False alarm prevention automated feature extraction method and device, electronic equipment and storage medium

Abstract

The false alarm prevention automatic feature extraction method and device, electronic equipment and storage medium disclosed by the embodiment of the application relate to the field of anti-malicious code, can avoid false alarm as a white file, and improve the accuracy of automatic feature extraction. The method comprises the following steps: obtaining actual file tail information of a to-be-extracted automatic feature sample file and target file tail information obtained by a to-be-extracted automatic feature sample structure for a to-be-extracted automatic feature sample determined as a malicious sample by a malicious determination standard library; determining whether the actual file tail information is consistent with the target file tail information; if not, further determining a region where a malicious code is located in the to-be-extracted feature sample according to the target file tail information; and if the region where the malicious code is located is between a head of the to-be-extracted automatic feature sample and the target file tail, extracting features of the to-be-extracted feature sample. The application is suitable for sample detection carrying a malicious code.

Description

Technical Field

[0001] This invention relates to the field of anti-malware, and more particularly to an automated feature extraction method, apparatus, electronic device, and storage medium for preventing false positives. Background Technology

[0002] To improve detection efficiency, antivirus engines develop judgment criteria based on external detection strategies. Samples that meet the criteria are identified as black samples. Features are extracted based on the file structure of the sample to detect the sample and its similar samples.

[0003] Hackers (attackers) often place malicious code 'b' at the end of a normal file 'a' to evade detection. Current automated detection strategies for this type of malicious sample typically use feature matching. They usually perform automated feature extraction on samples (a+b) that have a normal header but malicious code at the end. Because the malicious code 'b' at the end does not affect the file structure of the normal file 'a' at the beginning, the extracted features (features of a+b) will be identical to the features of the normal file at the beginning (features of a), leading to false positives and affecting detection accuracy. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an automated feature extraction method, apparatus, electronic device, and storage medium for preventing false alarms, which facilitates the detection of the region where malicious code carried by such samples is located, avoids false alarms of being a white file, and thus improves the accuracy of automated feature extraction for preventing false alarms.

[0005] In a first aspect, embodiments of the present invention provide an automated feature extraction method for preventing false alarms, comprising the steps of: for an automated feature sample to be extracted that is determined to be a malicious sample by a malicious determination standard library, obtaining the actual file tail information of the automated feature sample file to be extracted, and the target file tail information obtained from the structure of the automated feature sample to be extracted; determining whether the actual file tail information and the target file tail information are consistent; if they are inconsistent, further determining the region where the malicious code is located in the feature sample to be extracted based on the target file tail information; if the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file, then performing feature extraction operation on the feature sample to be extracted.

[0006] Optionally, further determining the region where the malicious code is located in the feature sample to be extracted based on the tail information of the target file includes: generating a target file to be tested by concatenating the header of the automated feature sample to be extracted with the tail information of the target file; determining whether the target file to be tested is a malicious file according to the malicious determination standard library; if so, determining that the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0007] Optionally, further determining the region where the malicious code is located in the feature sample to be extracted based on the tail information of the target file includes: concatenating the binary data between the tail of the target file of the automated feature sample to be extracted and the tail of the actual file to the tail of a known white file to generate a target file to be tested based on the tail information of the target file of the automated feature sample to be extracted; determining whether the target file to be tested is a malicious file according to the malicious determination standard library; if not, determining that the region where the malicious code is located is between the head of the automated feature sample to be extracted and the tail of the target file.

[0008] Optionally, after determining the region where the malicious code is located in the feature sample to be extracted, the method further includes: determining whether to perform an automated feature extraction operation based on the region where the malicious code is located in the feature sample to be extracted.

[0009] Optionally, the inconsistency includes the case where the actual file end information is greater than the target file end information.

[0010] Secondly, embodiments of the present invention also provide an automated feature extraction device for preventing false alarms, comprising: an acquisition program unit, configured to acquire, for example, actual file tail information of the file to be extracted and target file tail information obtained from the structure of the automated feature sample to be extracted, for an automated feature sample to be extracted that is determined to be a malicious sample by a malicious determination standard library; a judgment program unit, configured to determine whether the actual file tail information and the target file tail information are consistent; a determination program unit, configured to further determine the region where the malicious code is located in the feature sample to be extracted based on the target file tail information if they are inconsistent; and an extraction program unit, configured to perform feature extraction operation on the feature sample to be extracted if the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0011] Optionally, the determining program unit includes: a splicing program module, used to splice the header information of the automated feature sample file to be extracted and the tail information of the target file to generate a target file to be tested; a judging program module, used to judge whether the target file to be tested is a malicious file according to the malicious judgment standard library; and a determining program module, used to determine that if it is, the area where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0012] Optionally, the extraction program unit is further configured to, after determining the region in which the malicious code is located in the feature sample to be extracted, determine whether to perform an automated feature extraction operation based on the region in which the malicious code is located in the feature sample to be extracted.

[0013] Thirdly, embodiments of the present invention also provide an electronic device, the electronic device comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the automated feature extraction method for preventing false alarms as described in any of the first aspects above.

[0014] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing one or more programs that can be executed by one or more processors to implement the automated feature extraction method for preventing false alarms as described in any of the first aspects.

[0015] This invention provides an automated feature extraction method, apparatus, electronic device, and storage medium to prevent false positives. The method involves the following steps: for a sample identified as malicious by a malicious detection standard library, the actual file tail information of the sample file and the target file tail information obtained from the sample structure are acquired; it is determined whether the actual file tail information and the target file tail information are consistent; if they are inconsistent, the malicious code is further determined based on the target file tail information; if the malicious code is located between the header of the sample and the tail of the target file, feature extraction is performed on the sample. This facilitates the detection of the malicious code region in samples carrying malicious code, avoiding false positives of innocent files and improving the accuracy of automated feature extraction to prevent false positives. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of an automated feature extraction method for preventing false alarms provided in an embodiment of the present invention;

[0018] Figure 2 A detailed flowchart of an automated feature extraction method for preventing false alarms provided in an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of an automated feature extraction device for preventing false alarms provided in an embodiment of the present invention;

[0020] Figure 4 A schematic diagram of an electronic device provided as an embodiment of the present invention. Detailed Implementation

[0021] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0022] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0023] Hackers typically place malicious code at the end of normal files, using samples with appended data to evade detection. This appended data consists of a piece of binary code appended to the end of the corresponding file structure.

[0024] To address the aforementioned issues and prevent false positives for white files, thereby improving the efficiency of automated feature detection, this invention provides an automated feature extraction method for preventing false positives. This method constructs a malicious detection standard library based on collected and summarized external detection strategies. These external detection strategies are those independent of the current detection engine, such as competitor detection results, collected malicious intelligence, or detection solutions provided by open-source detection systems. Samples meeting the judgment criteria are identified as malicious samples. The sample file is then reassembled based on its information and further detected according to the judgment criteria, avoiding false positives for white files. This achieves the detection of malicious code within the sample. Furthermore, it determines whether to perform automated feature extraction, thus improving the accuracy of automated feature extraction.

[0025] Example 1

[0026] Figure 1 This is a flowchart illustrating an embodiment of the automated feature extraction method for preventing false alarms according to the present invention. Please refer to it. Figure 1 As shown, the automated feature extraction method for preventing false alarms may include the following steps:

[0027] S110. For automated feature samples to be extracted that are identified as malicious samples by the malicious judgment standard library, obtain the actual file tail information of the automated feature sample file to be extracted, as well as the target file tail information obtained from the structure of the automated feature sample to be extracted.

[0028] Specifically, in step S110, for the automated feature sample A to be extracted, which is determined to be a malicious sample by the malicious judgment standard library, the actual file tail information of the automated feature sample file A to be extracted is first obtained. By parsing the structural information of the automated feature sample A to be extracted, the structural file tail of the automated feature sample A to be extracted is obtained according to the structural information of the automated feature sample A to be extracted, that is, the file tail information of the target file a. Among them, the file tail information is used to characterize the size of the file.

[0029] S120. Determine whether the actual file end information is consistent with the target file end information.

[0030] Specifically, the actual file end information is compared with the target file end information to determine whether the actual file end information of the automated feature sample to be extracted is consistent with the target file end information, thereby further determining the region where the malicious code is located in the feature sample to be extracted.

[0031] For example: Consider a sample A containing a target file (a PE file) to be used for automated feature extraction. The sample's file type is generally the same as the target file. A PE file typically consists of a DOS header, an NT header, a section table, and specific sections, starting from the beginning. Based on the PE file's structure information, such as the end of the last section, the end of the target file's structure file is located, and the target file's end information (for clarity, referred to as the target file end) is obtained. Alternatively, the end information can be determined by querying the structure information table corresponding to the target file, for example, 0x1000. Assuming the sample is a PE file, the actual end information of the PE sample file is 0x2000, while the target file's end information is 0x1000. This discrepancy indicates that the sample contains additional data, further determining the location of the malicious code.

[0032] It should be understood that conventional methods directly match based on the structural features of sample files. Since the sample file and its target file share some structural features, misjudgments can occur, preventing the detection of malicious code. However, in this application, by determining whether the actual file tail information of the automated feature sample to be extracted matches the tail information of the target file, it can be determined that the sample file to be extracted has additional data. Further execution of step S130 then coordinates these steps to prevent malicious code from evading detection.

[0033] S130. If there is a discrepancy, the region where the malicious code is located in the feature sample to be extracted is further determined based on the tail information of the target file.

[0034] Specifically, when the actual file tail information of the sample file to be extracted for automated feature extraction is inconsistent with the target file tail information, such as when the actual file tail information is greater than the target file tail information, further determining the region where malicious code is located in the sample file to be extracted for automated feature extraction based on the target file tail information can prevent malicious samples from evading detection, thereby improving the detection rate and accuracy of malicious code.

[0035] S140. If the area where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file, then the feature extraction operation is performed on the feature sample to be extracted.

[0036] Specifically, after further determining the region where the malicious code is located in the feature sample to be extracted, if the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file, then the features of the feature sample to be extracted are extracted.

[0037] This invention detects malicious viruses in the automated feature samples to be extracted, further assembles the target file to be tested based on the information of the automated feature samples to be extracted, obtains the location of the malicious virus according to the engine automated judgment standard in the malicious judgment standard library, and then extracts automated detection features from the automated feature samples to be extracted. After extraction, the automated detection features can be stored for rapid detection of subsequent identical or similar sample files.

[0038] Please refer to Figure 2 As shown, in some embodiments, in step S130, further determining the region where the malicious code is located in the feature sample to be extracted based on the tail information of the target file includes: generating a target file to be tested by concatenating the header of the automated feature sample to be extracted with the tail information of the target file; determining whether the target file to be tested is a malicious file according to the malicious determination standard library; if so, determining that the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0039] The malicious identification criteria library can consist of one or several, dozens, or even hundreds of malicious sample identification criteria.

[0040] Specifically, when it is determined that the actual file tail information of the automated feature sample file to be extracted is inconsistent with the target file tail information, that is, when the actual file tail information of the automated feature sample file to be extracted is greater than the target file tail information, the header of the automated feature sample file to be extracted and the tail information of the target file can be concatenated to generate the target file to be tested. It can be understood that the header of the automated feature sample file to be extracted is the same as the header of the target file. The two are identical. That is, the target file to be tested in this embodiment is the target file. According to the malicious determination standard library, it is determined whether the target file to be tested is a malicious file. When the target file to be tested is a malicious file, it is determined that there is malicious code in the automated feature sample to be extracted, and the malicious code exists in the target file. That is, it means that the area where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0041] In this embodiment, the target file is essentially the same as the target file to be tested.

[0042] When malicious code is determined to be located between the beginning and end of the file of the automated feature sample A to be extracted, for example, the automated features are extracted from 0x0 to 0x1000 of the automated feature sample A.

[0043] If it does not meet the automated judgment criteria in the malicious judgment standard library, it means that the malicious code is in the binary code from the end of the structure file to the end of the actual file of the automated feature sample A to be extracted. For example, it is in 0x1000-0x2000 of the automated feature sample A to be extracted, that is, the automated feature is not extracted from the automated feature sample A.

[0044] Therefore, specifically, after determining the region where the malicious code is located in the feature sample to be extracted, the method further includes: determining whether to perform an automated feature extraction operation based on the region where the malicious code is located in the feature sample to be extracted.

[0045] Thus, after determining the region where the malicious code is located in the feature sample to be extracted, it is determined whether to perform an automated feature extraction operation based on the region where the malicious code is located in the feature sample to be extracted.

[0046] The extracted automated features are used as automated detection features, which are structure-based and used to achieve automated detection of samples with the same or similar structures.

[0047] For example, taking the 4KB hash of the header of the section containing the entry point of a PE sample as an example, the automated detection feature is to extract the 4KB hash of the header of the section containing the entry point of the sample to be tested and use it as the automated detection feature, because the entry point is the location where the PE sample performs the action. If other PE samples have the same action at their entry points, then it can be concluded that other PE samples are the same as or similar to the current sample, and are therefore malicious samples, thus enabling detection.

[0048] Please continue reading. Figure 2 In some other embodiments, step S130, further determining the region where the malicious code is located in the feature sample to be extracted based on the target file tail information, includes: based on the target file tail information of the automated feature sample to be extracted, concatenating the binary data between the target file tail and the actual file tail of the automated feature sample to be extracted to the tail of a known white file to generate a target file to be tested; determining whether the target file to be tested is a malicious file according to the malicious determination standard library; if not, determining that the region where the malicious code is located is between the head of the automated feature sample to be extracted and the tail of the target file.

[0049] For example, step S130 includes: Step 1: Concatenate a known white file, such as a white PE file, with a size of 0x0-0x100, and the binary code from the end of the structure file to the end of the actual file of the automated feature sample A to be extracted, for example: the end of the structure file to the end of the actual file of the automated feature sample A to be extracted is 0x1000-0x2000, to generate a test file C, for example: the known white PE file 0x0-0x100 and the automated feature sample A to be extracted 0x1000-0x2000, with a total size of 0x1100;

[0050] Step 2: Rescan the file C to be tested according to the malicious detection standard library for automated detection;

[0051] Step 3: Determine whether the file C to be tested meets the engine's automated judgment criteria in the malicious detection criteria library;

[0052] Step 4: If it matches, it means that the malicious code is in the binary code from the end of the structure file to the end of the actual file of the automated feature sample A to be extracted, for example, in 0x1000-0x2000 of the automated feature sample A to be extracted, that is, the automated detection features are not extracted from the automated feature sample A.

[0053] If it does not match, it means that the malicious code is located between the beginning and end of the file of the automated feature sample A to be extracted, for example, between 0x0 and 0x1000 of the automated feature sample A to be extracted, which means that the automated detection features of the automated feature sample A to be extracted are being extracted.

[0054] In this embodiment, when it is determined that the actual file tail information of the automated feature sample file to be extracted is inconsistent with the target file tail information, for example, when the actual file tail information of the automated feature sample file to be extracted is greater than the target file tail information, the binary data between the target file tail information and the actual file tail information of the automated feature sample file to be extracted is concatenated with a known white file to generate the target file to be tested. According to the malicious determination standard library, it is determined whether the target file to be tested is a malicious file. If the target file to be tested is not a malicious file, the area where the malicious code is located is determined to be between the header of the automated feature sample to be extracted and the tail of the target file.

[0055] In this embodiment, after determining the region where the malicious code is located in the feature sample to be extracted, the method further includes: determining whether to perform an automated feature extraction operation based on the region where the malicious code is located in the feature sample to be extracted.

[0056] Specifically, after determining the region where the malicious code is located in the feature sample to be extracted, it is determined whether to perform automated feature extraction based on the region where the malicious code is located in the feature sample to be extracted; when it is determined that the region where the malicious code is located is between the head of the automated feature sample to be extracted and the tail of the target file, automated feature extraction is performed on the automated feature sample to be extracted; furthermore, the extracted automated features are used as automated detection features to achieve automated detection of samples with the same or similar structures.

[0057] To help understand the technical solutions and their effects provided by the embodiments of the present invention, a specific embodiment is now described in conjunction with... Figure 2 The illustrated method and process are explained in detail below:

[0058] For ease of explanation, this example uses a PE file. The target file for extracting automated feature samples ends at 0x1000; the actual file ends at 0x2000; and the file header is 0x0.

[0059] First, for the automated feature sample A that meets the engine's automated judgment criteria, the target file tail of the sample A is obtained based on its file structure information (e.g., the end of the last section). If the actual file tail of the sample A is greater than the target file tail (actual file tail 0x2000 > structure file tail 0x1000), then the following scheme is used to detect malicious code and avoid false positives.

[0060] Option 1:

[0061] Step 1: Summarize the header of the file to be extracted from the automated feature sample A (e.g., header 0x0) to the tail of the target file to be extracted from the automated feature sample A (e.g., tail 0x1000), and generate the test file B (e.g., the tail of the automated feature sample A to be extracted from 0x0 to 0x1000).

[0062] Step 2: Rescan the file to be tested, B;

[0063] Step 3: Determine whether the file to be tested, B, meets the engine's automated judgment criteria;

[0064] If the conditions are met, it means that the malicious code is located between the beginning and end of the file of the automated feature sample A to be extracted, that is, in the target file, for example, in 0x0-0x1000 of the automated feature sample A to be extracted. In other words, the malicious code can be extracted from 0x0-0x1000 of the automated feature sample A to be extracted. In this way, not only can the presence of malicious code in the automated feature sample A to be extracted be effectively detected, but the location of the malicious code can also be determined.

[0065] If it does not meet the requirements, it means that the malicious code is in the binary code from the end of the target file to the end of the actual file of the automated feature sample A to be extracted, that is, 0x1000-0x2000 of the automated feature sample A to be extracted, which means that the automated features of the automated feature sample A will not be extracted.

[0066] Option 2:

[0067] Step 1: Concatenate the known blank file, such as a blank PE file with a size of 0x0-0x100, and the binary code from the end of the target file to the end of the actual file of the automated feature sample A to be extracted, for example: the end of the target file to the end of the actual file of the automated feature sample A to be extracted is 0x1000-0x2000, to generate the test file C, for example: the known blank PE file with a size of 0x0-0x100 and the automated feature sample A to be extracted with a size of 0x1100.

[0068] Step 2: Rescan the file C to be tested according to the malicious detection standard library for automated detection;

[0069] Step 3: Determine whether the file C to be tested meets the engine's automated judgment criteria in the malicious detection criteria library;

[0070] Step 4: If it matches, it means that the malicious code is in the binary code from the end of the target file to the end of the actual file of the automated feature sample A to be extracted, for example, in 0x1000-0x2000 of the automated feature sample A to be extracted, that is, the automated detection features are not extracted from the automated feature sample A.

[0071] If it does not match, it means that the malicious code is located from the beginning of the file to the end of the target file of the automated feature sample A to be extracted, for example, in the range 0x0-0x1000 of the automated feature sample A to be extracted. In other words, the malicious code is extracted from the range 0x0-0x1000 of the automated feature sample A to be extracted. In this way, not only can the presence of malicious code in the automated feature sample A to be extracted be effectively detected, but the location of the malicious code can also be determined.

[0072] As can be seen from the above disclosure, the automated feature extraction method for preventing false alarms provided in this embodiment of the invention reassembles a new test file based on the file information of the automated feature sample to be extracted, which is identified as a black sample and meets the judgment criteria. Then, it performs further detection according to the detection judgment criteria to determine the location of malicious code, thereby avoiding the situation of false alarms as white files and improving the accuracy of automated feature extraction for preventing false alarms.

[0073] Furthermore, after detecting the location of malicious code in the sample file containing the automated feature to be extracted, automated detection features can be extracted from the sample file to achieve rapid detection of the sample and similar malicious samples.

[0074] Example 2

[0075] like Figure 3 As shown, embodiments of the present invention also provide an automated feature extraction device 200 for preventing false alarms, comprising:

[0076] The acquisition program unit 210 is used to acquire the actual file tail information of the automated feature sample file to be extracted and the target file tail information obtained from the structure of the automated feature sample to be extracted, for the automated feature sample to be extracted that is determined to be a malicious sample by the malicious judgment standard library.

[0077] The judgment program unit 220 is used to determine whether the actual file end information is consistent with the target file end information;

[0078] The program unit 230 is used to further determine the region where the malicious code is located in the feature sample to be extracted based on the tail information of the target file if there is a discrepancy.

[0079] Extraction program unit 240 is used to perform feature extraction operation on the feature sample to be extracted if the area where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0080] The determining procedure unit 230 includes:

[0081] The splicing module is used to splice the header information of the automated feature sample file to be extracted with the tail information of the target file to generate the target file to be tested.

[0082] The judgment module is used to determine whether the target file to be tested is a malicious file based on the maliciousness judgment standard library;

[0083] The program module is used to determine, if yes, the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

[0084] The extraction program unit 240 is further configured to, after determining the region in which the malicious code is located in the feature sample to be extracted, determine whether to perform an automated feature extraction operation based on the region in which the malicious code is located in the feature sample to be extracted.

[0085] The apparatus in this embodiment can be used to execute the technical solution of the method embodiment shown in Embodiment 1. Its implementation principle and technical effect are similar, and will not be repeated here.

[0086] Example 3

[0087] Figure 4 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. Based on the method provided in Embodiment 1 and the device provided in Embodiment 2, the present invention also provides an electronic device, such as... Figure 4 As shown, the steps and flow of any of the embodiments described in Embodiment 1 of the present invention can be implemented.

[0088] The aforementioned electronic device may include: a housing 41, a processor 42, a memory 43, a circuit board 44, and a power supply circuit 45, wherein the circuit board 44 is disposed inside the space enclosed by the housing 41, and the processor 42 and the memory 43 are disposed on the circuit board 44; the power supply circuit 45 is used to supply power to the various circuits or devices of the aforementioned electronic device; the memory 43 is used to store executable program code; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, for executing the automated feature extraction method for preventing false alarms as described in any of the foregoing embodiments.

[0089] The specific execution process of the above steps by the processor 42, as well as the steps further executed by the processor 42 by running executable program code, can be found in the description of the foregoing embodiments, and will not be repeated here.

[0090] This electronic device exists in various forms, including but not limited to:

[0091] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0092] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0093] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0094] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0095] (5) Other electronic devices with data interaction functions.

[0096] Example 4

[0097] Embodiments of the present invention also provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement any of the automated feature extraction methods for preventing false alarms provided in the foregoing embodiments, and thus can also achieve the corresponding technical effects. This has been described in detail above and will not be repeated here.

[0098] In summary, the automated feature extraction method, apparatus, electronic device, and storage medium for preventing false alarms provided by the embodiments of the present invention can, for sample files containing malicious code, first determine whether they are sample files to be extracted for automated feature extraction. If so, further assemble the target file to be tested based on the information of the sample file to be extracted for automated feature extraction, determine the target file to be tested according to the engine automated judgment standard in the malicious judgment standard library, determine the location of the malicious virus, avoid the situation of false alarms as innocent files, and thus improve the accuracy of automated feature extraction for preventing false alarms.

[0099] Furthermore, by reassembling and reconstructing the sample file to be extracted into a new target file, and then re-scanning and detecting the target file based on the malicious detection standard library, it is possible to accurately determine whether there is malicious code in the sample file to be extracted and to locate the location of the malicious code in the sample file.

[0100] Furthermore, an automated detection feature library can be built based on the extracted automated detection features, which can be used to update the malicious judgment standard library, making it easier to quickly detect the same or similar malicious samples in the future.

[0101] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0102] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0103] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0104] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0105] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0106] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An automated feature extraction method for preventing false alarms, characterized in that, Including the following steps: For automated feature samples to be extracted that are identified as malicious samples by the malicious identification standard library, the actual file tail information of the automated feature sample file to be extracted and the target file tail information obtained from the structural information of the automated feature sample to be extracted are obtained; wherein, the file tail information is used to characterize the size of the file; Determine whether the actual file end information matches the target file end information; If there is a discrepancy, the region where the malicious code is located in the feature sample to be extracted will be further determined based on the information at the end of the target file. If the malicious code is located between the header of the automated feature sample to be extracted and the tail of the target file, then the feature extraction operation is performed on the feature sample to be extracted.

2. The automated feature extraction method for preventing false alarms according to claim 1, characterized in that, The step of further determining the region where the malicious code is located in the feature sample to be extracted based on the tail information of the target file includes: The target file to be tested is generated by concatenating the header information of the automated feature sample to be extracted with the tail information of the target file. Based on the malicious detection standard library, determine whether the target file to be tested is a malicious file; If so, the region where the malicious code is located is determined to be between the header of the automated feature sample to be extracted and the tail of the target file.

3. The automated feature extraction method for preventing false alarms according to claim 1, characterized in that, The step of further determining the region where the malicious code is located in the feature sample to be extracted based on the tail information of the target file includes: Based on the tail information of the target file of the automated feature sample to be extracted, the binary data between the tail of the target file of the automated feature sample to be extracted and the tail of the actual file is concatenated to the tail of the known white file to generate the target file to be tested; Based on the malicious detection standard library, determine whether the target file to be tested is a malicious file; If not, then the malicious code is located between the header of the automated feature sample to be extracted and the tail of the target file.

4. The automated feature extraction method for preventing false alarms according to any one of claims 1 to 3, characterized in that, After determining the region where the malicious code is located in the feature sample to be extracted, the method further includes: Based on the region where the malicious code is located in the feature sample to be extracted, determine whether to perform automated feature extraction.

5. The automated feature extraction method for preventing false alarms according to claim 1, characterized in that, The inconsistency includes situations where the actual file's end information is greater than the target file's end information.

6. An automated feature extraction device for preventing false alarms, characterized in that, include: The acquisition program unit is used to acquire the actual file tail information of the automated feature sample file to be extracted, as well as the target file tail information obtained from the structural information of the automated feature sample to be extracted, for the automated feature sample to be extracted that is determined to be a malicious sample by the malicious judgment standard library; wherein, the file tail information is used to characterize the size of the file; The judgment program unit is used to determine whether the actual file end information is consistent with the target file end information; A program unit is identified, which, if inconsistent, further determines the region in the feature sample to be extracted where the malicious code is located based on the tail information of the target file; An extraction program unit is used to perform feature extraction operations on the sample to be extracted if the area where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

7. The automated feature extraction device for preventing false alarms according to claim 6, characterized in that, The determining procedure unit includes: The splicing module is used to splice the header information of the automated feature sample file to be extracted with the tail information of the target file to generate the target file to be tested. The judgment module is used to determine whether the target file to be tested is a malicious file based on the maliciousness judgment standard library; The program module is used to determine, if yes, the region where the malicious code is located is between the header of the automated feature sample to be extracted and the tail of the target file.

8. The automated feature extraction device for preventing false alarms according to claim 6, characterized in that, The extraction program unit is further configured to, after determining the region in which the malicious code is located in the feature sample to be extracted, determine whether to perform an automated feature extraction operation based on the region in which the malicious code is located in the feature sample to be extracted.

9. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the automated feature extraction method for preventing false alarms as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the automated feature extraction method for preventing false alarms as described in any one of claims 1 to 5.

Images