A family determination method, device, apparatus and storage medium
By comparing the code similarity between target samples in a computer system and a sample library, a set of similar samples is identified and their families are determined. This solves the problem of accurately identifying malicious sample families and improves system security and determination efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-06-25
- Publication Date
- 2026-03-27
AI Technical Summary
Existing technologies make it difficult to accurately determine the family to which malicious samples belong in a computer system, leading to improper handling and impacting system security.
By comparing the code similarity between the target sample and each malicious sample in the sample library, a set of similar samples is determined. Based on the family to which the similar sample set belongs, the family to which the target sample belongs is determined. Further determination is made using a set labeling system and manual confirmation.
It improves the accuracy of family identification, ensures the security of computer systems, reduces human intervention, is suitable for identifying large batches of samples, and can promptly discover new families.
Smart Images
Figure CN115525894B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of computer application, in particular to a family determination method and device, equipment and storage medium. BACKGROUND
[0002] With the rapid development of computer technology, the application of computers is becoming more and more common, and the attention to computer security issues is becoming higher and higher. In the process of computer running, it may encounter virus attacks, which brings security threats to the computer system.
[0003] Viruses belonging to the same family pose similar security threats to computer systems and can be handled in the same way. At present, through pre-research or analysis of historical data, the processing method for multiple virus families can be obtained. When a malicious sample in the computer system is detected, how to accurately determine its attribution family so as to use the processing method of its attribution family to process it is a technical problem that the technical personnel in the field urgently need to solve. SUMMARY
[0004] The purpose of the present application is to provide a family determination method, device, equipment and storage medium to accurately determine the attribution family of a malicious sample, facilitate processing it through the processing method of its attribution family, and ensure the security of the computer system.
[0005] To solve the above technical problems, the present application provides the following technical solutions:
[0006] A family determination method comprises:
[0007] Obtaining a target sample;
[0008] Comparing the target sample with each malicious sample in a sample library in terms of code similarity to obtain a comparison result;
[0009] According to the comparison result, determining a similar sample set of the target sample;
[0010] Based on the attribution family of each malicious sample in the similar sample set, determining the attribution family of the target sample.
[0011] In one specific embodiment of the present application, the function set of each malicious sample is recorded in the sample library; the comparison of the target sample with each malicious sample in the sample library in terms of code similarity comprises:
[0012] Splitting the target sample to obtain a function set of the target sample;
[0013] The function set of the target sample is compared with the function set of each malicious sample in the sample library respectively.
[0014] In an embodiment of the present application, the determining of the similar sample set of the target sample according to the comparison result comprises:
[0015] According to the comparison result, a malicious sample with a code similarity greater than a set similarity threshold to the target sample is determined in the sample library.
[0016] The determined set of malicious samples is determined as the similar sample set of the target sample.
[0017] In an embodiment of the present application, the determining of the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set comprises:
[0018] It is determined whether the attribution family of each malicious sample in the similar sample set is known.
[0019] If it is known, the attribution family of the similar sample set is determined as the attribution family of the target sample.
[0020] In an embodiment of the present application, it further comprises:
[0021] If the attribution family of each malicious sample in the similar sample set is unknown, the target sample is added to the similar sample set to obtain a temporary sample set.
[0022] If a set new family recognition trigger condition is reached, the attribution family of each temporary sample set is determined.
[0023] In an embodiment of the present application, the determining of the attribution family of each temporary sample set comprises:
[0024] The attribution family of each temporary sample set is determined by using a set label system.
[0025] For the temporary sample set whose attribution family cannot be determined by the label system, the attribution family is determined by an artificial confirmation method.
[0026] In an embodiment of the present application, after the determining of the similar sample set of the target sample according to the comparison result, it further comprises:
[0027] If the similar sample set is empty, the target sample is determined as an isolated sample and stored in the sample library.
[0028] A family determination device comprises:
[0029] a target sample obtaining module configured to obtain a target sample;
[0030] a comparison result obtaining module configured to compare the target sample with each malicious sample in a sample library respectively in terms of code similarity to obtain a comparison result;
[0031] a similar sample set determining module configured to determine a similar sample set of the target sample according to the comparison result;
[0032] a family determining module configured to determine a family of the target sample based on a family of each malicious sample in the similar sample set.
[0033] A family determining device comprises:
[0034] a memory configured to store a computer program;
[0035] a processor configured to implement the steps of the family determining method according to any one of the preceding embodiments when executing the computer program.
[0036] A computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the steps of the family determining method according to any one of the preceding embodiments.
[0037] According to the technical solution provided by the embodiments of the present application, after obtaining the target sample, the target sample is compared with each malicious sample in the sample library respectively in terms of code similarity to obtain a comparison result, then the similar sample set of the target sample is determined according to the comparison result, and finally the family of the target sample is determined based on the family of each malicious sample in the similar sample set. The family of the similar sample set of the target sample determined based on the code similarity comparison can improve the determination accuracy, facilitate the processing of the target sample through the processing mode of its family, and ensure the security of the computer system. BRIEF DESCRIPTION OF DRAWINGS
[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.
[0039] Figure 1 An implementation flowchart of the family determining method in the embodiments of the present application;
[0040] Figure 2 A schematic diagram of the similarity comparison process between samples in the embodiments of the present application;
[0041] Figure 3 Fig. 1 is a structural schematic diagram of a family determination device according to an embodiment of the present application;
[0042] Figure 4 Fig. 1 is a structural schematic diagram of a family determination device according to an embodiment of the present application; DETAILED DESCRIPTION
[0043] The core of the present application is to provide a family determination method, which can be applied to a security device. The security device can be deployed in a computer system to protect the computer system, or can be deployed in a cloud to protect multiple computer systems connected to the cloud.
[0044] In order for those skilled in the art to better understand the present application, the present application will be further described in detail below in combination with the drawings and specific embodiments. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0045] Referring to Figure 1 Fig. 1 is an implementation flowchart of a family determination method according to an embodiment of the present application. The method can include the following steps:
[0046] S110: Obtain a target sample.
[0047] The target sample can be any malicious sample currently detected for family attribution determination. For example, when a sample in a computer system is currently detected to have a security threat behavior, the sample can be determined as the target sample.
[0048] The attribution family of the target sample is unknown, and the processing method of the target sample is obtained through the determination of the attribution family of the target sample, so as to protect the security of the computer system. In addition, the determination of the attribution family of the target sample can also increase the number of samples of the corresponding family, so as to facilitate the learning of more samples and the more detailed or comprehensive analysis of more samples.
[0049] After obtaining the target sample, the subsequent steps can be continued.
[0050] S120: Compare the target sample with each malicious sample in the sample library respectively for code similarity, and obtain a comparison result.
[0051] In the embodiment of the present application, a sample library can be constructed in advance, the sample library records a plurality of malicious samples, and the malicious samples can be marked with a family tag through expert analysis, a third-party engine, etc. The sample library can be in the form of a distributed database to store a large amount of sample information.
[0052] After obtaining the target sample, the target sample can be compared with each malicious sample in the sample library for code similarity to obtain a comparison result. The comparison result can include a calculation result of the code similarity between the target sample and each malicious sample in the sample library.
[0053] S130: determining a similar sample set of the target sample according to the comparison result.
[0054] After the target sample is compared with each malicious sample in the sample library for code similarity, the comparison result can include a calculation result of the code similarity between the target sample and each malicious sample in the sample library.
[0055] According to the comparison result, the code similarity between the target sample and each malicious sample in the sample library can be determined. The greater the code similarity, the more similar the two samples. Accordingly, the similar sample set of the target sample can be determined.
[0056] S140: determining the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set.
[0057] The similar sample set of the target sample determined can include one or more malicious samples. For a similar sample set, because the codes of the malicious samples included are similar, the threat behaviors of the malicious samples are also similar, and the attribution families of each malicious sample in the similar sample set are also the same.
[0058] Based on the attribution family of each malicious sample in the similar sample set, the attribution family of the target sample can be determined. The attribution family of the target sample determined can be the same as that of the similar sample set.
[0059] By applying the method provided in the embodiment of the present application, after obtaining the target sample, the target sample can be compared with each malicious sample in the sample library for code similarity to obtain a comparison result, then the similar sample set of the target sample is determined according to the comparison result, and the attribution family of the target sample is determined based on the attribution family of each malicious sample in the similar sample set. The attribution family of the similar sample set of the target sample determined based on the code similarity comparison can improve the determination accuracy, facilitate processing of the target sample through the processing mode of the attribution family, and ensure the security of the computer system.
[0060] In one embodiment of this application, the sample library records the function set of each malicious sample, and step S120 may include the following steps:
[0061] Step 1: Split the target sample to obtain the function set of the target sample;
[0062] Step 2: Compare the function set of the target sample with the function set of each malicious sample in the sample library for similarity.
[0063] For ease of description, the two steps above will be explained together.
[0064] In this embodiment of the application, the function set of each malicious sample can be recorded in advance in the sample library. Specifically, it can be recorded in a fuzzy hashing manner.
[0065] After obtaining the target sample, it can be split into its function set. Specifically, the target sample can be split into a set of functions through disassembly.
[0066] The function set of the target sample is compared with the function set of each malicious sample in the sample library for similarity. When comparing the similarity of the function sets of the target sample and any malicious sample in the sample library, factors that interfere with similarity matching, such as opcode removal, can be removed before calculating the similarity between the two function sets. The similarity between the two function sets can be represented using the Jaccard coefficient.
[0067] The Jaccard coefficient, also known as the Jaccard similarity coefficient, is used to compare the similarity and differences between finite sets. A higher Jaccard coefficient value indicates a higher degree of similarity between the sets. Given two sets A and B, the Jaccard coefficient can be defined as the ratio of the size of the intersection of A and B to the size of the size of the union of A and B, as defined below:
[0068]
[0069] like Figure 2 As shown, samples X and Y can be decomposed into three sets of functions, namely func_1, func_2 and func_3. By comparing the similarity of these two sets of functions, it can be concluded that samples X and Y have strong similarity.
[0070] Of course, in actual application, the function set of each malicious sample can not be recorded in the sample library in advance, and when code similarity comparison is needed, the two samples to be compared are respectively disassembled into function sets, and then similarity comparison is performed on the function sets. In this way, the function set of the sample can be obtained in time using the update technology, and the similarity comparison of the function set can be performed to obtain more accurate comparison results.
[0071] In a specific embodiment of the present application, when performing code similarity comparison between the target sample and each malicious sample in the sample library, more fine-grained comparison can also be performed according to the execution flow, basic block, combination of basic blocks, etc.
[0072] In an embodiment of the present application, step S130 can include the following steps:
[0073] The first step is to determine, according to the comparison result, the malicious sample in the sample library whose code similarity with the target sample is greater than a set similarity threshold;
[0074] The second step is to determine the set of the determined malicious samples as the similar sample set of the target sample.
[0075] For ease of description, the above two steps are combined for description.
[0076] In an embodiment of the present application, a similarity threshold can be set in advance, such as 90%. The similarity threshold can be set and adjusted according to actual situation or historical data.
[0077] Obtain the target sample, compare the code similarity of the target sample with each malicious sample in the sample library, obtain the comparison result, and obtain the code similarity of the target sample with each malicious sample in the sample library through the comparison result. Compare each obtained code similarity with the similarity threshold, and obtain the malicious sample whose code similarity is greater than the similarity threshold.
[0078] Determine the set of the determined malicious samples in the sample library whose code similarity is greater than the set similarity threshold as the similar sample set of the target sample.
[0079] In an embodiment of the present application, step S140 can include the following steps:
[0080] Step one: determine whether the attribution family of each malicious sample in the similar sample set is known, if known, execute step two;
[0081] Step two: determine the attribution family of the similar sample set as the attribution family of the target sample.
[0082] For ease of description, the above two steps are combined for description.
[0083] In the embodiments of the present application, after the target sample is compared with each malicious sample in the sample library for code similarity, and the similar sample set of the target sample is determined according to the comparison result, it can be further determined whether the attribution family of each malicious sample in the similar sample set is known.
[0084] If it is known, it can be considered that the attribution family of each malicious software in the similar sample set has been determined, and the attribution family of the similar sample set is the known attribution family of each malicious sample in the similar sample set.
[0085] In this case, the attribution family of the similar sample set can be determined as the attribution family of the target sample. In this way, the target sample can be processed according to the processing mode corresponding to the determined attribution family.
[0086] In an embodiment of the present application, the method can further include the following steps:
[0087] The first step: if the attribution family of each malicious sample in the similar sample set is unknown, the target sample is added to the similar sample set to obtain a temporary sample set;
[0088] The second step: if the set new family recognition trigger condition is reached, the attribution family of each temporary sample set is determined.
[0089] For ease of description, the above two steps are combined for description.
[0090] In the embodiments of the present application, if the attribution family of each malicious sample in the similar sample set is unknown, it indicates that the determination result of the attribution family of these malicious samples has not been obtained before, and the target sample can be added to the similar sample set to obtain a temporary sample set. Specifically, the target sample and each malicious sample in the similar sample set can be given an unknown family tag in the sample library, and a family name can be randomly given to the unknown family as a temporary family name, for example, a name can be given according to a time rule.
[0091] As more samples are detected, there can be multiple temporary sample sets in the sample library, and the code similarity between malicious samples in the same temporary sample set is high, and the code similarity between malicious samples in different temporary sample sets is low. Different temporary sample sets can be distinguished by temporary family names or other identifiers.
[0092] Because the data amount of malicious samples in the sample library is limited, it can not completely cover all families, so there is a case that the attribution family of the temporary sample set is known, but it cannot be recognized through the sample library. This requires further determination of whether the attribution family of each temporary sample set is really unknown. Of course, there is also a case that the attribution family of the temporary sample set is a new family.
[0093] The new family recognition trigger condition can be preset, for example, when a set time interval is reached, it is considered that the new family recognition trigger condition is reached, or when the number of malicious samples in the temporary sample set reaches a set number threshold, it is considered that the new family recognition trigger condition is reached.
[0094] In the case where the set new family recognition trigger condition is reached, the attribution family determination can be performed on each temporary sample set.
[0095] Specifically, the attribution family determination can be performed on each temporary sample set using a set label system. For example, the malicious samples in each temporary sample set are labeled using an NLP (Natural Language Processing) label system. If the label can be applied, it indicates that it belongs to a known family, and thus the corresponding determination result can be obtained. The attribution family label of the corresponding malicious sample can be updated in the sample library.
[0096] It should be noted that the NLP label system can integrate the identification results of each engine. The NLP can learn the label correlation of each engine, learn the feature vector of the sample, cluster the sample and label the sample.
[0097] The attribution family determination of each temporary sample set using the set label system can not obtain the determination result. For the temporary sample set that cannot be determined by the label system, the attribution family determination can be performed by manual confirmation. For example, the attribution family is determined by expert analysis.
[0098] This helps to discover new families in a timely manner, analyze malicious samples belonging to new families, obtain processing methods for new families, and continuously enhance the family identification capability.
[0099] In an embodiment of the present application, after determining the similar sample set of the target sample according to the comparison result, the method can further include the following steps:
[0100] If the similar sample set is empty, the target sample is determined as an isolated sample and stored in the sample library.
[0101] In the embodiment of the present application, after the target sample is compared with each malicious sample in the sample library for code similarity, and the similar sample set of the target sample is determined according to the comparison result, it can be determined whether the similar sample set contains at least one malicious sample. If not, the similar sample set is empty, indicating that none of the malicious samples in the sample library has high code similarity with the target sample. In this case, the target sample can be determined as an isolated sample and stored in the sample library. Because the target sample does not have a similar sample set, it lacks a reference of the attribution family of the similar sample set, so the attribution family of the target sample cannot be determined at present, and the target sample can be used as a reference sample for determining the attribution family of other samples. In this way, the number of malicious samples in the sample library gradually increases, which is helpful for subsequent analysis and determination.
[0102] Compared with the related art of simply manually labeling the malicious sample with a family tag, the technical solution provided by the embodiment of the present application can automatically determine the attribution family of the target sample, reduce manual intervention, has a lower threshold, higher determination efficiency, and is suitable for determining the attribution family of a large number of samples.
[0103] Meanwhile, compared with the related art of labeling the malicious sample with a family tag based on a third-party engine, the technical solution provided by the embodiment of the present application can avoid the problems that the samples cannot be accurately clustered when the results of different engines are not unified, and new families cannot be discovered in time, and has higher reliability.
[0104] Corresponding to the above method embodiment, the embodiment of the present application also provides a family determination device. The family determination device described below can be mutually corresponding and referred to the family determination method described above.
[0105] Referring to Figure 3 As shown in the figure, the device can include the following modules:
[0106] The target sample obtaining module 310 is configured to obtain a target sample.
[0107] The comparison result obtaining module 320 is configured to compare the target sample with each malicious sample in the sample library for code similarity, and obtain a comparison result.
[0108] The similar sample set determining module 330 is configured to determine a similar sample set of the target sample according to the comparison result.
[0109] The attribution family determining module 340 is configured to determine the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set.
[0110] The device provided in the embodiment of the application can be used to compare the target sample with each malicious sample in the sample library respectively based on code similarity, obtain a comparison result, determine a similar sample set of the target sample based on the comparison result, and determine the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set. The attribution family of the target sample is determined based on the similar sample set obtained based on code similarity comparison, which can improve the determination accuracy, facilitate processing of the target sample through the processing mode of the attribution family, and ensure the security of the computer system.
[0111] In one specific embodiment of the application, the sample library records a function set of each malicious sample; the comparison result obtaining module 320 is configured to:
[0112] split the target sample to obtain a function set of the target sample;
[0113] compare the function set of the target sample with the function set of each malicious sample in the sample library respectively based on similarity.
[0114] In one specific embodiment of the application, the similar sample set determining module 330 is configured to:
[0115] determine, based on the comparison result, a malicious sample in the sample library that has a code similarity greater than a set similarity threshold with the target sample;
[0116] determine the set of the determined malicious samples as the similar sample set of the target sample.
[0117] In one specific embodiment of the application, the attribution family determining module 340 is configured to:
[0118] determine whether the attribution family of each malicious sample in the similar sample set is known;
[0119] if the attribution family is known, determine the attribution family of the similar sample set as the attribution family of the target sample.
[0120] In one specific embodiment of the application, the attribution family determining module 340 is further configured to:
[0121] if the attribution family of each malicious sample in the similar sample set is unknown, add the target sample to the similar sample set to obtain a temporary sample set;
[0122] if a set new family recognition trigger condition is reached, determine the attribution family of each temporary sample set.
[0123] In one specific embodiment of the application, the attribution family determining module 340 is configured to:
[0124] Each temporary sample set is attributed to a family using a set label system;
[0125] For a temporary sample set that cannot be attributed to a family by the label system, the attribution to a family is determined by manual confirmation.
[0126] In one specific embodiment of the present application, a stray sample determination module is further included for:
[0127] After the similar sample set of the target sample is determined according to the comparison result, if the similar sample set is empty, the target sample is determined as a stray sample and stored in the sample library.
[0128] Corresponding to the above method embodiment, the present application embodiment further provides a family determination device, comprising:
[0129] a memory for storing a computer program;
[0130] a processor for executing the computer program to implement the steps of the above family determination method.
[0131] As shown in Figure 4 , it is a schematic diagram of the composition structure of the family determination device. The family determination device can include a processor 10, a memory 11, a communication interface 12 and a communication bus 13. The processor 10, the memory 11 and the communication interface 12 all complete the communication among each other through the communication bus 13.
[0132] In the embodiment of the present application, the processor 10 can be a central processing unit (CPU), a specific application integrated circuit, a digital signal processor, a field programmable gate array or other programmable logic devices, etc.
[0133] The processor 10 can call the program stored in the memory 11. Specifically, the processor 10 can execute the operations in the embodiments of the family determination method.
[0134] The memory 11 is used to store one or more programs. The program can include program code, and the program code includes computer operation instructions. In the embodiment of the present application, the memory 11 at least stores a program for implementing the following functions:
[0135] obtaining a target sample;
[0136] comparing the target sample with each malicious sample in the sample library for code similarity to obtain a comparison result;
[0137] determining a similar sample set of the target sample according to the comparison result;
[0138] The attribution family of the target sample is determined based on the attribution family of each malicious sample in the similar sample set.
[0139] In a possible implementation, the memory 11 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function (such as a code comparison function, an information storage function), etc. The data storage area can store data created during use, such as comparison data, sample data, etc.
[0140] In addition, the memory 11 can include a high-speed random access memory, and can also include a non-volatile memory, for example, at least one magnetic disk storage device or other volatile solid-state storage device.
[0141] The communication interface 12 can be an interface of a communication module, used to connect with other devices or systems.
[0142] Of course, it needs to be explained that, Figure 4 The structures shown do not constitute a limitation on the family determination device in the embodiments of the present application. In actual applications, the family determination device can include more or fewer components than Figure 4 those shown, or some components can be combined.
[0143] Corresponding to the above method embodiments, the embodiments of the present application also provide a computer readable storage medium, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of the above family determination method are implemented.
[0144] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts of each embodiment can be referred to each other.
[0145] The skilled person can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed in the present text can be realized in electronic hardware, computer software or a combination of both. In order to clearly show the interchangeability of hardware and software, the composition and steps of each example have been described in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.
[0146] The steps of a method or algorithm described in connection with the embodiments disclosed herein can be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module can reside in random access memory (RAM), flash memory, read-only memory (ROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, hard disk can be used as a storage medium.
[0147] The principles and implementations of the present application have been described in relation to specific examples, which are presented as illustrations of the application and are not intended to be limiting of the application in any way. The above description is exemplary and explanatory only and is not intended to be limiting of the application in any manner. The application is only limited by the scope of the claims therefore and the equivalents thereof.
Claims
1. A family determination method characterized by comprising: The method comprises the following steps: obtaining a target sample; comparing the target sample with each malicious sample in a sample library respectively in terms of code similarity to obtain comparison results; determining a similar sample set of the target sample according to the comparison results; if the similar sample set is empty, the target sample is determined as an isolated sample and stored in the sample library; judging the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set; wherein the judging the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set comprises: if the attribution family of each malicious sample in the similar sample set is unknown, the target sample is added to the similar sample set to obtain a temporary sample set; judging the attribution family of each temporary sample set when a set new family recognition trigger condition is reached.
2. The family determination method according to claim 1, characterized by, The sample library records a function set of each malicious sample; the comparing the target sample with each malicious sample in the sample library respectively in terms of code similarity comprises: splitting the target sample to obtain a function set of the target sample; comparing the function set of the target sample with the function set of each malicious sample in the sample library respectively in terms of similarity.
3. The family determination method according to claim 1, characterized by, The determining the similar sample set of the target sample according to the comparison results comprises: determining, according to the comparison results, a malicious sample in the sample library that has a code similarity greater than a set similarity threshold with the target sample; determining the set of the determined malicious sample as the similar sample set of the target sample.
4. The family determination method according to claim 1, characterized by, The judging the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set comprises: determining whether the attribution family of each malicious sample in the similar sample set is known; if yes, the attribution family of the similar sample set is determined as the attribution family of the target sample.
5. The family determination method according to claim 1, characterized by, The judging the attribution family of each temporary sample set comprises: judging the attribution family of each temporary sample set by using a set label system; judging the attribution family of the temporary sample set for which the label system cannot determine the attribution family by an artificial confirmation method.
6. A family determination device characterized by comprising: The method comprises the following steps: a target sample obtaining module for obtaining a target sample; a comparison result obtaining module for comparing the target sample with each malicious sample in a sample library respectively in terms of code similarity to obtain comparison results; a similar sample set determining module for determining a similar sample set of the target sample according to the comparison results; if the similar sample set is empty, the target sample is determined as an isolated sample and stored in the sample library; an attribution family judging module for judging the attribution family of the target sample based on the attribution family of each malicious sample in the similar sample set; The home family determination module is specifically configured to: if the home family of each malicious sample in the similar sample set is unknown, add the target sample to the similar sample set to obtain a temporary sample set; and determine the home family of each temporary sample set in a case where a set new family recognition trigger condition is reached.
7. A family determination device characterized by comprising: The method comprises the following steps: a memory for storing a computer program; a processor for executing the computer program to implement the steps of the family determination method according to any one of claims 1 to 5.
8. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium and is executed by the processor to implement the steps of the family determination method according to any one of claims 1 to 5.
Citation Information
Patent Citations
Family decision method and system based on code slicing, and storage medium
CN108073815A