File detection method, device, electronic device and storage medium

Abstract

The present application provides a file detection method, device, electronic device, and storage medium. The method includes: obtaining a target file set; performing a web search based on the URL information and target file name corresponding to the URL access shortcut to determine a plurality of target web pages; each target web page can provide a download link for a downloadable file whose file name contains the target file name; obtaining the file size information of the downloadable file corresponding to each target web page to obtain a plurality of file size information; if the difference between each file size information and the target file size information meets a second preset rule, the file set to be detected is determined to be an abnormal file set. In the present application, by determining whether the difference between each file size information in the target web page and the target file size information meets the second preset rule, it is possible to quickly determine whether the target file set is an abnormal file set, thereby completing the security detection of the target file set.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a file detection method, device, electronic device, and storage medium. Background Art

[0002] Download sites are websites that provide a variety of executable files (such as software or installation packages). Nowadays, many users download executable files from software download sites rather than from official websites. However, due to the large number of users on download sites, many attackers disguise offensive code (such as viruses or Trojans) as legitimate software and upload them to public download sites. Once a user downloads and executes this disguised offensive code, it remains dormant on the user's system for an extended period, performing various destructive actions and causing financial losses. It is also difficult for non-expert users to identify whether the executable files they download are disguised as offensive code. Summary of the Invention

[0003] In view of this, the present application provides a file detection method, device, electronic device and storage medium, which at least partially solve the problems existing in the prior art.

[0004] In one aspect of the present application, a file detection method is provided, comprising:

[0005] Obtaining a target file set; the target file set includes target files and website access shortcuts;

[0006] Performing a web search based on the URL information and target file name corresponding to the URL access shortcut to determine a plurality of target web pages; each of the target web pages can provide a download link for a downloadable file containing the target file name;

[0007] Obtaining file size information of a downloadable file corresponding to each target web page to obtain a plurality of file size information;

[0008] If the difference between each of the file size information and the target file size information complies with a second preset rule, the to-be-detected file set is determined to be an abnormal file set.

[0009] In an exemplary embodiment of the present application, obtaining the target file set includes:

[0010] Get the set of files to be tested;

[0011] If the to-be-detected file set contains both a target file and a website access shortcut, determining whether the file name of the website access shortcut complies with a first preset rule;

[0012] If they are consistent, the file set to be detected is determined as the target file set.

[0013] In an exemplary embodiment of the present application, determining whether the file name of the website access shortcut meets a first preset rule includes:

[0014] Determining whether the file name of the website access shortcut contains a first type of setting character string;

[0015] If included, it complies with the first preset rule.

[0016] In an exemplary embodiment of the present application, if the set of files to be detected includes both a target file and a URL access shortcut, before determining whether the file name of the URL access shortcut meets the first preset rule, the method further includes:

[0017] Determining whether the file set size information of the to-be-detected file set is less than a first set threshold;

[0018] If so, it is determined whether the to-be-detected file set contains both the target file and the website access shortcut.

[0019] In an exemplary embodiment of the present application, a webpage search is performed based on the URL information corresponding to the URL access shortcut and the target file name to determine several target webpages, including:

[0020] Inputting the URL information and the target file name into a web search engine to obtain a number of candidate web pages;

[0021] According to the ranking of the candidate web pages, a set number of target web pages are determined from the candidate web pages.

[0022] In an exemplary embodiment of the present application, inputting the URL information and the target file name into a web search engine includes:

[0023] Adding a setting instruction character before the website information to obtain the target website information;

[0024] The target website information and the target file name are input into a web search engine as search keywords.

[0025] In an exemplary embodiment of the present application, obtaining the file size information of the downloadable file corresponding to each target webpage to obtain the plurality of file size information includes:

[0026] Extracting text information from each target web page;

[0027] Perform string recognition on each text message;

[0028] If a second type of character string is identified, the character string following the identified second type of character string is determined as the file size information.

[0029] In an exemplary embodiment of the present application, the second preset rule includes:

[0030] The ratio of the file size information to the target file size information is greater than a second set threshold;

[0031] and / or,

[0032] The file size information is smaller than the target file size information, and a difference between the file size information and the target file size information is greater than a third set threshold.

[0033] In another aspect of the present application, a file detection device is provided, comprising:

[0034] A first acquisition module is used to acquire a target file set; the target file set includes target files and website access shortcuts;

[0035] A first determining module is configured to perform a web search based on the URL information corresponding to the URL access shortcut and the target file name, and determine a plurality of target web pages; each of the target web pages can provide a download link for a downloadable file whose file name contains the target file name;

[0036] A second acquisition module is used to acquire file size information of a downloadable file corresponding to each target web page to obtain a plurality of file size information;

[0037] The second determining module is configured to determine the to-be-detected file set as an abnormal file set if the difference between each of the file size information and the target file size information complies with a second preset rule.

[0038] In another aspect of the present application, an electronic device is provided, comprising a processor and a memory;

[0039] The processor is configured to execute the steps of any of the above methods by calling the program or instruction stored in the memory.

[0040] In another aspect of the present application, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium stores a program or instruction, wherein the program or instruction enables a computer to execute the steps of any one of the above methods.

[0041] The file detection method provided by the present application, after obtaining a target file set, will perform a web search based on the file name of the target file (such as an executable file such as an installer or script program) and the URL information (such as URL) corresponding to the URL access shortcut (such as an Internet shortcut). In this way, a target web page that can provide a download link for a downloadable file whose file name contains the target file name is determined, and the file size information of the downloadable file corresponding to each target web page is obtained. Among them, the downloadable file whose file name contains the target file name is a file that has a high probability of being of the same category or identical to the target file in the target file set. Since most executable files disguised as offensive code have a relatively small amount of data, the size of the files disguised as executable files will be small. By using the file size information of the same downloadable file on the Internet, it is determined whether the file size of the executable file currently downloaded to the local computer is normal.

[0042] Therefore, in the present application, by determining whether the difference between the file size information of each of the target web pages and the target file size information meets the second preset rule, it is possible to quickly determine whether the target file set is an abnormal file set, thereby completing the security detection of the target file set. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0044] Figure 1 A flowchart of a file detection method provided in an embodiment of the present application;

[0045] Figure 2 This is a structural block diagram of a file detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0047] It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments may be combined with each other; and, based on the embodiments in this disclosure, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of this disclosure.

[0048] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on this disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement an apparatus and / or practice a method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this apparatus and / or practice this method.

[0049] Please refer to Figure 1 As shown, in one aspect of the present application, a file detection method is provided, comprising the following steps:

[0050] S100: Obtain a target file set, wherein the target file set includes target files and website access shortcuts.

[0051] The target file is an executable file, which may be a script file, an installation package, or other executable file. The URL access shortcut may be an Internet shortcut, etc. The target file set may be a compressed package or a folder, etc. In this embodiment, the target file set exists in the form of a compressed package.

[0052] S200: Perform a web search based on the URL information corresponding to the URL access shortcut and the target file name to determine a plurality of target web pages. The target file name is the file name of the target file; each of the target web pages can provide a download link for a downloadable file whose file name includes the target file name. Specifically, the URL information can be the information within the url key (i.e., url) within the attribute information of the URL access shortcut. Therefore, when performing a web search based on the URL information and the target file name, a web page that provides a download link for a downloadable file whose file name includes the target file name can be found, i.e., the target web page.

[0053] S300: Obtain file size information of a downloadable file corresponding to each target webpage to obtain a plurality of file size information. The file size information can be extracted from the webpage content of the target webpage.

[0054] S400: If the difference between each file size information and the target file size information meets the second preset rule, the to-be-detected file set is determined as an abnormal file set; the target file size information is the file size information of the target file.

[0055] In general, to evade detection and further gain user trust, attackers usually disguise the name of the offensive code as the name of practical software, and compress the offensive code together with the download site shortcuts, instructions, technical documents and other files to trick users into executing them.

[0056] After obtaining a target file set, the file detection method provided in this embodiment performs a webpage search based on the filenames of the target files (e.g., executable files such as installers or scripts) and the URL information (e.g., URL) corresponding to URL access shortcuts (e.g., Internet shortcuts). This method identifies target webpages that provide download links to downloadable files containing the target filename. A downloadable file containing the target filename is likely to be of the same category or identical to a target file in the target file set. The file size information of the downloadable file corresponding to each target webpage is then obtained.

[0057] Since most executable files disguised as attack code contain relatively small amounts of data, the size of the disguised executable file is relatively small. By using the file size information of the same downloadable file from the internet, it is possible to determine whether the size of the currently downloaded executable file is normal. Specifically, since attack code typically does not include files such as graphical interfaces or functional components, its file size can be significantly different from that of normal, practical software. Therefore, by comparing the software size indicated on the download site with the actual size of the downloaded software, it is possible to detect whether the downloaded software is attack code.

[0058] Therefore, in this embodiment, by determining whether the difference between the file size information of each file in the target web page and the target file size information meets the second preset rule, it can be quickly determined whether the target file set is an abnormal file set, thereby completing the security detection of the target file set.

[0059] Furthermore, since this method eliminates the need for deep file feature extraction or virus database queries when testing a target file set, its processing power and speed are superior to traditional methods that directly use virus engines. Furthermore, the identified abnormal file set can be re-entered into the virus engine for testing, thereby reducing the number of files tested and improving efficiency.

[0060] In an exemplary embodiment of the present application, step S100 may specifically include the following steps:

[0061] S110: Obtain a set of files to be detected. The set of files to be detected may be a new set of files downloaded by a download engine, or a set of files in a folder or disk specified by a user.

[0062] S120: If the set of files to be detected contains both a target file (executable file) and a URL access shortcut, determine whether the file name of the URL access shortcut meets the first preset rule. If not, stop executing subsequent steps.

[0063] As can be seen from the above content, in order to evade detection and to further gain the trust of users, attackers usually disguise the name of the offensive code as the name of practical software, and compress the shortcuts, instructions, technical documents and other files of the download site together with the offensive code. Therefore, if the file set to be detected contains both executable files and URL access shortcuts, it can be determined with a high probability that it is a file set downloaded from the download site (the security of the file set downloaded from the download site is much lower than the file set downloaded from the official website and other channels). Specifically, by identifying the suffix of the file in the file set to be detected, it can be determined whether it contains executable files or URL access shortcuts. If a file with the suffix ".exe" is identified, it can be determined that it contains executable files. If a file with the suffix ".url" or ".htm" is identified, it can be determined that it contains URL access shortcuts.

[0064] S130: If the conditions are met, the file set to be detected is determined as the target file set. If the conditions are not met, subsequent steps are stopped.

[0065] URL access shortcuts in file collections downloaded from a download site often use a limited number of naming methods. Therefore, if the file collection to be detected contains both executable files and URL access shortcuts, and the file names of the URL access shortcuts meet the first preset rule, it can be determined that the current file collection to be detected was downloaded from the download site. In this case, it can be determined as the target file collection for subsequent detection steps.

[0066] In this application, the above method can be used to select the set of files to be detected downloaded from the download station as the target file set. In this way, subsequent detection steps can be avoided for some sets of files to be detected that are not downloaded from the download station, thereby reducing the amount of useless processing.

[0067] In an exemplary embodiment of the present application, determining whether the file name of the website access shortcut meets a first preset rule includes:

[0068] Determine whether the file name of the website access shortcut contains a first type of setting character string.

[0069] If included, it complies with the first preset rule.

[0070] The first type of set character strings can be multiple preset character strings, such as "download" or "resource" or other common download site website names, etc. Most download sites provide URL access with strings such as "XX download" or "XX resource site" in their file names.

[0071] Therefore, if the file name of the URL access shortcut contains any one or more first-type setting character strings, it can be accurately determined that the set of files to be detected is downloaded from the download site.

[0072] In an exemplary embodiment of the present application, if the set of files to be detected contains both a target file (executable file) and a URL access shortcut, before determining whether the file name of the URL access shortcut meets the first preset rule, the method further includes:

[0073] Determine whether the file set size information of the file set to be detected is less than a first set threshold value. The set threshold value can be set between 1Mb and 100Mb.

[0074] If so, it is determined whether the to-be-detected file set contains both a target file (executable file) and a website access shortcut.

[0075] Since many software files are large (e.g., software larger than 1Gb), the sizes of downloadable files on different target web pages may vary significantly. Therefore, using the method provided in this embodiment to determine whether a file set is abnormal will result in a certain rate of false positives. Therefore, in order to reduce the false positive rate, the subsequent detection steps are only performed on the files to be detected whose file set size information is less than the first set threshold.

[0076] In an exemplary embodiment of the present application, a webpage search is performed based on the URL information corresponding to the URL access shortcut and the target file name to determine several target webpages, including:

[0077] The website address information and the target file name are input into a web search engine to obtain a plurality of candidate web pages, which are the results output by the web search engine that match the website address information and the target file name.

[0078] According to the ranking of the candidate web pages, a set number of target web pages are determined from the candidate web pages. The set number can be any number from 3 to 10. In this embodiment, the set number is 5.

[0079] Specifically, in this embodiment, based on the ranking of the candidate web pages, a predetermined number of candidate web pages ranked top are determined as target web pages. Since most web search engines rank search results based on the accuracy of search results, the predetermined number of candidate web pages ranked top are selected as target web pages to ensure that the determined target web pages can generally provide downloadable files that are identical to the executable files in the target file set, thereby improving the accuracy of subsequent detection.

[0080] In an exemplary embodiment of the present application, inputting the URL information and the target file name into a web search engine includes:

[0081] Add setting instruction characters before the website information to obtain the target website information. The setting instruction characters can be instruction characters such as "site:" that can improve the search accuracy. For example, if the website information is www.xxxx.com, the target website information can be site:www.xxxx.com.

[0082] The target website information and the target file name are input into a web search engine as search keywords.

[0083] In this embodiment, before the URL information and the target file name are input into the search engine, setting instruction characters are added before the URL information to improve the accuracy of the retrieval, thereby improving the accuracy of subsequent detection results.

[0084] In an exemplary embodiment of the present application, obtaining the file size information of the downloadable file corresponding to each target webpage to obtain the plurality of file size information includes:

[0085] Extract the text information from each target web page. The text information can be extracted by crawlers or image recognition.

[0086] Perform character string recognition on each text message.

[0087] If a second-category string is identified, the string following the identified second-category string is determined as the file size information. The second-category string can be a preset string such as "software size," "file size," or "resource size." On typical download site webpages, the aforementioned string is followed by specific downloadable file size information, such as "software size: 15Mb." This allows for rapid determination of the file size information for downloadable files that do not have a corresponding target webpage.

[0088] In an exemplary embodiment of the present application, the second preset rule includes:

[0089] The ratio of the file size information to the target file size information is greater than a second set threshold. Specifically, the second set threshold can be any value between 2 and 10. In this embodiment, the second set threshold is 4.

[0090] and / or,

[0091] The file size information is smaller than the target file size information, and the difference between the file size information and the target file size information is greater than a third set threshold. Specifically, the third set threshold can be any value between 10Mb and 50Mb. In this embodiment, the third set threshold is 20Mb.

[0092] In this embodiment, the requirement that the difference between each file size information and the target file size information meet the second preset rule is because some download sites may incorrectly or not update the file size of the downloadable files they provide within their webpages. Therefore, if there are multiple target webpages, designating the target file set as an abnormal file set when only one file size information differs from the target file size information according to the second preset rule would significantly reduce the accuracy of the detection results. Therefore, in this embodiment, the target file set is designated as an abnormal file set only when the difference between each file size information and the target file size information meets the second preset rule.

[0093] Please refer to Figure 2 As shown, in another aspect of the present application, a file detection device is provided, comprising:

[0094] The first acquisition module is used to acquire a target file set; the target file set includes target files and website access shortcuts.

[0095] The first determining module is configured to perform a web search based on the URL information corresponding to the URL access shortcut and the target file name, and determine a plurality of target web pages, wherein the target file name is the file name of the target file; each of the target web pages can provide a download link for a downloadable file whose file name includes the target file name.

[0096] The second acquisition module is used to acquire the file size information of the downloadable file corresponding to each target web page to obtain a plurality of file size information.

[0097] The second determining module is configured to determine the set of files to be detected as an abnormal file set if the difference between each of the file size information and the target file size information meets a second preset rule. The target file size information is the file size information of the target file.

[0098] Furthermore, although the steps of the method of the present disclosure are described in a particular order in the accompanying drawings, this does not require or imply that the steps must be performed in this particular order, or that all steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0099] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0100] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0101] Those skilled in the art will appreciate that various aspects of the present application can be implemented as systems, methods, or program products. Therefore, various aspects of the present application can be specifically implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0102] The electronic device according to this embodiment of the present application is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0103] The electronic device is implemented as a general-purpose computing device. Components of the electronic device may include, but are not limited to, the at least one processor, the at least one memory, and a bus connecting different system components (including the memory and the processor).

[0104] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0105] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0106] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0107] The bus may represent one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0108] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figures, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0109] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0110] In exemplary embodiments of the present disclosure, a computer-readable storage medium is also provided, on which is stored a program product capable of implementing the aforementioned methods of this specification. In some possible implementations, various aspects of this application may also be implemented in the form of a program product comprising program code. When the program product is executed on a terminal device, the program code is used to cause the terminal device to execute the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present application.

[0111] The program product may be implemented in any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0112] A computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0113] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0114] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and conventional procedural programming languages such as "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0115] Furthermore, the above-mentioned figures are merely illustrative of the processes included in the methods according to exemplary embodiments of the present application and are not intended to be limiting. It is readily understood that the processes illustrated in the above-mentioned figures do not indicate or limit the temporal order of these processes. Furthermore, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0116] It should be noted that although several modules or units of the device for action execution are mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0117] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A file detection method, characterized in that: include: Obtaining a target file set; the target file set includes target files and website access shortcuts; Performing a web search based on the URL information and target file name corresponding to the URL access shortcut to determine a plurality of target web pages; each of the target web pages can provide a download link for a downloadable file containing the target file name; Obtaining file size information of a downloadable file corresponding to each target web page to obtain a plurality of file size information; If the difference between each of the file size information and the target file size information meets the second preset rule, the target file set is determined as an abnormal file set; The obtaining of the target file set includes: Get the set of files to be tested; If the to-be-detected file set contains both a target file and a website access shortcut, determining whether the file name of the website access shortcut complies with a first preset rule; If they are consistent, the file set to be detected is determined as the target file set; The determining whether the file name of the website access shortcut meets a first preset rule includes: Determining whether the file name of the website access shortcut contains a first type of setting character string; If included, it complies with the first preset rule; Before determining whether the file name of the website access shortcut complies with the first preset rule if the target file and the website access shortcut are both included in the file set to be detected, the method further includes: Determining whether the file set size information of the to-be-detected file set is less than a first set threshold; If so, it is determined whether the to-be-detected file set contains both the target file and the website access shortcut.

2. The file detection method according to claim 1, wherein: Performing a web search based on the URL information and target file name corresponding to the URL access shortcut to determine a number of target web pages, including: Inputting the URL information and the target file name into a web search engine to obtain a number of candidate web pages; According to the ranking of the candidate web pages, a set number of target web pages are determined from the candidate web pages.

3. The file detection method according to claim 2, characterized in that: The step of inputting the URL information and the target file name into a web search engine includes: Adding a setting instruction character before the website information to obtain the target website information; The target website information and the target file name are input into a web search engine as search keywords.

4. The file detection method according to claim 1, wherein: The file size information of the downloadable file corresponding to each target webpage is obtained to obtain a plurality of file size information, including: Extracting text information from each target web page; Perform string recognition on each text message; If a second type of character string is identified, the character string following the identified second type of character string is determined as the file size information.

5. The file detection method according to claim 1, wherein: The second preset rule includes: The ratio of the file size information to the target file size information is greater than a second set threshold; and / or, The file size information is smaller than the target file size information, and a difference between the file size information and the target file size information is greater than a third set threshold.

6. A file detection device, characterized in that: include: A first acquisition module is used to acquire a target file set; the target file set includes target files and website access shortcuts; A first determining module is configured to perform a web search based on the URL information corresponding to the URL access shortcut and the target file name, and determine a plurality of target web pages; each of the target web pages can provide a download link for a downloadable file whose file name contains the target file name; A second acquisition module is used to acquire file size information of a downloadable file corresponding to each target web page to obtain a plurality of file size information; a second determining module, configured to determine the target file set as an abnormal file set if the difference between each of the file size information and the target file size information meets a second preset rule; The obtaining of the target file set includes: Get the set of files to be tested; If the to-be-detected file set contains both a target file and a website access shortcut, determining whether the file name of the website access shortcut complies with a first preset rule; If they are consistent, the file set to be detected is determined as the target file set; The determining whether the file name of the website access shortcut meets a first preset rule includes: Determining whether the file name of the website access shortcut contains a first type of setting character string; If included, it complies with the first preset rule; If the to-be-detected file set contains both a target file and a URL access shortcut, before determining whether the file name of the URL access shortcut complies with a first preset rule, the first acquisition module is further configured to: Determining whether the file set size information of the to-be-detected file set is less than a first set threshold; If so, it is determined whether the to-be-detected file set contains both the target file and the website access shortcut.

7. An electronic device, characterized in that: including processor and memory; The processor is configured to execute the steps of the method according to any one of claims 1 to 5 by calling the program or instructions stored in the memory.

8. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute the steps of the method according to any one of claims 1 to 5.

Images