A method, apparatus, electronic device and storage medium for recognizing graphic codes.
By using graphic code recognition methods to distinguish and process operation instructions in graphic codes, the problems of low efficiency and insufficient accuracy in QR code analysis are solved, enabling automated malicious file processing and improving the security and analysis efficiency of electronic devices.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- HARBIN ANTIY TECH
- Filing Date
- 2022-12-19
- Publication Date
- 2026-07-17
Smart Images
Figure CN116108869B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security, and in particular to a method, apparatus, electronic device and storage medium for graphic code recognition. Background Technology
[0002] The types and frequency of cyberattacks facing the cybersecurity industry today are constantly increasing. Among them, QR codes are often used as a carrier of cyberattacks to attract victims to scan and download or run malicious programs.
[0003] Traditional QR code analysis mostly relies on manual analysis, which is inefficient. While it can meet the needs when the amount of data is small, it also leads to inaccurate results. However, with the development of e-commerce in my country, users are using QR codes to access various services more and more frequently. This has resulted in a massive increase in the reach and frequency of cyberattacks. Manual analysis is simply not able to make good use of the large amount of data samples. There is an urgent need for a QR code recognition method that can improve the efficiency and accuracy of analysis. Summary of the Invention
[0004] In view of this, this application provides a graphic code recognition method, apparatus, electronic device, and storage medium, which at least partially solves the problems existing in the prior art.
[0005] In one aspect of this application, a graphic code recognition method is provided, comprising:
[0006] In response to the recognition of a graphic code, at least one operation instruction contained within the graphic code is obtained.
[0007] If at least one of the operation instructions contains a background download instruction, then the target file corresponding to the background download instruction is downloaded to the first storage space.
[0008] The target file is subjected to file detection to determine whether it is a threat file.
[0009] If the target file is a threat file, then delete the target file and prevent the execution of other operation instructions.
[0010] If the target file is not a threat file, move the target file to the second storage space and execute other operation instructions.
[0011] The security level of the first storage space is higher than that of the second storage space.
[0012] In one exemplary embodiment of this application, the step of performing file detection on the target file to determine whether the target file is a threat file includes:
[0013] Obtain the file feature information corresponding to the target file.
[0014] The file feature information is input into a preset feature recognition model to determine whether the target file is a threat file based on the output of the feature recognition model.
[0015] In one exemplary embodiment of this application, the file feature information includes: hash information of the target file and / or digest information of the target file.
[0016] In one exemplary embodiment of this application, the feature recognition model is a machine learning model that uses the Gaussian Bayes algorithm for feature recognition.
[0017] In one exemplary embodiment of this application, if the target file is a threat file, the method further includes:
[0018] Obtain the analysis report of the target file.
[0019] In one exemplary embodiment of this application, after obtaining at least one operation instruction contained within the graphic code, the method further includes:
[0020] Determine the instruction type for each operation instruction.
[0021] The instruction feature information corresponding to the graphic code is determined based on the instruction type.
[0022] Determine whether to execute the at least one operation instruction based on the instruction feature information.
[0023] In one exemplary embodiment of this application, determining the instruction feature information corresponding to the graphic code based on the instruction type includes:
[0024] Determine the type ID corresponding to each instruction type.
[0025] Each type ID is arranged according to the execution order of the corresponding operation instructions to generate the instruction feature information.
[0026] In another aspect of this application, a graphic code recognition device is provided, comprising:
[0027] The acquisition module is used to acquire at least one operation instruction contained in the graphic code in response to the recognition of the graphic code.
[0028] The determining module is configured to download the target file corresponding to the background download instruction to the first storage space if at least one of the operation instructions contains a background download instruction.
[0029] The detection module is used to perform file detection on the target file to determine whether the target file is a threat file.
[0030] An execution module is configured to delete the target file and prevent the execution of other operation instructions if the target file is a threat file; and to move the target file to a second storage space and execute other operation instructions if the target file is not a threat file.
[0031] The security level of the first storage space is higher than that of the second storage space.
[0032] In another aspect of this application, an electronic device is provided, including a processor and a memory.
[0033] The processor executes the steps of any of the methods described above by invoking programs or instructions stored in the memory.
[0034] In another aspect of this application, a non-transitory computer-readable storage medium is provided, which stores a program or instructions that cause a computer to perform the steps of any of the methods described above.
[0035] The graphic code recognition method provided in this application, after obtaining the operation instructions from the graphic code, determines whether the obtained operation instructions include a background download instruction. If a background download instruction exists, the target file corresponding to the background download instruction is downloaded to a preset first storage space. The first storage space is a high-security storage space, which can prevent malicious files within it from damaging other storage spaces, thus ensuring security. After the target file is downloaded to the first storage space, the target file is checked, and if the target file is identified as a threat file, it is directly deleted, and the execution of other operation instructions is blocked to prevent the electronic device from being attacked by malicious users. This achieves malicious graphic code recognition without human judgment, and when the graphic code is determined to be malicious, the execution of its corresponding operation instructions is blocked, thereby improving the security of the electronic device. Attached Figure Description
[0036] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0037] Figure 1 This is a flowchart of a graphic code recognition method provided in an embodiment of this application.
[0038] Figure 2This is a structural block diagram of a graphic code recognition device provided in an embodiment of this application. Detailed Implementation
[0039] The embodiments of this application will now be described in detail with reference to the accompanying drawings.
[0040] It should be noted that, in the absence of conflict, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.
[0041] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.
[0042] Please refer to Figure 1 In one aspect of this application, a graphic code recognition method is provided, comprising the following steps:
[0043] S100, in response to recognizing the graphic code, acquire at least one operation instruction contained in the graphic code.
[0044] The operation commands can include webpage redirection commands, foreground download commands, background download commands, and settings change commands. The graphic codes can be common computer-recognizable graphic codes such as QR codes and barcodes.
[0045] S200, if at least one of the operation instructions contains a background download instruction, then the target file corresponding to the background download instruction is downloaded to the first storage space.
[0046] Background download commands refer to commands that automatically download files in the background without requiring user confirmation. The first storage space can be a pre-defined secure storage space, such as a storage space isolated from other storage spaces, or a storage space that can only be accessed and controlled by pre-defined software (such as antivirus software). This can be understood as meaning that even if threatening files (such as viruses or Trojans) exist in the first storage space, it will not negatively impact the electronic device.
[0047] S300, Perform file detection on the target file to determine whether the target file is a threat file.
[0048] The file detection method can employ existing threat file detection methods, such as using existing antivirus software.
[0049] S400, if the target file is a threat file, then delete the target file and prevent the execution of other operation instructions.
[0050] S500, if the target file is not a threat file, move the target file to the second storage space and execute other operation instructions so that at least one operation instruction corresponding to the graphic code can be executed normally.
[0051] The second storage space can be a conventional storage space, that is, a storage space that normal software can access and control. The security level of the first storage space is higher than that of the second storage space, and the other operation instructions are instructions other than the background download instruction among the at least one operation instructions.
[0052] The graphic code recognition method provided in this embodiment, after obtaining the operation instructions from the graphic code, determines whether the obtained operation instructions include a background download instruction. If a background download instruction exists, the target file corresponding to the background download instruction is downloaded to a preset first storage space. The first storage space is a high-security storage space, which can prevent malicious files within it from damaging other storage spaces, thereby ensuring security. After the target file is downloaded to the first storage space, the target file is checked, and if the target file is a threatening file, it is directly deleted, and the execution of other operation instructions is blocked to prevent the electronic device from being attacked by malicious users.
[0053] The graphic code recognition method provided in this embodiment enables the recognition of malicious graphic codes without human judgment. When a graphic code is determined to be malicious, the execution of its corresponding operation instructions will be blocked. This prevents the background download instructions in the malicious graphic code from downloading threat files such as viruses and Trojans to the user's electronic device without the user's knowledge, thereby threatening the user's electronic device and personal information and improving the security of the electronic device.
[0054] In one exemplary embodiment of this application, step S300 includes:
[0055] S310, Obtain the file feature information corresponding to the target file.
[0056] S320, The file feature information is input into a preset feature recognition model to determine whether the target file is a threat file based on the output of the feature recognition model.
[0057] The file feature information includes at least one of the following: the hash information of the target file or the digest information of the target file. The feature recognition model can be a machine learning model that uses the Gaussian Bayes algorithm for feature recognition.
[0058] The feature recognition model can be obtained by extracting file feature information from identified historical threat files, marking the historical file feature information corresponding to each historical threat file, and training the feature recognition model using the historical file feature information.
[0059] Furthermore, since the Gaussian Bayes algorithm is more accurate in matching continuous feature values, and the feature values in the hash information or summary information in this application are all related feature values, in this embodiment, the machine learning model that uses the Gaussian Bayes algorithm for feature recognition is used as the feature recognition model, which can improve the accuracy of recognition.
[0060] In one exemplary embodiment of this application, if the target file is a threat file, the method further includes:
[0061] Obtain the analysis report of the target file.
[0062] Specifically, the analysis report can be determined based on the output of the feature recognition model. The output may include the file type of the target file. Based on the file type, the report determines the corresponding threat behavior, handling method, threat level, and other information from a preset mapping table, thereby generating an analysis report for the target file. This allows staff to perform subsequent analysis or processing on the target file or the identified graphic code based on the analysis report.
[0063] In one exemplary embodiment of this application, after obtaining at least one operation instruction contained within the graphic code, the method further includes:
[0064] S600 determines the instruction type for each operation command. Instruction types can include: jump, control, download, etc.
[0065] S700, determine the instruction feature information corresponding to the graphic code according to the instruction type.
[0066] S800, determine whether to execute the at least one operation instruction based on the instruction feature information.
[0067] Specifically, steps S600-S800 can be executed after determining that the target file is not a threat file. That is, after determining that the target file is not a threat file, steps S600-S800 determine whether to execute at least one operation instruction contained in the graphic code. In other embodiments, steps S600-S800 and steps S200-S500 can be executed in parallel after step S100. The final determination of whether to execute at least one operation instruction contained in the graphic code can be determined by the final result of the two paths.
[0068] Specifically, step S700 includes:
[0069] S710 determines the type ID corresponding to each instruction type.
[0070] Each instruction type can be pre-set with a corresponding type ID, for example, the type ID for jump is 01, the type ID for control is 02, and the type ID for download is 03.
[0071] S720, each type ID is arranged according to the execution order of the corresponding operation instruction to generate the instruction feature information.
[0072] In this application, by arranging each type of ID according to the execution order of the corresponding operation instructions, the instruction feature information can include the behavioral characteristics corresponding to the graphic code. Many malicious attacks often share similar or identical behavioral patterns. Therefore, in this embodiment, historical instruction feature information of historically identified threat graphic codes can be obtained, and the behavioral characteristics of the threat behavior can be analyzed (through statistical analysis or using existing behavioral analysis models). The instruction feature information is then compared with the behavioral characteristics of the threat behavior to determine whether the currently identified graphic code is malicious. If the currently identified graphic code is malicious, the execution of at least one operation instruction is blocked.
[0073] Please refer to Figure 2 As shown, in another aspect of this application, a graphic code recognition device is provided, comprising:
[0074] The acquisition module is used to acquire at least one operation instruction contained in the graphic code in response to the recognition of the graphic code.
[0075] The determining module is configured to download the target file corresponding to the background download instruction to the first storage space if at least one of the operation instructions contains a background download instruction.
[0076] The detection module is used to perform file detection on the target file to determine whether the target file is a threat file.
[0077] An execution module is configured to delete the target file and prevent the execution of other operation instructions if the target file is a threat file; and to move the target file to a second storage space and execute other operation instructions if the target file is not a threat file.
[0078] The security level of the first storage space is higher than that of the second storage space.
[0079] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.
[0080] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.
[0081] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.
[0082] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."
[0083] An electronic device according to this embodiment of the present application. The electronic device is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of this application.
[0084] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).
[0085] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of this application.
[0086] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).
[0087] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.
[0088] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.
[0089] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be performed via input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0090] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.
[0091] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible implementations, various aspects of this application may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of this application described in the "Exemplary Methods" section above.
[0092] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0093] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.
[0094] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.
[0095] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages such as Java and C++, and conventional procedural programming languages such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).
[0096] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this application, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.
[0097] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
[0098] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
Claims
1. A method for recognizing graphic codes, characterized in that, include: In response to the recognition of a graphic code, at least one operation instruction contained within the graphic code is obtained; If at least one of the operation instructions contains a background download instruction, then the target file corresponding to the background download instruction is downloaded to the first storage space; The target file is subjected to file detection to determine whether it is a threat file; If the target file is a threat file, then delete the target file and prevent the execution of other operation commands; If the target file is not a threat file, move the target file to the second storage space and execute other operation instructions; The security level of the first storage space is higher than that of the second storage space. After obtaining at least one operation instruction contained within the graphic code, the method further includes: Determine the instruction type for each operation instruction; Determine the instruction feature information corresponding to the graphic code based on the instruction type; Determine whether to execute the at least one operation instruction based on the instruction feature information; The step of determining the instruction feature information corresponding to the graphic code based on the instruction type includes: Determine the type ID corresponding to each instruction type; Each type ID is arranged according to the execution order of the corresponding operation instructions to generate the instruction feature information; Determining whether to execute the at least one operation instruction based on the instruction feature information includes: The command feature information is compared with the behavioral features of the threat behavior to determine whether the identified graphic code is a malicious graphic code; the behavioral features of the threat behavior are obtained by acquiring and analyzing the historical command feature information of historically identified threat graphic codes. If the identified graphic code is malicious, the execution of at least one operation instruction will be blocked.
2. The graphic code recognition method according to claim 1, characterized in that, The step of performing file detection on the target file to determine whether the target file is a threat file includes: Obtain the file feature information corresponding to the target file; The file feature information is input into a preset feature recognition model to determine whether the target file is a threat file based on the output of the feature recognition model.
3. The graphic code recognition method according to claim 2, characterized in that, The file feature information includes: the hash information of the target file and / or the digest information of the target file.
4. The graphic code recognition method according to claim 2, characterized in that, The feature recognition model is a machine learning model that uses the Gaussian Bayes algorithm for feature recognition.
5. The graphic code recognition method according to claim 1, characterized in that, If the target file is a threat file, the method further includes: Obtain the analysis report of the target file.
6. A graphic code recognition device, characterized in that, include: The acquisition module is used to acquire at least one operation instruction contained in the graphic code in response to the recognition of the graphic code; The determining module is configured to download the target file corresponding to the background download instruction to the first storage space if at least one of the operation instructions contains a background download instruction. The detection module is used to perform file detection on the target file to determine whether the target file is a threat file; An execution module is configured to delete the target file and prevent the execution of other operation instructions if the target file is a threat file; and to move the target file to a second storage space and execute other operation instructions if the target file is not a threat file. The security level of the first storage space is higher than that of the second storage space. After obtaining at least one operation instruction contained within the graphic code, the method further includes: Determine the instruction type for each operation instruction; Determine the instruction feature information corresponding to the graphic code based on the instruction type; Determine whether to execute the at least one operation instruction based on the instruction feature information; The step of determining the instruction feature information corresponding to the graphic code based on the instruction type includes: Determine the type ID corresponding to each instruction type; Each type ID is arranged according to the execution order of the corresponding operation instructions to generate the instruction feature information; Determining whether to execute the at least one operation instruction based on the instruction feature information includes: The command feature information is compared with the behavioral features of the threat behavior to determine whether the identified graphic code is a malicious graphic code; the behavioral features of the threat behavior are obtained by acquiring and analyzing the historical command feature information of historically identified threat graphic codes. If the identified graphic code is malicious, the execution of at least one operation instruction will be blocked.
7. An electronic device, characterized in that, Including processor and memory; The processor executes the steps of the method as described in any one of claims 1 to 5 by invoking programs or instructions stored in the memory.
8. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores a program or instructions that cause a computer to perform the steps of the method as described in any one of claims 1 to 5.