Abnormal file detection method, device, equipment, storage medium and program product

Abstract

The application discloses an abnormal file detection method and device, equipment, a storage medium and a program product, and relates to the technical field of network security. The method comprises the following steps: acquiring a file generation log, the file generation log containing at least one generation record of a generated file; determining a file activity feature of the generated file based on a machine identifier and a file generation path indicated by the generation record, the machine identifier being an identifier of a machine to which the generated file belongs, and the file activity feature being used for indicating the activity of the generated file generated on different machines and in different paths; determining a file modification feature of the generated file based on a content modification frequency indicated by the generation record, the content modification frequency being determined according to the content change frequency of the generated file in the same generation position; and filtering the at least one generated file based on the file activity feature and the file modification feature, to obtain an abnormal file. The method provided in the application can reduce the false negative rate of abnormal files in the file detection process.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network security, and particularly relate to a method and device for detecting abnormal files, a storage medium and a program product. BACKGROUND

[0002] A Webshell file is a command execution environment in the form of a web page file. An attacker can use a Webshell file to break into a website server and control the website server.

[0003] Currently, when detecting a Webshell file, detection is performed based on file content features, such as matching the characteristic code, characteristic value and dangerous function name of a file with known Webshell file features, to determine whether the file is a Webshell file.

[0004] The method in the related art relies on traditional features of a Webshell and can only detect known Webshell files, with a high false negative rate. SUMMARY

[0005] Embodiments of the present application provide a method and device for detecting abnormal files, a storage medium and a program product, which can detect unknown abnormal files and reduce the false negative rate of abnormal files. The technical solution is as follows:

[0006] In one aspect, the present application provides a method for detecting abnormal files, which comprises:

[0007] obtaining a file generation log, the file generation log containing at least one generation record of a generated file;

[0008] determining a file activity feature of the generated file based on a machine identifier and a file generation path indicated by the generation record, the machine identifier being an identifier of a machine to which the generated file belongs, and the file activity feature being used to indicate the activity of the generated file generated in different machines and different paths;

[0009] determining a file modification feature of the generated file based on a content modification frequency indicated by the generation record, the content modification frequency being determined according to the number of content changes of the generated file in the same generation position;

[0010] filtering at least one of the generated files based on the file activity feature and the file modification feature to obtain an abnormal file.

[0011] In another aspect, the present application provides a device for detecting abnormal files, which comprises:

[0012] The log acquisition module is configured to acquire a file generation log, the file generation log including at least one generation record of a generated file;

[0013] The feature determination module is configured to determine a file activity feature of the generated file based on a machine identifier indicated by the generation record and a file generation path, the machine identifier being an identifier of a machine to which the generated file belongs, and the file activity feature being used to indicate activity of the generated file generated in different machines and different paths.

[0014] The feature determination module is further configured to determine a file modification feature of the generated file based on a content modification frequency indicated by the generation record, the content modification frequency being determined according to a content change frequency of the generated file in the same generation position.

[0015] The file filtering module is configured to filter at least one of the generated files based on the file activity feature and the file modification feature to obtain an abnormal file.

[0016] In another aspect, an embodiment of the present application provides a computer device, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or the instruction set being loaded and executed by the processor to implement the method for detecting an abnormal file according to the above aspect.

[0017] In another aspect, a computer readable storage medium is provided, the readable storage medium storing at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or the instruction set being loaded and executed by a processor to implement the method for detecting an abnormal file according to the above aspect.

[0018] In another aspect, an embodiment of the present application provides a computer program product or a computer program, the computer program product or the computer program including computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to enable the computer device to perform the method for detecting an abnormal file according to the above aspect.

[0019] The technical scheme provided by the embodiments of the present application has at least the following beneficial effects:

[0020] In the embodiments of the present application, the computer device obtains a file generation log, and analyzes file active features and file modification features of each generated file according to generation records of each generated file in the file generation log, and then filters the generated files according to the activity of the generated files in different machines and different paths and the content modification after the generation, to obtain abnormal file creation behaviors, and thus determines the abnormal files. In the process, the computer device determines according to the file generation behaviors, without obtaining the features of the specific file content, and without relying on the features of the known abnormal files, so that the detection of unknown abnormal files can be realized, and the false negative rate of the abnormal files in the file detection process can be reduced. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 A schematic diagram of an implementation environment provided by an example embodiment of the present application is shown;

[0023] Figure 2 A flowchart of an abnormal file detection method provided by an example embodiment of the present application is shown;

[0024] Figure 3 A flowchart of an abnormal file detection method provided by another example embodiment of the present application is shown;

[0025] Figure 4 A schematic diagram of preprocessing of file generation records provided by an example embodiment of the present application is shown;

[0026] Figure 5 A flowchart of an abnormal file detection method provided by another example embodiment of the present application is shown;

[0027] Figure 6 A flowchart of an abnormal file detection method provided by another example embodiment of the present application is shown;

[0028] Figure 7 A structural block diagram of an abnormal file detection device provided by an example embodiment of the present application is shown;

[0029] Figure 8 A structural schematic diagram of a computer device provided by an example embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0031] Webshell: "Web" refers to a web server, and "Shell" refers to a script program. A webshell is a command execution environment that exists as a web page file such as .php, .cgi, .asp, or .jsp. When attackers compromise a website, they typically mix webshell files with normal web page files on the website server, allowing them to access the webshell backdoor through a browser and ultimately gain control of the website server.

[0032] File MD5: MD5 is an encryption algorithm commonly used for encrypting strings or files. A file MD5 is the value obtained after encrypting the file content. Every file has one and only one unique MD5 value, and the MD5 value changes accordingly after the file content is modified.

[0033] In related technologies, when detecting Webshell files, the file's corresponding signature, signature value, and dangerous function name are matched with features in a Webshell database to determine whether the file is a Webshell file. This method can only detect known types of Webshell files, resulting in a high false negative rate.

[0034] This application proposes an abnormal file detection method for detecting Webshell files. This method uses file generation records to determine the activity level of files generated at different locations and the extent of file modifications. By filtering abnormal files based on generation behavior characteristics, it can detect unknown Webshell files without needing to know the specific content of the file, reducing the false negative rate of abnormal files.

[0035] The method provided in this application can be applied to host security defense products to detect abnormal files on a host. This application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0036] Figure 1 A schematic diagram of an implementation environment provided by an exemplary embodiment of this application is shown. This implementation environment includes a computer device 110 and at least one server 120. The computer device 110 and each server 120 communicate via a communication network. Optionally, the communication network can be a wired network or a wireless network, and the communication network can be at least one of a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN).

[0037] The computer device 110 is an electronic device for detecting abnormal files, which includes but is not limited to a mobile phone, a computer, a smart voice interaction device, a smart home appliance, a vehicle terminal, an aircraft terminal, and the like, and can also be a cloud server for computing. The present embodiment is not limited thereto.

[0038] The server 120 can be a stand-alone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0039] In a possible implementation, the computer device 110 can receive file generation logs from each server 120, filter each generated file according to the generation records of each file in the file generation logs, obtain abnormal files, and feed back to the server 120.

[0040] Please refer to Figure 2 which shows a flowchart of an abnormal file detection method provided by an example embodiment of the present application. The present embodiment takes the method for a computer device as an example, and the method includes the following steps.

[0041] In step 201, a file generation log is obtained, which contains the generation records of at least one generated file.

[0042] Optionally, a generation record is generated at each file creation, which is used to record the file generation position and the generation time, etc. The file generation position can include the specific machine (i.e. host) and the specific file path information.

[0043] In the present embodiment, the computer device will determine whether it is an abnormal generation behavior according to the generation records of each generated file. In a possible implementation, the computer device can send an acquisition request to each cloud machine when obtaining the file generation log, and the cloud machine sends the file generation log containing the generation records of each generated file to the computer device after receiving the acquisition request.

[0044] In another possible implementation, each cloud machine can send the file generation log to the computer device every target period, so that the computer device screens abnormal files according to the file generation log.

[0045] At step 202, based on the machine identifier indicated by the generation record and the file generation path, the file active feature of the generated file is determined, the machine identifier is the identifier of the machine to which the generated file belongs, and the file active feature is used to indicate the activity of the generated file generated in different machines and different paths.

[0046] The abnormal file has some characteristics in the file generation behavior when it is generated to achieve concealment, such as limited abnormal file generation position and not generated in multiple machines. In addition, in order to achieve concealment, for the generated files with the same content, they are usually generated in different paths to achieve the purpose of concealment through path variability. Therefore, in a possible implementation, the computer device screens the abnormal file according to the characteristics of the generation behavior of each generated file.

[0047] Optionally, when the generation record of each generated file is obtained, the file active feature and the file modification feature can be determined according to the information in the generation record, and the characteristics in different dimensions are analyzed. The file active feature is used to indicate the activity of the generated file generated in different generation positions, which can be determined according to the generation position information in the generation record, and the generation position information includes the machine located and the specific path information in the machine. That is, the generation record contains the machine identifier of the machine to which the generated file belongs and the file generation path of the generated file. The computer device can determine the activity of the file generated in different machines according to the machine identifier corresponding to the generated file, and can determine the activity of the file generated in different paths according to the different file generation paths corresponding to the generated file.

[0048] At step 203, based on the content modification times indicated by the generation record, the file modification feature of the generated file is determined, and the content modification times are determined according to the content change times of the generated file in the same generation position.

[0049] The abnormal file usually does not occur after being generated, so as to achieve the purpose of concealment. Therefore, in a possible implementation, the computer device can also determine the file modification feature, and screen the abnormal file according to the file modification feature. The file modification feature is used to indicate the content modification of the generated file.

[0050] In a possible implementation, the file modification feature can be determined based on the content modification times of the file, that is, only the content modification times are obtained, and the specific modified content is not required. In a possible implementation, the computer device can determine the content modification times according to the content change times of the generated file in the same generation position.

[0051] The generation record records the content identifier of the generated file, which is used to represent the unique file content. In a possible implementation, the computer device can analyze the content modification times according to the change times of the content identifier of the generated file.

[0052] Since the obtained file generation record can contain generation records in a long period, the file activity features and the file modification features in different time lengths can be different, and if the features in a long period are used to determine the features, the features can be inaccurate, therefore, for different features, the computer device can determine the file generation record obtained in different historical time lengths. For example, the file activity features and the file modification features can be determined according to the file generation records in different time lengths respectively.

[0053] In step 204, at least one generated file is filtered based on the file activity features and the file modification features, and an abnormal file is obtained.

[0054] In a possible implementation, the computer device can filter the generated files according to the file activity features and the file modification features of the generated files. Different filtering conditions are set for different features, the computer device can filter the files according to the filtering conditions corresponding to the file activity features, and filter the files according to the filtering conditions corresponding to the file modification features. When the file activity features and the file modification features both meet the conditions, the file can be determined as an abnormal file.

[0055] In summary, in the embodiment of the present application, the computer device obtains the file generation log, and analyzes the file activity features and the file modification features of each generated file according to the generation records of the generated files, and then filters the generated files according to the activity of the generated files in different machines and different paths and the content modification after the generation, obtains the abnormal file creation behavior, and determines the abnormal file. In the process, the computer device determines according to the file generation behavior, without obtaining the features of the specific file content, and without relying on the features of the known abnormal file, therefore, the detection of unknown abnormal files can be realized, and the false negative rate of the abnormal files in the file detection process is reduced.

[0056] In the embodiment, the file activity features can include machine activity features and path activity features, in a possible implementation, the machine activity features and the path activity features can be determined according to the machines and the paths of the generated files indicated in the generation records respectively. The file modification features can be determined according to the file modification times indicated in the generation records. The following will be described with exemplary embodiments.

[0057] Please refer to Figure 3 which shows a flowchart of an abnormal file detection method provided by another exemplary embodiment of the present application. The embodiment takes the method used in a computer device as an example, and the method includes the following steps.

[0058] In step 301, a file generation log is obtained.

[0059] Optionally, the computer device can acquire file generation logs of all cloud machines, thereby acquiring generation records of files generated on each machine. The generation record includes the correspondence between the machine identifier of the machine where the file is generated, the content identifier of the generated file, and the file generation path. The machine identifier of the machine where the file is generated is a unique identifier of each host, used to identify a unique machine; the content identifier of the file is the MD5 value of the file, used to identify a unique file content; the file generation path is the location of the file in the computer system of the machine, which includes the generation directory and the generation file name. In addition, the generation record also includes the file generation time of the generated file, which is recorded at the time of generation.

[0060] Illustratively, the acquired file generation logs can be as shown in Table 1:

[0061] Table 1

[0062]

[0063]

[0064] which includes the corresponding generation records of the generated files 67183f27, 4e2f5d80, and 2ccd53e0, etc.

[0065] In one possible implementation, after acquiring each generation record, the computer device can preprocess each generation record, extract the directory and file name in the file generation path, and extract the date in the file generation time, without recording the time, minute, and second.

[0066] Illustratively, the preprocessing method of the generation record of the generated file 67183f27 can be as shown in Table 2: Figure 4 According to the file path 401, the corresponding file directory 402 of the generated file 67183f27 can be obtained: / www / wwwroot / 66ts.vip / Tudou / Runtime, and the file name 403: crons.php. And the file generation date 405: 2022-02-16 is extracted from the file generation time 404. According to the generation record, it can be obtained that the generated file 67183f27 is generated in the machine 0001 on February 16, 2022, in the / www / wwwroot / 66ts.vip / Tudou / Runtime of the machine 0001, and the file name is crons.php.

[0067] Step 302, determining the machine activity feature based on the correspondence between the machine identifier and the content identifier.

[0068] Optionally, the file activity feature comprises a machine activity feature and a path activity feature. The machine activity feature is used to represent the activity of the generated file on different machines, and the path activity feature is used to represent the activity of the generated file on different paths.

[0069] In the process of generating the abnormal file, in order to avoid being killed by hiding its existence, the generating range of the abnormal file is usually limited, and the abnormal file rarely attacks the same machine for multiple times, i.e., the activity of the abnormal file on the machine is low. Therefore, the machine activity feature can be used to determine whether the generated file has an abnormal creation behavior.

[0070] The machine activity feature comprises a generating range feature and a generating heat feature. The generating range refers to the range of machines involved in the generated file, i.e., the number of corresponding machines in which the generated file is generated. For example, when the generated file is generated in 50 different machines, the generating range is 50. The generating heat comprises at least one of a global generating heat and a local generating heat. The global generating heat is used to indicate the number of times that the generated file is generated in all machines, i.e., the total number of times that the generated file appears in all machines. The local generating heat is used to indicate the number of times that the generated file is generated in a single machine, i.e., the total number of times that the generated file appears in the target machine.

[0071] In a possible implementation, the computer device can determine the generating range feature and the generating heat feature based on the generation record of each generated file.

[0072] Optionally, the generation record comprises a correspondence among a machine identifier, a file generation path, and a content identifier of the generated file.

[0073] The computer device determines the generating range feature and the generating heat feature of the generated file based on the machine identifier corresponding to the content identifier of the generated file. The generating range feature is used to indicate the number of machines to which the generated file belongs, and the generating heat feature is used to indicate the number of times that the generated file is generated on the machine.

[0074] It should be noted that the generating range feature and the generating heat feature are determined according to the file generation log within a period of time. Optionally, the computer device can determine the generating range feature and the generating heat feature of the generated file according to the file generation log within a first time length. Illustratively, the first time length can be one day, and the generating range feature and the generating heat feature of the file can be determined according to the file generation log of each machine in the day.

[0075] When the generation breadth feature of the generated file needs to be determined, the number of different machine identifiers corresponding to the content identifier of the generated file in the file generation log obtained on the day can be determined to determine the generation breadth, and the generation breadth feature is obtained, that is, the generation breadth feature can be represented by the number of different machine identifiers corresponding to the content identifier. In combination with the above example, when the number of different machine identifiers corresponding to the generated file 67183f27 contains 50, it can be determined that the generation breadth is 50.

[0076] The number of different machine identifiers corresponding to the content identifier in the file generation log obtained on the day can be determined to determine the global generation heat, that is, the number of records of the content identifier of the generated file in the file generation log can be counted to determine the global generation heat. When the generated file 67183f27 appears 20 times in the file generation log, the global generation heat is determined to be 20. The number of records of the content identifier of the generated file corresponding to the target machine identifier in the file generation log obtained on the day can be determined to determine the local generation heat of the generated file. For example, when the number of records of the generated file 67183f27 under the machine 0001 is 2, the local generation heat of the generated file 67183f27 in the machine 0001 is determined to be 2. The computer device can determine the local generation heat of the generated file in each machine according to the correspondence between the content identifier and the machine identifier, and determine the generation heat feature according to the global generation heat and the local generation heat

[0077] In step 303, the path activity feature is determined based on the correspondence between the file generation path and the content identifier.

[0078] During the generation of the abnormal file, the file name and the directory where the file is located may be changed multiple times to reduce the possibility of being discovered, that is, the abnormal file is generated in different paths, and the path activity is high. Therefore, whether the generated file has an abnormal creation behavior can be determined according to the path activity feature.

[0079] The path activity feature includes the file name activity feature and the directory activity feature. Optionally, determining the path activity feature can include the following steps:

[0080] In step one, the file name activity feature is determined based on the number of different file names corresponding to the content identifier of the generated file, and the file generation path indicates the file name.

[0081] Optionally, the computer device can determine the number of different file names corresponding to each file generation path based on the content identifier of the generated file, and the number of file names can represent the file name activity feature.

[0082] In step two, the directory activity feature is determined based on the number of different generation directories corresponding to the content identifier of the generated file, and the file generation path indicates the generation directory.

[0083] Optionally, the computer device can determine the number of different generation directories corresponding to the content identifiers of the generated files based on the generated file content identifiers, and the number of different generation directories can represent the directory activity feature.

[0084] It should be noted that the number of file names and the number of generation directories both refer to the number of different file names and the number of different directories corresponding to the generated files in the same machine.

[0085] Correspondingly, when determining the number of different file names and the number of different generation directories of the generated files, the number of different file names and the number of different generation directories in the second time period are determined based on the file generation logs in the second time period, so as to avoid that the data in a longer time period or a shorter time period cannot accurately represent the file name and directory change feature of the generated files. Optionally, the second time period can be one week.

[0086] The computer device can determine the number of file names and the number of generation directories based on the number of different file names and the number of different generation directories corresponding to the content identifiers of the generated files in the historical 7-day file generation logs.

[0087] In step 304, the first file modification feature is determined based on the number of times of changes of the content identifiers corresponding to the same file generation path in the same machine in the generation record.

[0088] In addition to the above features, the abnormal file is of a hidden type and is usually rarely modified after being generated. Therefore, the file modification feature can be determined. Optionally, the file modification feature can be determined based on the number of content modifications. In a possible implementation, the computer device determines the number of content modifications based on the number of times of changes of the content identifiers of the generated files. When the content identifier is changed without changing the generation position, it indicates that the content of the original generated file is possibly modified. Therefore, the number of times of changes of the content identifiers in the same generation position can be used to determine the file modification feature.

[0089] Optionally, the generation position can be the file generation path.

[0090] When the file generation path is unchanged and the content identifier of the corresponding generated file is changed, it indicates that the content of the generated file is possibly modified. Therefore, in a possible implementation, the computer device can count the number of times of changes of the content identifiers in the same file generation path in the same machine, that is, the number of different content identifiers, to obtain the first modification number, and determine the first modification number as the first file modification feature.

[0091] The first modification number can be obtained according to file generation log in a third time period. Optionally, the third time period can be 20 days. When the file generation log in the last 20 days indicates that the content identifier corresponding to the file generation path / www / wwwroot / 66ts.vip / Tudou / Runtime / crons.php in the machine 0001 contains two, it can be determined that the first modification number is 2, indicating that the content of the file named crons.php generated in the directory / www / wwwroot / 66ts.vip / Tudou / Runtime may have been modified.

[0092] In step 305, the second file modification feature is determined based on the number of changes of the content identifier corresponding to the same generation directory in the same machine in the generation record.

[0093] When the content identifier of the file in the same generation directory changes, it can also indicate that the file may have been changed. In addition, according to the number of different content identifiers in the same generation directory, the activity of the generation directory can also be determined. Generally, abnormal files tend to be generated in inactive directories to achieve the purpose of concealment. Therefore, in one possible implementation, the computer device can count the number of changes of the content identifier in the same file generation directory in the same machine, that is, the number of different content identifiers, which can represent the number of file modifications on the one hand, and can indicate the activity of the directory on the other hand. The computer device obtains the number of different content identifiers corresponding to the same machine identifier and the same generation directory, determines the second modification number, and determines the second modification number as the second file modification feature.

[0094] In the statistics of the second modification number, the file generation log in a fourth time period can be counted. Optionally, the fourth time period can be 2 days. The computer device can obtain the number of different content identifiers in the same generation directory in the last 2 days.

[0095] In step 306, the third file modification feature is determined based on the number of changes of the content identifier corresponding to the same file name in the same machine in the generation record.

[0096] In order to further determine whether the file has been modified, the computer device can obtain the number of changes of the content identifier corresponding to the same file name in the same machine, that is, the number of different content identifiers corresponding to the same machine identifier and the same file name, determine the third modification number, and determine the third modification number as the third file modification feature. When the file name is the same and the content identifier is different, the generated file may have been modified.

[0097] And in the statistics of the third modification times, the file generation logs in the fifth time length can be used for statistics. Optionally, the fifth time length can be 1 day. The computer device obtains the number of different content identifiers in the same generation directory in the same machine in the day.

[0098] In step 307, in the case that the file active feature indicates that the generated file is a hidden file, the generated file is determined as the first abnormal file.

[0099] After the computer device obtains the machine active feature and the path active feature respectively, it can determine whether the generated file is abnormal according to the two features. Different filtering conditions are used for different active features.

[0100] For the machine active feature, when the file generation range is smaller and the number of occurrences in the machine is less, it is likely to be an abnormal file. Therefore, in a possible implementation, the computer device determines the generated file as a hidden file when the generation breadth feature indicates that the generation breadth is lower than a breadth threshold and the generation heat feature indicates that the generation heat is lower than a heat threshold, and determines the generated file as the first abnormal file. Optionally, the breadth threshold can be 100, that is, when the number of machines in which the generated file belongs to is less than 100, the generated file is likely to be an abnormal file. The generation heat feature can indicate global generation heat and local generation heat at the same time. Different generation heat corresponds to different heat thresholds. For the global generation heat, the heat threshold can be 30, and for the local generation heat, the heat threshold can be 1. When the generation breadth is equal to the breadth threshold and the generation heat is equal to the heat threshold, the generated file can also be determined as the first abnormal file.

[0101] For example, when the machine breadth corresponding to the generated file is 20, the global machine heat is 20, and the local machine heat is 1, the generated file is determined as the first abnormal file.

[0102] For the path active feature, when the generated file modifies the file name or changes the number of times in different directories more, it is likely to hide itself. Therefore, in a possible implementation, when the number of generated file names and the number of generated directories are greater than a generation number threshold, the generated file is determined as the first abnormal file.

[0103] Optionally, the generation number threshold can be 1. When the number of generated file names is greater than 1, it indicates that the file name of the generated file has been modified; when the number of generated directories is greater than 1, it indicates that the storage location of the generated file has been changed. When the number of generated file names and the number of generated directories are greater than 1, the computer device determines the generated file as the first abnormal file.

[0104] Step 308, in the case that the file modification feature indicates that the number of modifications of the generated file is less than the number threshold, the generated file is determined as the second abnormal file.

[0105] Optionally, the file modification feature is represented by the number of content modifications of the file. When the number of content modifications is less than the number threshold, it indicates that the content of the file is less modified, which may be an abnormal file. Therefore, the computer device can determine whether the generated file is an abnormal file according to the relationship between the number of content modifications and the number threshold.

[0106] Optionally, in the case that the first file modification feature, the second file modification feature, and the third file modification feature indicate that the number of content modifications is less than the number threshold, the generated file is determined as the second abnormal file.

[0107] That is, in the case that the first number of modifications, the second number of modifications, and the third number of modifications are less than or equal to the number threshold, the generated file is determined as the second abnormal file.

[0108] Optionally, the number threshold can be 1, that is, the number of modifications is limited to 1. When the first number of modifications is 1, it indicates that the same file generation path corresponds to only one content identifier, and the content of the generated file is not updated. When the second number of modifications is 1, it indicates that only one file is generated under the same generation directory, and it can represent that the generation directory is not active. When the third number of modifications is 1, it indicates that the content of the generated file corresponding to the same file name is not updated.

[0109] Step 309, determining the abnormal file based on the intersection file of the first abnormal file and the second abnormal file.

[0110] After determining each first abnormal file and each second abnormal file, the computer device can determine the intersection file in the first abnormal file and the second abnormal file as the abnormal file. That is, when the machine activity feature, the path activity feature, and the file modification feature all meet the conditions, the generated file is determined as the abnormal file.

[0111] In another possible implementation, to improve the accuracy of abnormal file identification, after obtaining the intersection file, the file identification network can be further used for further screening to identify the abnormal file therein.

[0112] This mode can include steps 309a-309c (not shown in the figure):

[0113] Step 309a, determining the intersection file of the first abnormal file and the second abnormal file.

[0114] Optionally, the computer device can first determine the intersection file in the first abnormal file and the second abnormal file.

[0115] Step 309b, obtaining the file activity feature and the file modification feature of each candidate abnormal file in the intersection file.

[0116] Then, the computer device can obtain the file activity feature and the file modification feature of each candidate abnormal file in the intersection file, and determine the abnormal file again based on the file activity feature and the file modification feature of the candidate abnormal file.

[0117] Step 309c, inputting the file activity feature and the file modification feature of each candidate abnormal file into the file identification model for abnormal file identification to obtain the abnormal file, wherein the file identification model is trained based on the file activity feature and the file modification feature of the sample file, and the sample file is a labeled file.

[0118] The computer device can input the file activity feature and the file modification feature of each candidate abnormal file into the file identification model for abnormal file identification to obtain the abnormal file.

[0119] The identification process can include the following steps:

[0120] Step one, inputting the file activity feature and the file modification feature into the feature extraction branch of the file identification model for feature extraction to obtain the active feature vector and the modification feature vector, wherein the active feature vector is obtained based on the generation breadth feature, the generation heat feature, the file name activity feature and the directory activity feature, and the modification feature vector is obtained based on the first file modification feature, the second file modification feature and the third file modification feature.

[0121] First, the computer device can input the file activity feature and the file modification feature into the feature extraction branch of the file identification model for feature extraction to obtain the active feature vector and the modification feature vector. The file activity feature includes the generation breadth feature, the generation heat feature, the file name activity feature and the directory activity feature. The computer device can normalize each feature in the file activity feature to obtain the normalized breadth feature, the normalized heat feature, the normalized file name feature and the normalized directory feature, and then weight and fuse the normalized features to obtain the active feature vector. Different weights corresponding to different features can be trained based on sample files.

[0122] The first file modification feature, the second file modification feature and the third file modification feature can be normalized, and the normalized file modification features can be weighted and fused based on different weights corresponding to different types of modification times to obtain the modification feature vector. Different weights corresponding to different modification times are also trained based on sample files.

[0123] In step two, the active feature vector and the modified feature vector are input into a feature identification branch of the file identification model to perform feature identification, and an identification result is obtained. The identification result is used to indicate that the candidate abnormal file is an abnormal file or to indicate that the candidate abnormal file is a normal file.

[0124] Subsequently, the computer device inputs the active feature vector and the modified feature vector into the feature identification branch to perform feature identification, and an identification result is obtained. Optionally, the identification result can be a probability that the candidate abnormal file is an abnormal file. When the probability is greater than a probability threshold, it is determined that the candidate abnormal file is an abnormal file. Optionally, the probability threshold can be 80%.

[0125] Optionally, the model parameters in the feature extraction branch and the feature identification branch of the file identification model can be trained according to sample files. In a possible implementation, the computer device can obtain the file active features and the file modified features of each sample file, and input the file active features and the file modified features of the sample abnormal file into the file identification model to obtain a prediction probability, which is the probability that the sample file is an abnormal file. Thus, the file identification model is reversely trained according to the difference between the prediction probability and the label of the sample file. The label of the sample file includes two types: abnormal file and normal file.

[0126] In this embodiment, the computer device constructs features and filters data according to the file path, file naming, file directory, file generation breadth, and file generation heat of historically generated files to discover abnormal file creation behaviors, so as to discover unknown malicious Webshell files without relying on the features of known types of abnormal files, and the false negative rate of abnormal files can be reduced.

[0127] In this embodiment, after filtering according to each feature, the file identification model can be further used to identify the intersection files, so as to improve the accuracy of abnormal file detection.

[0128] In the above embodiments, whether a generated file is an abnormal file is determined according to different features. However, some generated files can be generated in a machine for caching. There are many generated files in such a machine, and the file changes are large. If the file generation log of the machine is used, it can affect the determination of the abnormal file creation behavior, and the reference value is low. Therefore, the machine needs to be filtered. Similarly, there are some cache or temporary directories, and the file changes are large, which will interfere with the determination of abnormal files. Therefore, such directories need to be filtered. The following will be described with illustrative embodiments.

[0129] Please refer to Figure 5 which shows a flowchart of an abnormal file detection method provided by another example embodiment of the present application. This embodiment takes the method used in a computer device as an example, and the method includes the following steps.

[0130] At step 501, the computer device acquires the file generation log every target period.

[0131] In a possible implementation, the computer device can acquire the file generation log newly generated by the cloud machine every period, so as to update the file activity features and the file modification features of each generated file. The file activity features and the file modification features of the newly generated file can be added.

[0132] Optionally, the target period can be 3 hours. The computer device can acquire the file generation log of the cloud machine every 3 hours.

[0133] At step 502, each generated file is screened to obtain a target generated file belonging to a target file format, the target file format being a file format to which the abnormal file belongs.

[0134] Since not all files of all formats can be Webshell files, after acquiring the file generation log, the computer device first needs to filter according to the file format. The computer device can screen each generated file according to the file format of the generated file to obtain a target generated file belonging to a target file format.

[0135] Optionally, for a Webshell file, the target file format can be a file in php, cgi, asp, or jsp format.

[0136] When the file generation record is acquired, when the file name of the generated file indicates that the generated file belongs to the php format, the generated file can be determined as the target generated file.

[0137] At step 503, the file activity features of the target generated file are determined based on the machine identifier and the file generation path indicated by the generation record of the target generated file.

[0138] In a possible implementation, the computer device can determine the file activity features of each target generated file based on only the generation record of the target generated file.

[0139] At step 504, the file modification features of the target generated file are determined based on the content modification times indicated by the target generated file.

[0140] Correspondingly, the computer device can determine the file modification features of the target generated file based on only the generation record of the target generated file, that is, screen the abnormal file in the target generated file.

[0141] And based on the generation record of the generated file, the characteristics of each generated file are determined, and since a new file generation log is obtained every target period, the computer device also needs to update the file active characteristics and file modification characteristics of the generated file based on the latest generation record obtained.

[0142] In step 505, based on the file active characteristics and the file modification characteristics, the candidate abnormal files in the generated files are determined.

[0143] Optionally, the computer device can determine the first abnormal file based on the file active characteristics, and determine the second abnormal file based on the file modification characteristics, and determine the intersection file of the first abnormal file and the second abnormal file as the candidate abnormal file. Wherein, the specific process of determining the first abnormal file and the second abnormal file can refer to the above-mentioned embodiments, and this embodiment will not be described here.

[0144] And for the target generated file screened, the computer device can screen the candidate abnormal file in the target generated file according to the file active characteristics and the file modification characteristics of the target generated file.

[0145] In step 506, the files belonging to the target machine in the candidate abnormal file are determined as abnormal files, and the target machine refers to the machine whose generated file number in the target time is less than the file number threshold.

[0146] When the candidate abnormal file is screened, the computer device also needs to be filtered according to the machine. In a possible implementation, the computer device can determine whether the machine is a cache according to the generated file number of the machine in the target time. When the generated file number in the target time is greater than the file number threshold, it is determined that the machine is a cache, and the machine needs to be filtered, that is, the generated file in the machine is excluded.

[0147] Optionally, the file number threshold can be 30, and the target time can be 1 day. That is, the computer device can determine the generated file number of each machine in 1 day according to the file generation log, when the generated file number of the machine is greater than 30, it can be filtered, and when the generated file number of the machine is less than 30, it can be determined as the target machine. The computer device determines the files belonging to the target machine in the candidate abnormal file as abnormal files.

[0148] In step 507, the files in the candidate abnormal file which do not belong to the temporary directory or the cache directory are determined as abnormal files, and the temporary directory and the cache directory are determined according to the directory identifier.

[0149] And in addition to filtering according to the machine, the computer device can also filter according to the directory. In a possible implementation, the computer device can determine the files which do not belong to the temporary directory or the cache directory as abnormal files.

[0150] Optionally, it can be determined whether the directory is a temporary directory or a cache directory according to the directory identification. When the directory contains a cache / tmp / temp identification, it can be determined that the directory is a temporary directory or a cache directory, and the candidate abnormal files belonging to the directory are filtered out to obtain the final abnormal files.

[0151] In the embodiment, the computer device can filter the candidate abnormal files according to the file active features and the file modification features of the generated files, and further filter based on the generation machine and the generation directory to avoid misjudgment of the generated files as the files under the cache machine or the cache directory, thereby improving the accuracy of abnormal file identification.

[0152] In the embodiment, after obtaining the file generation log, the target generated files belonging to the target file format are obtained by filtering the files according to the file format, and then the abnormal files are obtained by filtering the target generated files, so that the detection efficiency of the abnormal files can be improved without determining according to the generation records of all format files.

[0153] In a possible implementation, the detection process of the abnormal file can include the following steps as shown in Figure 6

[0154] Step 601, obtaining a file generation log.

[0155] The computer device can obtain the file generation log of the newly generated files of the cloud machine every 3 hours to obtain the file generation record.

[0156] Step 602, filtering the file generation record of the target generated file in the file generation log.

[0157] After obtaining the file generation record, the computer device first filters according to the target file format to obtain the target generated files with php / cgi / asp / jsp as the suffix, thereby obtaining the file generation record of the target generated file, wherein the php / cgi / asp / jsp format file is a possible file format of the abnormal file.

[0158] Step 603, preprocessing the file generation record of the target generated file to obtain the machine identification, file generation path, generation directory and file name corresponding to the content identification of the target generated file.

[0159] After filtering the file generation record, the file generation record of each target generated file is preprocessed to obtain the machine identification, file generation path, generation directory and file name corresponding to the content identification of each target generated file, and the file generation date of the target generated file is also obtained. That is, the corresponding relationship between the content identification (file MD5), machine identification (machine ID), generation directory, file name and file generation date is obtained.​

[0160] In step 604, the corresponding machine identifier is determined based on the content identifier, the generation breadth feature and the generation heat feature are determined, and the target generation file is filtered based on the breadth threshold and the heat threshold.

[0161] The computer device can count the generation breadth and the generation heat of the file on the same day according to the file MD5 group, and filter according to the condition.

[0162] That is, the computer device can determine the generation breadth and the generation heat of the file corresponding to the file MD5 according to the machine ID corresponding to the file MD5, and filter based on the breadth threshold (100), the global heat threshold (30) and the local heat threshold (1).

[0163] In step 605, the first file modification feature is determined based on the number of different content identifiers corresponding to the same file generation path, and filtered based on the number threshold.

[0164] That is, the historical 20-day data is counted according to the machine ID and the file generation path group, and the number of different file MD5 is obtained, and then filtered according to the condition.

[0165] The computer device can obtain the number of different file MD5 in the file generation record of the same machine ID and the same file generation path in the last 20 days, determine the first modification number, obtain the first file modification feature, and then filter based on the number threshold (1).

[0166] In step 606, the second file modification feature is determined based on the number of different content identifiers corresponding to the same generation directory, and filtered based on the number threshold.

[0167] That is, the historical 2-day data is counted according to the machine ID and the file directory group, the number of files generated in a certain directory of a certain machine is calculated, and then filtered according to the condition.

[0168] The computer device can obtain the second modification number according to the number of different file MD5 in the same machine ID and the same generation directory, and filter based on the number threshold (1).

[0169] In step 607, the target machine is screened based on the number of generation files of the machine.

[0170] The computer device can count the number of generation files corresponding to the same machine ID at present, so as to filter according to the file number threshold (30) to obtain the machine with the number of generation files less than 30.

[0171] In step 608, the file name active feature and the directory active feature of the generation file are determined based on the different file generation paths corresponding to the content identifier.

[0172] That is, the number of different file names and the number of different directories of the file in the past 7 days are counted according to the file MD5 grouping, and then filtered according to the condition.

[0173] The computer device can obtain the different file generation paths corresponding to the file MD5, count the number of different file names and the number of different directories based on the different file generation paths, and filter according to the generation quantity threshold (1).

[0174] In step 609, the third file modification feature is determined based on the number of different content identifiers corresponding to the same file name, and filtered based on the times threshold.

[0175] The computer device can count the number of different times of the file MD5 of the same day according to the machine ID and the file name grouping, and filter out the files that have been changed.

[0176] The computer device can obtain the number of different MD5 corresponding to the same file name under the same machine ID, and filter based on the times threshold (1).

[0177] In step 610, the intersection file is obtained.

[0178] The above steps 604 to 609 are different conditions for screening abnormal files. In one possible implementation, the computer device can obtain the intersection file after filtering according to the above conditions.

[0179] In another possible implementation, the computer device can screen the intersection file based on one or any combination of the conditions. For example, the computer device can screen the intersection file based on the file activity feature, i.e., based on the combination of steps 604 and 608; or the computer device can screen the intersection file based on the file modification feature, i.e., based on the combination of steps 605, 606 and 609, which are not limited in this embodiment.

[0180] In step 611, the intersection file is screened to obtain the abnormal file.

[0181] The files in the intersection file belonging to the cache directory or the temporary directory are filtered to obtain the abnormal file.

[0182] Figure 7 A structural block diagram of an abnormal file detection device provided by an example embodiment of the present application is shown, and the device includes:

[0183] The log acquisition module 701 is configured to obtain a file generation log, wherein the file generation log includes at least one generation record of a generated file.

[0184] The feature determination module 702 is configured to determine a file activity feature of the generated file based on the machine identifier indicated by the generation record and the file generation path, the machine identifier being an identifier of a machine to which the generated file belongs, and the file activity feature being used to indicate activity of the generated file generated in different machines and different paths.

[0185] The feature determination module 702 is further configured to determine a file modification feature of the generated file based on the content modification times indicated by the generation record, the content modification times being determined according to the number of content changes of the generated file in the same generation position.

[0186] The file filtering module 703 is configured to filter at least one of the generated files based on the file activity feature and the file modification feature, to obtain an abnormal file.

[0187] Optionally, the file activity feature includes a machine activity feature and a path activity feature, and the generation record includes a correspondence relationship among the machine identifier, the file generation path, and a content identifier of the generated file.

[0188] The feature determination module 702 is further configured to:

[0189] determine the machine activity feature based on the correspondence relationship between the machine identifier and the content identifier.

[0190] determine the path activity feature based on the correspondence relationship between the file generation path and the content identifier.

[0191] Optionally, the machine activity feature includes a generation breadth feature and a generation heat feature, and the path activity feature includes a file name activity feature and a directory activity feature.

[0192] The feature determination module 702 is further configured to:

[0193] determine the generation breadth feature and the generation heat feature of the generated file based on the machine identifier corresponding to the content identifier of the generated file, the generation breadth feature being used to indicate a number of machines to which the generated file belongs, and the generation heat feature being used to indicate a number of times of generation of the generated file in a machine.

[0194] determine the file name activity feature based on a number of different file names corresponding to the content identifier of the generated file, the file generation path indicating a file name.

[0195] determine the directory activity feature based on a number of different generation directories corresponding to the content identifier of the generated file, the file generation path indicating a generation directory.

[0196] Optionally, the feature determining module 702 is further configured to:

[0197] determine a first file modification feature based on a number of times of changes of the content identifier corresponding to the same file generation path in the same machine in the generation record;

[0198] determine a second file modification feature based on a number of times of changes of the content identifier corresponding to the same generation directory in the same machine in the generation record;

[0199] determine a third file modification feature based on a number of times of changes of the content identifier corresponding to the same generation file name in the same machine in the generation record.

[0200] Optionally, the file filtering module 703 is further configured to:

[0201] determine the generated file as a first abnormal file in a case where the file activity feature indicates that the generated file is a hidden type file;

[0202] determine the generated file as a second abnormal file in a case where the file modification feature indicates that a number of modifications of the generated file is lower than a number threshold;

[0203] determine the abnormal file based on an intersection file of the first abnormal file and the second abnormal file.

[0204] Optionally, the file filtering module 703 is further configured to:

[0205] determine the generated file as the hidden type file and determine the generated file as the first abnormal file in a case where the generation breadth feature indicates that a generation breadth is lower than a breadth threshold and the generation heat feature indicates that a generation heat is lower than a heat threshold;

[0206] determine the generated file as a hidden type file and determine the generated file as the first abnormal file in a case where the file name activity feature indicates that a number of file names is greater than a generation number threshold and the directory activity feature indicates that a number of generation directories is greater than the generation number threshold;

[0207] The determining the generated file as the second abnormal file in the case where the file modification feature indicates that the number of modifications of the generated file is lower than the number threshold, comprises:

[0208] determining the generated file as the second abnormal file in a case where the first file modification feature, the second file modification feature and the third file modification feature indicate that a number of content modifications is less than the number threshold.

[0209] Optionally, the file filtering module 703 is further configured to:

[0210] determine an intersection file of the first abnormal file and the second abnormal file;

[0211] obtain the file activity feature and the file modification feature of each candidate abnormal file in the intersection file;

[0212] input the file activity feature and the file modification feature of each candidate abnormal file into a file identification model for abnormal file identification to obtain the abnormal file, the file identification model being trained based on the file activity feature and the file modification feature of sample files, the sample files being labeled files.

[0213] Optionally, the file filtering module 703 is further used for:

[0214] input the file activity feature and the file modification feature into a feature extraction branch of the file identification model for feature extraction to obtain an active feature vector and a modification feature vector, the active feature vector being obtained based on fusion of the generation breadth feature, the generation heat feature, the file name activity feature and the directory activity feature, and the modification feature vector being obtained based on fusion of the first file modification feature, the second file modification feature and the third file modification feature;

[0215] input the active feature vector and the modification feature vector into a feature identification branch of the file identification model for feature identification to obtain an identification result, the identification result being used for indicating that the candidate abnormal file is an abnormal file or indicating that the candidate abnormal file is a normal file.

[0216] Optionally, the file filtering module 703 is further used for:

[0217] determine a candidate abnormal file in the generated file based on the file activity feature and the file modification feature;

[0218] determine a file belonging to a target machine in the candidate abnormal file as the abnormal file, the target machine being a machine generating a number of files less than a file quantity threshold within a target time length.

[0219] Optionally, the file filtering module 703 is further used for:

[0220] determine a candidate abnormal file in the generated file based on the file activity feature and the file modification feature;

[0221] determine a file not belonging to a temporary directory or a cache directory in the candidate abnormal file as the abnormal file, the temporary directory and the cache directory being determined according to a directory identifier.

[0222] Optionally, the apparatus further comprises:

[0223] a file screening module configured to screen each of the generated files to obtain a target generated file belonging to a target file format, the target file format being a file format to which the abnormal file belongs;

[0224] The feature determination module 702 is further configured to:

[0225] determine the file activity feature of the target generated file based on the machine identifier and the file generation path indicated by the generation record of the target generated file;

[0226] determine the file modification feature of the target generated file based on the number of content modifications indicated by the target generated file.

[0227] In summary, in the embodiments of the present application, the computer device obtains the file generation log, and thus analyzes the file activity feature and the file modification feature of each generated file according to the generation record of each generated file, and then filters the generated files according to the activity of the generated files generated in different machines and different paths and the content modification after generation, to obtain the abnormal file creation behavior, and thus determines the abnormal file. In this process, the computer device determines according to the file generation behavior, without needing to obtain the features of the specific file content, and without relying on the features of the known abnormal file, and thus can realize the detection of unknown abnormal files, thereby reducing the false negative rate of abnormal files in the file detection process.

[0228] It should be noted that: the apparatus provided in the above embodiments is only exemplified by the division of the above functional modules, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the apparatus is divided into different functional modules to complete all or part of the above described functions. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the implementation process is detailed in the method embodiments, which will not be repeated here.

[0229] Please refer to Figure 8Fig. 8 shows a schematic diagram of a computer device according to an example embodiment of the present application. In particular, the computer device 800 includes a central processing unit (CPU) 801, a system memory 804, including a random access memory 802 and a read-only memory 803, and a system bus 805 that couples the system memory 804 to the central processing unit 801. The computer device 800 also includes an input / output (I / O) system 806 that helps transfer information between the various devices within the computer, and a mass storage device 807 for storing an operating system 813, application programs 814, and other program modules 815.

[0230] The I / O system 806 includes a display 808 for displaying information and an input device 809, such as a mouse, keyboard, or the like, for inputting information into the computer device 800. Both the display 808 and the input device 809 are connected to the central processing unit 801 through an input / output controller 810 that is connected to the system bus 805. The I / O system 806 can also include the input / output controller 810 for receiving and processing input from a number of other devices, such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 810 provides output to a display screen, printer, or other type of output device.

[0231] The mass storage device 807 is connected to the central processing unit 801 through a mass storage controller (not shown) that is connected to the system bus 805. The mass storage device 807 and its associated computer-readable media provide non-volatile storage for the computer device 800. That is, the mass storage device 807 can include a computer-readable medium (not shown), such as a hard disk or drive.

[0232] Without loss of generality, the computer readable medium can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes Random Access Memory (RAM), Read Only Memory (ROM), flash memory or other solid state memory, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD), or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices. It should be understood by those skilled in the art that computer storage media does not limit to the above-mentioned several types. The system memory 804 and the mass storage device 807 mentioned above can be collectively referred to as memory.

[0233] The memory stores one or more programs configured to be executed by the one or more central processing units 801, and the one or more programs contain instructions for implementing the above method. The central processing unit 801 executes the one or more programs to implement the method provided by each method embodiment.

[0234] According to various embodiments of the present application, the computer device 800 can also be connected to a remote computer operating on a network such as the Internet. That is, the computer device 800 can be connected to a network 812 through a network interface unit 811 connected to the system bus 805, or can be connected to other types of networks or remote computer systems (not shown) using the network interface unit 811.

[0235] The memory also includes one or more programs stored in the memory, and the one or more programs contain steps performed by the computer device in the method provided by the embodiments of the present application.

[0236] The embodiments of the present application also provide a computer readable storage medium, which stores at least one instruction, at least one program, a code set or an instruction set. The at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the method for detecting an abnormal file according to any of the above embodiments.

[0237] The embodiment of the present application provides a computer program product or computer program, the computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer equipment reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer equipment executes the detection method of the abnormal file provided in the above aspect.

[0238] Those skilled in the art can understand that all or part of the steps in the above-mentioned various methods of embodiments can be completed by programs instructing relevant hardware, and the programs can be stored in a computer readable storage medium. The computer readable storage medium can be a computer readable storage medium contained in the memory in the above-mentioned embodiments, or can exist separately and not be assembled into the terminal. The computer readable storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the processor loads and executes the at least one instruction, the at least one program, the code set or the instruction set to realize the detection method of the abnormal file described in any method embodiment.

[0239] Optionally, the computer readable storage medium can include ROM, RAM, solid state disk (Solid State Drives, SSD) or optical disk, etc. The RAM can include resistance random access memory (Resistance Random Access Memory, ReRAM) and dynamic random access memory (Dynamic Random Access Memory, DRAM). The serial numbers of the above embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0240] Those skilled in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or can be completed by programs instructing relevant hardware, and the programs can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk.

[0241] The above is only the optional embodiment of the present application, and does not limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of detecting an abnormal file, characterized by, The method comprises: obtaining a file generation log, the file generation log comprising at least one generation record of a generated file, the generation record comprising a correspondence between a machine identifier, a file generation path and a content identifier of the generated file, the machine identifier being an identifier of a machine to which the generated file belongs; determining a generation breadth feature and a generation heat feature of the generated file based on the machine identifier corresponding to the content identifier of the generated file, the generation breadth feature being used to indicate a number of machines to which the generated file belongs, and the generation heat feature being used to indicate a number of times of generation of the generated file on a machine; determining a filename activity feature based on a number of different filenames corresponding to the content identifier of the generated file, the file generation path indicating a filename, and determining a directory activity feature based on a number of different generation directories corresponding to the content identifier of the generated file, the file generation path indicating a generation directory; determining a file modification feature of the generated file based on a number of content modifications indicated by the generation record, the number of content modifications being determined according to a number of times of content change of the generated file at a same generation position; filtering at least one of the generated files based on a file activity feature and the file modification feature to obtain an abnormal file, the file activity feature comprising the generation breadth feature, the generation heat feature, the filename activity feature and the directory activity feature.

2. The method of claim 1, wherein, The determining of the file modification feature of the generated file based on the number of content modifications indicated by the generation record comprises: determining a first file modification feature based on a number of times of change of the content identifier corresponding to a same file generation path in a same machine in the generation record; determining a second file modification feature based on a number of times of change of the content identifier corresponding to a same generation directory in the same machine in the generation record; determining a third file modification feature based on a number of times of change of the content identifier corresponding to a same filename in the same machine in the generation record.

3. The method of claim 2, wherein, The filtering of at least one of the generated files based on the file activity feature and the file modification feature to obtain an abnormal file comprises: in a case where the file activity feature indicates that the generated file is a hidden type file, determining the generated file as a first abnormal file; in a case where the file modification feature indicates that a number of modifications of the generated file is lower than a number threshold, determining the generated file as a second abnormal file; determining the abnormal file based on an intersection file of the first abnormal file and the second abnormal file.

4. The method of claim 3, wherein, The determining of the generated file as a first abnormal file in a case where the file activity feature indicates that the generated file is a hidden type file comprises: in a case where a generation breadth indicated by the generation breadth feature is lower than a breadth threshold and a generation heat indicated by the generation heat feature is lower than a heat threshold, determining the generated file as the hidden type file, and determining the generated file as the first abnormal file. In a case where the number of file names indicated by the file name activity feature and the number of generated directories indicated by the directory activity feature are greater than a generated number threshold, the generated file is determined as a hidden file, and the generated file is determined as the first abnormal file; The determining the generated file as the second abnormal file in a case where the file modification feature indicates that the number of modifications of the generated file is less than a number threshold, includes: In a case where the number of content modifications indicated by the first file modification feature, the second file modification feature, and the third file modification feature is less than the number threshold, the generated file is determined as the second abnormal file.

5. The method of claim 3, wherein, The determining the abnormal file based on the intersection file of the first abnormal file and the second abnormal file, includes: Determining an intersection file of the first abnormal file and the second abnormal file; Obtaining the file activity feature and the file modification feature of each candidate abnormal file in the intersection file; Inputting the file activity feature and the file modification feature of each candidate abnormal file into a file identification model for abnormal file identification to obtain the abnormal file, the file identification model being trained based on the file activity feature and the file modification feature of a sample file, the sample file being a labeled file.

6. The method of claim 5, wherein, The inputting the file activity feature and the file modification feature of each candidate abnormal file into a file identification model for abnormal file identification to obtain the abnormal file, includes: Inputting the file activity feature and the file modification feature into a feature extraction branch of the file identification model for feature extraction to obtain an active feature vector and a modification feature vector, the active feature vector being obtained based on fusion of the generated scope feature, the generated heat feature, the file name activity feature, and the directory activity feature, and the modification feature vector being obtained based on fusion of the first file modification feature, the second file modification feature, and the third file modification feature; Inputting the active feature vector and the modification feature vector into a feature recognition branch of the file identification model for feature recognition to obtain a recognition result, the recognition result being used to indicate that the candidate abnormal file is an abnormal file or to indicate that the candidate abnormal file is a normal file.

7. The method according to any one of claims 1 to 6, characterized in that, The filtering at least one generated file based on a file activity feature and a file modification feature to obtain an abnormal file, includes: Determining a candidate abnormal file in the generated file based on the file activity feature and the file modification feature; Determining a file belonging to a target machine in the candidate abnormal file as the abnormal file, the target machine being a machine that generates a number of files less than a file number threshold within a target time length.

8. The method according to any one of claims 1 to 6, characterized in that, The filtering at least one generated file based on a file activity feature and a file modification feature to obtain an abnormal file, includes: Determining a candidate abnormal file in the generated file based on the file activity feature and the file modification feature; The files in the candidate abnormal files that do not belong to the temporary directory or the cache directory are determined as the abnormal files according to the directory identification.

9. The method according to any one of claims 1 to 6, characterized in that, After the file generation log is obtained, the method further includes: Each of the generated files is screened to obtain a target generated file belonging to a target file format, the target file format being a file format to which the abnormal file belongs. The method further includes: The file active feature of the target generated file is determined based on the machine identification and the file generation path indicated by the generation record of the target generated file. The file modification feature of the generated file is determined based on the content modification times indicated by the generation record, including: The file modification feature of the target generated file is determined based on the content modification times indicated by the target generated file.

10. An abnormal file detecting apparatus characterized by comprising: The device includes: A log obtaining module is configured to obtain a file generation log, the file generation log containing a generation record of at least one generated file, the generation record containing a correspondence between a machine identification, a file generation path and a content identification of the generated file, the machine identification being an identification of a machine to which the generated file belongs; A feature determining module is configured to determine a generation breadth feature and a generation heat feature of the generated file based on the machine identification corresponding to the content identification of the generated file, the generation breadth feature being used to indicate a number of machines to which the generated file belongs, and the generation heat feature being used to indicate a number of times of generation of the generated file on a machine; The feature determining module is further configured to determine a filename active feature based on a number of different filenames corresponding to the content identification of the generated file, the file generation path indicating the filenames, and determine a directory active feature based on a number of different generation directories corresponding to the content identification of the generated file, the file generation path indicating the generation directories; The feature determining module is further configured to determine a file modification feature of the generated file based on content modification times indicated by the generation record, the content modification times being determined according to a number of times of content change of the generated file at a same generation position; A file filtering module is configured to filter at least one of the generated files based on a file active feature and the file modification feature to obtain an abnormal file, the file active feature including the generation breadth feature, the generation heat feature, the filename active feature and the directory active feature.

11. A computer device, comprising: The computer device includes a processor and a memory, the memory storing at least one program, the at least one program being loaded and executed by the processor to implement the method for detecting an abnormal file according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The readable storage medium stores at least one program, the at least one program being loaded and executed by the processor to implement the method for detecting an abnormal file according to any one of claims 1 to 9.

13. A computer program product, characterised in that, The computer program product comprises computer instructions stored in a computer readable storage medium, a processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions to implement the method for detecting an abnormal file according to any one of claims 1 to 9.

Images