A shell identification method, a database establishment method, an apparatus, and a storage medium

Abstract

Embodiments of the present application provide a shell identification method, a database establishment method, an apparatus and a storage medium. The shell identification method comprises: obtaining a feature set to be detected of a file to be detected; performing similarity query on the feature set to be detected in a preset database, and determining a sub-shell label set of the file to be detected according to a query result; and performing statistical analysis on the sub-shell label set of the file to be detected, and determining whether the file to be detected is a file with a shell. In this way, the similarity query on the feature set to be detected of the file to be detected by using the preset database can quickly and accurately identify whether the file to be detected is a file with a shell, so as to perform safety analysis on the file to be detected in a targeted manner, and the disadvantage that the file with a shell is difficult to analyze is remedied.

Description

Technical Field

[0001] This application relates to the field of security detection technology, and in particular to a shell identification method, database establishment method, device and storage medium. Background Technology

[0002] Shell code is a type of code used to hide the actual executable code. When a shelled file is executed, the shell code decompresses the original executable program in memory and then returns control to the decompressed executable program.

[0003] While packers can protect legitimate files from unauthorized modification, they can also be used by malicious code to evade detection. Because the portion of a packed malicious file presented to security software is essentially unpacked code, it can evade scanning and removal by conventional security software. This can lead to the computer being compromised by malicious files during security analysis. Summary of the Invention

[0004] This application provides a shell identification method, a database establishment method, an apparatus, and a storage medium, which can quickly and accurately identify whether a file to be tested is a shell file, so as to perform targeted security analysis on the file to be tested and make up for the drawback of shell files being difficult to analyze.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, embodiments of this application provide a shell identification method, the method comprising:

[0007] Obtain the feature set of the file to be detected;

[0008] The feature set to be detected is queried in a preset database for similarity, and the subshell tag set of the file to be detected is determined based on the query results;

[0009] Statistical analysis is performed on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file.

[0010] In the above scheme, obtaining the feature set of the file to be detected includes:

[0011] The file to be detected is disassembled to obtain the code to be detected;

[0012] Based on a preset granularity, feature extraction is performed on the code to be detected to obtain the feature set to be detected; wherein the preset granularity includes at least one of the following: function, control flow, and basic block.

[0013] In the above scheme, the preset database stores multiple preset shell features and sub-shell tag sets for each preset shell feature; the step of performing a similarity query on the feature set to be detected in the preset database and determining the sub-shell tag set of the file to be detected based on the query results includes:

[0014] The first feature to be detected is compared with the plurality of preset shell features; wherein, the first feature to be detected is any one of the features to be detected in the set of features to be detected;

[0015] If the first feature to be detected is not similar to any of the multiple preset shell features, then the subshell label set of the first feature to be detected is determined to be an empty set.

[0016] If the first feature to be detected is similar to one of the preset shell features, then the subshell tag set of the one preset shell feature is determined as the subshell tag set of the first feature to be detected.

[0017] After determining the subshell tag set for each feature in the set of features to be detected, the determined set of all subshell tags is defined as the subshell tag set of the file to be detected.

[0018] In the above scheme, the step of statistically analyzing the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file includes:

[0019] From the set of subshell tags of the file to be detected, obtain multiple suspected subshell tags;

[0020] The detection feature set is classified according to the multiple suspected subshell labels to determine the detection feature subset of each of the multiple suspected subshell labels;

[0021] Obtain the preset shell conditions for each of the multiple suspected subshell tags;

[0022] The detection feature subsets of each of the multiple suspected subshell tags are compared with the preset shell conditions of each of the multiple suspected subshell tags;

[0023] Based on the comparison results, it is determined whether the file to be detected is a file with a shell.

[0024] In the above scheme, determining whether the file to be detected is a shell file based on the comparison result includes:

[0025] If, among the plurality of suspected subshell tags, the subset of features to be detected of one of the suspected subshell tags satisfies the preset shell condition of one of the suspected subshell tags, then the file to be detected is determined to be a shell file.

[0026] If the subset of features to be detected for each suspected subshell tag does not meet the preset shell condition for each suspected subshell tag, then the file to be detected is determined to be an unshelled file.

[0027] Secondly, embodiments of this application provide a database creation method, the method comprising:

[0028] Cluster analysis was performed on multiple shell files to determine multiple preset shell features;

[0029] Based on the subshell type to which the multiple preset shell features belong, determine the subshell tag set for each of the multiple preset shell features;

[0030] The preset database is established based on the sub-shell tag sets of each of the multiple preset shell features.

[0031] In the above scheme, the step of performing cluster analysis on multiple shell files to determine multiple preset shell features includes:

[0032] Obtain the standard shell type to which each of the multiple shell files belongs, and perform a coarse classification of the multiple shell files according to their respective standard shell types to obtain multiple shell file sets; wherein, different shell file sets correspond to different standard shell types;

[0033] Cluster analysis is performed on each of the multiple shell file sets. Based on the cluster analysis results, the multiple shell file sets are further classified to obtain multiple sub-shell file sets; wherein, different sub-shell file sets correspond to different sub-shell types.

[0034] Feature analysis is performed on the multiple sets of subshell files to determine the multiple preset shell features.

[0035] In the above scheme, before performing cluster analysis on each of the plurality of shell file sets, the method further includes:

[0036] The multiple shell files are disassembled to obtain the code of each shell file.

[0037] Based on a preset granularity, feature extraction is performed on the code of each of the multiple shell files to obtain the feature set of each of the multiple shell files; wherein, the preset granularity includes at least one of the following: function, control flow, and basic block;

[0038] Accordingly, the clustering analysis of each of the plurality of shell file sets includes:

[0039] Based on the feature sets of each of the multiple shell files, cluster analysis is performed on each set of shell files in the multiple shell file sets.

[0040] In the above scheme, the step of performing cluster analysis on each set of shell files in the multiple shell file sets based on their respective feature sets includes:

[0041] Determine a first set of shell files; wherein the first set of shell files is any one of the plurality of shell file sets;

[0042] Based on the feature sets of each of the multiple shell files, obtain the feature sets of each of the multiple first shell files in the first shell file set;

[0043] Based on the feature sets of each of the plurality of first shell files, a preset similarity algorithm is used to calculate the similarity score between any two first shell files among the plurality of first shell files;

[0044] Cluster analysis is performed on the set of first shell files based on the similarity score between any two first shell files among the plurality of first shell files;

[0045] After performing cluster analysis on each of the multiple shell file sets, the cluster analysis results are obtained.

[0046] In the above scheme, the step of performing feature analysis on the multiple sets of sub-shell files to determine the multiple preset shell features includes:

[0047] Determine the set of subshell files to be processed; wherein, the set of subshell files to be processed is any one of the plurality of subshell file sets;

[0048] Based on the feature sets of each of the multiple shell files, obtain the feature sets of each of the multiple shell files to be processed in the set of subshell files to be processed;

[0049] The feature sets of the multiple shell files to be processed are intersected to obtain the preset shell features of the set of sub-shell files to be processed;

[0050] After obtaining the preset shell features of each of the multiple subshell file sets, the multiple preset shell features are determined.

[0051] Thirdly, embodiments of this application provide a shell identification device, which includes an acquisition unit, a query unit, and an analysis unit; wherein,

[0052] The acquisition unit is configured to acquire the feature set to be detected from the file to be detected.

[0053] The query unit is configured to perform a similarity query on the feature set to be detected in a preset database, and determine the subshell tag set of the file to be detected based on the query results;

[0054] The analysis unit is configured to perform statistical analysis on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file.

[0055] Fourthly, embodiments of this application provide a shell identification device, which includes a first memory and a first processor; wherein,

[0056] The first memory is used to store computer programs that can run on the processor;

[0057] The first processor is configured to perform the steps of the method as described in the first aspect when running the computer program.

[0058] Fifthly, embodiments of this application provide a database creation apparatus, which includes a feature unit, a tag unit, and a database creation unit; wherein,

[0059] The feature unit is configured to perform cluster analysis on multiple shell files to determine multiple preset shell features;

[0060] The tag unit is configured to determine the subshell tag set of each of the multiple preset shell features based on the subshell type to which the multiple preset shell features belong;

[0061] The database building unit is configured to build the preset database based on the sub-shell tag sets of each of the multiple preset shell features.

[0062] Sixthly, embodiments of this application provide a database creation apparatus, which includes a second memory and a second processor; wherein,

[0063] The second memory is used to store computer programs that can run on the processor;

[0064] The second processor is configured to perform the steps of the method as described in the second aspect when running the computer program.

[0065] In a seventh aspect, embodiments of this application provide a computer storage medium storing a computer program that, when executed by a first processor, implements the method described in the first aspect, or when executed by a second processor, implements the method described in the second aspect.

[0066] This application provides a shell identification method, a database establishment method, an apparatus, and a storage medium. The shell identification method involves obtaining a set of features to be detected from a file to be detected; performing a similarity query on the set of features in a preset database; determining a set of sub-shell tags for the file to be detected based on the query results; and performing statistical analysis on the sub-shell tags to determine whether the file to be detected is a shelled file. The database establishment method involves performing cluster analysis on multiple shelled files to determine multiple preset shell features; determining the sub-shell tag sets for each of the multiple preset shell features based on their respective sub-shell types; and establishing the preset database based on the sub-shell tag sets for each of the multiple preset shell features. Thus, by using the preset database to perform a similarity query on the features to be detected from a file to be detected, it is possible to quickly and accurately identify whether the file to be detected is a shelled file, enabling targeted security analysis of the file and overcoming the difficulty in analyzing shelled files. Attached Figure Description

[0067] Figure 1 This is a schematic diagram of the structure of a shelled file provided in an embodiment of this application;

[0068] Figure 2 A schematic flowchart illustrating a shell identification method provided in an embodiment of this application;

[0069] Figure 3 A schematic flowchart illustrating a database creation method provided in an embodiment of this application;

[0070] Figure 4 A flowchart illustrating another database creation method provided in an embodiment of this application;

[0071] Figure 5 A schematic diagram of cluster analysis results for a database creation method provided in this application embodiment;

[0072] Figure 6 A flowchart illustrating another shell identification method provided in an embodiment of this application;

[0073] Figure 7 This is a schematic diagram of the composition structure of a shell recognition device provided in an embodiment of this application;

[0074] Figure 8 This is a schematic diagram of the hardware structure of a shell recognition device provided in an embodiment of this application;

[0075] Figure 9 This is a schematic diagram of the composition structure of a database creation device provided in an embodiment of this application;

[0076] Figure 10 A schematic diagram of the hardware structure of a database creation device provided in an embodiment of this application;

[0077] Figure 11 This is a schematic diagram of the composition structure of a shell recognition system provided in an embodiment of this application. Detailed Implementation

[0078] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It is understood that the specific embodiments described herein are merely for explaining the relevant application and not for limiting the application. Furthermore, it should be noted that, for ease of description, only the parts relevant to the application are shown in the accompanying drawings.

[0079] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0080] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0081] It should be noted that the terms "first, second, and third" used in the embodiments of this application are merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, and third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0082] The technical terms used in the embodiments of this application are explained as follows:

[0083] (1) Jaccard Similarity Coefficient: Used to compare the similarity and differences between finite sample sets. The larger the Jaccard coefficient between different sets, the higher the sample similarity. Given two sets A and B, the Jaccard coefficient is defined as the ratio of the size of the intersection of A and B to the size of the size of the union of A and B. The calculation method of the Jaccard coefficient is shown in equation (1) or equation (2).

[0084]

[0085]

[0086] Here, J(A, B) represents the Jaccard coefficients of set A and set B.

[0087] (2) Control Flow Graph (CFG): Also known as a control flow diagram, it is an abstract representation of a process or program. It is an abstract data structure used in the compiler and maintained internally by the compiler. It represents all the paths that a program will traverse during execution. In other words, the control flow graph represents the possible flow of execution of all basic blocks within a process in the form of a graph, and can also reflect the real-time execution process of a process.

[0088] (3) Basic block: refers to a sequence of statements in code that are executed sequentially, with only one entry point and one exit point. The entry point is the first statement in the block, and the exit point is the last statement. For a basic block, execution only enters from its entry point and exits from its exit point.

[0089] Shell code is a type of code used to hide the actual executable code in a program. Shell code is attached to the executable program; when the executable program is executed, the shell code first decompresses the original program in memory, and then returns control to the decompressed, real program.

[0090] Shell code is a type of code used to hide the actual executable code. When a packed file is executed, the shell code decompresses the original executable program in memory and then returns control to the decompressed executable program. While shell code can protect normal files from unauthorized modification, it can also become a means for malicious code to evade detection. Because the portion of a packed malicious file presented to security software is essentially unpacked code, it can evade scanning and detection by conventional security software. In other words, for unknown files, it is necessary to identify whether the unknown file is packed in order to conduct targeted security analysis and better protect the computer from malicious files.

[0091] Specifically, malware writers often use packing or obfuscation techniques to make their files more difficult to detect or analyze. Obfuscation is code that malware writers attempt to hide its execution process, while packing is a type of obfuscation; packed malware is compressed and difficult to analyze. See also Figure 1 This illustrates a schematic diagram of the structure of a shelled file provided in an embodiment of this application. Figure 1As shown, before packing, the string list and other information of the executable source file are visible. After packing, the packed file can include both an unpacker program and a packed executable program, with the string list and other information of the packed executable program being invisible. When the packed file runs, the unpacker program first runs to decompress the packed executable program, thus obtaining the executable source file (with the string list and other information visible). Then, the actual file functionality is achieved by running the executable source file. Based on this, when performing static analysis on a packed program, only this small piece of unpacking code can be parsed, leading to inaccurate analysis results. In other words, for unknown files, it is necessary to identify whether the unknown file is packed in order to perform targeted security analysis and better protect the computer from malicious files.

[0092] This application provides a shell identification method. The basic idea of ​​this method is as follows: obtain the feature set to be detected of the file to be detected; perform a similarity query on the feature set to be detected in a preset database, and determine the sub-shell tag set of the file to be detected based on the query results; perform statistical analysis on the sub-shell tag set of the file to be detected to determine whether the file to be detected is a shelled file. In this way, by using a preset database to perform a similarity query on the feature set to be detected of the file to be detected, it is possible to quickly and accurately identify whether the file to be detected is a shelled file, so as to perform targeted security analysis on the file to be detected and make up for the drawback of the difficulty in analyzing shelled files.

[0093] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0094] In one embodiment of this application, see Figure 2 The diagram illustrates a flowchart of a shell identification method provided in an embodiment of this application. Figure 2 As shown, the method may include:

[0095] S101: Obtain the feature set to be detected for the file to be detected.

[0096] It should be noted that the embodiments of this application provide a shell identification method, the purpose of which is to identify whether the file to be detected is a shell file, so as to process the file to be detected in a targeted manner and avoid the drawback of the difficulty in analyzing shell files.

[0097] Therefore, for a file to be detected, it is necessary to extract its feature set. The file to be detected can include various file types, such as executable files (EXE), dynamic link libraries (DLLs), and Hypertext Markup Language (HTML) files. Furthermore, the feature set can include only one specific feature or a collection of multiple features.

[0098] It should be noted that the feature set to be detected may refer to the code features of the file to be detected. Therefore, in some embodiments, the method may further include:

[0099] The file to be detected is disassembled to obtain the code to be detected;

[0100] Based on a preset granularity, feature extraction is performed on the code to be detected to obtain the feature set to be detected; wherein the preset granularity includes at least one of the following: function, control flow, and basic block.

[0101] It should be noted that, in order to obtain the feature set to be detected, the file to be detected can be processed as follows:

[0102] The first step is to disassemble the file to be tested to obtain the corresponding code to be tested. Disassembly is the process of converting the code to be tested into assembly code, that is, converting machine language into assembly language. In other words, the code to be tested obtained through disassembly is written in assembly language.

[0103] The second step involves identifying code that still contains numerous details (such as replaceable addresses and formatting aids). To avoid missing files belonging to the same category due to differences in these details during similarity comparison, the code needs to be segmented at a preset granularity to obtain a feature set for detection.

[0104] The preset granularity can be functions, basic blocks, control flow, etc. Taking functions as the preset granularity as an example, the feature set to be detected actually contains all the functions in the code to be detected; that is, the feature set to be detected is actually a set of functions.

[0105] In this way, through the above steps, we obtain the feature set of the file to be detected, which enables us to determine whether the file to be detected is a shell file.

[0106] S102: Perform a similarity query on the feature set to be detected in a preset database, and determine the subshell tag set of the file to be detected based on the query results.

[0107] It should be noted that the feature set to be detected is searched for similarity in a pre-defined database to determine the subshell tag set of the file to be detected. Here, subshell tags refer to the subshell categories to which the feature set to be detected may belong, that is, the subshell categories that the file to be detected may have.

[0108] It should also be noted that the preset database is built based on some known shell files, which stores multiple preset shell features and their respective subshell tag sets. Here, since a preset shell feature may correspond to multiple subshell categories simultaneously, a preset shell feature may correspond to one or more subshell tags, thus forming the subshell tag set of the preset shell feature.

[0109] Furthermore, in some embodiments, the step of performing a similarity query on the feature set to be detected in a preset database and determining the subshell tag set of the file to be detected based on the query results may include:

[0110] The first feature to be detected is compared with the plurality of preset shell features; wherein, the first feature to be detected is any one of the features to be detected in the set of features to be detected;

[0111] If the first feature to be detected is not similar to any of the multiple preset shell features, then the subshell label set of the first feature to be detected is determined to be an empty set.

[0112] If the first feature to be detected is similar to one of the preset shell features, then the subshell tag set of the one preset shell feature is determined as the subshell tag set of the first feature to be detected.

[0113] After determining the subshell tag set for each feature in the set of features to be detected, the determined set of all subshell tags is defined as the subshell tag set of the file to be detected.

[0114] It should be noted that the similarity query process for the feature set to be detected is explained using the first feature to be detected as an example. Here, the first feature to be detected refers to any feature in the feature set to be detected.

[0115] At this point, the first feature to be detected is compared with multiple preset shell features for similarity. If the first feature to be detected is dissimilar to all of the preset shell features, the subshell tag set of the first feature to be detected is determined to be an empty set, meaning the first feature to be detected does not belong to any subshell category. If the first feature to be detected is similar to a preset shell feature, the subshell tag set of the first feature to be detected is determined to be the subshell tag set of that preset shell feature, meaning the subshell category to which the preset shell feature belongs is also the subshell category to which the first feature set belongs. Thus, after comparing the similarity of all the features to be detected with the multiple preset shell features, the subshell tag set of the file to be detected is obtained.

[0116] Taking the function granularity as a preset granularity as an example, the feature set to be detected refers to all functions contained in the code of the file to be detected. Assume the feature set to be detected = {function A, function K, function 1, function 7}. At this time, the preset database also stores multiple preset shell functions (i.e., preset shell features), and each function has its own sub-shell category. For example, the preset database stores functions A to Z, and the sub-shell label set LA of function A = {shell 1, shell 2}, ..., and the sub-shell label set LZ of function Z = {shell 1}.

[0117] At this point, the feature set to be detected is queried in the preset database, that is, the similarity comparison between function A, function K, function 1, function 7 and the functions in the preset database is performed in turn;

[0118] For functions A and K, similar functions can be found in the preset database. In this case, the sub-shell label set of function A is determined as LA, and the sub-shell label set of function K is determined as LK. For functions 1 and 7, no similar functions can be found in the preset database. In this case, the sub-shell label sets of functions 1 and 7 are determined as empty sets. In other words, the sub-shell label sets of the feature set to be detected actually refer to the two sets LA corresponding to function A and LK corresponding to function B.

[0119] In this way, by determining the set of subshell tags of the file to be detected, it is possible to infer the possible subshell categories that the file to be detected may have, thereby determining whether the file to be detected is packed with a shell.

[0120] S103: Perform statistical analysis on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file.

[0121] It should be noted that, for the set of subshell tags of the file to be detected, the subshell tags are statistically analyzed according to category, and then it is determined whether the file to be detected is a shell file.

[0122] Furthermore, in some embodiments, the step of statistically analyzing the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file may include:

[0123] From the set of subshell tags of the file to be detected, obtain multiple suspected subshell tags;

[0124] The detection feature set is classified according to the multiple suspected subshell labels to determine the detection feature subset of each of the multiple suspected subshell labels;

[0125] Obtain the preset shell conditions for each of the multiple suspected subshell tags;

[0126] The detection feature subsets of each of the multiple suspected subshell tags are compared with the preset shell conditions of each of the multiple suspected subshell tags;

[0127] Based on the comparison results, it is determined whether the file to be detected is a file with a shell.

[0128] It should be noted that, in order to determine whether the file to be detected is a packed file, the following steps can be taken:

[0129] First, multiple suspected shell tags are obtained from the set of sub-shell tags of the file to be detected. Here, all shell tags that appear in the set of sub-shell tags of the file to be detected can be identified as suspected shell tags, or the shell tag with the most occurrences can be selected as a suspected shell tag, or a preliminary screening can be performed according to a preset quantity threshold to identify multiple suspected shell tags. This embodiment of the application does not specifically limit this approach.

[0130] Secondly, based on multiple suspected subshell labels, the set of features to be detected is classified, thereby obtaining the subset of features to be detected corresponding to each of the multiple suspected subshell labels. In other words, for a specific suspected subshell label, those features possessing that suspected subshell label are selected from the set of features to be detected, thus forming the subset of features to be detected for that suspected subshell label. It should be understood that since a feature to be detected may have multiple subshell labels, the same feature to be detected may appear in different subsets of features to be detected.

[0131] Finally, the subset of features to be detected for each of the multiple suspected subshell tags is compared with the preset shell conditions for each of the multiple suspected subshell tags to determine whether the file to be detected is a shell file.

[0132] Here, the preset conditions for including a seed shell vary depending on the subshell tag. Generally, the preset conditions are some common characteristics of that type of seed shell. That is, if the file to be detected has all the common characteristics of that type of seed shell, then it can be determined that the file to be detected contains that seed shell.

[0133] Furthermore, in some embodiments, determining whether the file to be detected is a shell file based on the comparison result may include:

[0134] If, among the plurality of suspected subshell tags, the subset of features to be detected of one of the suspected subshell tags satisfies the preset shell condition of one of the suspected subshell tags, then the file to be detected is determined to be a shelled file.

[0135] If the subset of features to be detected for each suspected subshell tag does not meet the preset shell condition for each suspected subshell tag, then the file to be detected is determined to be an unshelled file.

[0136] It should be noted that, for multiple suspected subshell tags, it is determined whether the subset of features to be detected for a specific suspected subshell tag meets the preset conditions for being shelled for that suspected subshell tag. If so, the file to be detected is determined to be a shelled file; if the subset of features to be detected for each suspected subshell tag does not meet the preset conditions for being shelled for each suspected subshell tag, the file to be detected is determined to be an unshelled file.

[0137] Taking a preset granularity of function as an example, assume the feature set to be detected = {function A, function B, function C, function D, function E}. After a similarity query in the preset database, it is found that the sub-shell tag set of function A is LA = {shell1, shell2}, the sub-shell tag set of function B is LB = {shell1, shell2, shell3}, the sub-shell tag set of function C is LC = {shell2}, the sub-shell tag set of function D is LD = {shell2}, and the sub-shell tag set of function E is empty. At this time, the sub-shell tag sets of the file to be detected are LA, LB, LC, and LD.

[0138] At this point, the process of determining whether the file to be tested is packed with a protective shell is as follows:

[0139] First, in the set of subshell tags of the file to be detected, all the subshell tags that have appeared are identified as suspected shell tags; that is, the multiple suspected shell tags obtained are shell1, shell2 and shell3 respectively.

[0140] Secondly, the detection feature sets were classified according to the suspected shell labels. It was found that the subset of features to be detected for shell 1 was {function A, function B}, the subset of features to be detected for shell 2 was {function A, function B, function C, function D}, and the subset of features to be detected for shell 3 was {function B}.

[0141] Finally, assuming that the preset shell condition for shell 1 is containing functions A, B, E, and X; that the preset shell condition for shell 2 is containing functions A, B, C, and D; and that the shell condition for shell 3 is containing functions B and Y; comparing the subsets of features to be detected for each of shells 1, 2, and 3 with their respective preset shell conditions, it is found that the subset of features to be detected for shell 2 satisfies the shell condition for shell 2. Therefore, it can be determined that the file to be detected is a shell file, and it can also be determined that the file to be detected contains a shell of type shell 2. Here, the preset shell conditions are determined based on the analysis of a large number of files of this seed shell type.

[0142] This application provides a shell identification method, which involves acquiring a set of features to be detected from a file to be tested; performing a similarity query on the set of features in a preset database; determining a set of sub-shell tags for the file to be tested based on the query results; and performing statistical analysis on the sub-shell tags to determine whether the file to be tested is a shelled file. In this way, by using a preset database to perform a similarity query on the features to be detected from the file to be tested, it is possible to quickly and accurately identify whether the file to be tested is a shelled file, enabling targeted security analysis of the file and overcoming the difficulty in analyzing shelled files.

[0143] In another embodiment of this application, see Figure 3 This illustrates a flowchart of a database creation method provided in an embodiment of this application. Figure 3 As shown, the method may include:

[0144] S201: Perform cluster analysis on multiple shell files to determine multiple preset shell features.

[0145] It should be noted that the embodiments of this application provide a database establishment method. The established preset database stores multiple preset shell features and sub-shell tag sets of each preset shell feature, thereby quickly retrieving the feature set of the file to be detected and determining whether the file to be detected is a shelled file.

[0146] Here, the preset shell features to be added to the database must be common features among shells of the same type. Therefore, it is necessary to perform cluster analysis on multiple existing shell files, and then select multiple preset shell features based on the cluster analysis results.

[0147] Furthermore, in some embodiments, the clustering analysis of multiple shell files to determine multiple preset shell features may include:

[0148] Obtain the standard shell type to which each of the multiple shell files belongs, and perform a coarse classification of the multiple shell files according to their respective standard shell types to obtain multiple shell file sets; wherein, different shell file sets correspond to different standard shell types;

[0149] Cluster analysis is performed on each of the multiple shell file sets. Based on the cluster analysis results, the multiple shell file sets are further classified to obtain multiple sub-shell file sets; wherein, different sub-shell file sets correspond to different sub-shell types.

[0150] Feature analysis is performed on the multiple sets of subshell files to determine the multiple preset shell features.

[0151] It should be noted that multiple shell files are classified twice (coarse classification and fine classification) to obtain multiple sets of sub-shell files. At this point, each set of sub-shell files corresponds to a specific sub-shell type. Then, feature analysis is performed on each set of sub-shell files to determine multiple preset shell features.

[0152] Specifically, the process of determining the preset shell features is as follows:

[0153] First, for multiple shell files, the standard shell type to which each shell file belongs is determined. Then, the multiple shell files are roughly classified according to the standard shell type, resulting in multiple shell file sets. Here, different shell file sets correspond to different standard shell types. Standard shell types refer to some existing standardized shell classifications, commonly classified according to the packing tools used by the shell files (such as ASPack packer, UPX packer, PEcompat packer, etc.).

[0154] Secondly, for a set of shell files, the files within it still have many variations, making it very difficult to directly extract common features. Therefore, cluster analysis is performed on each set of shell files, and then each set is further subdivided based on the cluster analysis results, resulting in multiple sub-shell file sets. Here, a specific sub-shell file set represents a specific sub-shell type. In other words, sub-shell types are further subdivisions under the standard shell type.

[0155] Finally, for a specific set of subshell files, their common features are extracted, thus obtaining at least one preset shell feature corresponding to that set of subshell files. Simultaneously, the common features of this set of subshell files also constitute the "preset shell conditions" for that subshell category in the aforementioned embodiments.

[0156] Furthermore, in some embodiments, before performing cluster analysis on each of the plurality of shell file sets, the method may further include:

[0157] The multiple shell files are disassembled to obtain the code of each shell file.

[0158] Based on a preset granularity, feature extraction is performed on the code of each of the multiple shell files to obtain the feature set of each of the multiple shell files; wherein, the preset granularity includes at least one of the following: function, control flow, and basic block;

[0159] Accordingly, the clustering analysis of each of the plurality of shell file sets may include:

[0160] Based on the feature sets of each of the multiple shell files, cluster analysis is performed on each set of shell files in the multiple shell file sets.

[0161] It should be noted that the principle of cluster analysis is to divide samples into multiple categories based on the distance between them. Specifically, feature extraction is performed on different shell files to obtain their own feature sets. Then, the distance between different shell files is determined according to the similarity between their feature sets, thereby achieving cluster analysis of the shell files.

[0162] Therefore, before performing cluster analysis on each of the multiple shell file sets, the feature set of each shell file is extracted. The method for extracting the feature set of each shell file is the same as the method for extracting the feature set of the file to be detected, which is as follows: disassemble the multiple shell files respectively to determine the code of each shell file; then, extract the features of the code of each of the multiple shell files according to a preset granularity to obtain the feature set of each of the multiple shell files.

[0163] Here, the preset granularity includes at least one of the following: functions, control flow, and basic blocks. Taking function granularity as an example, the feature set of each of the multiple shell files refers to the function set of each of the multiple shell files. It should be understood that the preset granularity in the embodiments of this application and the preset granularity used in the processing of the code to be detected in the foregoing embodiments need to be consistent.

[0164] In this way, based on the feature sets of each of the multiple shell files, the similarity score between any two shell files can be calculated, thereby performing the step of clustering analysis on each set of shell files in the multiple shell file sets.

[0165] Furthermore, in some embodiments, the step of performing cluster analysis on each set of shell files in the plurality of shell file sets based on their respective feature sets may include:

[0166] Determine a first set of shell files; wherein the first set of shell files is any one of the plurality of shell file sets;

[0167] Based on the feature sets of each of the multiple shell files, obtain the feature sets of each of the multiple first shell files in the first shell file set;

[0168] Based on the feature sets of each of the plurality of first shell files, a preset similarity algorithm is used to calculate the similarity score between any two first shell files among the plurality of first shell files;

[0169] Cluster analysis is performed on the set of first shell files based on the similarity score between any two first shell files among the plurality of first shell files;

[0170] After performing cluster analysis on each of the multiple shell file sets, the cluster analysis results are obtained.

[0171] It should be noted that the clustering analysis process is explained using the first set of shell files as an example. Here, the first set of shell files refers to any one of the multiple sets of shell files, and the first shell file refers to the shell file in the first set of shell files. The clustering analysis process includes the following steps:

[0172] First, based on the feature sets of each of the first shell files, the similarity score between any two first shell files is calculated using a preset similarity algorithm. Here, the preset similarity algorithm can be selected according to the actual use case. For example, the Jaccard similarity coefficient can be used as the similarity score between two shell files, and the preset similarity algorithm is as shown in Equation (1) or Equation (2) above.

[0173] Then, after obtaining the similarity scores between any two shell files, cluster analysis can be performed on the first set of shell files.

[0174] In this way, after performing cluster analysis on all shell file sets, the cluster analysis results can be obtained, and the shell file sets can be classified a second time, resulting in multiple sub-shell file sets.

[0175] Furthermore, in some embodiments, the step of performing feature analysis on the plurality of sub-shell file sets to determine the plurality of preset shell features may include:

[0176] Determine the set of subshell files to be processed; wherein, the set of subshell files to be processed is any one of the plurality of subshell file sets;

[0177] Based on the feature sets of each of the multiple shell files, obtain the feature sets of each of the multiple shell files to be processed in the set of subshell files to be processed;

[0178] The feature sets of the multiple shell files to be processed are intersected to obtain the preset shell features of the set of sub-shell files to be processed;

[0179] After obtaining the preset shell features of each of the multiple subshell file sets, the multiple preset shell features are determined.

[0180] It should be noted that after obtaining multiple sets of subshell files, it is necessary to extract some common features for each subshell category and store them in the database. In other words, it is necessary to extract the common features among all files in each subshell file set, thereby forming the preset shell features for storage in the database.

[0181] For ease of explanation, the steps of feature analysis are illustrated using a set of subshell files to be processed as an example. Here, the set of subshell files to be processed represents any one of the multiple sets of subshell files, and the shell file to be processed represents the shell file in the set of subshell files to be processed. The feature analysis process then includes the following steps:

[0182] First, obtain the feature sets of each shell file to be processed. Here, the set of subshells to be processed is the set of shell files under a specific subshell category;

[0183] Secondly, the feature sets of all the shell files to be processed are intersected to obtain the preset shell features corresponding to the set of sub-shell files to be processed;

[0184] Finally, after performing the above processing on all subshell file sets, the preset shell features of each subshell file set are obtained, thereby determining multiple preset shell features to be added to the database.

[0185] In this way, multiple preset shell features are obtained for multiple shell files, which can be used as a blueprint for shell recognition of unknown files.

[0186] S202: Determine the subshell tag set for each of the multiple preset shell features based on the subshell type to which they belong.

[0187] It should also be noted that, as mentioned above, the preset shell features are determined based on a subset of subshell files, and one subset of subshell files corresponds to one subshell type. Therefore, each preset shell feature has a clear association with a subshell type. Furthermore, different subshell types may contain the same preset shell features, so one preset shell feature may correspond to multiple subshell types.

[0188] Therefore, based on the subshell type to which the multiple preset shell features belong, the subshell tag set of each of the multiple preset shell features can be determined.

[0189] S203: Establish the preset database based on the sub-shell tag sets of each of the multiple preset shell features.

[0190] It should be noted that storing multiple preset shell features and their respective sub-shell tag sets in a database establishes a preset database. This preset database can be of various types, and this embodiment does not limit its use.

[0191] This application provides a database establishment method. By performing cluster analysis on multiple shell files, multiple preset shell features are determined. Based on the sub-shell types to which the multiple preset shell features belong, a set of sub-shell tags for each of the multiple preset shell features is determined. A preset database is then established based on the sub-shell tag sets of each of the multiple preset shell features. In this way, multiple preset shell features are determined from multiple shell files, and then a preset database is established using these multiple preset shell features and their respective sub-shell tag sets. This preset database allows for quick and accurate identification of whether a file to be detected is a shell file, enabling targeted security analysis of the file and overcoming the difficulty in analyzing shell files.

[0192] In another embodiment of this application, taking a preset granularity as the function granularity as an example, see [link to example]. Figure 4 This illustrates a flowchart of another database creation method provided in an embodiment of this application. Figure 4 As shown, the method may include:

[0193] S301: Obtain a large number of shelled samples.

[0194] It should be noted that a backscan of the known shell sample database yielded tens of millions of shell samples. Here, "shell samples" are equivalent to the aforementioned "shell files".

[0195] S302: Sample sampling is performed for a standard shell type, and cluster analysis is conducted on the sampled shells to determine the cluster analysis results.

[0196] It should be noted that from the massive number of shelled samples, a predetermined number of shelled samples are extracted for a specific standard shell type. Here, the standard shell type can be a shell type from an existing shell classification, such as ASPack v2.1. The predetermined number can be determined based on the actual use case, for example, 500, 1000, 2000, etc. Furthermore, this predetermined number of shelled samples constitutes the aforementioned set of shelled samples.

[0197] Taking the ASPack v2.1 shell as an example, after extracting a sufficient number of samples with the ASPack v2.1 shell, cluster analysis is performed on these samples. Specifically, each shelled sample is disassembled to obtain its code, and then the function set of each shelled sample is extracted. Based on the function set of each shelled sample, the intersection and union of the function sets of any two shelled samples are calculated, thereby calculating the Jaccard similarity coefficient (equivalent to the aforementioned similarity score) between any two shelled samples. Then, based on the Jaccard similarity coefficient between any two shelled samples, cluster analysis is performed on these shelled samples. Here, the function set is equivalent to the aforementioned feature set.

[0198] See Figure 5 It shows a schematic diagram of cluster analysis results of a database establishment method provided in an embodiment of this application; Figure 5 Each point in the array represents a shelled sample. For example... Figure 5 As shown, after cluster analysis, the ASPack v2.1 shell can be further subdivided into multiple subshell categories.

[0199] S303: Based on the cluster analysis results, select and determine multiple shell functions.

[0200] It should be noted that, as Figure 5 As shown, in the clustering analysis results, some sub-shell categories include only a few samples. If the functions of these samples are included in the database, the shell functions may not have generalization ability. Currently, these samples are treated as noise and are not included in the database for these sub-shell categories. After filtering, the sub-shell categories to be included in the database are determined. Then, for each sub-shell category, the function sets of multiple samples corresponding to that sub-shell category are intersected. The functions in the union of the resulting function sets are stored as shell functions in the preset database, and a corresponding sub-shell label is assigned to each shell function.

[0201] S304: Add multiple shell functions to the library and set subshell tags.

[0202] It should be noted that the determined shell functions are stored sequentially in the preset database. Since the same shell function may appear in different sub-shell categories, when storing a specific shell function, it is necessary to search the database for the shell function. If the shell function is not stored in the preset database, it can be stored, and a sub-shell tag can be set for it. If the shell function already exists in the preset database (meaning it was stored when a certain sub-shell category was previously added to the database), then a sub-shell tag is added to the shell function, making it point to different sub-shell categories simultaneously. In other words, a shell function may correspond to multiple sub-shell tags.

[0203] This application provides a database establishment method. Through the detailed description of the foregoing embodiments in this embodiment, it can be seen that multiple preset shell features are determined based on multiple shell files. Then, a preset database is established using the multiple preset shell features and their respective sub-shell tag sets. Thus, the preset database can quickly and accurately identify whether the file to be detected is a shell file, so as to perform targeted security analysis on the file to be detected, making up for the drawback of the difficulty in analyzing shell files.

[0204] In another embodiment of this application, taking a preset granularity as the function granularity as an example, see [link to example]. Figure 6 This illustrates a flowchart of another shell identification method provided in an embodiment of this application. Figure 6 As shown, the method may include:

[0205] S401: Disassemble the file to be tested to obtain the function set of the file to be tested.

[0206] It should be noted that the file to be detected is disassembled to obtain the code to be detected, and then the code to be detected is segmented according to the function granularity to obtain the function set of the file to be detected (equivalent to the aforementioned feature set to be detected).

[0207] S402: For the function set of the file to be detected, query the preset database one by one through the fuzzy matching method to obtain multiple subshell tags.

[0208] It should be noted that, for the function set of the file to be detected, each function is queried in a preset database using a fuzzy matching method, thereby obtaining multiple subshell tags (equivalent to the aforementioned subshell tag set of the file to be detected).

[0209] S403: Determine whether the file to be detected is packed based on multiple sub-shell tags.

[0210] It should be noted that the determination of whether a file to be detected is packed is based on multiple sub-shell tags. Specifically, if the function set in the file to be detected matches all the common shell functions of a certain sub-shell tag, then the file to be detected is determined to be packed, and it carries the shell indicated by that sub-shell tag.

[0211] In other words, the embodiments of this application include two parts: the first part is shell feature extraction and storage (equivalent to a database establishment method), and the second part is a shell recognition method.

[0212] The database establishment method can be divided into four steps: (1) collecting shelled samples, scanning the massive sample database, and querying tens of millions of shelled samples; (2) re-clustering within the shells, disassembling the samples of each type of shell to obtain function information, calculating the function intersection and union of the samples within each shell, and finding that the number of intersections of sample functions within most specific types of shells is very small, so it is necessary to re-cluster them. After clustering analysis, it was found that many shells can be subdivided into multiple subshells, such as Figure 5 As shown, for the ASPack v2.1 shell, the shell can be further subdivided into multiple categories; (3) Filtering of shell information upon entry, such as Figure 5 As shown, after clustering, many subshells have only a few samples. If the functions of these samples are included in the database, the shell functions may not have generalization ability, or these samples themselves may be noise. At present, these samples are treated as noise and these subshells are not included in the database; (4) Shell function inclusion: the samples to be included in the database are subjected to feature analysis to determine multiple shell functions. If the preset database does not have a shell function, the shell function is inserted into the function library and the shell information is marked; if the preset database has a shell function, the subshell label is updated.

[0213] The shell identification method can be divided into three steps: (1) disassemble the file to be detected to obtain the function set of the sample; (2) query the preset database for each function by means of fuzzy matching to obtain multiple sub-shell tags; (3) determine whether the file to be detected is shelled based on the shell function and multiple sub-shell tags.

[0214] In summary, the shell identification method based on code similarity in this application can be further divided into the following parts: First, based on a massive amount of shelled samples, the code is segmented into fragments using specific rules; second, according to the distribution of each code segment in the shell samples, the code segment is labeled as belonging to a shell feature and its shell type, and this information is stored in a distributed database for fast retrieval; finally, code-level similarity is defined, and for the file to be detected, fast retrieval can identify whether the file to be detected is shelled and provide evidence. Thus, by determining whether the file to be detected is shelled, the confidence level of the static analysis results can be judged. For example, if the file to be detected is shelled, the function used in the static analysis of the file to be detected may only be an unpacking function, and the analysis results may not be accurate. In addition, the shell type of the file to be detected can also be determined so that corresponding unpacking and analysis can be performed based on the shell type.

[0215] In related technologies, it is common practice to manually analyze shelled samples, extract byte features as rules, and then the file to be detected is determined to be shelled and its type by rule matching. However, manually extracting shell features is usually time-consuming and labor-intensive, and it is difficult to cope with the ever-changing shell types. The shell recognition method in this application has been automated, and it can automatically extract shell-specific byte features, solving the problem of low efficiency in manual rule extraction.

[0216] In addition, in the embodiments of this application, the preset granularity can be in the form of function execution flow, basic block, combination of basic blocks, etc. Besides the specific methods given in the embodiments of this application, other methods for shell determination by code information after establishing a code feature library are also within the protection scope of the embodiments of this application.

[0217] This application provides a shell identification method. Through the detailed description of the foregoing embodiments in this embodiment, it can be seen that by using a preset database to perform similarity queries on the features to be detected of the file to be detected, it is possible to quickly and accurately identify whether the file to be detected is a shell file, so as to perform targeted security analysis on the file to be detected and make up for the drawback that shell files are difficult to analyze.

[0218] In another embodiment of this application, see [link to application]. Figure 7 This illustration shows a schematic diagram of the structural composition of a shell identification device 50 provided in an embodiment of this application. Figure 7 As shown, the shell identification device 50 includes an acquisition unit 501, a query unit 502, and an analysis unit 503, wherein,

[0219] The acquisition unit 501 is configured to acquire the feature set to be detected of the file to be detected;

[0220] The query unit 502 is configured to perform a similarity query on the feature set to be detected in a preset database, and determine the subshell tag set of the file to be detected based on the query results;

[0221] Analysis unit 503 is configured to perform statistical analysis on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file.

[0222] In some embodiments, the acquisition unit 501 is specifically configured to disassemble the file to be detected to obtain the code to be detected; and to extract features from the code to be detected based on a preset granularity to obtain the feature set to be detected; wherein the preset granularity includes at least one of the following: function, control flow, and basic block.

[0223] In some embodiments, the preset database stores multiple preset shell features and subshell tag sets for each of the multiple preset shell features; the query unit 502 is specifically configured to perform a similarity comparison between a first feature to be detected and the multiple preset shell features; wherein, the first feature to be detected is any one of the features to be detected in the feature set; if the first feature to be detected is not similar to any of the multiple preset shell features, then the subshell tag set of the first feature to be detected is determined to be an empty set; if the first feature to be detected is similar to one of the preset shell features, then the subshell tag set of the one preset shell feature is determined as the subshell tag set of the first feature to be detected; after determining the subshell tag set for each feature to be detected in the feature set, all the determined subshell tag sets are determined as the subshell tag set of the file to be detected.

[0224] In some embodiments, the analysis unit 503 is specifically configured to: obtain multiple suspected subshell tags from the subshell tag set of the file to be detected; classify the feature set to be detected according to the multiple suspected subshell tags to determine the feature subset to be detected for each of the multiple suspected subshell tags; obtain the preset shell conditions for each of the multiple suspected subshell tags; compare the feature subset to be detected for each of the multiple suspected subshell tags with the preset shell conditions for each of the multiple suspected subshell tags; and determine whether the file to be detected is a shelled file based on the comparison result.

[0225] In some embodiments, the analysis unit 503 is further configured to, among the plurality of suspected subshell tags, determine that the file to be detected is a file with a shell if the subset of features to be detected of one of the suspected subshell tags satisfies the preset shell condition of the one of the suspected subshell tags; and determine that the file to be detected is a file without a shell if the subset of features to be detected of each suspected subshell tag does not satisfy the preset shell condition of each suspected subshell tag.

[0226] Understandably, in this embodiment, a "unit" can be a portion of a circuit, a portion of a processor, a portion of a program or software, etc., and can also be a module or a non-modular component. Furthermore, the components in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional module.

[0227] If the integrated unit is implemented as a software functional module and not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this embodiment, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the method described in this embodiment. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0228] Therefore, this embodiment provides a computer storage medium storing a storage management program, which, when executed by at least one processor, implements the steps of the method described in any of the foregoing embodiments.

[0229] Based on the above-described composition of a shell identification device 50 and its computer storage medium, see [link to relevant documentation]. Figure 8 This illustrates a schematic diagram of the specific hardware structure of a shell identification device 50 provided in an embodiment of this application. For example... Figure 8 As shown, it may include: a communication interface 601, a first memory 602, and a first processor 603; the various components are coupled together through a bus system 604. It is understood that the bus system 604 is used to implement communication between these components. In addition to a data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 8 The various buses are all labeled as bus system 604. Among them, communication interface 601 is used for receiving and sending signals during the process of sending and receiving information with other external network elements;

[0230] The first memory 602 is used to store computer programs that can run on the first processor 603;

[0231] The first processor 603 is configured to, when running the computer program, perform:

[0232] Obtain the feature set of the file to be detected;

[0233] The feature set to be detected is queried in a preset database for similarity, and the subshell tag set of the file to be detected is determined based on the query results;

[0234] Statistical analysis is performed on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file.

[0235] It is understood that the first memory 602 in the embodiments of this application can be a volatile first memory or a non-volatile first memory, or may include both volatile and non-volatile first memories. The non-volatile first memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile first memory can be a random access memory (RAM), which serves as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The first memory 602 of the systems and methods described in this application is intended to include, but is not limited to, these and any other suitable types of first memory.

[0236] The first processor 603 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the first processor 603 or by instructions in software form. The first processor 603 may be a general-purpose first processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose first processor may be a micro-first processor or any conventional first processor. The steps of the method disclosed in the embodiments of this application can be directly embodied as being executed by the hardware decoding first processor, or being executed by a combination of hardware and software modules in the decoding first processor. The software modules may be located in a random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in the first memory 602. The first processor 603 reads the information in the first memory 602 and, in conjunction with its hardware, completes the steps of the above method.

[0237] It is understood that the embodiments described in this application can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processing (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose first processors, controllers, microcontrollers, micro-first processors, other electronic units for performing the functions described in this application, or combinations thereof.

[0238] For software implementation, the technology described in this application can be implemented by modules (e.g., procedures, functions, etc.) that perform the functions described in this application. The software code can be stored in a first memory and executed by a first processor. The first memory can be implemented in the first processor or external to the first processor.

[0239] Alternatively, as another embodiment, the first processor 603 is further configured to perform the steps of the method described in any of the foregoing embodiments when running the computer program.

[0240] This application provides a shell identification device, which includes an acquisition unit, a query unit, and an analysis unit. By using a preset database to perform similarity queries on the features to be detected of the file to be detected, it can quickly and accurately identify whether the file to be detected is a shell file, so as to perform targeted security analysis on the file to be detected and make up for the drawback of shell files being difficult to analyze.

[0241] In another embodiment of this application, see [reference needed]. Figure 9 It shows a structural diagram of a database creation apparatus 70 provided in an embodiment of this application, such as... Figure 9 As shown, the database creation device 70 includes a feature unit 701, a tag unit 702, and a database creation unit 703; wherein,

[0242] Feature unit 701 is configured to perform cluster analysis on multiple shell files to determine multiple preset shell features;

[0243] The tag unit 702 is configured to determine the subshell tag set of each of the multiple preset shell features according to the subshell type to which the multiple preset shell features belong;

[0244] The database building unit 703 is configured to build the preset database based on the sub-shell tag sets of each of the multiple preset shell features.

[0245] In some implementations, the feature unit 701 is specifically configured to: obtain the standard shell type to which each of the multiple shell files belongs; perform coarse classification on the multiple shell files according to their respective standard shell types to obtain multiple shell file sets; wherein different shell file sets correspond to different standard shell types; perform cluster analysis on each of the multiple shell file sets; perform fine classification on the multiple shell file sets according to the cluster analysis results to obtain multiple sub-shell file sets; wherein different sub-shell file sets correspond to different sub-shell types; and perform feature analysis on the multiple sub-shell file sets to determine the multiple preset shell features.

[0246] In some implementations, the feature unit 701 is further configured to disassemble the plurality of shell files to obtain the code of each of the plurality of shell files; extract features from the code of each of the plurality of shell files based on a preset granularity to obtain the feature set of each of the plurality of shell files; wherein the preset granularity includes at least one of the following: functions, control flow, and basic blocks; and perform cluster analysis on each set of shell files in the plurality of shell file sets based on the feature set of each of the plurality of shell files.

[0247] In some implementations, the feature unit 701 is further configured to determine a first set of shell files; wherein the first set of shell files is any one of the plurality of shell file sets; based on the feature sets of each of the plurality of shell files, obtain the feature sets of each of the plurality of first shell files in the first set of shell files; calculate the similarity score between any two of the plurality of first shell files using a preset similarity algorithm according to the feature sets of each of the plurality of first shell files; perform cluster analysis on the first set of shell files according to the similarity score between any two of the plurality of first shell files; and obtain the cluster analysis result after performing cluster analysis on each of the plurality of shell file sets.

[0248] In some implementations, the feature unit 701 is further configured to determine a set of subshell files to be processed; wherein the set of subshell files to be processed is any one of the plurality of subshell file sets; based on the feature sets of each of the plurality of shell files, obtain the feature sets of each of the plurality of shell files to be processed in the set of subshell files to be processed; perform an intersection operation on the feature sets of each of the plurality of shell files to be processed to obtain preset shell features of the set of subshell files to be processed; and after obtaining the preset shell features of each of the plurality of subshell file sets, determine the plurality of preset shell features.

[0249] Understandably, in this embodiment, a "unit" can be a portion of a circuit, a portion of a processor, a portion of a program or software, etc., and can also be a module or a non-modular component. Furthermore, the components in this embodiment can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional module.

[0250] If the integrated unit is implemented as a software functional module and is not sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, this embodiment provides a computer storage medium applied to a database creation apparatus 70. This computer storage medium stores a storage management program, which, when executed by a second processor, implements the method described in any of the foregoing embodiments.

[0251] Based on the composition of the aforementioned database establishment device 70 and the computer storage medium, see [link to documentation]. Figure 10 It illustrates a specific hardware structure example of the database creation apparatus 70 provided in the embodiments of this application, such as... Figure 10 As shown, the database establishment apparatus 70 may include: a second communication interface 801, a second memory 802, and a second processor 803; the various components are coupled together via a second bus system 804. It is understood that the second bus system 804 is used to realize the connection and communication between these components. In addition to a data bus, the second bus system 804 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 10 The various buses are all labeled as the second bus system 804. Among them,

[0252] The second communication interface 801 is used for receiving and sending signals during the process of sending and receiving information with other external network elements;

[0253] The second memory 802 is used to store computer programs that can run on the second processor 803;

[0254] The second processor 803 is configured to perform the following when running the computer program:

[0255] Cluster analysis was performed on multiple shell files to determine multiple preset shell features;

[0256] Based on the subshell type to which the multiple preset shell features belong, determine the subshell tag set for each of the multiple preset shell features;

[0257] The preset database is established based on the sub-shell tag sets of each of the multiple preset shell features.

[0258] Alternatively, as another embodiment, the second processor 803 is also configured to perform the method described in any of the foregoing embodiments when running the computer program.

[0259] It is understood that the second memory 802 has similar hardware functions to the first memory 602, and the second processor 803 has similar hardware functions to the first processor 603; these will not be described in detail here.

[0260] This application provides a database establishment device, which includes a feature unit, a tag unit, and a database building unit. It determines multiple preset shell features based on multiple shell files, and then establishes a preset database using the multiple preset shell features and their respective sub-shell tag sets. Thus, the preset database can quickly and accurately identify whether the file to be detected is a shell file, so as to perform targeted security analysis on the file to be detected, thus making up for the drawback of the difficulty in analyzing shell files.

[0261] Based on the above-described composition and hardware structure diagram of the shell identification device 50. See also... Figure 11 This illustrates a schematic diagram of the composition structure of a shell identification system 90 provided in an embodiment of this application. For example... Figure 11 As shown, the shell recognition system 30 includes at least a preset database 901 and a shell recognition device 50 as described in any of the foregoing embodiments, and the preset database 901 and the shell recognition device 50 are connected in communication.

[0262] For the shell recognition system 90, by using a preset database to perform similarity queries on the features to be detected of the file to be detected, it can quickly and accurately identify whether the file to be detected is a shell file, so as to perform targeted security analysis on the file to be detected, thus making up for the drawback that shell files are difficult to analyze.

[0263] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application.

[0264] It should be noted that, in this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0265] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0266] The methods disclosed in the several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0267] The features disclosed in the several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0268] The features disclosed in the several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0269] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A shell identification method, characterized in that, The method includes: Obtain the feature set of the file to be detected; The feature set to be detected is queried in a preset database for similarity, and the subshell tag set of the file to be detected is determined based on the query results; the preset database stores multiple preset shell features and the subshell tag sets of each preset shell feature. Statistical analysis is performed on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file; The step of statistically analyzing the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file includes: From the set of subshell tags of the file to be detected, obtain multiple suspected subshell tags; The detection feature set is classified according to the multiple suspected subshell labels to determine the detection feature subset of each of the multiple suspected subshell labels; Obtain the preset shell conditions for each of the multiple suspected shell tags; compare the detection feature subsets of each of the multiple suspected shell tags with the preset shell conditions of each of the multiple suspected shell tags; and determine whether the file to be detected is a shell file based on the comparison results.

2. The shell identification method according to claim 1, characterized in that, The process of obtaining the feature set of the file to be detected includes: The file to be detected is disassembled to obtain the code to be detected; Based on a preset granularity, feature extraction is performed on the code to be detected to obtain the feature set to be detected; wherein the preset granularity includes at least one of the following: function, control flow, and basic block.

3. The shell identification method according to claim 1, characterized in that, The step of performing a similarity query on the feature set to be detected in a preset database, and determining the sub-shell tag set of the file to be detected based on the query results, includes: The first feature to be detected is compared with the plurality of preset shell features; wherein, the first feature to be detected is any one of the features to be detected in the set of features to be detected; If the first feature to be detected is not similar to any of the multiple preset shell features, then the subshell label set of the first feature to be detected is determined to be an empty set. If the first feature to be detected is similar to one of the preset shell features, then the subshell tag set of the one preset shell feature is determined as the subshell tag set of the first feature to be detected. After determining the subshell tag set for each feature in the set of features to be detected, the determined set of all subshell tags is defined as the subshell tag set of the file to be detected.

4. The shell identification method according to claim 3, characterized in that, The step of determining whether the file to be detected is a file with a shell based on the comparison results includes: If, among the plurality of suspected subshell tags, the subset of features to be detected of one of the suspected subshell tags satisfies the preset shell condition of one of the suspected subshell tags, then the file to be detected is determined to be a shell file. If the subset of features to be detected for each suspected subshell tag does not meet the preset shell condition for each suspected subshell tag, then the file to be detected is determined to be an unshelled file.

5. A database creation method, characterized in that, The method includes: Cluster analysis was performed on multiple shell files to determine multiple preset shell features; Based on the subshell type to which the multiple preset shell features belong, determine the subshell tag set for each of the multiple preset shell features; A preset database is established based on the sub-shell tag sets of each of the multiple preset shell features; The process of clustering multiple shell files to determine multiple preset shell features includes: Obtain the standard shell type to which each of the multiple shell files belongs, and perform a coarse classification of the multiple shell files according to their respective standard shell types to obtain multiple shell file sets; wherein, different shell file sets correspond to different standard shell types; Cluster analysis is performed on each of the multiple shell file sets. Based on the cluster analysis results, the multiple shell file sets are further classified to obtain multiple sub-shell file sets; wherein, different sub-shell file sets correspond to different sub-shell types. Feature analysis is performed on the multiple sets of subshell files to determine the multiple preset shell features.

6. The database establishment method according to claim 5, characterized in that, Before performing cluster analysis on each of the plurality of shell file sets, the method further includes: The multiple shell files are disassembled to obtain the code of each shell file. Based on a preset granularity, feature extraction is performed on the code of each of the multiple shell files to obtain the feature set of each of the multiple shell files; wherein, the preset granularity includes at least one of the following: function, control flow, and basic block; Accordingly, the clustering analysis of each of the plurality of shell file sets includes: Based on the feature sets of each of the multiple shell files, cluster analysis is performed on each set of shell files in the multiple shell file sets.

7. The database establishment method according to claim 6, characterized in that, The step of performing cluster analysis on each set of shell files based on their respective feature sets includes: Determine a first set of shell files; wherein the first set of shell files is any one of the plurality of shell file sets; Based on the feature sets of each of the multiple shell files, obtain the feature sets of each of the multiple first shell files in the first shell file set; Based on the feature sets of each of the plurality of first shell files, a preset similarity algorithm is used to calculate the similarity score between any two first shell files among the plurality of first shell files; Cluster analysis is performed on the set of first shell files based on the similarity score between any two first shell files among the plurality of first shell files; After performing cluster analysis on each of the multiple shell file sets, the cluster analysis results are obtained.

8. The database establishment method according to claim 6, characterized in that, The step of performing feature analysis on the multiple sets of sub-shell files to determine the multiple preset shell features includes: Determine the set of subshell files to be processed; wherein, the set of subshell files to be processed is any one of the plurality of subshell file sets; Based on the feature sets of each of the multiple shell files, obtain the feature sets of each of the multiple shell files to be processed in the set of subshell files to be processed; The feature sets of the multiple shell files to be processed are intersected to obtain the preset shell features of the set of sub-shell files to be processed; After obtaining the preset shell features of each of the multiple subshell file sets, the multiple preset shell features are determined.

9. A shell identification device, characterized in that, The shell identification device includes an acquisition unit, a query unit, and an analysis unit, wherein, The acquisition unit is configured to acquire the feature set to be detected of the file to be detected; The query unit is configured to perform a similarity query on the feature set to be detected in a preset database, and determine the subshell tag set of the file to be detected based on the query results; the preset database stores multiple preset shell features and subshell tag sets for each of the multiple preset shell features. The analysis unit is configured to perform statistical analysis on the set of subshell tags of the file to be detected to determine whether the file to be detected is a shelled file. The analysis unit is specifically configured to: obtain multiple suspected subshell tags from the set of subshell tags of the file to be detected; classify the feature set to be detected according to the multiple suspected subshell tags to determine the feature subset to be detected for each of the multiple suspected subshell tags; obtain the preset shell conditions for each of the multiple suspected subshell tags; compare the feature subset to be detected for each of the multiple suspected subshell tags with the preset shell conditions for each of the multiple suspected subshell tags; and determine whether the file to be detected is a shelled file based on the comparison result.

10. A shell identification device, characterized in that, The shell identification device includes a first memory and a first processor; wherein... The first memory is used to store computer programs that can run on the processor; The first processor is configured to perform the steps of the method as described in any one of claims 1 to 4 when running the computer program.

11. A database creation apparatus, characterized in that, The database creation device includes a feature unit, a tag unit, and a database creation unit, wherein, The feature unit is configured to perform cluster analysis on multiple shell files to determine multiple preset shell features; The tag unit is configured to determine the subshell tag set of each of the multiple preset shell features according to the subshell type to which the multiple preset shell features belong; The database building unit is configured to build a preset database based on the sub-shell tag sets of each of the multiple preset shell features; The feature unit is specifically configured to obtain the standard shell type to which each of the multiple shell files belongs, and to perform coarse classification on the multiple shell files according to the standard shell type to which each of the multiple shell files belongs, thereby obtaining multiple shell file sets; wherein, different shell file sets correspond to different standard shell types; Cluster analysis is performed on each of the multiple shell file sets. Based on the cluster analysis results, the multiple shell file sets are further classified to obtain multiple sub-shell file sets; wherein, different sub-shell file sets correspond to different sub-shell types. Feature analysis is performed on the multiple sets of subshell files to determine the multiple preset shell features.

12. A database creation apparatus, characterized in that, The database creation device includes a second memory and a second processor; wherein... The second memory is used to store computer programs that can run on the processor; The second processor is configured to perform the steps of the method as described in any one of claims 5 to 8 when running the computer program.

13. A computer storage medium, characterized in that, The computer storage medium stores a computer program that, when executed by a first processor, implements the steps of the method as described in any one of claims 1 to 4, or when executed by a second processor, implements the steps of the method as described in any one of claims 5 to 8.

Images