the similarity query method is specifically described by taking the first preset granularity as the code granularity and the second preset granularity as an example. Figure 2 , which shows a flow chart of a similarity query method provided by an embodiment of the present application. Figure 2As shown, the method may include:

[0084] S201: performing disassembly processing on the file to be detected to obtain the code to be detected corresponding to the file to be detected.

[0085] It should be noted that, for multiple files of the same category, their assembly codes have certain similarities. Therefore, the files to be detected are disassembled to obtain the codes to be detected corresponding to the files to be detected.

[0086] Here, disassembly refers to the process of converting the code to be tested into assembly code, that is, converting machine language into assembly language. In other words, the code to be tested obtained through disassembly is written in assembly language. Assembly language, also known as a symbolic language, is a low-level language used in electronic computers, microprocessors, microcontrollers, or other programmable devices. In assembly language, mnemonics replace the opcodes of machine instructions, and address symbols or labels replace the addresses of instructions or operands. Different devices correspond to different machine language instruction sets, and the assembly process converts them into machine instructions.

[0087] S202: Extract features of the code to be detected to obtain a first target feature.

[0088] It should be noted that after obtaining the code to be detected, it is necessary to perform feature extraction on the code to be detected, so as to obtain the first target feature.

[0089] Furthermore, in some embodiments, extracting features from the code to be detected to obtain the first target feature may include:

[0090] The code to be detected is segmented based on a preset subdivision granularity to obtain at least one object to be detected; wherein the preset subdivision granularity includes at least one of the following: function, control flow, basic block;

[0091] Performing hash calculations on the at least one object to be detected to obtain a target code hash value set;

[0092] The target code hash value set is determined as the first target feature.

[0093] It should be noted that there are still too many details in the code to be detected (such as replaceable addresses, format-related auxiliary languages, etc.). When performing similarity comparison, in order to avoid the difference in details that causes files belonging to the same category to be unable to be detected, it is necessary to segment the code to be detected according to the preset subdivision granularity to obtain at least one object to be detected. In other words, the preset subdivision granularity is a further subdivision of the first preset granularity. For example, when the first preset granularity is the code granularity, the preset subdivision granularity can be a function, a basic block, a control flow, etc.

[0094] After obtaining at least one object to be detected, a hash value is calculated for each object to be detected to obtain a target code hash value set, which is the first target feature. The hash calculation can use a variety of existing hash algorithms, such as fuzzy hash algorithms, message digest algorithms (MD5), and 256-bit secure hash algorithms (SHA256).

[0095] It should also be noted that, according to the aforementioned content, when the first preset granularity is code, the preset subdivision granularity can include at least one of the following: function, control flow, basic block combination, basic block, etc. Taking the preset subdivision granularity as function as an example, after obtaining the code to be tested, the code to be tested is divided into functions to obtain multiple functions (i.e., objects to be tested) included in the code to be tested; then, hash calculations are performed on the contents of these multiple functions respectively, and the multiple hash values ​​obtained constitute the target hash value set.

[0096] Furthermore, the preset subdivision granularity can include a combination of multiple granularities. For example, using both functions and basic blocks as the preset subdivision granularity, the code to be tested needs to be segmented into functions to obtain multiple functions to be tested, and the code to be tested needs to be segmented into basic blocks to obtain multiple basic blocks to be tested. Thus, when comparing similarity, comparisons can be made at both the function and basic block granularities, or the function and basic block granularities can be combined to obtain a similarity query result at the first preset granularity.

[0097] In this way, through the above processing, the first target feature of the file to be detected is obtained, and the first target feature can be used to trace the source of the file to be detected later.

[0098] S203: Performing a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database.

[0099] It should be noted that the first target feature is subjected to a similarity query in the first feature database, so as to determine whether there is a similar sample file to the file to be detected in the first feature database.

[0100] Specifically, the first feature database stores code features of known sample files corresponding to a first preset granularity. Therefore, in some embodiments, the method may further include:

[0101] obtaining a plurality of first sample files;

[0102] Performing feature extraction on each of the plurality of first sample files according to a first preset granularity to obtain code features of each of the plurality of first sample files;

[0103] The first feature database is established based on the code features of each of the plurality of first sample files.

[0104] It should be noted that the first sample file refers to a known sample file and serves as a blueprint for similarity comparison. Feature extraction is performed on each of the multiple first sample files according to a first preset granularity, thereby obtaining code features for each of the multiple first sample files. The obtained code features for each of the multiple first sample files are stored, thereby establishing a first feature database. The first feature database can be of various types, and this embodiment of the present application does not limit this.

[0105] It should also be noted that in order to avoid the poor universality of directly extracted features, the features can also be generalized. Therefore, in some embodiments, when the first preset granularity is the code granularity, extracting features from the multiple first sample files according to the first preset granularity to obtain the code features of the multiple first sample files may include:

[0106] performing disassembly processing on the first sample file to obtain codes of respective ones of the plurality of first sample files;

[0107] performing a segmentation operation on the codes of the plurality of first sample files based on a preset segmentation granularity to obtain at least one code object corresponding to each of the plurality of first sample files;

[0108] Performing instruction generalization processing on at least one code object corresponding to each of the plurality of first sample files to obtain objects to be stored corresponding to each of the plurality of first sample files;

[0109] Performing hash calculation on the objects to be stored corresponding to each of the plurality of first sample files to obtain a code hash value set corresponding to each of the plurality of first sample files;

[0110] The code hash value sets corresponding to the plurality of first sample files are determined as the code features of the plurality of first sample files.

[0111] It should be noted that, taking the first preset granularity as code granularity and the preset subdivision granularity as function as an example, the process of obtaining code features is as follows: first, for multiple first sample files, multiple sample codes are obtained through disassembly processing; then, each sample code is segmented to determine the multiple functions (equivalent to code objects) corresponding to each first sample file; thereafter, instruction generalization processing is performed on the multiple functions to obtain generalized functions (equivalent to objects to be stored); hash calculations are performed on the multiple generalized functions corresponding to each first sample file respectively to obtain a code hash value set corresponding to each first sample file (equivalent to code features); the code hash value sets corresponding to each of the multiple first sample files are stored, thereby establishing a first feature database.

[0112] In this way, instruction generalization processing can remove some features that interfere with similarity matching (for example, the address of the instruction of the same function in different binaries is likely to change), making the code features of multiple first sample files more representative and improving the detection accuracy in subsequent use.

[0113] It should also be noted that, taking the first preset granularity as code granularity as an example, in this case, the first target feature is a target code hash value set, and the code feature of the first sample file is a code hash value set. In other words, the first feature database stores a plurality of code hash value sets for respective first sample files. The process of performing a similarity query on the first target feature in the first feature database to determine whether there are similar sample files to the file to be detected in the first feature database may include:

[0114] Comparing the code hash value sets of each of the plurality of first sample files with the target code hash value set to determine a plurality of code similarity scores; wherein each of the plurality of first sample files corresponds to a code similarity score;

[0115] determining a highest code similarity score from the plurality of code similarity scores;

[0116] When the highest code similarity score is less than a first preset threshold, there is no similar sample file of the file to be detected in the first feature database;

[0117] When the highest code similarity score is greater than or equal to a first preset threshold, it is determined that a similar sample file to the file to be detected exists in the first feature database.

[0118] It should be noted that by comparing the to-be-detected text with a plurality of first sample files, it is determined whether there are similar sample files to the to-be-detected file in the first feature database. The process of determining whether there are similar sample files to the to-be-detected file in the first feature database is as follows:

[0119] First, the code hash value sets of each of the multiple first sample files are compared with the target code hash value set to obtain multiple code similarity scores. Here, each code similarity score represents the degree of similarity between the file to be tested and one of the first sample files, so each first sample file corresponds to a code similarity score.

[0120] Next, the highest code similarity score is determined among the multiple code similarity scores, and then the highest code similarity score is compared with a first preset threshold. Here, the first preset threshold can be determined according to actual application requirements and is not specifically set in the embodiment of the present application.

[0121] If the highest code similarity score is less than the first preset threshold, it means that the file to be detected is not very similar to any of the first sample files, that is, there is no similar sample file to the file to be detected in the first feature database; if the highest code similarity score is equal to or greater than the first preset threshold, it means that the file to be detected is relatively similar to one of the first sample files (that is, the sample file corresponding to the highest code similarity score), that is, there is a similar sample file to the file to be detected in the first feature database.

[0122] In this way, by comparing the text to be detected with a plurality of first sample files, it is determined whether there are sample files similar to the file to be detected in the first feature database.

[0123] Furthermore, the Jaccard similarity coefficient can be used as the code similarity score between the sample to be detected and the first sample file. Therefore, in some embodiments, comparing the code hash value sets of the plurality of first sample files with the target code hash value set to determine the plurality of code similarity scores may include:

[0124] Determine a sample file to be calculated and a code hash value set of the sample file to be calculated; wherein the sample file to be calculated is any one of the multiple first sample files;

[0125] Performing an intersection and union operation on the code hash value set of the sample file to be calculated and the target code hash value set to obtain a code hash value union and a code hash value intersection;

[0126] Determine the number of hash values ​​in the intersection of the code hash values ​​as a first number, and determine the number of hash values ​​in the union of the code hash values ​​as a second number;

[0127] Performing a division operation on the first number and the second number to obtain a code similarity score of the sample file to be calculated;

[0128] After determining the code similarity scores of the respective first sample files, the multiple code similarity scores are obtained.

[0129] It should be noted that, for the sake of convenience, the sample file to be calculated refers to any first sample file, and the code similarity score between the file to be detected and the sample file to be calculated can be calculated by the following steps:

[0130] First, the code hash value set of the sample file to be calculated and the target code hash value set are intersected and unioned to obtain the intersection of the two sets, i.e., the code hash value intersection; and the union of the two sets, i.e., the code hash value union.

[0131] Secondly, the number of hash values ​​contained in the code hash value intersection and the code hash value union is counted respectively, the number of hash values ​​in the code hash value intersection is recorded as a first number, and the number of hash values ​​in the code hash value union is recorded as a second number;

[0132] Finally, the ratio between the first number and the second number is determined as the code similarity score corresponding to the sample file to be calculated.

[0133] According to the above process, the file to be detected is compared with the plurality of first sample files respectively to obtain a plurality of code similarity scores. Here, the process is to calculate the code similarity scores according to the aforementioned formula (1).

[0134] In addition, in the application embodiment, it is also possible to determine only the union of the target code hash value set and the code hash value set to be calculated, that is, the code hash value union; in this case, the code similarity score is calculated according to the aforementioned formula (2).

[0135] In this way, through the above process, it is possible to preliminarily determine whether there are similar sample files of the file to be detected in the first feature database; if there are similar sample files, the file type of the file to be detected, whether it is a malicious file, and other information can be preliminarily determined through the similar sample files.

[0136] It should also be noted that since the first sample files are all known files, in addition to storing the feature information of each of the first sample files, other information that can be collected about the sample files (such as code family information and malicious code location) will also be stored. Therefore, if there are sample files similar to the file to be detected in the first feature database, the method may further include:

[0137] Determine a similar sample file to the file to be detected as a target sample file;

[0138] The code family information of the target sample file is obtained from the first feature database, and the code family to which the file to be detected belongs is determined according to the code family information.

[0139] It should be noted that, for the convenience of description, a similar sample file to the detection file is referred to as a target sample file below.

[0140] If similar sample files to the file to be detected exist in the first feature database, since the first feature database also stores the code family information for each first sample file, determining the code family information of the target sample file in the first feature database also reveals the code family to which the file to be detected belongs. Here, a code family refers to a class of codes with similar behavior. If the code family to which the file to be detected belongs can be determined, the behavior information, offensiveness, source, and attack targets of the file to be detected can be more accurately predicted, thereby completing the source analysis of the file to be detected.

[0141] Furthermore, in some embodiments, when there are sample files similar to the file to be detected in the first feature database, the method may further include:

[0142] Determining whether the first feature database includes a malicious code location of the target sample file;

[0143] If the judgment result is yes, malicious code is extracted from the file to be detected according to the malicious code position to obtain a target code; wherein the target code is used to determine whether the file to be detected is a malicious file.

[0144] It should be noted that if the target sample file itself is a malicious file, the location of the malicious code may also be recorded in the first database. According to the location of the malicious code, the malicious code is extracted from the file to be detected (specifically the code to be detected), and the target code can be obtained. Then, based on the target code, it is possible to more accurately determine whether the file to be detected is a malicious file, and even obtain information such as the attack object, attack means and attack process of the file to be detected; in addition, the way the target code is written can also help to infer the latest development trend of malicious files, so as to carry out some active defense measures. In other words, through the code family to which the file to be detected belongs, the target malicious code and the target similar sample file, a comprehensive malicious evidence can be provided for the file to be detected.

[0145] In this way, according to the first preset granularity, the first target feature of the file to be detected can be extracted, and then according to the similarity query result of the first target feature in the first feature database, it is determined whether there is a similar sample file to the file to be detected in the first feature database.

[0146] S204: When there is no similar sample file to the file to be detected in the first feature database, obtain content data of the file to be detected.

[0147] It should be noted that if the first feature database cannot detect similar sample files of the file to be detected, the second target feature of the file to be detected can be further extracted. In the embodiment of the present application, the second target feature is text content granularity, so it is necessary to obtain the content data of the file to be detected, such as binary data.

[0148] S205: Obtain the second target feature according to the content data of the file to be detected.

[0149] It should be noted that feature extraction is performed on the content data of the file to be detected to obtain the second target feature.

[0150] Furthermore, in some embodiments, obtaining the second target feature according to the content data of the file to be detected may include:

[0151] Calculating a hash value for the content data of the file to be detected to obtain a target content hash value;

[0152] The target content hash value is determined as the second target feature.

[0153] It should be noted that the second preset granularity is file content granularity, meaning that features are extracted based on the content of the file to be detected. This involves obtaining the content data of the file to be detected, typically in binary format. A hash value is then calculated on the content data to obtain the target content hash value, which serves as the second target feature.

[0154] Here, the hash calculation for the file content data can also use a variety of hash algorithms, such as the fuzzy hash algorithm, the MD5 message digest algorithm, or the SHA256 algorithm. In addition, the hash calculation for the object to be detected and the hash calculation for the file content data can use the same hash algorithm or different algorithms.

[0155] In this way, if similar sample files of the file to be detected cannot be determined in the first feature database, the second target feature of the file to be detected can be extracted according to the second preset granularity, thereby more comprehensively querying similar sample files of the file to be detected and improving the accuracy of tracing analysis.

[0156] S206: Perform a similarity query on the second target feature in a second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0157] It should be noted that after obtaining the second target feature, a similarity query is performed on the second target feature in the second database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0158] Furthermore, in some embodiments, the method may further include:

[0159] obtaining a plurality of second sample files;

[0160] performing feature extraction on each of the plurality of second sample files according to the second preset granularity to obtain content features of each of the plurality of second sample files;

[0161] The second feature database is established based on the content features of each of the plurality of second sample files.

[0162] When the second preset granularity is the file content granularity, the content feature of the second sample file is a content hash value. In this case, the second feature database stores the content hash values ​​of multiple second sample files. Therefore, in some embodiments, performing a similarity query on the second target feature in the second feature database to determine whether there are similar sample files to the file to be detected in the second feature database may include:

[0163] Comparing the content hash values ​​of the plurality of second sample files with the target content hash value to determine a plurality of content similarity scores, wherein each second sample file in the plurality of second sample files corresponds to a content similarity score;

[0164] determining a highest content similarity score from the plurality of content similarity scores;

[0165] If the highest content similarity score is greater than or equal to a second preset threshold, determining that a similar sample file to the file to be detected exists in the second feature database;

[0166] When the highest second similarity score is less than the second preset threshold, it is determined that no similar sample file to the file to be detected exists in the second feature database.

[0167] It should be noted that performing similarity query on the target content feature in the preset content database may specifically include the following steps:

[0168] First, the content hash values ​​of the plurality of second sample files are compared with the target content hash value to determine a plurality of content similarity scores. Here, the content similarity score is used to indicate the similarity between the file to be detected and any second sample file, so each second sample file corresponds to a content similarity score.

[0169] Then, the highest content similarity score is determined from the multiple content similarity scores, and the highest content similarity score is compared with a second preset threshold value. Here, the second preset threshold value can be determined according to the actual application scenario.

[0170] If the highest content similarity score is greater than or equal to the second preset threshold, it indicates that a similar sample file to the file to be detected exists in the second feature database. If the highest second similarity score is less than the second preset threshold, it indicates that a similar sample file to the file to be detected does not exist in the second feature database. In this case, the file to be detected can be considered an isolated file.

[0171] Furthermore, in some embodiments, the method may further include:

[0172] When the highest content similarity score is less than the second preset threshold, the second sample file corresponding to the highest content similarity score is determined as a similar sample file to the file to be detected.

[0173] It should also be noted that, when the highest content similarity score is less than the second preset threshold, the second sample file corresponding to the highest content similarity score is determined as a similar sample file to the file to be detected. In this way, the file to be detected can be further understood based on the relevant information of the target sample file.

[0174] The embodiment of the present application provides a similarity query method, which extracts features from a file to be detected according to a first preset granularity to obtain a first target feature; performs a similarity query on the first target feature in a first feature database to determine whether a similar sample file of the file to be detected exists in the first feature database; if a similar sample file of the file to be detected does not exist in the first feature database, extracts features from the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity; performs a similarity query on the second target feature in the second feature database to determine whether a similar sample file of the file to be detected exists in the second feature database; in this way, by extracting features from the file to be detected using two preset granularities (the first preset granularity and the second preset granularity) respectively, and performing similarity queries in sequence based on the extracted features, it is possible to more accurately perform source tracing analysis on the file to be detected, so as to detect similar sample files of the file to be detected, thereby understanding the category of the file to be detected, whether it is a malicious file, the attack method, the attack target, the attacker information, etc.; in addition, the above process can also realize automatic source tracing analysis of the file to be detected, improve analysis efficiency, and analyze massive samples.

[0175] In another embodiment of the present application, see Figure 3 , which shows a flow chart of a database updating method provided by an embodiment of the present application. Figure 3 As shown, the method may include:

[0176] S301: Acquire a file to be detected, perform feature extraction on the file to be detected according to code granularity to obtain a first target feature, and perform feature extraction on the file to be detected according to content granularity to obtain a second target feature.

[0177] It should be noted that, when the first preset granularity is the code granularity, the second preset granularity is the content granularity, and the first feature database stores the corresponding code family, the present application further provides a database update method to continuously improve the database, especially the first feature database, so as to be more conducive to querying samples with similar behaviors based on the code granularity, thereby improving the tracking and tracing capabilities. In other words, after performing a similarity query on the files to be detected in the first feature database and the second feature database, the files to be detected will also be stored in the database based on the similarity query results, so that the first feature database and the second feature database are updated in a timely manner, thereby ensuring that accurate identification can be performed when new files to be detected are received subsequently.

[0178] Based on this idea, the database includes a first feature database and a second feature database. The first feature database stores code features of the first sample file and can also indicate the code family to which the first sample file belongs. The second feature database stores content features of the second sample file.

[0179] S302: When similar sample files to the file to be detected do not exist in the first feature database, and similar sample files to the file to be detected exist in the second feature database, the first target feature and the code features of the similar sample files are stored in the first feature database, and the code family to which the file to be detected belongs is determined, so as to indicate the first target feature and the code features of the similar sample files in the first feature database.

[0180] S303: When there is no similar sample file to the file to be detected in the first feature database and there is no similar sample file to the file to be detected in the second feature database, the second target feature is stored in the second feature database.

[0181] Here, there is no specific execution order between step S302 and step S303.

[0182] It should be noted that after querying the files to be detected using the first feature database or the second feature database, different processing methods are used depending on the query results. The reasons for the different processing methods are as follows: the first feature database generally stores code features of different code families and does not store files that do not clearly belong to a code family. The second feature database stores content features, that is, it extracts and stores all different files.

[0183] Based on the above principles, the similarity query results of the files to be detected can be divided into two categories:

[0184] Query result (1): There is no similar sample file to the file to be detected in the first feature database, and there is a similar sample file to the file to be detected in the second feature database.

[0185] In this case, it is necessary to store the first target feature into the first feature database; in addition, the second target feature is stored into the second feature database.

[0186] Specifically, if a similar sample file is found in the second feature database, it indicates that the file to be detected and the similar sample file belong to the same family. Therefore, the first target feature of the file to be detected can be included in the first feature database with reference to the code family to which the similar sample file belongs (the name of the code family can be an artificially named "custom family 1", which is not limited in this application). At the same time, if the feature corresponding to the similar sample file in the second feature database is not included in the first feature database, it will also be included in the first feature database and its corresponding family will be identified.

[0187] For example, assume that there are files 1 and 2. When performing a similarity check on file 1, neither the first feature database nor the second feature database can find a similar sample file. In this case, the content features of file 1 are stored in the second feature database. Then, when performing a similarity check on file 2, the first feature database cannot find a similar sample file, but the second feature database finds that file 2 is similar to file 1. In this case, files 1 and 2 constitute a new code family. In this case, a family identifier can be set for the code family of files 1 and 2, and the code features of files 1 and 2 can be stored in the first feature database based on the family identifier.

[0188] Query result (2): There are no similar sample files of the file to be detected in the first feature database and the second feature database.

[0189] In this case, the second target feature needs to be stored in the second feature database.

[0190] Specifically, since it is impossible to determine whether the file to be detected is a file that appears by chance (in this case, it does not need to be stored in the first feature database) or one of the files of a new code family (in this case, it needs to be stored in the first feature database), it will first be treated as an isolated sample to extract content features and store them in the second feature database.

[0191] Furthermore, in some embodiments, for the query result (1), the method further includes:

[0192] The second target feature is stored in the second feature database.

[0193] It should be noted that, since the second feature database is used to store content features of different files, even if the content features of "similar sample files to the file to be detected" are already stored in the second feature database, the content features of the file to be detected (i.e., the second target features) can still be stored in the second feature database.

[0194] Furthermore, in some embodiments, when there are sample files similar to the file to be detected in the first feature database, the method may further include:

[0195] The second target feature is stored in the second feature database.

[0196] It should be noted that, in addition to query results (1) and (2), query result (3) may also appear. Query result (3) refers to sample files similar to the file to be detected that exist in the first feature database.

[0197] In this case, regardless of whether the second feature database can find a similar sample file to the file to be detected, the second target feature can be stored in the second feature database.

[0198] Furthermore, for the query result (3), the method may further include:

[0199] The first target feature is stored in the first feature database.

[0200] It should be noted that, similarly, even if the first feature database already stores code features of “similar sample files to the file to be detected”, the code features of the file to be detected (ie, the first target features) can still be stored in the first feature database.

[0201] Furthermore, with respect to the query result (3), storing the second target feature into the second feature database may include:

[0202] When there is no similar sample file in the second feature database, the second target feature is stored in the second feature database.

[0203] It should be noted that, considering the problem of storage space occupation, the second target feature can be stored in the database only when there is no similar sample file in the second feature database.

[0204] To summarize, for different query results, you can update the database by following these steps:

[0205] For query result (1), the file to be detected cannot be found in the first feature database, but can be found in the second feature database. At this time, the first target feature is stored in the first feature database, and the second target feature is stored in the second feature database.

[0206] For query result (2), neither the first feature database nor the second feature database can find the file to be detected. In this case, the second target feature is stored in the second feature database, and if the code family to which the file to be detected belongs can be determined, the first target feature is stored in the first feature database.

[0207] Regarding query result (3): if there are similar sample files of the file to be detected in the first feature database, the second target feature is stored in the second feature database.

[0208] It should be understood that for query result (2), since the corresponding code features already exist in the first feature database, and since the features at the code level may occupy a large amount of storage space, considering the problem of storage space occupation, it is not necessary to store the first target features of the file to be detected in the database; however, since the features at the file content level do not occupy much space, the second target features of the file to be detected can be stored in the second feature database. In addition, this application does not exclude the possibility of storing the first target features of the file to be detected in the first feature database, and this solution is also within the scope of protection of this application;

[0209] Regarding the above feature storage step, regardless of whether similar sample files are found in the second feature database, the content features of the file to be detected will be stored in the second feature database. Although this ensures the real-time update of the second feature database, it may cause the amount of data in the second feature database to be too large, thereby slowing down the system operation. Therefore, considering the storage space, the following also provides an optimized feature storage step. Specifically, the above query result (3) is divided into two cases:

[0210] Query result (3.1): If the file to be detected can be found in both the first feature database and the second feature database, it means that the file to be detected belongs to a known code family, and the features of the file to be detected have been recorded in both the first feature database and the second feature database. Therefore, there is no need to store the features of the file to be detected, that is, the content features of the file to be detected are not stored.

[0211] Query result (3.2): If the first feature database can find the file to be detected, but the second feature database cannot find it, it means that the file to be detected belongs to a known code family, and there is no similar record of the file content features of the file to be detected in the second feature database. The content features of the file to be detected will be stored in the database.

[0212] For query results (1) and (2), follow the above steps.

[0213] In addition, you can also choose to automatically store files that are determined to be malicious samples into the database to continuously enhance the system's traceability capabilities.

[0214] In this way, the similarity query method provided in the embodiment of the present application can also support the automatic storage of files to be detected, and continuously enhance the traceability capability of the system.

[0215] In summary, the embodiment of the present application provides a similarity query method that can automatically analyze the files to be detected and support efficient traceability of massive samples. Specifically, the embodiment of the present application includes the following parts: (1) Based on massive samples, a distributed database (i.e., a first feature database and a second feature database) is established to store the features of different sample files (e.g., code features and content features); (2) the files to be detected are traced from the first preset granularity and the second preset granularity respectively, and according to the traceability results, the maliciousness of the malicious files can be comprehensively proved from multiple dimensions such as similar samples, belonging families, shells, malicious codes, etc.; (3) the files to be detected are supported to be automatically stored in the warehouse, and the traceability capability of the system is continuously enhanced.

[0216] The embodiment of the present application provides a database update method, which obtains a file to be detected, extracts features of the file to be detected according to the code granularity to obtain a first target feature, and extracts features of the file to be detected according to the content granularity to obtain a second target feature; if there is no similar sample file of the file to be detected in the first feature database, and there is a similar sample file of the file to be detected in the second feature database, the first target feature and the code features of the similar sample file are stored in the first feature database, and the code family to which the file to be detected belongs is determined to indicate the first target feature and the code features of the similar sample file in the first feature database; if there is no similar sample file of the file to be detected in the first feature database, and there is no similar sample file of the file to be detected in the second feature database, the second target feature is stored in the second feature database. In this way, the first target feature and / or the second target feature are stored in the database according to the query result of the file to be detected, ensuring that the two feature databases are updated in a timely manner and continuously improving the ability of traceability analysis. In addition, the similarity query method in the embodiment of the present application has realized an automated process, and can perform automated analysis by providing a sample file, which can trace the source of massive samples and improve the efficiency of traceability analysis.

[0217] In yet another embodiment of the present application, see Figure 4 , which shows a flow chart of another similarity query method provided by an embodiment of the present application. Figure 4 As shown, the method may include:

[0218] S401: Establish two preset databases based on a large number of sample files.

[0219] It should be noted that the embodiment of the present application provides a similarity query method that can perform similarity query on the file to be detected, thereby obtaining the traceability analysis results of the file to be detected. The entire similarity query method can be divided into three parts: database establishment method, similarity matching method and automatic warehousing method.

[0220] The database establishment method is to establish two preset databases based on a large number of sample files. Here, the two preset databases are equivalent to the first feature database and the second feature database mentioned above.

[0221] Furthermore, if Figure 5 As shown, step S401 may specifically include the following process:

[0222] S501: Obtain a large number of sample files.

[0223] It should be noted that two preset databases are established by using popular sample files in specific product fields in the past two years and daily new sample files to obtain massive sample files.

[0224] S502: Perform feature extraction on the massive sample files to obtain content features of each of the massive sample files and code features of each of the massive sample files.

[0225] It should be noted that feature extraction is performed on the massive sample files obtained. Here, the extracted features include features at two granularities: one is the content feature (equivalent to the aforementioned code feature), which uses the fuzzy hash method to calculate the binary content of the entire sample file to obtain the content feature at the file content granularity; the other is the code feature (equivalent to the aforementioned content feature), which first uses a disassembly tool to disassemble the sample file to obtain the assembly code of the sample file, and then subdivides the assembly code into multiple functions (equivalent to the aforementioned objects to be detected); secondly, instruction generalization technology is used to remove some features that interfere with similarity matching. For example, the address of the instruction of the same function in different binaries is likely to change; finally, the fuzzy hash algorithm is used to calculate the hash value of each generalized function, thereby obtaining a set of hash values ​​corresponding to a sample file as the code feature of the sample file.

[0226] Here, when subdividing the assembly code, you can not only choose to use functions as units, but also expand it to the control flow graph of the function, partial basic block combination, and single basic block, etc.

[0227] S503: storing the content features of the massive sample files in a sample library, and storing the code features of the massive sample files in a code library.

[0228] It should be noted that the preset database is divided into two: a sample database that stores binary content features of sample files (equivalent to the aforementioned second feature database), and a code database that stores code features of sample files (equivalent to the aforementioned first feature database). After obtaining the sample features and code features of each sample file, the content features are stored in the sample database, and the code features are stored in the code database.

[0229] In this way, by extracting features from massive sample files, two preset databases, namely the sample library and the code library, were established to facilitate subsequent traceability analysis of the files to be tested.

[0230] S402: Perform similarity query on the files to be detected in two preset databases to obtain similarity detection results.

[0231] It should be noted that similarity queries are performed in two preset databases to determine whether similar sample files of the file to be detected can be found, thereby completing the traceability analysis of the file to be detected. In the embodiment of the present application, since the preset database is divided into two, the similarity between files is also defined from two granularities: the similarity of the file content granularity and the similarity of the code granularity. Among them,

[0232] Similarity at the file content granularity: This similarity is relatively strict. It uses a fuzzy hash value algorithm to calculate the binary file contents of two files respectively, and compares the two obtained hash values ​​to calculate the content similarity between the two files.

[0233] Code granularity similarity: This similarity is calculated based on each function in the code. First, the code information of the file is extracted using disassembly technology. Next, the code information is divided into multiple segments based on the combination of execution flows. Then, code irrelevant to the match (such as operands) is removed. Finally, the number of similar functions in the two files is counted, and the Jaccard similarity coefficient is calculated as the content similarity between the two files.

[0234] Therefore, if Figure 6 As shown, step S402 may specifically include the following process:

[0235] S601: Searching the file to be detected in the code library to determine a first similar sample file set.

[0236] It should be noted that the file to be detected is queried in the code library. Specifically, the code features of the file to be detected can be calculated according to the aforementioned method, and then the code features of the file to be detected can be compared with multiple code features stored in the code library to determine the first similar sample file set. Here, since the code library stores the code features of each type of sample file, the first similar sample file set refers to the type of sample file stored in the code library that is most similar to the file to be detected. In other words, the first similar sample file set is compared as a whole with the file to be detected for similarity, and the first similar sample file set is essentially equivalent to the aforementioned "first sample corresponding to the highest code similarity score."

[0237] S602: Determine whether the similarity between the first similar sample file set and the file to be detected is greater than or equal to a first preset threshold.

[0238] Here, for step S602, if the judgment result is yes, step S603 is executed; if the judgment result is no, step S604 is executed.

[0239] It should be noted that, by judging whether the similarity between the first similar sample file set and the file to be detected (specifically, the aforementioned highest code similarity score) is greater than or equal to the first preset threshold, it is determined whether there are similar sample files to the file to be detected in the code library.

[0240] S603: Determine whether the file to be detected is a known family file.

[0241] It should be noted that, for the code library, the sample files stored therein all belong to files of a known family. Therefore, if the highest code similarity score is greater than or equal to the first preset threshold, the file to be detected is determined to be a file of a known family.

[0242] It should also be noted that for malicious code families, the code library will also record the malicious code location, so that the malicious code of the file to be detected can be obtained.

[0243] S604: Searching the file to be detected in the sample library to determine a second similar sample file set.

[0244] It should be noted that the file to be detected is queried in the code library. Specifically, the content features of the file to be detected can be calculated according to the aforementioned method, and then the content features of the file to be detected can be compared one by one with the multiple content features stored in the sample library, and the second similar sample file set is determined based on the comparison results. Similarly, since the sample library is stored according to the content features of each type of sample file, the second similar sample file set refers to a type of sample file stored in the sample library that is most similar to the file to be detected. In other words, the second similar sample file set is compared as a whole with the file to be detected, and the second similar sample file set is essentially equivalent to the aforementioned "second sample corresponding to the highest content similarity score".

[0245] S605: Determine whether the similarity between the second similar sample file set and the file to be detected is greater than or equal to a second preset threshold.

[0246] Here, for step S605, if the judgment result is yes, step S606 is executed; if the judgment result is no, step S607 is executed.

[0247] It should be noted that it is determined whether the similarity between the second similar sample file set and the file to be detected (specifically, the aforementioned highest content similarity score) is greater than or equal to the second preset threshold, thereby determining whether there are similar sample files to the file to be detected in the sample library.

[0248] S606: Determine that the file to be detected is an unknown family file.

[0249] It should be noted that if the similarity between the second similar sample file set and the file to be detected is greater than or equal to the second preset threshold, the file to be detected is determined to be an unknown family file.

[0250] S607: Determine whether the file to be detected is an isolated sample file.

[0251] It should be noted that if the similarity between the second similar sample file set and the file to be detected is less than a second preset threshold, the file to be detected is determined to be an isolated sample file.

[0252] In other words, the query method for the files to be tested is a two-level query. First, the code library is queried. Since the samples involved in the code library are all samples of known families, the samples found belong to known families. Second, if no similar samples are found in the code library, the sample library is queried. If a similar sample is found, it means that similar samples can be found in the family, but the family information is unknown. Finally, if no similar samples are found in either the code library or the sample library, it is considered a relatively new sample and is recorded as an isolated sample.

[0253] Through similarity query, the following information can be obtained:

[0254] (1) Similar sample files of the file to be detected: Similar samples are obtained through two channels: one is through code similarity, and the other is through file content similarity.

[0255] (2) The code family to which the file to be detected belongs: Files with similar code features must behave in the same way. Therefore, in this embodiment of the application, the family of similar samples is used as the family of the file to be detected.

[0256] (3) Malicious code of the file to be detected: The embodiment of the present application records the location of each similar code in the sample and saves the malicious information of the code fragment in the database. Combining these two parts can obtain the malicious code of the sample.

[0257] In this way, a similarity query is performed on the file to be detected through a preset database to obtain a similarity query result, so as to obtain the traceability information of the file to be detected.

[0258] S403: Based on the similarity query results, the files to be detected are automatically stored in the database.

[0259] It should be noted that, based on the similarity query results, the files to be tested are automatically stored in the database so that the sample library and code library are updated in a timely manner and a high detection rate is always maintained.

[0260] Specifically, see Figure 7 , which shows a schematic diagram of the working process of a database update method provided by an embodiment of the present application. Figure 7 As shown in the figure, sample storage can be divided into three situations:

[0261] (1) Isolated sample files: The sample family is unknown and there are no similar samples. Such samples are temporarily inserted into the sample library and then inserted into the code library after obtaining the family information.

[0262] (2) Known family files: Similar samples can be queried through the code library. Since the corresponding code information already exists in the code library, there is no need to insert the code library, only the sample library.

[0263] (3) Unknown family file: This means that similar samples cannot be found through the code library, but can be found through the sample library. In this case, the sample information needs to be inserted into both the sample library and the code library.

[0264] That is to say, the embodiment of the present application proposes a fast code similarity query system, which can be divided by providing samples, and can support the tracing of massive samples. The fast code similarity query system in the embodiment of the present application includes the following parts: (1) Based on massive samples, a distributed database is established to store file content and code information; (2) The source of the files to be detected is traced from the granularity of files and codes respectively, and the maliciousness of malware is comprehensively proved from multiple dimensions such as similar samples, belonging families, shells, malicious codes, etc.; (3) It supports the automatic storage of malicious samples, and continuously enhances the system's tracing ability. In this way, the fast code similarity query system can perform similarity queries on the files to be detected, thereby obtaining the tracing analysis results of the files to be detected; and the similarity query process provided by the embodiment of the present application has been automated, and new data sources are continuously inserted into the preset database, so that the tracing analysis capability is also continuously enhanced.

[0265] To sum up, the embodiment of the present application can trace the source of multiple family events through the code similarity matching method, providing more sample sources for malicious file analysis; and through the code tracing capability of the embodiment of the present application, code information of multiple malicious files can be extracted.

[0266] In addition, the following technical solutions are also within the scope of protection of the embodiments of the present application: (1) Any method similar to the architecture or method of the embodiments of the present application, but used in different scenarios. (2) Any method similar to the architecture or method of the embodiments of the present application, using code similarity to query similar samples. (3) Any method similar to the architecture or method of the embodiments of the present application, using code similarity to trace family ancestry. (4) Any method similar to the architecture or method of the embodiments of the present application, using code similarity to locate malicious code. (5) In the embodiments of the present application, the sample code segmentation granularity includes functions, basic blocks, basic block combinations, partial control flows, etc. (6) Any method similar to the architecture or method of the embodiments of the present application, but using different similarity definitions. (7) Any method that uses code information to calculate the similarity between samples.

[0267] The embodiment of the present application provides a similarity query method. Through the detailed explanation of the above embodiment in this embodiment, it can be seen that two feature databases are established for two preset granularities respectively, and then feature extraction and similarity query are performed on the files to be detected in turn. This can more accurately detect similar sample files of the files to be detected and improve the accuracy of traceability analysis.

[0268] In another embodiment of the present application, see Figure 8 , which shows a schematic diagram of the composition structure of a similarity query device 70 provided in an embodiment of the present application. Figure 8As shown, the similarity query device 70 includes a first extraction unit 701, a first query unit 702, a second extraction unit 703 and a second query unit 704; wherein,

[0269] The first extraction unit 701 is configured to extract features of the file to be detected according to a first preset granularity to obtain a first target feature;

[0270] A first query unit 702 is configured to perform a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database;

[0271] A second extraction unit 703 is configured to extract features of the file to be detected according to a second preset granularity to obtain a second target feature if there is no similar sample file to the file to be detected in the first feature database; wherein the second preset granularity is different from the first preset granularity;

[0272] The second query unit 704 is configured to perform a similarity query on the second target feature in the second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0273] In some implementations, the first preset granularity is the code granularity; the first extraction unit 701 is specifically configured to disassemble the file to be detected to obtain the code to be detected corresponding to the file to be detected; perform feature extraction on the code to be detected to obtain the first target feature; and / or, the second preset granularity is the file content granularity; the second extraction unit 703 is specifically configured to obtain the content data of the file to be detected; and obtain the second target feature based on the content data of the file to be detected.

[0274] In some embodiments, the first extraction unit 701 is further configured to perform a segmentation operation on the code to be detected based on a preset subdivision granularity to obtain at least one object to be detected; wherein the preset subdivision granularity includes at least one of the following: function, control flow, basic block; calculate the hash value of each of the at least one object to be detected to form a target code hash value set; and determine the target code hash value set as the first target feature.

[0275] In some embodiments, the first feature database further stores code family information of respective first sample files; the first query unit 702 is further configured to, if a similar sample file of the file to be detected exists in the first feature database, determine the similar sample file of the file to be detected as a target sample file; obtain the code family information of the target sample file from the first feature database, and determine the code family to which the file to be detected belongs based on the code family information.

[0276] In some embodiments, the first query unit 702 is further configured to determine whether the first feature database includes the malicious code location of the target sample file; if the judgment result is yes, the malicious code of the file to be detected is extracted according to the malicious code location to obtain the target code; wherein, the target code is used to determine whether the file to be detected is a malicious file.

[0277] In some embodiments, the second extraction unit 703 is specifically configured to obtain content data of the file to be detected; perform hash value calculation on the content data of the file to be detected to obtain a target content hash value; and determine the target content hash value as the second target feature.

[0278] It is understood that in this embodiment, a "unit" can be a portion of a circuit, a portion of a processor, a portion of a program or software, etc., and can also be a module or a non-modular system. Furthermore, the various components in this embodiment can be integrated into a single processing unit, or each unit can exist physically separately, or two or more units can be integrated into a single unit. The aforementioned integrated units can be implemented in the form of hardware or software functional modules.

[0279] If the integrated unit is implemented as a software functional module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, service device, or network device, etc.) or a processor to execute all or part of the steps of the method of this embodiment. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0280] Therefore, this embodiment provides a computer storage medium storing a computer program. When the computer program is executed by at least one processor, the steps of the user recommendation method in any one of the aforementioned embodiments are implemented.

[0281] Based on the composition of the similarity query device 80 and the computer storage medium, see Figure 9 , which shows a schematic diagram of the specific hardware structure of a similarity query device 80 provided in an embodiment of the present application. Figure 9 As shown, it may include: a first communication interface 801, a first memory 802 and a first processor 803; each component is coupled together via a bus system 804. It is understood that the first bus system 804 is used to achieve connection and communication between these components. In addition to the data bus, the first bus system 804 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 9 Various buses are labeled as the first bus system 804. Among them, the first communication interface 801 is used to receive and send signals during the process of sending and receiving information between other external network elements;

[0282] A first memory 802 is used to store computer programs that can be run on the first processor 803;

[0283] The first processor 803 is configured to, when running the computer program, execute:

[0284] Extracting features of the file to be inspected according to a first preset granularity to obtain a first target feature;

[0285] Performing a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database;

[0286] If there is no similar sample file to the file to be detected in the first feature database, extract features of the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity;

[0287] A similarity query is performed on the second target feature in a second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database.

[0288] It is understood that the first memory 802 in the embodiment of the present application can be a volatile first memory or a non-volatile first memory, or can include both volatile and non-volatile first memories. Among them, the non-volatile first memory can be a read-only first memory (ROM), a programmable read-only first memory (PROM), an erasable programmable read-only first memory (EPROM), an electrically erasable programmable read-only first memory (EEPROM), or a flash memory. The volatile first memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus random access memory (DRRAM). The first memory 802 of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of first memory.

[0289] The first processor 803 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits or software instructions in the first processor 803. The above-mentioned first processor 803 may be a general-purpose first processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of this application can be implemented or executed. The general-purpose first processor can be a microprocessor or any conventional first processor. The steps of the method disclosed in the embodiments of this application can be directly implemented and executed by the hardware decoding first processor, or by a combination of hardware and software modules in the decoding first processor. The software module can be located in a storage medium mature in the art, such as a random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the first memory 802 , and the first processor 803 reads the information in the first memory 802 and completes the steps of the above method in combination with its hardware.

[0290] It is understood that the embodiments described herein may be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit may be implemented in one or more application-specific integrated circuits (ASICs), digital signal processing (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, or other electronic units or combinations thereof for performing the functions of the present invention.

[0291] For software implementation, the technology of the present application can be implemented by a module (e.g., a procedure, a function, etc.) that performs the functions of the present application. The software code can be stored in a first memory and executed by a first processor. The first memory can be implemented in the first processor or external to the first processor.

[0292] Optionally, as another embodiment, the first processor 803 is further configured to execute the steps of the method in any one of the aforementioned embodiments when running the computer program.

[0293] Based on the composition and hardware structure of the above-mentioned similarity query device 70 , an embodiment of the present application further provides a similarity query system, which at least includes a similarity query 70 .

[0294] An embodiment of the present application provides a similarity query device, which includes a first extraction unit, a first query unit, a second extraction unit, and a second query unit. Two feature databases are established based on two preset granularities, and then feature extraction and similarity query are performed on the files to be detected in turn. This device can more accurately detect similar sample files of the files to be detected, thereby improving the accuracy of traceability analysis.

[0295] In another embodiment of the present application, see Figure 10 , which shows a structural diagram of a database updating device 90 provided in an embodiment of the present application, such as Figure 10 As shown, the database includes a first feature database and a second feature database, wherein the first feature database stores code features of each of a plurality of first sample files and code family information of each of the plurality of first sample files, and the second feature database stores content features of each of a plurality of second sample files;

[0296] The database updating device 90 includes an acquiring unit 901 and an updating unit 902; wherein,

[0297] An acquisition unit 901 is configured to acquire a file to be detected, perform feature extraction on the file to be detected based on code granularity to obtain a first target feature, and perform feature extraction on the file to be detected based on content granularity to obtain a second target feature;

[0298] The updating unit 902 is configured to, if similar sample files to the file to be detected do not exist in the first feature database, but similar sample files to the file to be detected do exist in the second feature database, store the first target feature and the code features of the similar sample files together in the first feature database, and determine the code family to which the file to be detected belongs, so as to indicate the first target feature and the code features of the similar sample files in the first feature database;

[0299] The updating unit 902 is further configured to store the second target feature in the second feature database if there is no similar sample file of the file to be detected in the first feature database and there is no similar sample file of the file to be detected in the second feature database.

[0300] In some embodiments, the updating unit 902 is further configured to store the second target feature into the second feature database when there is no similar sample file of the file to be detected in the first feature database and there is a similar sample file of the file to be detected in the second feature database.

[0301] In some embodiments, the updating unit 902 is further configured to store the second target feature in the second feature database if a similar sample file to the file to be detected exists in the first feature database.

[0302] In some embodiments, the updating unit 902 is further configured to store the first target feature in the first feature database if a similar sample file to the file to be detected exists in the first feature database.

[0303] In some embodiments, the updating unit 902 is further configured to store the second target feature in the second feature database if there is no similar sample file in the second feature database.

[0304] It is understood that in this embodiment, a "unit" can be a portion of a circuit, a portion of a processor, a portion of a program or software, etc., and can also be a module or a non-modular system. Furthermore, the various components in this embodiment can be integrated into a single processing unit, or each unit can exist physically separately, or two or more units can be integrated into a single unit. The aforementioned integrated units can be implemented in the form of hardware or software functional modules.

[0305] If the integrated unit is implemented as a software functional module and not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, this embodiment provides a computer storage medium for use in database updating device 90. The computer storage medium stores a computer program that, when executed by a second processor, implements the steps of the work scoring method in any of the aforementioned embodiments.

[0306] Based on the composition of the above-mentioned database updating device 90 and the computer storage medium, see Figure 11 , which shows a specific hardware structure example of the database updating device 90 provided in an embodiment of the present application, such as Figure 11As shown, the database updating device 90 may include: a second communication interface 1001, a second memory 1002, and a second processor 1003; each component is coupled together via a second bus system 1004. It is understood that the second bus system 1004 is used to achieve connection and communication between these components. In addition to the data bus, the second bus system 1004 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, Figure 11 In FIG, various buses are labeled as a second bus system 1004.

[0307] The second communication interface 1001 is used to receive and send signals during the process of sending and receiving information with other external network elements;

[0308] The second memory 1002 is used to store computer programs that can be run on the second processor 1003;

[0309] The second processor 1003 is configured to, when running the computer program, execute:

[0310] Acquire a file to be detected, perform feature extraction on the file to be detected according to code granularity to obtain a first target feature, and perform feature extraction on the file to be detected according to content granularity to obtain a second target feature;

[0311] If similar sample files to the file to be detected do not exist in the first feature database, and similar sample files to the file to be detected exist in the second feature database, storing the first target feature and the code features of the similar sample files in the first feature database, and determining the code family to which the file to be detected belongs, so as to indicate the first target feature and the code features of the similar sample files in the first feature database;

[0312] When there is no similar sample file to the file to be detected in the first feature database and there is no similar sample file to the file to be detected in the second feature database, the second target feature is stored in the second feature database.

[0313] Optionally, as another embodiment, the second processor 1003 is further configured to execute any one of the methods in the foregoing embodiments when running the computer program.

[0314] It can be understood that the hardware functions of the second memory 1002 and the first memory 802 are similar, and the hardware functions of the second processor 1003 and the first processor 803 are similar; they will not be described in detail here.

[0315] Based on the composition and hardware structure of the above-mentioned database updating device 90 , an embodiment of the present application further provides a database updating system, which at least includes the database updating device 90 .

[0316] An embodiment of the present application provides a database updating device, which includes an acquisition unit and an update unit, and uses the first target feature and the second target feature of the file to be detected to update the database, so that the number of features in the first feature database and the second feature database continues to increase, and thus the first database and the second feature database can provide better traceability analysis capabilities.

[0317] The above description is merely a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application.

[0318] It should be noted that, in this application, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0319] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0320] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0321] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0322] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0323] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A similarity query method, characterized in that: The method comprises: Extracting features of the file to be inspected according to a first preset granularity to obtain a first target feature; Performing a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file to the file to be detected in the first feature database; If there is no similar sample file to the file to be detected in the first feature database, extract features of the file to be detected according to a second preset granularity to obtain a second target feature; wherein the second preset granularity is different from the first preset granularity; Performing a similarity query on the second target feature in a second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database; The first preset granularity is code granularity, and the second preset granularity is file content granularity; The extracting features of the file to be detected according to the first preset granularity to obtain the first target feature includes: Disassembling the file to be detected to obtain code to be detected corresponding to the file to be detected; segmenting the code to be detected based on a preset subdivision granularity to obtain at least one object to be detected; wherein the preset subdivision granularity includes at least one of the following: function, control flow, and basic block; calculating a hash value of each of the at least one object to be detected to form a target code hash value set; and determining the target code hash value set as the first target feature; The extracting features of the file to be detected according to the second preset granularity to obtain a second target feature includes: Acquire content data of the file to be detected; and obtain the second target feature based on the content data of the file to be detected.

2. The similarity query method according to claim 1, characterized in that: The first feature database further stores code family information of respective first sample files. When similar sample files to the file to be detected exist in the first feature database, the method further includes: Determine a similar sample file to the file to be detected as a target sample file; The code family information of the target sample file is obtained from the first feature database, and the code family to which the file to be detected belongs is determined according to the code family information.

3. The similarity query method according to claim 2, characterized in that: When there is a sample file similar to the file to be detected in the first feature database, the method further includes: Determining whether the first feature database includes a malicious code location of the target sample file; If the judgment result is yes, malicious code is extracted from the file to be detected according to the malicious code position to obtain a target code; wherein the target code is used to determine whether the file to be detected is a malicious file.

4. The similarity query method according to claim 1, characterized in that: The obtaining of the second target feature according to the content data of the file to be detected includes: Calculating a hash value for the content data of the file to be detected to obtain a target content hash value; The target content hash value is determined as the second target feature.

5. A database updating method, characterized in that: The database includes a first feature database and a second feature database, wherein the first feature database stores code features of each of the plurality of first sample files and code family information of each of the plurality of first sample files, and the second feature database stores content features of each of the plurality of second sample files; The method comprises: Acquire a file to be detected, perform feature extraction on the file to be detected according to code granularity to obtain a first target feature, and perform feature extraction on the file to be detected according to content granularity to obtain a second target feature; If similar sample files to the file to be detected do not exist in the first feature database, and similar sample files to the file to be detected exist in the second feature database, storing the first target feature and the code features of the similar sample files in the first feature database, and determining the code family to which the file to be detected belongs, so as to indicate the first target feature and the code features of the similar sample files in the first feature database; If there is no similar sample file of the file to be detected in the first feature database and no similar sample file of the file to be detected in the second feature database, storing the second target feature in the second feature database; The step of obtaining a file to be detected and extracting features of the file to be detected according to code granularity to obtain a first target feature includes: Disassembling the file to be detected to obtain code to be detected corresponding to the file to be detected; segmenting the code to be detected based on a preset subdivision granularity to obtain at least one object to be detected; wherein the preset subdivision granularity includes at least one of the following: function, control flow, and basic block; calculating a hash value of each of the at least one object to be detected to form a target code hash value set; and determining the target code hash value set as the first target feature; The extracting features of the file to be detected according to the content granularity to obtain the second target feature includes: Acquire content data of the file to be detected; and obtain the second target feature based on the content data of the file to be detected.

6. The database updating method according to claim 5, characterized in that: In a case where there is no similar sample file to the file to be detected in the first feature database, and there is a similar sample file to the file to be detected in the second feature database, the method further includes: The second target feature is stored in the second feature database.

7. The database updating method according to claim 5 or 6, characterized in that: When there is a sample file similar to the file to be detected in the first feature database, the method further includes: The second target feature is stored in the second feature database.

8. The database updating method according to claim 7, characterized in that: When there is a sample file similar to the file to be detected in the first feature database, the method further includes: The first target feature is stored in the first feature database.

9. The database updating method according to claim 7, characterized in that: The storing the second target feature into the second feature database includes: When there is no similar sample file in the second feature database, the second target feature is stored in the second feature database.

10. A similarity query device, characterized in that: The similarity query device includes a first extraction unit, a first query unit, a second extraction unit and a second query unit, wherein: The first extraction unit is configured to extract features of the file to be detected according to a first preset granularity to obtain a first target feature; The first query unit is configured to perform a similarity query on the first target feature in a first feature database to determine whether there is a similar sample file of the file to be detected in the first feature database; The second extraction unit is configured to extract features of the file to be detected according to a second preset granularity to obtain a second target feature if there is no similar sample file to the file to be detected in the first feature database; wherein the second preset granularity is different from the first preset granularity; The second query unit is configured to perform a similarity query on the second target feature in the second feature database to determine whether there is a similar sample file to the file to be detected in the second feature database; The first preset granularity is code granularity, and the second preset granularity is file content granularity; The first extraction unit is specifically configured to disassemble the file to be detected to obtain the code to be detected corresponding to the file to be detected; segment the code to be detected based on a preset subdivision granularity to obtain at least one object to be detected; wherein the preset subdivision granularity includes at least one of the following: function, control flow, and basic block; calculate the hash value of each of the at least one object to be detected to form a target code hash value set; and determine the target code hash value set as the first target feature; The second extraction unit is specifically configured to obtain content data of the file to be detected; and obtain the second target feature according to the content data of the file to be detected.

11. A database updating device, characterized in that: The database includes a first feature database and a second feature database, wherein the first feature database stores code features of each of the plurality of first sample files and code family information of each of the plurality of first sample files, and the second feature database stores content features of each of the plurality of second sample files; The database updating device includes an acquiring unit and an updating unit; wherein, The acquisition unit is configured to acquire a file to be detected, perform feature extraction on the file to be detected according to code granularity to obtain a first target feature, and perform feature extraction on the file to be detected according to content granularity to obtain a second target feature; The updating unit is configured to, if similar sample files to the file to be detected do not exist in the first feature database, and similar sample files to the file to be detected do exist in the second feature database, store the first target feature and the code features of the similar sample files together in the first feature database, and determine the code family to which the file to be detected belongs, so as to indicate the first target feature and the code features of the similar sample files in the first feature database; The updating unit is further configured to store the second target feature in the second feature database if there is no similar sample file of the file to be detected in the first feature database and there is no similar sample file of the file to be detected in the second feature database; The acquisition unit is specifically configured to disassemble the file to be detected to obtain the code to be detected corresponding to the file to be detected; split the code to be detected based on a preset subdivision granularity to obtain at least one object to be detected; wherein the preset subdivision granularity includes at least one of the following: function, control flow, basic block; calculate the hash value of each of the at least one object to be detected to form a target code hash value set; determine the target code hash value set as the first target feature; and obtain content data of the file to be detected; and obtain the second target feature based on the content data of the file to be detected.

12. A similarity query system, characterized in that: The similarity query system at least includes the similarity query device according to claim 10.

13. A database updating system, characterized in that: The database updating system at least includes the database updating device according to claim 12.

Images