A Classification Method, Device, Medium and Equipment for General Malicious Samples

Abstract

The present invention relates to the field of network security, and particularly to a classification method, device, medium and equipment for general malicious samples. The method includes: obtaining a target malicious sample. Generating a malicious label corresponding to each target malicious sample according to the suspicious features possessed by each target malicious sample. Dividing the threat categories of the target malicious samples according to the malicious labels. The present invention can perform priority sorting according to the threat categories corresponding to each target malicious sample, so as to perform more priority analysis and processing on the target malicious samples with higher threat intensity, while selectively abandoning the processing or delaying the analysis and processing of the target malicious samples with lower threat intensity. Thus, security analysts can carry out analysis work more targeted. Thereby, the recognition speed of intelligence by security analysts can be improved, and the analysis and response speed for general malicious code can be increased.

Description

Background Art

[0002] Most traditional static threat intelligence analysis systems rely on feature vector scanning to match with existing virus databases to determine the classification and virus name of malicious samples. Or, based on machine learning model training, malicious samples are matched according to the learned logic to determine the virus family, threat classification, and virus name of malicious samples. However, there are cases where malicious samples cannot match corresponding behaviors in the virus database, and there are also cases where the suspicious behaviors of some malicious samples cannot be matched according to the learned logic. Therefore, the existing threat analysis methods only give general classifications and virus names such as general type and heuristic. Since this general classification and virus name have no practical threat evaluation guiding significance, security analysts need to re-analyze all such malicious samples to ensure security.

[0003] However, with the increasing number of malicious samples, the processing method of this static threat intelligence analysis system often generates a large number of general malicious samples. In this case, it will seriously affect the analysis and response speed of security analysts to intelligence. Summary of the Invention

[0004] For the above technical problems, the technical solution adopted by the present invention is as follows:

[0005] According to one aspect of the present invention, there is provided a classification method for general malicious samples, the method comprising the following steps:

[0006] Obtain a target malicious sample.

[0007] According to the suspicious features of each target malicious sample, generate a malicious label corresponding to each target malicious sample. The malicious label is used to represent the threat intensity of the target malicious sample.

[0008] According to the malicious label, divide the threat category of the target malicious sample.

[0009] In the present invention, further, obtaining a target malicious sample includes:

[0010] Obtain a plurality of samples to be tested.

[0011] Perform static threat intelligence analysis processing on the plurality of samples to be tested to generate at least one target malicious sample. The static threat intelligence analysis processing is used to determine the threat level and virus name of the samples to be tested. The target malicious sample is a sample to be tested without a clear threat level and virus name.

[0012] In the present invention, further, each target malicious sample has at least one suspicious feature.

[0013] Generate a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample, including:

[0014] Obtain a feature-label mapping table. The feature-label mapping table is used to record the correspondence between suspicious features and malicious labels. The suspicious level represented by the suspicious feature is positively correlated with the threat intensity represented by the malicious label.

[0015] Determine the malicious label corresponding to each target malicious sample according to the feature-label mapping table and the suspicious features of each target malicious sample. Each suspicious feature corresponds to a malicious label.

[0016] In the present invention, further, the feature-label mapping table satisfies the following conditions:

[0017] If the suspicious feature is a mutex feature or a special string feature, the malicious label is a low-level malicious label.

[0018] If the suspicious feature is a registry modification feature or a file modification feature, the malicious label is a medium-level malicious label.

[0019] If the suspicious feature is a new file path derivation feature or a new file name derivation feature or a new URL access feature, the malicious label is a high-level malicious label.

[0020] In the present invention, further, the threat categories corresponding to the high-level malicious label, the medium-level malicious label, and the low-level malicious label decrease in sequence.

[0021] In the present invention, further, the method further includes:

[0022] Determine the processing priority for the target malicious sample according to the threat category corresponding to the malicious label of the target malicious sample.

[0023] In the present invention, further, determining the processing priority for the target malicious sample according to the threat category corresponding to the malicious label of the target malicious sample includes:

[0024] If the target malicious sample only has a low-level malicious label, the processing priority of the target malicious sample is the lowest.

[0025] According to the second aspect of the present invention, there is provided a classification device for general malicious samples, and the device includes:

[0026] An acquisition module, configured to acquire a target malicious sample.

[0027] A label generation module, configured to generate a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample. The malicious label is used to represent the threat intensity of the target malicious sample.

[0028] A category division module, configured to perform threat category division on a target malicious sample according to a malicious label.

[0029] According to a third aspect of the present invention, there is provided a non-transitory computer-readable storage medium storing a computer program which, when executed by a processor, implements the above-mentioned classification method for a general-purpose malicious sample.

[0030] According to a fourth aspect of the present invention, there is provided an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned classification method for a general-purpose malicious sample when executing the computer program.

[0031] The present invention has at least the following beneficial effects:

[0032] According to the suspicious features of each target malicious sample, the present invention performs threat category division on each target malicious sample again. Thus, the threat intensity corresponding to each target malicious sample can be determined. Thus, when facing a large number of target malicious samples with general classifications and virus names, security analysts can perform priority sorting according to the threat category corresponding to each target malicious sample, so as to analyze and process the target malicious samples with higher threat intensity more preferentially, and selectively abandon or delay the analysis and processing of the target malicious samples with lower threat intensity. Thus, it enables security analysts to carry out analysis work more pertinently. Thus, it can improve the recognition speed of security analysts for intelligence and the analysis response speed for general-purpose malicious code. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings without creative efforts based on these drawings.

[0034] Figure 1 It is a flowchart of a classification method for a general-purpose malicious sample provided by an embodiment of the present invention.

[0035] Figure 2 It is a structural block diagram of a classification device for a general-purpose malicious sample provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0036] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present invention.

[0037] According to one aspect of the present invention, as Figure 1 shown, a classification method for general malicious samples is provided, and the method includes the following steps:

[0038] S100: Obtain a target malicious sample.

[0039] Specifically, the target malicious sample can be an existing malicious code, and this malicious code can be a malicious code that cannot be matched to an exact specific classification and virus name in the virus library or according to the learned logic using traditional static threat intelligence analysis methods. The target malicious sample only has a general, heuristic classification and virus name. This general classification and virus name have no practical threat evaluation guiding significance and cannot clearly determine the threat classification or threat level corresponding to the target malicious sample.

[0040] S200: Generate a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample. The malicious label is used to represent the threat intensity of the target malicious sample.

[0041] Generally, when using the existing static threat intelligence analysis method, during the analysis process, multiple corresponding virus features of each target malicious sample will be extracted, and then a feature vector corresponding to each target malicious sample will be formed according to these virus features, and then the corresponding classification and virus name will be matched in the virus library or by machine learning methods according to the feature vector. Among the multiple corresponding virus features of each target malicious sample, there may include at least one suspicious feature, and this suspicious feature is a feature used to represent the threat degree of the target malicious sample.

[0042] For example, the suspicious features can include: mutex feature or special string feature, registry modification feature or file modification feature, derived new file path feature or derived new file name feature or access new URL feature, etc.

[0043] Thus, a preset suspicious feature can be extracted from the feature vector corresponding to each target malicious sample, and a corresponding malicious label can be configured for each target malicious sample according to the threat intensity represented by the suspicious feature. The threat level represented by the suspicious feature is positively correlated with the threat intensity represented by the malicious label.

[0044] S300: Classify the threat categories of the target malicious samples according to the malicious labels.

[0045] In this embodiment, during the analysis process of the existing static threat intelligence analysis method, the suspicious features existing in the feature vector corresponding to each determined target malicious sample can be directly used to match the corresponding malicious labels. The threat category of the target malicious sample can be classified without any other processing. Therefore, when the present invention classifies the threat category of the general type of samples, the computational complexity is extremely small, and the resource occupancy of the system is relatively small.

[0046] The present invention classifies the threat category of each target malicious sample again according to the suspicious features of each target malicious sample. Thus, the level of threat intensity corresponding to each target malicious sample can be judged. Therefore, when security analysts face a large number of target malicious samples with general classifications and virus names, they can perform priority sorting according to the threat category corresponding to each target malicious sample, so as to analyze and process the target malicious samples with higher threat intensity more preferentially, and selectively abandon or delay the analysis and processing of the target malicious samples with lower threat intensity. Thus, it enables security analysts to carry out analysis work more pertinently. This can improve the recognition speed of security analysts for intelligence and the analysis response speed for general malicious codes.

[0047] As a possible embodiment of the present invention, S100: Obtain target malicious samples, including:

[0048] S101: Obtain a plurality of samples to be tested.

[0049] The samples to be tested can be suspicious codes and malicious codes intercepted by existing security monitoring tools. The malicious codes can be malicious codes such as Trojans and worms. The security monitoring tool can be a firewall, an IDS (intrusion detection system), an endpoint security detection tool, etc.

[0050] S102: Perform static threat intelligence analysis and processing on the plurality of samples to be tested to generate at least one target malicious sample. The static threat intelligence analysis and processing is used to determine the threat level and virus name of the samples to be tested. The target malicious sample is a sample to be tested without a clear threat level and virus name. That is, a general type of sample without a clear threat classification.

[0051] The static threat intelligence analysis and processing can be implemented by existing static threat intelligence analysis methods or systems. Through the static threat intelligence analysis and processing, detailed and clear threat level classifications and virus names can be matched for a large number of samples to be tested. At the same time, some general type of samples that cannot be matched will also be output. Such general type of samples are the target malicious samples.

[0052] In this embodiment, the general malicious code identified by the traditional static analysis method can be further subdivided according to the threat level. This improves the judgment speed and analysis efficiency of security analysts for general malicious code. In the case of a large number of malicious codes, the general malicious codes can be selectively filtered according to the signature (malicious label), thereby saving the judgment time and improving the efficiency of security analysts in solving problems.

[0053] As a possible embodiment of the present invention, each target malicious sample has at least one suspicious feature.

[0054] S200: Generate a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample, including:

[0055] S201: Obtain a feature-label mapping table. The feature-label mapping table is used to record the correspondence between suspicious features and malicious labels. The suspicious level represented by the suspicious feature is positively correlated with the threat intensity represented by the malicious label.

[0056] Specifically, the feature-label mapping table satisfies the following conditions:

[0057] If the suspicious feature is a mutex feature or a special string feature, the malicious label is a low-level malicious label, and the corresponding signature is L.

[0058] Correspondingly, when only a mutex feature or a special string exists in the target malicious sample, it only indicates a relatively low suspiciousness. Usually, there are a large number of uncommon special strings in malicious code, but there may also be some uncommon special strings in regular normal code (whitelist code). Therefore, when only a special string exists in the target malicious sample, it only indicates a relatively low suspiciousness.

[0059] Mutexes are used to ensure that a sample can only run singly in the same running environment or the same terminal. Due to the above characteristics of mutexes, mutexes usually exist in malicious code, but in some normal codes, mutexes also exist to ensure the singularity of test cases. Therefore, when only a special string exists in the target malicious sample, it only indicates a relatively low suspiciousness.

[0060] If the suspicious feature is a registry modification feature or a file modification feature, the malicious label is a medium-level malicious label, and the corresponding signature is M.

[0061] If a sample has the behavioral characteristics of modifying the registry or files during operation, it indicates a high degree of suspicion. Usually, when a malicious sample wants to launch an attack, it needs to modify the registry or files privately to achieve the corresponding attack purpose. Although some normal samples may also involve modifying the registry or files during operation, the number of such samples is small, and most of them have the modification permission after security verification. Therefore, when a sample has the above behaviors, it indicates a high degree of suspicion.

[0062] If the suspicious feature is the feature of deriving a new file path or a new file name or accessing a new URL, the malicious label is a high-level malicious label. The corresponding feature code is H.

[0063] If a sample derives a new file path or a new file name or accesses a new URL during operation. It indicates a very high degree of suspicion. Usually, malicious samples are embedded in some normal software. When the software is downloaded and installed, the malicious sample can be loaded onto the installation terminal. For example, when downloading and installing a certain application software on some unofficial websites, there will be an embedded malicious sample in the installation package. Moreover, after the malicious sample is implanted into the terminal, it will create some folders and files by itself, that is, it derives a new file path or a new file name. At the same time, it also communicates with the corresponding virus control website for subsequent attack steps. And it will inevitably access a new URL during this process.

[0064] Therefore, when there are features of deriving a new file path or a new file name or accessing a new URL in the target malicious sample, it can indicate a very high degree of suspicion and is very likely to be a virus sample.

[0065] Preferably, the threat categories corresponding to the high-level malicious label, the intermediate-level malicious label, and the low-level malicious label decrease in turn.

[0066] S202: According to the feature label mapping table and the suspicious features of each target malicious sample, determine the malicious label corresponding to each target malicious sample.

[0067] Classify the general malicious code through the feature codes marked in the above feature label mapping table. There are 7 categories as follows:

[0068] 3 categories containing only a single feature code: L, M, H.

[0069] 3 categories containing two feature codes: LM, LH, MH.

[0070] 1 category containing three feature codes: LMH.

[0071] Arrange them in descending order of maliciousness, which are LMH, MH, LH, LM, H, M, and L in sequence.

[0072] In this embodiment, according to the level of suspiciousness indicated by the above-mentioned suspicious features, the general type of samples can be divided into more detailed threat levels, which helps security analysts find samples with higher threats more quickly for priority analysis. This embodiment can further improve the information integration ability of the static threat analysis method, and at the same time improve the analysis efficiency of security analysts and reduce labor costs.

[0073] As a possible embodiment of the present invention, the method further includes:

[0074] S400: Determine the processing priority for the target malicious sample according to the threat category corresponding to the malicious label of the target malicious sample.

[0075] Preferably, if the target malicious sample only has a low-level malicious label, the processing priority of the target malicious sample is the lowest.

[0076] In the case of analyzing a large number of samples, security analysts can classify them according to the signature identification. For samples that only contain L or M, they can be selectively abandoned first, while for samples that contain H, MH, and LHM, they are given priority for research and analysis, which can improve the targeting and save time costs at the same time.

[0077] According to the second aspect of the present invention, as Figure 2 shown, a classification device for general malicious samples is provided, and the device includes:

[0078] An acquisition module, configured to acquire a target malicious sample.

[0079] A label generation module, configured to generate a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample. The malicious label is used to represent the threat intensity of the target malicious sample.

[0080] A category division module, configured to divide the threat category of the target malicious sample according to the malicious label.

[0081] The present invention is a method for classifying general malicious code, which can improve the intelligence recognition of security analysts and the analysis and response speed for general malicious code. This method assigns corresponding signature codes L, M, and H to the feature vectors that cannot be matched scanned by the static threat analysis system, thereby improving the value of intelligence and more efficiently judging the threat of general malicious code.

[0082] An embodiment of the present invention also provides a non-transitory computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to a method in the method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiment.

[0083] An embodiment of the present invention also provides an electronic device, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0084] An embodiment of the present invention also provides a computer program product, which includes program code. When the program product runs on an electronic device, the program code is used to cause the electronic device to execute the steps in the method according to various exemplary embodiments of the present invention described above in this specification.

[0085] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that these steps must be executed in that specific order, or that all the shown steps must be executed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and / or one step may be decomposed into multiple steps for execution, etc.

[0086] Through the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described here can be implemented by software, or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0087] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0088] Those skilled in the art can understand that various aspects of the present application can be implemented as a system, a method, or a program product. Therefore, various aspects of the present application can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation combining hardware and software aspects, which can be collectively referred to as "circuit", "module", or "system" here.

[0089] An electronic device according to this embodiment of the present application. The electronic device is merely an example and should not impose any limitations on the functions and usage scope of the embodiments of the present application.

[0090] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: at least one of the above-mentioned processors, at least one of the above-mentioned memories, and a bus connecting different system components (including the memory and the processor).

[0091] Among them, the memory stores program code, and the program code can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present application described in the "Exemplary Method" section of this specification.

[0092] The memory may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) and / or a cache memory, and may further include a read-only memory (ROM).

[0093] The memory may also include a program / utilities having a set (at least one) of program modules. Such program modules include, but are not limited to: an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include the implementation of a network environment.

[0094] The bus may represent one or more of several types of bus structures, including a memory bus or a memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus using any bus structure in a variety of bus structures.

[0095] The electronic device may also communicate with one or more external devices (such as a keyboard, a pointing device, a Bluetooth device, etc.), and may also communicate with one or more devices that enable a user to interact with the electronic device, and / or communicate with any device that enables the electronic device to communicate with one or more other computing devices (such as a router, a modem, etc.). Such communication may be carried out through an input / output (I / O) interface. In addition, the electronic device may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter. The network adapter communicates with other modules of the electronic device through the bus. It should be understood that although not shown in the figure, other hardware and / or software modules may be used in combination with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0096] From the description of the above embodiments, those skilled in the art can easily understand that the exemplary embodiments described herein can be implemented by software or by a combination of software and necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a portable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

[0097] In an exemplary embodiment of the present disclosure, there is also provided a computer-readable storage medium having a program product stored thereon that can implement the methods described in this specification above. In some possible embodiments, various aspects of the present application can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present application described in the "Exemplary Methods" section above of this specification.

[0098] The program product may adopt any combination of one or more readable media. The readable media may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0099] The computer-readable signal medium may include a data signal propagated in a baseband or as a part of a carrier wave, which carries the readable program code. Such a propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than the readable storage medium, which can send, propagate, or transmit a program used by or in conjunction with an instruction execution system, apparatus, or device.

[0100] The program code included on the readable medium can be transmitted by any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the above.

[0101] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java, C++, etc., and also including conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, executed as a stand-alone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., by using an Internet service provider to connect through the Internet).

[0102] In addition, the above-mentioned drawings are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not for limiting purposes. It is easy to understand that the processes shown in the above-mentioned drawings do not indicate or limit the chronological order of these processes. Additionally, it is also easy to understand that these processes can be executed synchronously or asynchronously in, for example, multiple modules.

[0103] It should be noted that although several modules or units of a device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of the two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0104] The above are only the specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed in the present application should be covered by the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A classification method for general malicious samples, characterized in that, The method includes the following steps: Obtain a target malicious sample; Generate a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample; the malicious label is used to represent the threat intensity of the target malicious sample; Classify the threat categories of the target malicious samples according to the malicious labels; Obtaining a target malicious sample includes: Obtain a plurality of samples to be tested; Perform static threat intelligence analysis processing on the plurality of samples to be tested to generate at least one target malicious sample, and the static threat intelligence analysis processing is used to determine the threat level and virus name of the sample to be tested; the target malicious sample is a sample to be tested without a clear threat level and virus name; Each target malicious sample has at least one suspicious feature; The generating a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample includes: Obtain a feature label mapping table; the feature label mapping table is used to record the corresponding relationship between suspicious features and malicious labels; the suspicious level represented by the suspicious feature is positively correlated with the threat intensity represented by the malicious label; Determine the malicious label corresponding to each target malicious sample according to the feature label mapping table and the suspicious features of each target malicious sample, and each suspicious feature corresponds to a malicious label.

2. The method according to claim 1, wherein The feature label mapping table satisfies the following conditions: If the suspicious feature is a mutex feature or a special string feature, the malicious label is a low-level malicious label; If the suspicious feature is a registry modification feature or a file modification feature, the malicious label is a medium-level malicious label; If the suspicious feature is a feature of deriving a new file path or a new file name or accessing a new URL, the malicious label is a high-level malicious label.

3. The method according to claim 2, characterized in that The threat categories corresponding to the high-level malicious label, the medium-level malicious label, and the low-level malicious label decrease in turn.

4. The method according to claim 3, wherein The method further includes: Determine the processing priority for the target malicious sample according to the threat category corresponding to the malicious label of the target malicious sample.

5. The method according to claim 4, characterized in that Determining the processing priority for the target malicious sample according to the threat category corresponding to the malicious label of the target malicious sample includes: If the target malicious sample only has a low-level malicious label, the processing priority of the target malicious sample is the lowest.

6. A classification device for general malicious samples, characterized in that, including: An acquisition module for obtaining a target malicious sample; Obtaining a target malicious sample includes: Obtain a plurality of samples to be tested; Perform static threat intelligence analysis processing on the plurality of samples to be tested to generate at least one target malicious sample, and the static threat intelligence analysis processing is used to determine the threat level and virus name of the sample to be tested; the target malicious sample is a sample to be tested without a clear threat level and virus name; A label generation module for generating a malicious label corresponding to each target malicious sample according to the suspicious features of each target malicious sample; the malicious label is used to represent the threat intensity of the target malicious sample; Each target malicious sample has at least one suspicious feature; Generating a malicious label corresponding to each of the target malicious samples according to the suspicious features of each of the target malicious samples includes: Obtaining a feature-label mapping table; the feature-label mapping table is used to record the correspondence between suspicious features and malicious labels; the suspicious level represented by the suspicious features is positively correlated with the threat intensity represented by the malicious labels; Determining a malicious label corresponding to each of the target malicious samples according to the feature-label mapping table and the suspicious features of each of the target malicious samples, and each of the suspicious features corresponds to a malicious label; A category division module for dividing the threat categories of the target malicious samples according to the malicious labels.

7. A non-transitory computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements a classification method for a general malicious sample according to any one of claims 1 to 5.

8. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a classification method for a general malicious sample according to any one of claims 1 to 5.

Images