Sample file detection method, device and computer-readable storage medium

Abstract

The present application discloses a method, device, and computer-readable storage medium for detecting sample files. The method comprises: obtaining a sample file to be detected and a target operating environment corresponding to the sample file, wherein the target operating environment is a first type of operating environment or a second type of operating environment; when the target operating environment is a second type of operating environment, detecting whether a first operating environment corresponding to the target operating environment exists in a first storage area; when the first operating environment exists in the first storage area, detecting whether a first historical detection result exists in a second storage area; when the first historical detection result exists in the second storage area, determining that the first historical detection result is the target detection result of the sample file under the target operating environment. The present application solves the technical problem of low efficiency in detecting sample files in the prior art due to the inability to reuse detection results.

Description

Technical Field

[0001] The present application relates to the field of information security, and more specifically, to a method and device for detecting a sample file, and a computer-readable storage medium. Background Art

[0002] In the field of information security, testers typically test sample files in a specific operating environment to identify whether they are abnormal. Prior art techniques typically use container technology to generate a virtual operating environment, then run the sample file to be tested in that virtual environment. The tester then determines whether the sample file is abnormal by obtaining the running log data of the sample file in the virtual environment.

[0003] However, in the existing technology, even if a user has previously tested a sample file in a virtual operating environment and generated historical test results, the existing technology does not support the direct reuse of the historical test results, resulting in a large number of repeated test processes in the process of testing the sample file, which in turn leads to low detection efficiency of the sample file.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present application provide a method, apparatus, and computer-readable storage medium for detecting a sample file, to at least solve the technical problem in the prior art of low sample file detection efficiency due to the inability to reuse detection results.

[0006] According to one aspect of an embodiment of the present application, a method for detecting a sample file is provided, comprising: obtaining a sample file to be detected and a target operating environment corresponding to the sample file, wherein the target operating environment is an operating environment for detecting whether the sample file has an abnormality, and the target operating environment is a first type of operating environment or a second type of operating environment, wherein the first type of operating environment is an operating environment obtained by performing environmental adjustments based on the second type of operating environment, wherein the environmental adjustments include at least operating system adjustments and / or software adjustments; when the target operating environment is the second type of operating environment, detecting whether a first operating environment corresponding to the target operating environment exists in a first storage area, wherein the first operating environment is an operating environment of the first type obtained by performing environmental adjustments based on the target operating environment; if the first operating environment exists in the first storage area, detecting whether a first historical detection result exists in a second storage area, wherein the first historical detection result is a historical detection result obtained when the sample file is detected in the first operating environment, the first storage area being used to store all operating environments, and the second storage area being used to store all historical detection results; and if the first historical detection result exists in the second storage area, determining that the first historical detection result is a target detection result of the sample file in the target operating environment.

[0007] Furthermore, the sample file detection method also includes: each first type of operating environment corresponds to a creation user identifier, and the state of each first type of operating environment is a shared state, wherein the creation user identifier is used to characterize the user who created the operating environment, and the shared state is used to characterize that the operating environment is visible to all users and each user can use the operating environment to detect sample files.

[0008] Furthermore, the sample file detection method also includes: when the target operating environment is a second type of operating environment, if the first operating environment does not exist in the first storage area or the first historical detection result does not exist in the second storage area, detecting whether there is a second historical detection result in the second storage area, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; when the second historical detection result exists in the second storage area, determining that the second historical detection result is the target detection result of the sample file in the target operating environment; when the second historical detection result does not exist in the second storage area, transporting the sample file to the target operating environment for detection to obtain the target detection result of the sample file in the target operating environment.

[0009] Furthermore, the sample file detection method also includes: after obtaining the sample file to be detected and the target operating environment corresponding to the sample file, when the target operating environment is a first type of operating environment, detecting whether there is a second historical detection result in the second storage area; when the second historical detection result exists in the second storage area, determining that the second historical detection result is the target detection result of the sample file in the target operating environment; when the second historical detection result does not exist in the second storage area, transporting the sample file to the target operating environment for detection to obtain the target detection result of the sample file in the target operating environment.

[0010] Furthermore, the sample file detection method also includes: storing the target operating environment in the form of a virtual machine file in the first storage area, converting the target operating environment into a virtual machine, and running the sample file on the virtual machine; obtaining the operation record data when the sample file is running in the virtual machine; performing data filtering processing on the operation record data to obtain target data, wherein the data filtering processing is used to filter invalid data in the operation record data; analyzing the target data to obtain a target detection result.

[0011] Furthermore, the sample file detection method further includes: obtaining the running time of the sample file in the virtual machine; when the running time is greater than a preset time, prohibiting the sample file from continuing to run, and updating the running status of the sample file to a running completion status.

[0012] Furthermore, the detection method of the sample file also includes: there are multiple target operating environments corresponding to the sample file, and multiple target detection results are obtained, wherein each target detection result corresponds to a target operating environment; a comprehensive analysis is performed on the multiple target detection results to obtain a comprehensive analysis result; a target detection report is generated according to the comprehensive analysis result, and the target detection report is sent to the target device.

[0013] Furthermore, the sample file detection method also includes: after obtaining multiple target detection results, generating a detection report according to each target detection result to obtain multiple detection reports; comprehensively analyzing the multiple detection reports to obtain a target detection report, and sending the target detection report to the target device.

[0014] According to another aspect of an embodiment of the present application, a sample file detection device is provided, comprising: an acquisition module, configured to acquire a sample file to be detected and a target operating environment corresponding to the sample file, wherein the target operating environment is an operating environment for detecting whether the sample file has an abnormality, and the target operating environment is a first type of operating environment or a second type of operating environment, wherein the first type of operating environment is an operating environment obtained by performing environmental adjustments based on the second type of operating environment, wherein the environmental adjustments include at least operating system adjustments and / or software adjustments; a first detection module, configured to detect whether a first operating environment corresponding to the target operating environment exists in a first storage area when the target operating environment is the second type of operating environment, wherein the first operating environment is a first type of operating environment obtained by performing environmental adjustments based on the target operating environment; a second detection module, configured to detect whether a first historical detection result exists in a second storage area when the first operating environment exists in the first storage area, wherein the first historical detection result is a historical detection result obtained when the sample file is detected in the first operating environment, wherein the first storage area is used to store all operating environments, and the second storage area is used to store all historical detection results; and a determination module, configured to determine, when the first historical detection result exists in the second storage area, that the first historical detection result is a target detection result of the sample file in the target operating environment.

[0015] According to another aspect of an embodiment of the present application, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned detection method when running.

[0016] In the present application, by reusing the first historical detection result as the target detection result of the sample file in the target operating environment, first, a sample file to be detected and the target operating environment corresponding to the sample file are obtained. When the target operating environment is a second type of operating environment, whether the first operating environment corresponding to the target operating environment is detected in the first storage area. If the first operating environment exists in the first storage area, whether the first historical detection result exists in the second storage area is detected. If the first historical detection result exists in the second storage area, the first historical detection result is determined to be the target detection result of the sample file in the target operating environment. Wherein, the target operating environment is the operating environment used to detect whether the sample file has an abnormality, the target operating environment is the first type of operating environment or the second type of operating environment, the first type of operating environment is the operating environment obtained after the environment adjustment is performed on the second type of operating environment, and the environment adjustment includes at least operating system adjustment and / or software adjustment; the first operating environment is a first type of operating environment obtained after the environment adjustment is performed on the target operating environment; the first historical detection result is the historical detection result obtained when the sample file is detected in the first operating environment, the first storage area is used to store all operating environments, and the second storage area is used to store all historical detection results.

[0017] From the above content, it can be seen that, on the one hand, this application realizes anomaly detection on sample files by providing a second type of operating environment, and on the other hand, supports users to customize the creation of an operating environment (corresponding to the first type of operating environment) based on the second type of operating environment to perform anomaly detection on sample files. Since the first type of operating environment is closer to the user's actual application scenario, the detection results corresponding to the first operating environment created based on the target operating environment are also closer to the actual application scenario. On this basis, this application directly reuses the first historical detection result as the target detection result of the sample file under the second type of target operating environment, which can not only improve the efficiency of obtaining the target detection result, but also improve the detection quality of the target detection result.

[0018] It can be seen that through the technical solution of the present application, the purpose of reusing historical detection results as the target detection results of the sample file to be detected currently is achieved, thereby achieving the effect of improving the quality and acquisition efficiency of the target detection results, and thus solving the technical problem of low detection efficiency of sample files in the existing technology due to the inability to reuse detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional sample file detection method according to an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of a design of a customized operating environment according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional sample file detection system according to an embodiment of the present application;

[0023] Figure 4 This is a timing diagram of detecting sample files in an optional multi-operation environment according to an embodiment of the present application;

[0024] Figure 5 This is an example diagram of detection results in an optional multi-operation environment according to an embodiment of the present application;

[0025] Figure 6 This is a timing diagram of converting a custom operating environment into a virtual machine according to an embodiment of the present application;

[0026] Figure 7 is a schematic diagram of a preference setting condition according to an embodiment of the present application;

[0027] Figure 8 4 is a schematic diagram of an optional sample file detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] In addition, it should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0031] Example 1

[0032] According to an embodiment of the present application, an embodiment of a method for detecting a sample file is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0033] Figure 1 is a flow chart of an optional sample file detection method according to an embodiment of the present application, such as Figure 1 As shown, the method includes the following steps:

[0034] Step S101: Obtain a sample file to be tested and a target operating environment corresponding to the sample file.

[0035] In step S101, the target operating environment is an operating environment used to detect whether there is an abnormality in the sample file. The target operating environment is a first type of operating environment or a second type of operating environment. The first type of operating environment is an operating environment obtained after environmental adjustment based on the second type of operating environment. The environmental adjustment includes at least adjustment of the operating system and / or adjustment of the software.

[0036] Optionally, the sample file can be any type of file, such as a program script, a video file, a compressed file, or an email. The second type of operating environment is a fixed operating environment pre-deployed in the sample file detection system. The second type of operating environment can be understood as the operating environment that comes with the sample file detection system when the user first uses the sample file detection system. The first type of operating environment is a new operating environment obtained after the user adjusts the environment based on the second type of operating environment. In other words, the first type of operating environment can be understood as a new operating environment customized by the user based on the second type of operating environment.

[0037] In an optional embodiment, the present application supports users to create a custom operating environment (corresponding to the first type of operating environment) based on a pre-deployed fixed operating environment (corresponding to the second type of operating environment). Figure 2 A schematic diagram of a custom operating environment according to an embodiment of the present application is shown. Figure 2 In the example, the operating environment template is the second type of operating environment. Figure 2 The customized operating environment in is the first type of operating environment. Specifically, in this application, the main features of the operating environment template are reflected in three aspects: operating system, system services and installed software.

[0038] Among them, such as Figure 2 As shown, operating systems are distinguished by their version and bit size. For example, Windows operating systems include multiple versions, such as Windows 7 and Windows 10, with Windows 7 available in both 32-bit and 64-bit versions. Linux systems include multiple versions, such as Ubuntu 16.04, Ubuntu 18.04, and CentOS 7, with Ubuntu 16.04 available in both 32-bit and 64-bit versions. System services are distinguished by built-in services and custom services. Built-in services primarily indicate which services are enabled and which are disabled, while custom services primarily indicate whether additional services have been added to manage individual applications and programs after removing built-in services. Installed software is distinguished by software name and version. For example, a PDF file can be opened using various applications or some built-in browsers. However, opening the same PDF file with different software may trigger different underlying system calls, so opening the same sample file with different software may result in different detection results. Furthermore, with the continuous advancement of software technology, different versions of software can also affect detection results. For example, for the same software, an abnormal sample file may successfully attack an earlier version of the software but fail to attack a later version, resulting in two different detection results. Furthermore, as with system services, users can adjust the environment template by adding or removing software.

[0039] It's easy to note that the behavior of a sample file is closely related to the environment in which it resides. Therefore, this application supports user-defined runtime environments to better identify weaknesses in existing environments and better explain the potential for a sample file to attack the user's existing environment. Compared to discovering a general malicious sample, discovering a malicious sample that is aggressive to the user's runtime environment is more important, and this application achieves this through customized runtime environments.

[0040] like Figure 2As shown in the figure, the main features of a customized operating environment are also reflected in the three aspects of the operating system, system services, and installed software. The difference is that a customized operating environment can only be customized based on an operating environment template. The process of customizing the operating environment first selects the operating environment template corresponding to a specific type and version of the operating system, and then reconfigures the system services on this operating environment template, including which services to start and stop and which services to add, as well as managing installed software. For example, installing a reader software to run PDF files instead of opening PDF files through a browser in the operating environment template. In this way, the operating environment can be customized, making the customized environment as close to and restoring the user's actual office environment as possible.

[0041] It should be noted that in this application, a customized operating environment can only be customized based on a certain operating environment template, mainly for the following three considerations: first, the operating environment template is a calibrated environment, which includes various complex settings and adjustments to the system configuration, and is a platform that is more suitable for sample files to exhibit malicious behavior; second, when creating a customized operating environment based on the operating environment template, users no longer need to perform tedious and complex system configurations, which is more user-friendly and reduces the difficulty of configuring the customized operating environment; third, when configuring the operating environment for detecting sample files, there are some configuration parameters that are difficult for non-technical personnel to find, especially in systems such as Windows systems where various configurations are relatively hidden. If a certain configuration is not started, the sample file may fail to run and the sample performance behavior cannot be observed. Based on the above three considerations, this application pre-deploys an operating environment template that has completed the system configuration adjustment. Users only need to make a series of simple operating system adjustments and / or software adjustments based on the operating environment template to obtain a customized operating environment.

[0042] In addition, since the ultimate goal of this application is to increase the probability of discovering malicious samples by using multiple operating environments, it is sometimes not possible to configure the operating system to be completely consistent with the user environment. For example, if the user environment has a firewall turned on or antivirus software installed, it is generally difficult for malicious sample files to exhibit malicious behavior or even be unable to start and run normally. Therefore, if the goal is to maximize the restoration of the user environment, then one will lose sight of the other, and the final result may be that the malicious files cannot be accurately detected.

[0043] It can be seen from this that the customized operating environment in this application may not be an operating environment that is exactly the same as the user environment, but an environment that has a dependency on the operating environment template and makes individual adjustments to the system services and installed software features relative to a certain operating environment template.

[0044] In addition, in the prior art, it is usually only supported to deliver sample files to one operating environment for testing, while the present application also supports delivering sample files to multiple operating environments for testing at the same time, so that more test results can be obtained, and a more comprehensive test of the sample files can be achieved, thereby improving the detection effect of the sample files.

[0045] Step S102: When the target operating environment is the second type of operating environment, detecting whether there is a first operating environment corresponding to the target operating environment in the first storage area.

[0046] In step S102 , the first operating environment is a first type of operating environment obtained after environmental adjustment is performed based on the target operating environment.

[0047] Step S103 : If the first operating environment exists in the first storage area, detect whether the second storage area contains the first historical detection result.

[0048] In step S103 , the first historical detection result is a historical detection result obtained when the sample file is detected in the first operating environment. The first storage area is used to store all operating environments, and the second storage area is used to store all historical detection results.

[0049] Step S104 : when the first historical detection result exists in the second storage area, determining that the first historical detection result is a target detection result of the sample file in the target operating environment.

[0050] Optionally, assume that the target operating environment corresponding to sample file 1 is operating environment 2, where operating environment 2 is a second-type operating environment. At the same time, in addition to operating environment 2, the first storage area also stores operating environment 3, and operating environment 3 is a first-type operating environment customized by the user based on operating environment 2. On this basis, operating environment 3 is the first operating environment corresponding to operating environment 2. Based on this premise, if a user has previously transferred sample file 1 to operating environment 3 for detection and generated a first historical detection result A, then in order to improve detection efficiency, the first historical detection result A can be directly determined as the target detection result of sample file 1 in operating environment 2.

[0051] It should be noted that since operating environment 3 is an operating environment customized by the user based on operating environment 2, compared with operating environment 2, operating environment 3 is actually closer to the user's actual application scenario. On this basis, this application directly determines the first historical detection result A of sample file 1 under operating environment 3 as the target detection result of sample file 1 under operating environment 2, which can actually improve the accuracy of the target detection result. That is, this application actually uses the user's customized operating environment to optimize the detection result of the sample file, and directly reuses the optimized detection result to other users for use, thereby not only improving the quality of the detection result, but also improving the detection efficiency.

[0052] In addition, in the present application, each first type of operating environment corresponds to a creating user identifier, and the state of each first type of operating environment is a shared state, wherein the creating user identifier is used to characterize the user who created the operating environment, and the shared state is used to characterize that the operating environment is visible to all users and each user can use the operating environment to detect sample files.

[0053] In an optional embodiment, a sample file detection system can be used as the execution subject of the sample file detection method in this application, such as Figure 3 As shown, the sample file detection system includes at least a management server and node servers. The two servers form a one-to-many relationship, meaning one management server can correspond to multiple node servers. Because the functional design and responsibilities of multiple node servers are consistent, for ease of explanation, the following uses a single node server as an example.

[0054] Optionally, the management server includes at least functional modules such as a preference configuration management module, a sample and report management module, a runtime environment library management module, a scheduling management module, a detection result management module, and a node management module.

[0055] Among them, such as Figure 3As shown, the preference configuration management module is used to process preference setting requests from users, and record and maintain preference setting conditions. The preference setting conditions are used to characterize the specified relationship between the file type of the sample file and the operating environment. The two are a one-to-many relationship, that is, one file type can correspond to multiple operating environments. When a user specifies multiple operating environments for a certain file type, the management server will regard the sample file of this file type subsequently uploaded by the user as a multi-environment detection task and process the sample file. For file types for which the user does not explicitly specify the operating environment, the preference configuration management module provides a preset operating environment determination policy, wherein the operating environment determination policy can be understood as a default preference policy that cannot be changed by the user. When the file type of the sample file uploaded by the user does not have a corresponding preference setting condition, the preference configuration management will specify a default operating environment for the sample file according to the preset operating environment determination policy.

[0056] The sample and report management module is used to receive sample files uploaded by users, return sample test results to users, and provide test report download functions. The sample and report management module consists of two parts: the sample management submodule and the report management submodule. The sample management submodule is mainly responsible for preprocessing sample files, saving sample files, and maintaining sample-related information. After receiving the sample file uploaded by the user, the sample management submodule will identify the file type of the file, record the relevant information of the sample, including the user from which it comes, the sample upload time, the sample file type, the sample MD5 / SHA1 / SHA256, etc., and save the sample file. The sample MD5 / SHA1 / SHA256 can be uniquely mapped to a specific sample file. The report management submodule is mainly responsible for storing sample test reports, and also processes and maintains the correspondence between reports and samples. In addition, in order to reduce sample testing time and maximize the reuse of test results to save resources, the report management submodule in the sample and report management module also serves as a report cache resource library. When the sample management submodule receives the sample file uploaded by the user, it will query the report cache resource library through the report management submodule to see if there is a ready-made test report available. If so, the test report will be returned to the user. If not, the sample file will be submitted to the scheduling management module for processing. The report cache resource library maintains the correspondence between the test report, the sample file, and the operating environment, and records which sample file a test report corresponds to and under which operating environments the sample file was detected. The report management submodule generates a test report for display to the user and for the user to download by processing the test results from the test result management module. The test report in this application has a fixed style, such as an HTML report or a PDF report.

[0057] The operating environment library management module is the first storage area in this application, which is used to store and maintain the operating environment template (corresponding to the second type of operating environment) for users to download. At the same time, the operating environment library management module receives the custom operating environment (corresponding to the first type of operating environment) uploaded by the user, records and maintains the custom operating environment related information and the corresponding relationship with the user. The operating environment refers to the operating system environment in which the sample file starts to run in the subsequent detection process, and is distinguished by the operating system type, enabled / disabled system services, installed auxiliary sample files to run or software that loads sample files, etc. The operating environment template is provided by the operating environment library management module by default. In order to ensure the correctness of malicious sample detection and reduce missed reports, the operating environment template will optimize the use of different operating systems' own system services, and intentionally turn off some system-level protection measures to provide a good system environment for malicious sample operation. Therefore, users are not allowed to modify and change the operating environment template. It should be noted that the design of the customized operating environment allows users to make some adjustments based on the operating environment template to be close to the actual office ecological environment, so that sample files can be tested and analyzed in an environment that is closer to the user's actual usage environment. Correspondingly, the test results obtained in the customized operating environment are also more meaningful for users, and can help users promptly discover weaknesses in the existing actual office ecological environment.

[0058] The scheduling management module is responsible for scheduling the detection and analysis of sample files. Based on the preference setting conditions of the preference setting module, it plans the scheduling strategy for the sample files and sample-related information uploaded by the sample and report management module. Through the load balancing strategy, it schedules the sample files to each node server for detection and analysis, or reuses the historical detection results in the detection result management module.

[0059] The test result management module is the second storage area in this application, which is used to receive the test results of the sample files returned from each node server in a single operating environment, and process and summarize all the test results. At the same time, it records and maintains the correspondence between the test results and the sample files, the correspondence between the test results and the operating environment, etc., to facilitate the reuse of historical test results by the subsequent scheduling management module. It should be noted that the difference and connection between the test results and the target detection report is that the test results are the running results of the sample files in a single operating environment, which are the original data of the behavior shown during the sample operation, and are not concretized into a fixed form of expression, such as a JSON file; while the target detection report can be a combination of the test results under multiple operating environments, and this comprehensive expression is generally obtained by further refining, processing and summarizing the test results of multiple single operating environments, and finally concretized in a fixed form. In short, the test results are raw data and the report is a form of expression.

[0060] The node management module is responsible for managing each node server, and is also responsible for synchronizing the custom operating environment uploaded by the user to each node server. Each node server then converts the custom operating environment into a specific virtual machine for subsequent running of sample files and performing sample detection and analysis tasks. It should be noted that when a new node server joins the sample file detection system of this application, it must first complete registration on the node management module. After registration is completed, the node management module is responsible for synchronizing each operating environment and instructing the new node server to complete the configuration management of the virtual machine according to the default virtual machine configuration information. Therefore, the node management module records and maintains the correspondence and quantity relationship between the existing operating environment and the virtual machine on each node server. In addition, in addition to being responsible for the synchronization of the operating environment and the management of the node server, the node management module will also count the number of virtual machines running on each node server in real time, providing data support for the scheduling management module to perform load balancing.

[0061] In another optional embodiment, as Figure 3 As shown, each node server includes at least functional modules such as a detection management module, a virtual machine management module, and an operation record analysis module, and also includes at least one virtual machine converted according to the operation environment.

[0062] Among them, the detection management module is used to receive the sample files and designated operating environment information uploaded by the scheduling management module in the management server, and with the assistance of the virtual machine management module, transfer the sample files to the designated virtual machine for operation, and then receive the detection results generated by the operation record analysis module, and transfer the detection results to the detection result management module in the management server for further processing. When the virtual machines corresponding to the designated operating environment are all busy, the detection management module is also used to implement queue buffering and temporarily cache the current sample files. When there is an idle virtual machine among the virtual machines corresponding to the designated operating environment, the cached sample files are then transferred to the idle virtual machine for operation analysis.

[0063] The virtual machine management module, as an auxiliary module of the detection management module, is used to receive sample files from the detection management module and open the virtual machine corresponding to the specified operating environment for the detection management module so that the sample files can be run on the virtual machine. After the sample file is run, the virtual machine management module collects the running record data of the sample file on the virtual machine and sends the running record data to the running record analysis module. In addition, the virtual machine management module is also used to receive the running environment synchronized from the management server and convert the running environment into a preset number of virtual machines based on the default virtual machine information. For example, in Figure 3 In the example, node server 1 is deployed with virtual machine 1 converted from operating environment 1, virtual machine 2 converted from operating environment 2, and virtual machine 3.

[0064] The operation record analysis module is responsible for processing the operation record data. After obtaining the operation record data, the operation record analysis module will eliminate redundant and superfluous information according to the established logic, and further simplify and summarize the effective information to form a clear and easy-to-read detection result, and then send the detection result to the detection management module. It should be noted that the operation record data not only comes from the record data on the virtual machine, but also includes the record data from the virtual machine's peripheral environment. Among them, the virtual machine's peripheral environment includes peripheral devices such as the virtual network card of the virtual machine. The operation record data includes but is not limited to log files, screenshot files, network traffic files, memory binary files, system tampering configuration record files and other data.

[0065] In an optional embodiment, it is assumed that user A customizes and uploads a customized operating environment C based on the operating environment template B. And user A sets the preference setting conditions, specifying that sample files of sample file type F are sent to both operating environment C and operating environment D for detection. Operating environment D can be either an operating environment template or a customized operating environment uploaded by other users. Then, user A submits sample file E, and the file type corresponding to sample file E is file type F. Sample file E will be sent to the virtual machines corresponding to operating environment C and operating environment D for detection and analysis. After the detection is completed, the sample file detection system obtains the detection result C of sample file E in operating environment C and the detection result D of sample file E in operating environment D. At the same time, since operating environment C comes from template operating environment B, the detection result C of sample file E in operating environment C can be regarded as the detection result of sample file E in operating environment B.

[0066] As can be seen from the above, the sample file detection system directly obtains test result C for sample file E in operating environment C and test result D for sample file E in operating environment D. It also indirectly obtains the test result for sample file E in operating environment B (i.e., test result C for sample file E in operating environment C). Ultimately, user A receives a target detection report containing test results C and D.

[0067] Furthermore, assume that user H sets a preference condition, specifying that sample files of sample file type F will be sent to runtime environment B for testing. Then, user H also submits a sample file E. Since the file type corresponding to sample file E is file type F, theoretically, sample file E should obtain the corresponding test result after running in runtime environment B. However, since the sample file detection system already maintains the test result of sample file E in runtime environment B (i.e., the above-mentioned test result C), the sample file detection system will directly reuse test result C and start generating the target detection report. Ultimately, user H will obtain a test report containing test result C.

[0068] It should be noted that by reusing the test results, the resource waste problem caused by the customized operating environment is solved, so that the test results of the customized operating environment can be reused by other test tasks, which not only improves the test efficiency, but also reduces the resource overhead of subsequent tests.

[0069] In an optional embodiment, when the target operating environment is the second type of operating environment, if the first operating environment does not exist in the first storage area or the first historical detection result does not exist in the second storage area, the sample file detection system will detect whether a second historical detection result exists in the second storage area, where the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment. If the second historical detection result exists in the second storage area, the sample file detection system will determine that the second historical detection result is the target detection result of the sample file in the target operating environment. If the second historical detection result does not exist in the second storage area, the sample file detection system will transfer the sample file to the target operating environment for detection to obtain the target detection result of the sample file in the target operating environment.

[0070] Optionally, when the target operating environment is the first type of operating environment, the sample file detection system also detects whether a second historical detection result exists in the second storage area. If the second historical detection result exists in the second storage area, the sample file detection system determines that the second historical detection result is the target detection result of the sample file in the target operating environment. If the second historical detection result does not exist in the second storage area, the sample file detection system transfers the sample file to the target operating environment for detection, thereby obtaining the target detection result of the sample file in the target operating environment.

[0071] Specifically, Figure 4 FIG. 1 shows a timing diagram of detecting sample files in an optional multi-operation environment according to an embodiment of the present application, wherein: Figure 4 It also involves calling the management module to allocate virtual machines for sample files according to the load balancing strategy, as follows:

[0072] Step S401: User A configures preference setting conditions through the configuration setting management module to set a binding relationship between a certain file type and a target operating environment;

[0073] Step S402: User A uploads a sample file B of the same file type;

[0074] Step S403: After receiving the sample file B, the sample and report management module identifies the file type and determines whether there is a historical test report that can be reused. If yes, the process jumps to step S620; if not, the process jumps to step S604.

[0075] Step S404: The sample and report management module transfers the sample file B to the scheduling management module for processing;

[0076] In step S405, the scheduling management module obtains the preference settings related to sample file B from the preference settings management module and submits the preference settings to the test result management module for query, hoping that the test result management module will assist in determining whether there are any historical test results that can be reused. If so, the process jumps to step S418; if not, the process jumps to step S406.

[0077] Step S406: The test result management module notifies the scheduling management module that the sample file B has no historical test results that can be reused under the specified preference settings;

[0078] In step S407, the scheduling management module maintains the current proportion of testing tasks undertaken by each node server and, based on these statistics, assigns the node server to which subsequent sample files will be sent for testing. After receiving feedback from the test result management module, the scheduling management module transfers sample file B and the target operating environment information specified by sample file B to the testing management module on the node server selected by the scheduling management module. Assume that this node server is server C.

[0079] Step S408: When there is an idle virtual machine available, the detection management module of server C transfers the sample file B and the specified target operating environment information to the virtual machine management module for processing;

[0080] Step S409: The virtual machine management module allocates a virtual machine corresponding to the specified target operating environment to the sample file B and starts the virtual machine. Assume that the virtual machine is virtual machine D.

[0081] Step S410: The virtual machine management module sends the sample file B to the virtual machine D for execution. The method of sending the sample file to the virtual machine includes but is not limited to HTTP, FTP and other communication methods, depending on the specific deployment and management scheme of the virtual machine.

[0082] Step S411: Wait for sample file B to complete execution. In this application, completion of sample execution refers to the time from when the sample file is started. When the running time of the sample file exceeds the preset time, the sample execution life cycle is forcibly terminated and the sample execution is considered completed. When the running time of the sample file does not reach the preset time, the sample execution process automatically terminates the execution life cycle and the sample execution is also considered completed.

[0083] Step S412: After the sample file B is executed, the virtual machine management module collects the operation record data of the sample file B on the virtual machine and submits it to the operation record analysis module for analysis and processing;

[0084] In step S413, the operation record analysis module removes redundant and superfluous information from the operation record data according to established logic, and further simplifies and summarizes the valid information to form a clear and comprehensive test result that is easy to read;

[0085] Step S414: The operation record analysis module returns the test results to the test management module;

[0086] Step S415: The detection management module returns the detection result to the detection result management module of the management server;

[0087] Step S416: After receiving the test result of sample file B, the test result management module updates the test result record so that the test result can be reused as a historical test result for other test tasks;

[0088] In step S417, the test result management module integrates the test results corresponding to the multiple target operating environments of sample file B, and transfers the integrated test results to the sample and report management module for processing, and then jumps to step S619;

[0089] Step S418: The test result management module transfers the reusable historical analysis results to the sample and report management module;

[0090] In step S419, the sample and report management module is responsible for converting the integrated detection results into a target detection report and updating the historical detection report record so that the target detection report can be reused as a historical report for other detection tasks.

[0091] In step S420 , the sample and report management module returns the target detection report to user A, ending the detection process of sample file B.

[0092] As can be seen from the above content, this application has a result reuse design for the management of test results and sample reports. In actual application environments, there are many scenarios in which the same file is uploaded for multiple tests within a local area network. There are two benefits to using result reuse, one is saving resources, and the other is speeding up the detection speed. At the same time, since this application allows users to customize the operating environment, this will make the test results strongly related to the detailed operating environment settings. If result reuse is not implemented, the operating results of many customized operating environments can only be applied to the current detection task, resulting in a waste of detection resources. This application improves detection efficiency by binding the test results and reports to the layered operating environment. When the same sample file is analyzed again in the future, it can be determined by layer whether the historical results can be reused according to the specific operating environment requirements.

[0093] In order to further illustrate the multiplexing logic of the detection results in this application, the following is described with reference to the accompanying drawings, wherein: Figure 5 FIG1 shows an example diagram of detection results in an optional multi-operation environment according to an embodiment of the present application. Figure 5 This diagram illustrates the application and management of test results in a multi-environment test task. First, the user must configure their preferences and submit a sample file of the corresponding file type to create a multi-environment test task. This sample file is referred to as Sample File A in the following description. The user's preferences specify that Sample File A be sent to both Environment 2 and Environment 3 for testing.

[0094] Optional, Figure 5The figure shows a premise background: the test result management module currently maintains two test results for sample file A, namely test result 1 and test result 2. Test result 1 is the test result of sample file A in runtime environment 1. Since runtime environment 1 is a customized environment based on runtime environment template 1, test result 1 can also be considered the test result corresponding to runtime environment template 1. Test result 2 is the test result of sample file A in runtime environment 2. Since runtime environment 2 is a customized environment based on runtime environment template 2, test result 2 can also be considered the test result corresponding to runtime environment template 2. In addition, two test reports are currently maintained in the sample and report management module, one of which is a multi-environment test report, which is generated based on the integrated test results of test result 1 and test result 2. In other words, the test report is the target test report obtained after sample file A is run in both operating environment 1 and operating environment 2; the other test report is a single-environment test report, which is generated based on test result 2. In other words, the test report is a test report for sample file A in the single operating environment 2. Since operating environment 2 is a custom environment based on operating environment template 2, the test report can also be regarded as a test report after sample file A is run in operating environment template 2.

[0095] Based on the above premise, Figure 5 As shown, the processing logic of this application after sending sample file A to operating environment 2 and operating environment 3 for detection at the same time is: Regarding the detection result of sample file A after running in operating environment 2, the above-mentioned detection result 2 can be directly reused. Regarding the detection result after sample file A runs in operating environment 3, it needs to be sent to the virtual machine corresponding to operating environment 3 for detection and analysis. After waiting for the detection result 3 corresponding to operating environment 3 to be generated, the sample and report management module completes the integration of detection result 2 and detection result 3, and then further generates a target detection report based on the integration result and presents it to the user. Among them, after the detection result 3 is generated, the detection result 3 will also be included in the detection result library as a historical detection result for management, and will be bound to the detection result of sample file A in operating environment 3. The target detection report finally generated will be included in the sample and report management module as a historical report for management, and will be bound to the detection report of sample file A in multiple environments of operating environment 2 and operating environment 3.

[0096] In another optional embodiment, it is assumed that user A and user B have submitted the same sample file 1 in succession, and when user B submits sample file 1, the sample file 1 submitted by user A has finished generating a test report. Among them, user A's preference setting conditions for the file type of sample file 1 are corresponding to operating environment 1 and operating environment 2. User B has not configured corresponding preference setting conditions for the file type of sample file 1, so when user B uploads sample file 1, the preference setting module will use the preset operating environment determination policy to determine the operating environment of sample file 1, assuming that the operating environment policy determines the operating environment template 2. On this basis, since operating environment 1 is a custom operating environment customized based on operating environment template 1, and operating environment 2 is a custom operating environment customized based on operating environment template 2, when the test result management module receives the test result 2 of sample file 1 in operating environment 2, it will automatically associate the test result 2 with the test result of operating environment template 2 through the definition of operating environment 2, so that when user B submits sample file 1, what is actually used is the test result 2 generated by user A in operating environment 2 when submitting sample file 1, and the test report generated thereby.

[0097] It should be noted that in this application, the starting point of the reuse of detection results is to save detection resources and improve detection efficiency. Specifically, there are two considerations for the reuse of detection results. First, the malicious behavior of some samples is strongly related to the operating system and has nothing to do with the installation of software. For example, the startup and operation of the Windows executable file exe does not depend on third-party software, that is, the software installed in the operating environment does not affect the operation of the exe file; second, for some users, the user does not care how the sample is run or what software is used to start the operation. On the contrary, these users are more concerned about the sample detection results. Combined with the two functional design points in this application that the custom operating environment and the operating environment template have the same operating system and the preset operating environment determination strategy binds the assignment relationship between some file types and a certain operating environment template, a detection result based on a certain custom operating environment is also applicable to the operating environment template associated with the custom operating environment, and can be used as the detection result of this operating environment template, thereby realizing result reuse, so that some detection tasks can reuse historical detection results without occupying more detection resources in the subsequent process, realizing rapid report output, and indirectly improving detection efficiency.

[0098] In an optional embodiment, the target operating environment is stored in the first storage area in the form of a virtual machine file. The sample file detection system first converts the target operating environment into a virtual machine, runs the sample file on the virtual machine, and then obtains the running log data of the sample file when it runs in the virtual machine. The running log data is then subjected to data filtering processing to obtain the target data, wherein the data filtering processing is used to filter out invalid data in the running log data. Finally, the sample file detection system analyzes the target data to obtain a target detection result.

[0099] Optionally, the operating environment template and customized operating environment in this application are stored as virtual machine files, and the file format depends on the virtualization component used during deployment. For example, if the virtualization component is a KVM component, the operating environment template and customized operating environment can be expressed as qcow2 files, etc.; if the virtualization component is a VMWARE component, the operating environment template and customized operating environment can be expressed as OVF files or OVA files, etc.

[0100] In addition, a running record analysis module is deployed on each node server, and the running record analysis module is used to process the running record data. First, after obtaining the running record data, the running record analysis module will eliminate invalid data according to the established logic, wherein the invalid data can be understood as redundant information in the running record data. After filtering out the invalid data, the running record analysis module can obtain the target data, and then the running record analysis module will further simplify and summarize the target data to form a clear and easy-to-read detection result. It should be noted that the running record data is not only the record data from the virtual machine, but also includes the record data from the virtual machine's peripheral environment. Among them, the virtual machine's peripheral environment includes peripheral devices such as the virtual network card of the virtual machine, and the running record data includes but is not limited to log files, screenshot files, network traffic files, memory binary files, system tampered configuration record files and other data.

[0101] In an optional embodiment, the sample file detection system will also obtain the running time of the sample file in the virtual machine. When the running time is greater than the preset time, the sample file detection system will prohibit the sample file from continuing to run and update the running status of the sample file to the running completion status.

[0102] It should be noted that some abnormal sample files may be a virus program, and the abnormal behavior exhibited in the target operating environment may cause the virtual machine to run the abnormal sample file in an infinite loop. In order to avoid this problem, this application can forcibly stop the running of the abnormal sample file by setting a preset time.

[0103] From the above content, we can see that the sample text is actually run in a virtual machine, where Figure 6 The following is a sequence diagram showing how a custom operating environment is converted to a virtual machine according to an embodiment of the present application. Taking user A as an example, the process from defining the operating environment to converting it to a virtual machine includes the following steps:

[0104] In step S601, user A checks whether the existing operating environment stored in the operating environment library management module meets the requirements. If so, the process goes directly to step S612. If not, the process goes to step S602.

[0105] Step S602: User A obtains and views pre-deployed operating environment templates, selects one that meets his / her needs, and downloads it to his / her local computer.

[0106] Step S603: User A performs custom operations on the operating environment based on the downloaded operating environment template, including starting or stopping system services, adding or updating software, or uninstalling software.

[0107] Step S604: User A uploads the customized operating environment to the operating environment library management module;

[0108] Step S605: After receiving the customized operating environment uploaded by user A, the operating environment library management module updates the operating environment record to achieve sharing of the operating environment, that is, to make it visible to all users;

[0109] Step S606: The operating environment library management module notifies the node management module that there is an operating environment update;

[0110] Step S607: The node management module synchronizes the new operating environment (i.e., the customized operating environment created by user A) to each node server;

[0111] Step S608: After synchronization is completed, the node management module notifies the virtual machine management module on each node server to create a specified number of virtual machines for the custom operating environment;

[0112] Step S609: After the virtual machine management module on the node server completes the creation of the virtual machine, it feeds back the creation completion result to the node management module;

[0113] Step S610: The node management module updates and records the types of virtual machines and the number of each type of virtual machines on the node server;

[0114] Step S611: The customized operating environment is effective. All subsequent users can bind file types to the customized operating environment by setting preference conditions. Then go to step S613;

[0115] Step S612: If the existing operating environment can meet the requirements, user A can directly set the preferred setting conditions without customizing the operating environment, and then go to step S613;

[0116] Step S613, the process ends.

[0117] It should be noted that each target operating environment corresponds to multiple virtual machines, and each virtual machine can run sample files. Before running the sample file on the virtual machine, the sample file detection system will detect whether there is an idle virtual machine among the multiple virtual machines, and if there is no idle virtual machine among the multiple virtual machines, the system will monitor the working status of each virtual machine, and when an idle virtual machine is detected, the sample file will be sent to the virtual machine to run the sample file through the virtual machine. Since the number of virtual machines may be limited, in order to improve the detection efficiency, this application will allocate an idle virtual machine to the sample file to be detected by calling the management module, so as to improve the efficiency of virtual machine use.

[0118] In an optional embodiment, since each target operating environment corresponds to a test result, after the sample file is sent to at least one target operating environment for testing, the sample file testing system ultimately obtains at least one test result. Based on this, the sample file testing system can generate a target test report for the sample file in the following two ways.

[0119] The first method is to generate a test report based on the test results of the sample file in a target operating environment, and then comprehensively analyze all the test reports corresponding to at least one target operating environment to obtain a target test report, and send the target test report to the target device.

[0120] It should be noted that since the user views the target detection report through the target device, the user directly sees the target detection report, but not the detection report. If the user wants to view the detection results under a certain target operating environment separately, the user can send a view request carrying the target operating environment identifier to the sample file detection system through the target device. After receiving the view request, the sample file detection system will send the detection report under the target operating environment corresponding to the target operating environment identifier to the target device for the user to view.

[0121] The second method is to obtain at least one detection result, perform a comprehensive analysis on the at least one detection result to obtain a comprehensive analysis result, and finally generate a target detection report based on the comprehensive analysis result, and send the target detection report to the target device.

[0122] It should be noted that in the second method, a detection report will not be generated separately for each detection result. Instead, a target detection result is directly generated after comprehensive analysis of all detection results, thereby saving storage resources and improving the efficiency of generating target detection reports.

[0123] In an optional embodiment, each user can configure the execution environments to which sample files of each file type can be delivered. Specifically, the sample file detection system first identifies the file type of the sample file and the user identifier corresponding to the sample file, wherein the user identifier is used to identify the user who uploaded the sample file. Then, the sample file detection system determines the preference setting conditions corresponding to the sample file based on the file type and user identifier, wherein the preference setting conditions are used to constrain the binding relationship between the file type and at least one target execution environment, and each user identifier corresponds to a preference setting condition. Finally, the sample file detection system determines at least one target execution environment from multiple pre-deployed execution environments based on the preference setting conditions and delivers the sample file to the at least one target execution environment for detection.

[0124] Optional, Figure 7 FIG. 1 shows a schematic diagram of a preference setting condition according to an embodiment of the present application. Figure 7 As shown, the preference setting conditions are used to characterize the binding relationship between the file type of the sample file and the runtime environment, wherein the runtime environment must be stored in the runtime environment library. At the same time, the preference setting conditions are user-specific. Different users can set different preferences and manage preference items, including enabling and disabling. The runtime environment library is shared, that is, the customized runtime environments uploaded by different users and the pre-set runtime environment templates are open to all users. The runtime environment library management module will display the environment configuration information and related descriptions of different runtime environments to users, so as to facilitate users to configure the preference settings.

[0125] In an optional embodiment, as Figure 7 As shown, when configuring the preference setting conditions, the user first needs to check the file type targeted by the preference setting conditions. The preference setting module will then automatically associate all the runtime environments in the runtime environment library that support the sample files of that file type for run detection, so that the user can make a selection. The user can then select the target runtime environment corresponding to each file type. This application supports checking multiple runtime environments as target runtime environments at the same time. In addition, the newly added preference setting is enabled by default, and the user can disable the enabled reddish setting conditions.

[0126] exist Figure 7In the example, a user's preference configuration condition includes three bias configuration entries: target runtime environments 1 and 3 for the file type doc; target runtime environment 2 for the file type exe64; and target runtime environments 2 and 3 for the file type exe32. The preference settings for the file types doc and exe32 are enabled, while the preference setting for the file type exe64 is disabled.

[0127] In an optional embodiment, when no preference setting conditions corresponding to the sample file are detected based on the file type and user identification, the sample file detection system initiates a preset operating environment determination strategy, wherein the operating environment determination strategy is used to directly determine an operating environment as the target operating environment from multiple operating environments.

[0128] Optionally, for file types that do not have a configuration preference setting condition, and for file types that have a configuration preference setting condition but the corresponding preference setting entry has been disabled, the present application provides a preset operating environment determination strategy, through which a suitable operating environment can be selected by default for sample files of these file types. For example, the file type of sample file 1 does not have a corresponding preference setting condition. Through the preset operating environment determination strategy, the sample file detection system will determine the sample file (assuming it is sample file A) that is closest to sample file 1 from the pre-stored sample file library, and then the sample file detection system will determine that the operating environment corresponding to sample file A is the default operating environment corresponding to sample file 1.

[0129] In an optional embodiment, the technical solution of the present application is further described below in combination with two application scenario examples. Among them, scenario one is a scenario of multiple operating environment detection. Assume that user A sets a preference setting condition, specifying that sample files of sample file type B are sent to operating environment C and operating environment D for detection at the same time. User A submits sample file E, and the sample file type corresponding to sample file E is sample file type B. According to the technical solution of the present application, sample file E will be sent to the virtual machines corresponding to operating environment C and operating environment D for detection and analysis at the same time. Finally, user A will get a target detection report containing the detection results of operating environment C and operating environment D. Among them, it is possible that operating environment C has discovered the malicious behavior of sample file E, it is also possible that operating environment D has discovered the malicious behavior of sample file E, or it is possible that two operating environments have discovered the malicious behavior of sample file E at the same time.

[0130] It is easy to notice that multi-environment detection allows sample files to run in more environments, providing more platforms for sample files to exhibit file behaviors, thereby increasing the possibility of discovering malicious behaviors in sample files.

[0131] Secondly, scenario two is an application scenario about a customized operating environment. Suppose user A customizes and uploads a customized operating environment C based on the pre-deployed operating environment template B. User A sets the preference setting conditions and specifies that sample files of sample file type F are sent to both operating environment C and operating environment D for detection. Among them, operating environment D can be the operating environment template that comes with the sample file detection system, or it can be a customized operating environment uploaded by other users. User A submits sample file E, and the sample file type corresponding to sample file E is sample file type F. Sample file E will be sent to the virtual machines corresponding to operating environment C and operating environment D for detection and analysis. Finally, user A will receive a target detection report containing the detection results of operating environment C and operating environment D.

[0132] It should be noted that this application, by supporting user-defined operating environments, can simulate the user's actual office ecological environment to the greatest extent possible, so as to discover malicious files that pose an attack risk to the user's ecology, and thus provide users with more accurate malicious file discovery services.

[0133] Example 2

[0134] According to an embodiment of the present application, a sample file detection device embodiment is also provided, wherein: Figure 8 FIG. 1 is a schematic diagram of an optional sample file detection device according to an embodiment of the present application, such as Figure 8 As shown, the device includes: an acquisition module 801 , a first detection module 802 , a second detection module 803 and a determination module 804 .

[0135] The acquisition module 801 is configured to acquire a sample file to be detected and a target operating environment corresponding to the sample file, wherein the target operating environment is an operating environment for detecting whether the sample file has an abnormality, and the target operating environment is a first type of operating environment or a second type of operating environment, wherein the first type of operating environment is an operating environment obtained by performing environmental adjustments based on the second type of operating environment, wherein the environmental adjustments include at least operating system adjustments and / or software adjustments. The first detection module 802 is configured to detect whether a first operating environment corresponding to the target operating environment exists in the first storage area when the target operating environment is the second type of operating environment, wherein the first operating environment is a first type of operating environment obtained by performing environmental adjustments based on the target operating environment. The second detection module 803 is configured to detect whether a first historical detection result exists in the second storage area when the first operating environment exists in the first storage area, wherein the first historical detection result is a historical detection result obtained when the sample file is detected in the first operating environment, wherein the first storage area is configured to store all operating environments, and the second storage area is configured to store all historical detection results. The determination module 804 is configured to determine, when the first historical detection result exists in the second storage area, that the first historical detection result is the target detection result of the sample file in the target operating environment.

[0136] It should be noted that the above-mentioned acquisition module 801, first detection module 802, second detection module 803 and determination module 804 correspond to steps S101 to S104 in the above-mentioned embodiment. The examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0137] Optionally, each first type of operating environment corresponds to a creating user identifier, and the state of each first type of operating environment is a shared state, wherein the creating user identifier is used to characterize the user who created the operating environment, and the shared state is used to characterize that the operating environment is visible to all users and each user can use the operating environment to detect sample files.

[0138] Optionally, the sample file detection device further includes: a third detection module, a first determination module, and a first delivery module. The third detection module is configured to, when the target operating environment is a second type of operating environment, detect whether there is a second historical detection result in the second storage area if the first operating environment does not exist in the first storage area or the first historical detection result does not exist in the second storage area, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; the first determination module is configured to, when the second historical detection result exists in the second storage area, determine that the second historical detection result is a target detection result of the sample file in the target operating environment; and the first delivery module is configured to, when the second historical detection result does not exist in the second storage area, deliver the sample file to the target operating environment for detection to obtain the target detection result of the sample file in the target operating environment.

[0139] Optionally, the sample file detection device further includes: a fourth detection module, a second determination module, and a second delivery module. The fourth detection module is configured to, when the target operating environment is the first type of operating environment, detect whether a second historical detection result exists in the second storage area, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; the second determination module is configured to, when the second historical detection result exists in the second storage area, determine that the second historical detection result is a target detection result of the sample file in the target operating environment; and the second delivery module is configured to, when the second historical detection result does not exist in the second storage area, deliver the sample file to the target operating environment for detection, thereby obtaining the target detection result of the sample file in the target operating environment.

[0140] Optionally, the sample file detection device further includes: a conversion module, a first acquisition module, a data processing module, and a first analysis module. The conversion module is configured to convert the target operating environment into a virtual machine and run the sample file on the virtual machine; the first acquisition module is configured to obtain operation log data when the sample file is running in the virtual machine; the data processing module is configured to perform data filtering on the operation log data to obtain target data, wherein the data filtering is configured to filter out invalid data in the operation log data; and the first analysis module is configured to analyze the target data to obtain target detection results.

[0141] Optionally, the conversion module further includes: a first acquisition unit and a prohibition unit. The first acquisition unit is configured to acquire the running time of the sample file in the virtual machine; the prohibition unit is configured to prohibit the sample file from continuing to run and update the running status of the sample file to a running completion state when the running time exceeds a preset time.

[0142] Optionally, the sample file detection device further includes: a second acquisition module, a second analysis module, and a first generation module. The second acquisition module is configured to acquire multiple target detection results, each corresponding to a target operating environment; the second analysis module is configured to perform a comprehensive analysis on the multiple target detection results to obtain a comprehensive analysis result; and the first generation module is configured to generate a target detection report based on the comprehensive analysis result and send the target detection report to the target device.

[0143] Optionally, the sample file detection device further includes: a second generation module and a third analysis module. The second generation module is configured to generate a detection report based on each target detection result, thereby obtaining multiple detection reports; and the third analysis module is configured to perform a comprehensive analysis of the multiple detection reports to obtain a target detection report, and then transmit the target detection report to the target device.

[0144] Example 3

[0145] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the sample file detection method in the above-mentioned embodiment 1 when running.

[0146] The serial numbers of the above embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0147] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0148] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0149] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0150] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0151] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0152] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting a sample file, characterized in that: include: Obtaining a sample file to be tested and a target operating environment corresponding to the sample file, wherein the target operating environment is an operating environment used to detect whether the sample file has an abnormality, and the target operating environment is a first type of operating environment or a second type of operating environment, wherein the first type of operating environment is an operating environment obtained after environmental adjustment is performed on the second type of operating environment, and the environmental adjustment includes at least operating system adjustment and / or software adjustment; When the target operating environment is the second type of operating environment, detecting whether there is a first operating environment corresponding to the target operating environment in the first storage area, wherein the first operating environment is an operating environment of the first type obtained after environmental adjustment is performed based on the target operating environment; If the first operating environment exists in the first storage area, detecting whether a first historical detection result exists in the second storage area, wherein the first historical detection result is a historical detection result obtained when the sample file is detected in the first operating environment, the first storage area is used to store all operating environments, and the second storage area is used to store all historical detection results; When the first historical detection result exists in the second storage area, determining that the first historical detection result is a target detection result of the sample file in the target operating environment; The method further comprises: When the target operating environment is the second type of operating environment, if the first operating environment does not exist in the first storage area or the first historical detection result does not exist in the second storage area, detecting whether the second storage area has a second historical detection result, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; When the second historical detection result exists in the second storage area, determining that the second historical detection result is a target detection result of the sample file in the target operating environment; When the second historical detection result does not exist in the second storage area, the sample file is transmitted to the target operating environment for detection to obtain a target detection result of the sample file in the target operating environment; After obtaining the sample file to be tested and the target operating environment corresponding to the sample file, the method further includes: When the target operating environment is the first type of operating environment, detecting whether there is a second historical detection result in the second storage area, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; When the second historical detection result exists in the second storage area, determining that the second historical detection result is a target detection result of the sample file in the target operating environment; When the second historical detection result does not exist in the second storage area, the sample file is transmitted to the target operating environment for detection to obtain a target detection result of the sample file in the target operating environment.

2. The method according to claim 1, characterized in that Each first-type operating environment corresponds to a creating user identifier, and the state of each first-type operating environment is a shared state, wherein the creating user identifier is used to characterize the user who created the operating environment, and the shared state is used to characterize that the operating environment is visible to all users and each user can use the operating environment to detect the sample file.

3. The method according to claim 1, characterized in that The target operating environment is stored in the first storage area in the form of a virtual machine file. The sample file is delivered to the target operating environment for detection, and a target detection result of the sample file in the target operating environment is obtained, including: Converting the target operating environment into a virtual machine and running the sample file on the virtual machine; Obtaining running record data of the sample file when it is running in the virtual machine; Performing data filtering processing on the operation record data to obtain target data, wherein the data filtering processing is used to filter invalid data in the operation record data; The target data is analyzed to obtain the target detection result.

4. The method according to claim 3, characterized in that Converting the target operating environment into a virtual machine and running the sample file on the virtual machine includes: Obtaining the running time of the sample file in the virtual machine; When the running time is longer than a preset time, the sample file is prohibited from continuing to run, and the running status of the sample file is updated to a running completion status.

5. The method according to claim 1, wherein There are multiple target operating environments corresponding to the sample file, and the method further includes: Obtaining multiple target detection results, where each target detection result corresponds to a target operating environment; Performing a comprehensive analysis on the multiple target detection results to obtain a comprehensive analysis result; A target detection report is generated based on the comprehensive analysis results, and the target detection report is sent to the target device.

6. The method according to claim 5, characterized in that After obtaining multiple target detection results, the method further includes: Generate a detection report based on each target detection result, and then obtain multiple detection reports based on the multiple target detection results; The multiple detection reports are comprehensively analyzed to obtain the target detection report, and the target detection report is sent to the target device.

7. A sample file detection device, characterized in that: include: an acquisition module, configured to acquire a sample file to be detected and a target operating environment corresponding to the sample file, wherein the target operating environment is an operating environment used to detect whether the sample file has an abnormality, and the target operating environment is a first type of operating environment or a second type of operating environment, wherein the first type of operating environment is an operating environment obtained by performing environmental adjustments based on the second type of operating environment, and the environmental adjustments include at least operating system adjustments and / or software adjustments; a first detection module configured to detect, when the target operating environment is the second type of operating environment, whether a first operating environment corresponding to the target operating environment exists in the first storage area, wherein the first operating environment is an operating environment of the first type obtained after environmental adjustment is performed on the target operating environment; a second detection module configured to detect whether a first historical detection result exists in the second storage area if the first operating environment exists in the first storage area, wherein the first historical detection result is a historical detection result obtained when the sample file is detected in the first operating environment; the first storage area is used to store all operating environments, and the second storage area is used to store all historical detection results; a determination module configured to, when the first historical detection result exists in the second storage area, determine that the first historical detection result is a target detection result of the sample file in the target operating environment; The device further includes: a third detection module for detecting whether there is a second historical detection result in the second storage area when the target operating environment is the second type of operating environment, if the first operating environment does not exist in the first storage area or the first historical detection result does not exist in the second storage area, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; a first determination module for determining that the second historical detection result is a target detection result of the sample file in the target operating environment when the second historical detection result exists in the second storage area; and a first delivery module for delivering the sample file to the target operating environment for detection to obtain a target detection result of the sample file in the target operating environment when the second historical detection result does not exist in the second storage area; After obtaining the sample file to be detected and the target operating environment corresponding to the sample file, the device also includes: a fourth detection module, which is used to detect whether there is a second historical detection result in the second storage area when the target operating environment is the first type of operating environment, wherein the second historical detection result is a historical detection result obtained when the sample file is detected in the target operating environment; a second determination module, which is used to determine that the second historical detection result is a target detection result of the sample file in the target operating environment when the second historical detection result exists in the second storage area; and a second delivery module, which is used to deliver the sample file to the target operating environment for detection when the second historical detection result does not exist in the second storage area, so as to obtain the target detection result of the sample file in the target operating environment.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the sample file detection method according to any one of claims 1 to 6 when running.

Images