Abnormal file detection methods, devices, systems and storage media

Abstract

This application provides an abnormal file detection method, apparatus, system, and storage medium, belonging to the field of network security technology. The method includes: receiving a file to be identified sent by a user terminal; performing keyword feature analysis and reverse file parsing on the file to be identified to generate parsed file information; determining static risk attribute information based on the parsed file information and pre-stored keyword information; performing dynamic analysis on the file to be identified to generate sensitive action information; determining dynamic analysis data and log records based on the sensitive action information; determining dynamic risk attribute information based on the dynamic analysis data and log records; determining comprehensive risk information based on the static and dynamic risk attribute information; generating an abnormal file detection result for the file to be identified; and sending the abnormal file detection result to the user terminal. This application has the advantage of improving the accuracy of abnormal file detection.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an abnormal file detection method, apparatus, system and storage medium. Background Technology

[0002] With the development of network security technology, network security protection has shifted from passive defense to active defense. In the process of active defense, if files that are intended to endanger network information security can be detected in advance, abnormal files that may cause damage and information theft in the future can be dealt with in advance.

[0003] Currently, existing technologies employ static detection techniques, which determine whether a file is abnormal by colliding the hash of the file to be detected with that of known abnormal files, thus completing the detection of unknown abnormal files.

[0004] However, the inventors have found that the existing technology has at least the following technical problems: when there are many files in the sample library, due to certain performance issues in querying and collision, the files to be identified are mistakenly reported as not being abnormal files, thereby reducing the detection accuracy of abnormal files. Summary of the Invention

[0005] This application provides an abnormal file detection method, apparatus, system, and storage medium, which can improve the detection accuracy of abnormal files.

[0006] Firstly, this application provides a method for detecting abnormal files, including:

[0007] Receive the original file to be identified sent by the user terminal, wherein the original file to be identified is obtained when the user terminal starts the pre-stored detection engine to perform abnormal file detection on the pre-stored file;

[0008] If the original file to be identified is detected to be a binary file, then the original file to be identified is subjected to keyword feature and reverse file parsing processing to generate parsed file information;

[0009] Based on the parsed file information and pre-stored keyword information, determine the static risk attribute information;

[0010] The original file to be identified is dynamically analyzed and processed to generate sensitive action information;

[0011] Based on the sensitive action information, determine the dynamic analysis data and log records;

[0012] Based on the dynamic analysis data and log records, determine the dynamic risk attribute information;

[0013] Based on the static risk attribute information and the dynamic risk attribute information, comprehensive risk information is determined;

[0014] If the comprehensive risk information is detected to meet the preset risk conditions, then the abnormal file detection result of the original file to be identified is generated;

[0015] The abnormal file detection results are sent to the user terminal.

[0016] In one possible implementation, the pre-stored keyword information includes multiple different instructions, and the static risk attribute information includes a static risk score and a static risk level. Accordingly, determining the static risk attribute information based on the parsed file information and the pre-stored keyword information includes: determining the risk level data corresponding to each instruction based on the parsed file information and the multiple different instructions; performing risk scoring and cumulative calculation on the risk level data corresponding to all instructions to determine the static risk score; and determining the static risk level based on the static risk score.

[0017] In one possible implementation, the dynamic analysis processing includes dynamic running processing and tracking analysis processing; correspondingly, the dynamic analysis processing of the original file to be identified to generate sensitive action information includes: performing dynamic running processing on the original file to be identified to generate process dynamic information, wherein the dynamic running processing is the operation of a preset virtual environment in response to a pre-stored system instruction to start a pre-stored parsing tool; executing a pre-stored running process monitoring program to track and analyze the process dynamic information to generate sensitive action information.

[0018] In one possible implementation, the dynamic risk attribute information includes a dynamic risk score and a dynamic risk level; correspondingly, determining the dynamic risk attribute information based on the dynamic analysis data and log records includes: determining the risk score value corresponding to all sensitive actions based on the dynamic analysis data and the log records; performing cumulative calculation on the risk score value to determine the dynamic risk score; and determining the dynamic risk level based on the dynamic risk score.

[0019] In one possible implementation, after determining the comprehensive risk information based on the static risk attribute information and the dynamic risk attribute information, the method further includes: if the comprehensive risk information is detected to meet the preset review conditions, then determining the abnormal file detection result of the original file to be identified based on the comprehensive risk information and the pre-stored file description information.

[0020] In one possible implementation, before sending the abnormal file detection result to the user terminal, the method further includes: determining an abnormal file detection strategy based on the abnormal file detection result; and sending the abnormal file detection strategy to the user terminal so that the user terminal performs an abnormal file detection operation according to the abnormal file detection strategy.

[0021] In one possible implementation, after receiving the original file to be identified sent by the user terminal, the method further includes: if the original file to be identified is detected to be a normal script file, then the steps of determining the static risk score and static risk level and thereafter are executed.

[0022] One possible implementation further includes: constructing a blacklist, a whitelist, and a graylist; receiving identified file information and identified original files sent by the user terminal, wherein the identified file information and identified original files are obtained when the user terminal starts a pre-stored detection engine to perform abnormal file detection on the pre-stored files; performing file comparison processing on the identified file information and the pre-stored file information to generate list classification information; determining blacklist original files and whitelist original files based on the identified original files and the list classification information; storing the blacklist original files in the blacklist; storing the whitelist original files in the whitelist; storing the original files to be identified in the graylist; and adjusting and updating the blacklist, whitelist, and graylist based on the abnormal file detection results to generate updated blacklist, whitelist, and graylist.

[0023] Secondly, this application also provides another method for detecting abnormal files, including:

[0024] The pre-stored detection engine is activated to detect abnormal files in the pre-stored files, and the original file to be identified is obtained.

[0025] The original file to be identified is sent to the server. If the server detects that the original file to be identified is a binary file, it performs keyword feature and reverse file parsing on the original file to generate parsed file information. Based on the parsed file information and pre-stored keyword information, it determines static risk attribute information. It then performs dynamic analysis on the original file to be identified to generate sensitive action information. Based on the sensitive action information, it determines dynamic analysis data and log records. Based on the dynamic analysis data and log records, it determines dynamic risk attribute information. Based on the static risk attribute information and the dynamic risk attribute information, it determines comprehensive risk information. If the comprehensive analysis result is found to meet preset risk conditions, it generates an abnormal file detection result for the original file to be identified.

[0026] Receive the abnormal file detection results sent by the server.

[0027] In one possible implementation, before receiving the abnormal file detection result sent by the server, the method further includes: receiving an abnormal file detection strategy sent by the server, wherein the abnormal file detection strategy is determined by the server based on the abnormal file detection result; and performing an abnormal file detection operation based on the abnormal file detection strategy.

[0028] In one possible implementation, the method further includes: starting a pre-stored detection engine to perform abnormal file detection on pre-stored files, obtaining identified file information and identified original files; sending the identified file information and identified original files to the server, so that the server can construct a blacklist library, a whitelist library, and a graylist library; performing file comparison processing on the identified file information and pre-stored file information to generate list classification information; determining the blacklist original files and whitelist original files based on the identified original files and the list classification information; storing the blacklist original files in the blacklist library, storing the whitelist original files in the whitelist, storing the original files to be identified in the graylist library; and adjusting and updating the blacklist library, whitelist library, and graylist library based on the abnormal file detection results to generate updated blacklist library, whitelist library, and graylist library.

[0029] Thirdly, this application provides an abnormal file detection device, including: a first receiving module, used to receive a file to be identified sent by a user terminal, wherein the file to be identified is obtained when the user terminal starts a pre-stored detection engine to perform abnormal file detection on a pre-stored file;

[0030] The parsing module is used to perform keyword feature and reverse file parsing on the original file to be identified if it is detected that the original file to be identified is a binary file, and generate parsed file information.

[0031] The static detection module is used to determine static risk attribute information based on the parsed file information and pre-stored keyword information;

[0032] The dynamic detection module is used to perform dynamic analysis and processing on the original file to be identified to generate sensitive action information; the dynamic detection module is also used to determine dynamic analysis data and log records based on the sensitive action information; the dynamic detection module is also used to determine dynamic risk attribute information based on the dynamic analysis data and log records.

[0033] The strategy analysis and management module is used to determine comprehensive risk information based on the static risk attribute information and the dynamic risk attribute information; the strategy analysis and management module is also used to generate abnormal file detection results for the original file to be identified if the comprehensive risk information is detected to meet the preset risk conditions.

[0034] The first sending module is used to send the abnormal file detection result to the user terminal.

[0035] Fourthly, this application also provides another abnormal document detection device, including:

[0036] The preliminary detection module is used to start the pre-stored detection engine to detect abnormal files in the pre-stored files and obtain the original file to be identified;

[0037] The second sending module is used to send the original file to be identified to the server, so that if the server detects that the original file to be identified is a binary file, it performs keyword feature and reverse file parsing on the original file to be identified to generate parsed file information. Based on the parsed file information and pre-stored keyword information, it determines static risk attribute information, performs dynamic analysis on the original file to be identified to generate sensitive action information, determines dynamic analysis data and log records based on the sensitive action information, determines dynamic risk attribute information based on the dynamic analysis data and log records, determines comprehensive risk information based on the static risk attribute information and the dynamic risk attribute information, and if the comprehensive analysis result is detected to meet the preset risk conditions, it generates an abnormal file detection result for the original file to be identified.

[0038] The second receiving module receives the abnormal file detection results sent by the server.

[0039] Fifthly, this application provides a server system, including: at least one processor and a memory;

[0040] The memory stores computer-executed instructions;

[0041] The at least one processor executes computer execution instructions stored in the memory, causing the at least one processor to perform the abnormal file detection method as described in the first or second aspect above.

[0042] Sixthly, this application provides a computer-readable storage medium storing an instruction executed by a computer, which, when executed by a processor, implements the abnormal file detection method as described in the first or second aspect above.

[0043] This application provides an anomaly file detection method, apparatus, system, and storage medium. The method involves initial detection at the user end, followed by uploading unidentifiable files to the server for further detection. After uploading, if the file to be identified is a binary file, keyword features and reverse file parsing are used to generate parsed file information. Static risk attribute information is then determined based on the parsed file and pre-stored keyword information. Furthermore, dynamic analysis is performed on the file to be identified to generate sensitive action information. Based on this sensitive action information, dynamic analysis data and log records are determined, and dynamic risk attribute information is further identified. Finally, the static and dynamic risk attribute information are comprehensively analyzed to obtain comprehensive risk information. If the comprehensive risk information is sufficient to determine the anomaly file detection result for the file to be identified, further review is not required, and this result is returned to the user end. By performing static and dynamic detection on the server end, anomaly files that cannot be detected during the initial user-end detection are supplemented, reducing the false positive rate and improving the accuracy of anomaly file detection. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram illustrating an application scenario of the abnormal file detection method provided in the embodiments of this application;

[0046] Figure 2 A flowchart illustrating an abnormal file detection method provided in one embodiment of this application;

[0047] Figure 3 A flowchart illustrating an abnormal file detection method provided in another embodiment of this application;

[0048] Figure 4 A schematic diagram of the interaction flow of an abnormal file detection method provided in another embodiment of this application;

[0049] Figure 5 This is a schematic diagram of the structure of an abnormal file detection device provided in one embodiment of this application;

[0050] Figure 6 This is a schematic diagram of the structure of an abnormal file detection device provided in another embodiment of this application;

[0051] Figure 7This is a schematic diagram of the hardware structure of the server system provided in an embodiment of this application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0053] With the development of network security technology, network security protection has shifted from passive defense to active defense. In the process of active defense, if files intended to endanger network information security can be detected in advance, abnormal files that may cause damage or information theft in the future can be dealt with proactively. Currently, existing technologies employ static detection technology, which determines whether a file is abnormal by colliding the hashes of the file to be detected with those of known abnormal files, thus completing the detection of unknown abnormal files. However, the inventors found that when using static detection technology, when the sample database is large, performance issues related to querying and collision lead to false positives for abnormal files, thereby reducing the accuracy of abnormal file detection.

[0054] To address the aforementioned technical problems, this application provides the following technical concept: First, the user terminal performs preliminary detection on locally stored files. Then, the original files to be identified that were not detected in the preliminary detection are uploaded to the server for further detection. On the server, a static detection method is used to detect the original files to be identified to obtain static risk attribute information, while a dynamic detection method is also used to detect the original files to be identified to obtain dynamic risk attribute information. Then, the static and dynamic risk attribute information are comprehensively analyzed to obtain comprehensive risk information. Finally, the abnormal file detection result is generated and returned to the user terminal. By combining static and dynamic detection methods, the detection efficiency of abnormal files is improved.

[0055] refer to Figure 1 , Figure 1 This is a schematic diagram illustrating an application scenario of the abnormal file detection method provided in the embodiments of this application, such as... Figure 1 As shown, it includes: client 101 and server 102.

[0056] The user terminal 101 is used by testing personnel to input commands to initiate preliminary testing of pre-stored files locally on the user terminal 101. The user terminal 101 can be an electronic device capable of running abnormal files, such as a laptop, server, or mobile phone. The server terminal 102 is used to receive the original file to be identified sent from the user terminal 101, perform further abnormal file detection on the original file to obtain abnormal file detection results, and return the abnormal file detection results to the user terminal 101. The server terminal 102 can be a cloud server, edge computing network node, or physical server, or a server with higher detection performance than the user terminal 101.

[0057] refer to Figure 2 , Figure 2 This is a flowchart illustrating an abnormal file detection method provided in one embodiment of this application. The execution entity of this embodiment can be... Figure 1 The server 102 in the illustrated embodiment can be a physical server, a cloud server, or other computer-related devices; this embodiment does not impose any particular limitations on this. Figure 2 As shown, the abnormal file detection method includes:

[0058] S201: Receive the original file to be identified sent by the user terminal, wherein the original file to be identified is obtained when the user terminal starts the pre-stored detection engine to perform abnormal file detection on the pre-stored file.

[0059] In this embodiment, the user terminal can be Figure 1 The user terminal 101 in the illustrated embodiment. The pre-stored files can be all computer files saved in the user terminal's storage space, such as program files, script files, audio and video files, text files, or data files.

[0060] When the user client starts the pre-stored detection engine to detect abnormal files in the pre-stored files, the results can include the original file to be identified, normal files, and abnormal files. Among them, the original file to be identified refers to the file whose final result cannot be determined by the pre-stored detection engine, and the result of the original file to be identified can only be determined by other detection techniques or manual detection.

[0061] S202: If the original file to be identified is detected to be a binary file, then the original file to be identified is subjected to keyword feature and reverse file parsing processing to generate parsed file information.

[0062] In this embodiment, the binary file can be a file formed by value encoding of file data. Keyword feature extraction and file reverse parsing processing can include two steps: keyword feature extraction and file reverse parsing. Keyword feature extraction involves extracting feature keywords from the file data in the binary file. File reverse parsing is the process of extracting information from the binary file that can be used for debugging or program analysis. For example, the binary file parsing tool IDA (Interactive Disassembler) can parse instructions from a binary file. The parsed file information consists of extracted feature keywords and information that can be used for debugging or program analysis; for example, the parsed file information may be instructions to modify system files, file encryption instructions, or file deletion instructions.

[0063] S203: Determine static risk attribute information based on the parsed file information and pre-stored keyword information.

[0064] In this embodiment, the pre-stored keyword information can be information used to describe common abnormal files. For example, the pre-stored keyword information may include commands to access system files, modify system files, elevate system privileges, execute files, encrypt files, decrypt files, and delete files. Static risk attribute information may be risk assessment results when the file is in a static, non-executable state.

[0065] Specifically, in an optional embodiment of this application, the pre-stored keyword information includes various different instructions, and the static risk attribute information includes static risk scores and static risk levels. Accordingly, step S203 includes:

[0066] S203a: Based on the parsed file information and various different instructions, determine the risk level data corresponding to each instruction.

[0067] In this embodiment, the various instructions include those described in the previous embodiments. When an instruction deemed an abnormal file is found in the parsed file information, the risk level data corresponding to the keywords in the parsed file information is determined based on the correspondence between the abnormal file instruction and the risk level. This correspondence can be a data table. The risk level data can be high, relatively high, medium, relatively low, and low. For example, an instruction to modify system files corresponds to a relatively high risk level.

[0068] S203b: Perform risk scoring and cumulative calculation on the risk level data corresponding to all instructions to determine the static risk score.

[0069] In this embodiment, the risk score can be a risk level corresponding to a corresponding risk value, and the risk value can be a manually set numerical value. For example, a risk score of 10 corresponds to a high risk level, and a risk score of 5 corresponds to a medium risk level.

[0070] After risk scoring, cumulative calculation is required to determine the static risk score. The cumulative calculation process can be to take a weighted average of the risk scores of all instructions to obtain the final static risk score value.

[0071] S203d: Determine the static risk level based on the static risk score.

[0072] In this embodiment, the static risk level can be found by referring to a pre-defined data correspondence between static risk scores and static risk levels. For example, the static risk level can range from level one to level five.

[0073] S204: Perform dynamic analysis and processing on the original file to be identified to generate sensitive action information.

[0074] In this embodiment, dynamic analysis and processing can be a process of sending the original file to be identified to a virtual runtime environment for execution. Sensitive action information can be the same action generated when the original file to be identified is executed as when the abnormal file is executed. For example, the sensitive action can include behaviors such as accessing files, modifying the registry, modifying system configuration information, encrypting files, decrypting files, deleting logs, sending files externally, unauthorized external connections, and uploading files.

[0075] Specifically, in an optional embodiment of this application, the dynamic analysis processing includes dynamic execution processing and tracking analysis processing. Accordingly, step S204 includes:

[0076] S204a: Perform dynamic processing on the original file to be identified, and generate dynamic process information. The dynamic processing refers to the operation of the preset virtual environment in response to the pre-stored system instructions when the pre-stored parsing tool is started.

[0077] S204b: Executes a pre-stored running process monitoring program to track, analyze, and process dynamic process information, and generate sensitive action information.

[0078] In this embodiment, dynamic execution processing can involve opening, starting, or executing the original file to be identified. During dynamic execution processing of the original file, information generated at each time point in the corresponding process is produced. This process is tracked and analyzed in real time, and records are kept during the tracking and analysis process to generate sensitive action information.

[0079] The pre-defined virtual environment can be a cloud processor or an edge computing node, the predicted system instructions can be startup instructions or execution instructions, and the pre-stored parsing tool can be a tool that can dynamically execute scripts in a specific environment. For example, a script parser.

[0080] S205: Based on sensitive action information, determine dynamic analysis data and log records.

[0081] In this embodiment, dynamic analysis data is obtained by running the entire original file to be identified and then performing behavioral analysis to determine whether the corresponding sensitive actions are actions generated during the execution of the abnormal file. The log records can be behavioral logs generated during the execution of the original file to be identified.

[0082] S206: Determine dynamic risk attribute information based on dynamic analysis data and log records.

[0083] In this embodiment, the dynamic risk attribute information can be the risk assessment result information of the file when it is in dynamic operation.

[0084] Specifically, in an optional embodiment of this application, the dynamic risk attribute information includes a dynamic risk score and a dynamic risk level. Accordingly, step S206 includes:

[0085] S206a: Based on dynamic analysis data and log records, determine the risk score value corresponding to all sensitive actions.

[0086] S206b: Accumulate and process the risk score values ​​to determine the dynamic risk score.

[0087] S206c: Determine the dynamic risk level based on the dynamic risk score.

[0088] In this embodiment, the risk score corresponding to all sensitive actions can be obtained by finding the correspondence between the risk score and the sensitive action. Each sensitive action corresponds to a risk score, and all risk scores are accumulated to calculate a final dynamic risk score. The accumulated calculation can be a weighted average.

[0089] The dynamic risk score and the dynamic risk level can be manually correlated. For example, if the dynamic risk score is 5, the dynamic risk level is 4. If the dynamic risk score is 9, the dynamic risk level is 5. The higher the dynamic risk level, the higher the probability that the original file to be identified is an abnormal file.

[0090] S207: Determine comprehensive risk information based on static risk attribute information and dynamic risk attribute information.

[0091] In this embodiment, static risk attribute information and dynamic risk attribute information can be combined to identify risk gaps. When performing comprehensive risk analysis, a strategy analysis and management engine can be used. After the static risk attribute information and dynamic risk attribute information are automatically input into the strategy analysis and management engine, comprehensive risk information including the risk score and risk level of the original document to be identified is output.

[0092] S208: If the comprehensive risk information is detected to meet the preset risk conditions, an abnormal file detection result of the original file to be identified is generated.

[0093] In this embodiment, the preset risk condition is that the comprehensive risk information can intuitively indicate that the original file to be identified is an abnormal file, and the abnormal file detection result of the original file to be identified can be "the original file to be identified is an abnormal file".

[0094] Based on the above embodiments, in an optional embodiment of this application, after step S207, the method further includes:

[0095] Step A: If the detected comprehensive risk information meets or does not meet the preset review conditions, then the abnormal file detection result of the original file to be identified is determined based on the comprehensive risk information and the pre-stored file description information.

[0096] In this embodiment, the preset review criteria may be that the comprehensive risk information is insufficient to completely determine whether the original file to be identified is an abnormal file or a normal file. The review can be conducted manually or automatically by the device, and the review content may involve comparing the accuracy, consistency, and authenticity of basic information such as the source, signature, or authentication number of the original file to be identified. The pre-stored file description information is the original description information of the original file to be identified, such as detailed information in the attributes of a file on a computer, mainly including the file name, type, path, size, and creation date.

[0097] S209: Send the abnormal file detection results to the user terminal.

[0098] In this embodiment, the abnormal file detection results are sent to the user terminal so that the user terminal can process the detected abnormal files based on the abnormal file detection results.

[0099] In summary, this embodiment provides an abnormal file detection method that first performs preliminary detection on the user's end, then uploads files that cannot be identified as the original files to be detected to the server for further detection. After uploading, if the original file to be identified is detected as a binary file, the keyword features of the original file to be identified and the file are reverse-parsed to generate parsed file information. Then, based on the parsed file and pre-stored keyword information, static risk attribute information is determined. Furthermore, the original file to be identified is dynamically analyzed to generate sensitive action information. Based on the sensitive action information, dynamic analysis data and log records are determined, and dynamic risk attribute information is determined based on the dynamic analysis data and log records. Finally, the static risk attribute information and dynamic risk information are comprehensively analyzed to obtain comprehensive risk information. If the comprehensive risk information can be used to obtain the abnormal file detection result of the original file to be identified without further review, the result is returned to the user's end. By performing static and dynamic detection on the server side to supplement the detection of abnormal files that cannot be detected during the preliminary detection on the user's end, the false detection rate is reduced and the accuracy of abnormal file detection is improved.

[0100] Meanwhile, when further review is needed based on the comprehensive risk information before generating the abnormal file detection result of the original file to be identified, the comprehensive risk information and the pre-stored file description information are compared and reviewed before the abnormal file detection result of the original file to be identified is determined, thereby further improving the accuracy of abnormal file detection.

[0101] Based on the above embodiments, in an optional embodiment of this application, before step S209, the following step is further included:

[0102] Step B: Determine the abnormal file detection strategy based on the abnormal file detection results.

[0103] Step C: Send the abnormal file detection strategy to the client so that the client can perform abnormal file detection operations according to the abnormal file detection strategy.

[0104] In this embodiment, the abnormal file detection strategy can be to select a static detection scheme or a dynamic detection scheme based on the basic description information of the original file to be identified, so as to complete the abnormal file detection work on the user end.

[0105] In summary, the abnormal file detection method provided in this embodiment determines the detection strategy for this type of abnormal file based on the abnormal file detection results, realizes the sharing of abnormal file detection strategies, prepares for subsequent abnormal file detection work, and improves the accuracy and efficiency of subsequent abnormal file detection.

[0106] Based on the above embodiments, as an optional embodiment of this application, after receiving the original file to be identified sent by the user terminal in step S201, the method further includes:

[0107] Step D: If the original file to be identified is detected as a regular script file, then proceed with the steps to determine the static risk score and static risk level, and so on.

[0108] In this embodiment, a regular script file can be a file that can be opened directly with a text editor, such as a .txt file. When a regular script file is an abnormal file and is entered into a new system, it will be automatically opened and new information will be continuously entered into the text. Therefore, if the original file to be identified is detected as a regular script file, there is no need to perform the operation in step S202. The steps in step S203, which determine the static risk score and static risk level, and subsequent steps, can be executed directly. The static risk score and static risk level are determined based on the original file to be identified and the pre-stored keyword information.

[0109] In summary, the abnormal file detection method provided in this embodiment saves detection time and improves detection efficiency by omitting the parsing step for ordinary files.

[0110] Based on the above embodiments, in an optional embodiment of this application, an abnormal file detection method is provided, which differs from the above embodiments in that the method further includes:

[0111] Step E: Build a blacklist, a whitelist, and a graylist.

[0112] Step F: Receive the identified file information and the identified original file sent by the user client. The identified file information and the identified original file are obtained when the user client starts the pre-stored detection engine to perform abnormal file detection on the pre-stored files.

[0113] In this embodiment, the blacklist can be used to store abnormal files and abnormal file information, the whitelist can be used to store normal files and normal file information, and the graylist can be used to store the original file to be identified and its information. The identified original file can include both normal and abnormal files, and the identified file information can include both normal and abnormal file information.

[0114] Step G: Perform file comparison processing on the identified file information and the pre-stored file information to generate list classification information.

[0115] Step H: Based on the identified original files and list classification information, determine the original files for the blacklist and whitelist.

[0116] In this embodiment, the list classification information can be the detection result information of any pre-stored file in the identified files. For example, if identified file 1 is an abnormal file and identified file 2 is a normal file, then after step H, the original blacklist file is identified file 1 and the whitelist file is identified file 2.

[0117] Step 1: Store the original blacklist file in the blacklist database, store the original whitelist file in the whitelist database, and store the original file to be identified in the graylist database.

[0118] Step J: Based on the abnormal file detection results, adjust and update the blacklist, whitelist, and graylist to generate updated blacklist, whitelist, and graylist.

[0119] In this embodiment, the adjustment and update process refers to moving abnormal files from the gray list to the black list after all original files to be identified are detected, and moving normal files from the gray list to the white list. Generally, the amount of data in the black list and white list will increase after the adjustment and update process, while the amount of data in the gray list will decrease.

[0120] In summary, the abnormal file detection method provided in this embodiment classifies and stores all files sent from the user terminal that have undergone preliminary detection by creating a blacklist, whitelist, and graylist. This provides reference and comparison data for future abnormal file detection, thereby improving the accuracy and efficiency of subsequent abnormal file detection.

[0121] refer to Figure 3 , Figure 3 This is a flowchart illustrating an abnormal file detection method provided in another embodiment of this application. The execution entity of this embodiment may be... Figure 1 The user terminal shown can also be other servers or computer devices connected to the server; this embodiment does not impose any special restrictions on this. Figure 3 As shown, the abnormal file detection method includes:

[0122] S301: Start the pre-stored detection engine to perform abnormal file detection on the pre-stored files and obtain the original file to be identified.

[0123] In this embodiment, the pre-stored detection engine can be a technical mechanism for detecting whether a specific file is an abnormal file, such as the virus file detection engine in antivirus software installed on a computer or mobile phone.

[0124] S302: The original file to be identified is sent to the server. If the server detects that the original file to be identified is a binary file, it performs keyword feature and reverse file parsing on the original file to be identified, generates parsed file information, determines static risk attribute information based on the parsed file information and pre-stored keyword information, performs dynamic analysis on the original file to be identified, generates sensitive action information, determines dynamic analysis data and log records based on the sensitive action information, determines dynamic risk attribute information based on the dynamic analysis data and log records, determines comprehensive risk information based on the static risk attribute information and dynamic risk attribute information, and generates abnormal file detection results for the original file to be identified if the comprehensive analysis results meet the preset risk conditions.

[0125] In this embodiment, after the original file to be identified is sent to the server, the corresponding abnormal file detection process on the server is as follows: Figure 2 The steps, principles, and technical effects shown are similar, and therefore will not be repeated here in this embodiment.

[0126] S303: Receive the abnormal file detection results sent by the server.

[0127] In this embodiment, after receiving the abnormal file detection results sent by the server, the abnormal file can be processed according to the abnormal file detection results, such as deletion, virus removal, or shredding.

[0128] Based on the above embodiments, in an optional embodiment of this application, the method further includes the following step before step S303:

[0129] Step a: Receive the abnormal file detection strategy sent by the server, where the abnormal file detection strategy is determined by the server based on the abnormal file detection results.

[0130] Step b: Perform abnormal file detection operations according to the abnormal file detection strategy.

[0131] In this embodiment, the abnormal file detection strategy can be to select a static detection scheme or a dynamic detection scheme based on the basic description information of the original file to be identified. The user terminal can control the pre-stored detection engine to use an appropriate abnormal file detection strategy to perform detection operations on abnormal files of the same type.

[0132] In summary, the abnormal file detection method provided in this embodiment improves the accuracy of abnormal file detection results by employing appropriate abnormal file detection strategies on the user end for abnormal files of the same type.

[0133] Based on the above embodiments, in an optional embodiment of this application, the abnormal file detection method further includes:

[0134] Step c: Start the pre-stored detection engine to detect abnormal files in the pre-stored files, and obtain the information of the identified files and the original files that have been identified.

[0135] Step d: Send the identified file information and the identified original file to the server so that the server can build a blacklist, whitelist, and graylist. Perform file comparison processing on the identified file information and the pre-stored file information to generate list classification information. Based on the identified original file and the list classification information, determine the blacklist original file and the whitelist original file. Store the blacklist original file in the blacklist database, store the whitelist original file in the whitelist, and store the original file to be identified in the graylist database. Based on the abnormal file detection results, adjust and update the blacklist database, whitelist database, and graylist database to generate the updated blacklist database, whitelist database, and graylist database.

[0136] In this embodiment, when the pre-stored detection engine performs anomaly detection on the pre-stored files locally on the user's end, it generates preliminary detection results. Each pre-stored file corresponds to one detection result. If the detection result of a pre-stored file is an anomaly file or a normal file, then the anomaly file or normal file is sent to the server as the original identified file. In this embodiment, the identified file information may include the path of the identified original file, the numerical hash value obtained by logical operation based on the data of the identified original file content, and the file category, type, and source information of the identified original file.

[0137] In the above method embodiments, respectively using Figure 1 The method for detecting abnormal files is described using the user terminal 101 as the execution entity and the server terminal 102 as the execution entity. Besides... Figure 1 In addition to the application scenarios shown, the above method embodiments can also be used in public cloud and private cloud cluster deployment scenarios. For example, any node in the cluster system can act as a user terminal and the master node as a server terminal. If a file stored in a node in the cluster system cannot be determined as an abnormal file after preliminary detection, it can be sent to the master node for detection. The detection results can be shared with all nodes in the cluster system. In addition, machine learning algorithms can be added for long-term training to improve the detection efficiency and accuracy of abnormal files in the entire cluster system.

[0138] refer to Figure 4 , Figure 4 This is a schematic diagram of the interaction flow of an abnormal file detection method provided in another embodiment of this application. For example... Figure 4 As shown, this abnormal file detection method includes the following steps:

[0139] S401: The user terminal starts the pre-stored detection engine to perform abnormal file detection on the pre-stored file and obtain the original file to be identified.

[0140] S402: The user sends the original file to be identified to the server.

[0141] S403: If the server detects that the original file to be identified is a binary file, it performs keyword feature and reverse file parsing on the original file to be identified, generates parsed file information, and determines static risk attribute information based on the parsed file information and pre-stored keyword information.

[0142] S404: The server performs dynamic analysis and processing on the original file to be identified, generates sensitive action information, and determines dynamic analysis data and log records based on the sensitive action information.

[0143] S405: The server determines dynamic risk attribute information based on dynamic analysis data and log records.

[0144] S406: The server determines the comprehensive risk information based on static risk attribute information and dynamic risk attribute information.

[0145] S407: If the server detects that the comprehensive risk information reaches the preset risk conditions, it generates the abnormal file detection result of the original file to be identified, and determines the abnormal file detection strategy based on the abnormal file detection result.

[0146] S408: The server sends the anomaly detection results and anomaly file detection strategy to the client.

[0147] refer to Figure 5 , Figure 5 This is a schematic diagram of the structure of an abnormal file detection device provided in one embodiment of the present application. The device includes: a first receiving module 51, a parsing module 52, a static detection module 53, a dynamic detection module 54, a strategy analysis and management module 55, and a first sending module 56.

[0148] The first receiving module 51 is used to receive the original file to be identified sent by the user terminal, wherein the original file to be identified is obtained when the user terminal starts the pre-stored detection engine to perform abnormal file detection on the pre-stored file.

[0149] The parsing module 52 is used to perform keyword feature and reverse parsing on the original file to be identified if it is detected that the original file to be identified is a binary file, and generate parsed file information.

[0150] The static detection module 53 is used to determine static risk attribute information based on parsed file information and pre-stored keyword information.

[0151] The dynamic detection module 54 is used to perform dynamic analysis and processing on the original file to be identified and generate sensitive action information; the dynamic detection module 54 is also used to determine dynamic analysis data and log records based on the sensitive action information; the dynamic detection module 54 is also used to determine dynamic risk attribute information based on the dynamic analysis data and log records.

[0152] The strategy analysis and management module 55 is used to determine comprehensive risk information based on static risk attribute information and dynamic risk attribute information; the strategy analysis and management module is also used to generate abnormal file detection results of the original file to be identified if the comprehensive risk information is detected to meet the preset risk conditions.

[0153] The first sending module 56 is used to send the abnormal file detection results to the user terminal.

[0154] In an optional embodiment of this application, the pre-stored keyword information includes various different instructions, and the static risk attribute information includes static risk scores and static risk levels. Accordingly, the static detection module 53 is specifically used to: determine the risk level data corresponding to each instruction based on the parsed file information and the various different instructions; perform risk scoring and cumulative calculation on the risk level data corresponding to all instructions to determine the static risk score; and determine the static risk level based on the static risk score.

[0155] In an optional embodiment of this application, dynamic analysis processing includes dynamic running processing and tracking analysis processing. Accordingly, the dynamic detection module 54 is specifically used for: performing dynamic running processing on the original file to be identified to generate process dynamic information, wherein dynamic running processing is the operation of a preset virtual environment in response to a pre-stored system instruction to start a pre-stored parsing tool; executing a pre-stored running process monitoring program to track and analyze the process dynamic information and generate sensitive action information.

[0156] In an optional embodiment of this application, the dynamic risk attribute information includes a dynamic risk score and a dynamic risk level. Accordingly, the dynamic detection module 54 is further specifically used to: determine the risk score value corresponding to all sensitive actions based on dynamic analysis data and log records; perform cumulative calculation processing on the risk score values ​​to determine the dynamic risk score; and determine the dynamic risk level based on the dynamic risk score.

[0157] In an optional embodiment of this application, the strategy analysis and management module 55 is further specifically used to: if the comprehensive risk information is detected to meet the preset review conditions, then determine the abnormal file detection result of the original file to be identified based on the comprehensive risk information and the pre-stored file description information.

[0158] In an optional embodiment of this application, the strategy analysis and management module 55 is further specifically used to: determine an abnormal file detection strategy based on the abnormal file detection results; and send the abnormal file detection strategy to the user terminal so that the user terminal can perform abnormal file detection operations according to the abnormal file detection strategy.

[0159] In an optional embodiment of this application, the parsing module 52 is further configured to: if the original file to be identified is detected to be a normal script file, then perform the steps of determining the static risk score and static risk level and thereafter.

[0160] In an optional embodiment of this application, the first receiving module 51 is further specifically used for: constructing a blacklist, a whitelist, and a graylist. It receives identified file information and identified original files sent by the user terminal, wherein the identified file information and identified original files are obtained when the user terminal starts a pre-stored detection engine to perform abnormal file detection on pre-stored files. It performs file comparison processing on the identified file information and pre-stored file information to generate list classification information. Based on the identified original files and list classification information, it determines the blacklist original files and whitelist original files; and stores the blacklist original files in the blacklist database. It stores the whitelist original files in the whitelist; and stores the original files to be identified in the graylist database. Based on the abnormal file detection results, it adjusts and updates the blacklist, whitelist, and graylist databases to generate updated blacklist, whitelist, and graylist databases.

[0161] The abnormal file detection device provided in this embodiment can be used to perform the above-mentioned... Figure 2 The technical solutions of the method embodiments shown are similar in implementation principle and technical effect, and will not be described again here.

[0162] refer to Figure 6 , Figure 6 This is a schematic diagram of the structure of an abnormal file detection device provided in another embodiment of this application. Figure 6 As shown, the device includes: a preliminary detection module 61, a second transmitting module 62, and a second receiving module 63.

[0163] The preliminary detection module 61 is used to start the pre-stored detection engine to detect abnormal files in the pre-stored files and obtain the original file to be identified.

[0164] The second sending module 62 is used to send the original file to be identified to the server. If the server detects that the original file to be identified is a binary file, it performs keyword feature and reverse file parsing on the original file to be identified, generates parsed file information, determines static risk attribute information based on the parsed file information and pre-stored keyword information, performs dynamic analysis on the original file to be identified, generates sensitive action information, determines dynamic analysis data and log records based on the sensitive action information, determines dynamic risk attribute information based on the dynamic analysis data and log records, determines comprehensive risk information based on the static risk attribute information and dynamic risk attribute information, and generates abnormal file detection results for the original file to be identified if the comprehensive analysis results meet the preset risk conditions.

[0165] The second receiving module 63 receives the abnormal file detection results sent by the server.

[0166] In an optional embodiment of this application, the second receiving module 63 is further configured to: receive an abnormal file detection strategy sent by the server, wherein the abnormal file detection strategy is determined by the server based on the abnormal file detection results.

[0167] The preliminary detection module 61 is also used to perform abnormal file detection operations according to the abnormal file detection strategy.

[0168] In an optional embodiment of this application, the preliminary detection module 61 is further specifically used to: start the pre-stored detection engine to perform abnormal file detection on the pre-stored files, and obtain the identified file information and the identified original file.

[0169] The second sending module 62 is also specifically used for: sending the identified file information and the identified original file to the server so that the server can build a blacklist, a whitelist and a graylist; performing file comparison processing on the identified file information and the pre-stored file information to generate list classification information; determining the blacklist original file and the whitelist original file based on the identified original file and the list classification information; storing the blacklist original file in the blacklist database; storing the whitelist original file in the whitelist database; storing the original file to be identified in the graylist database; and adjusting and updating the blacklist database, whitelist database and graylist database based on the abnormal file detection results to generate the updated blacklist database, whitelist database and graylist database.

[0170] The abnormal file detection device provided in this embodiment can be used to perform the above-mentioned... Figure 3 The technical solutions of the method embodiments shown are similar in implementation principle and technical effect, and will not be described again here.

[0171] refer to Figure 7 , Figure 7 This is a schematic diagram of the hardware structure of the server system provided in the embodiments of this application, such as... Figure 7As shown, the system includes at least one processor 701 and a memory 702.

[0172] The processor 701 is used to store computer execution instructions.

[0173] The memory 702 is used to execute computer execution instructions stored in the memory to implement the various steps involved in the above method embodiments. For details, please refer to the relevant descriptions in the foregoing method embodiments.

[0174] Alternatively, the memory 702 can be either standalone or integrated with the processor 701.

[0175] When the memory 702 is set up independently, the system also includes a bus 703 for connecting the memory 702 and the processor 701.

[0176] This application also provides a computer-readable storage medium storing computer-executable instructions. When the processor executes the computer-executable instructions, the above-mentioned abnormal file detection method is implemented.

[0177] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described abnormal file detection method.

[0178] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or modules, and may be electrical, mechanical, or other forms.

[0179] The modules described above as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0180] Furthermore, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0181] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute partial steps of the methods of the various embodiments of this application.

[0182] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0183] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0184] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0185] The aforementioned storage medium can be implemented from any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium accessible to general-purpose or special-purpose computers.

[0186] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. Both the processor and the storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic device or host device.

[0187] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0188] This description is intended to illustrate the technical solutions of this application, and not to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. An abnormal file detection method characterized by comprising: The method comprises the following steps: receiving a to-be-identified original file sent by a user terminal, wherein the to-be-identified original file is obtained when the user terminal starts a pre-stored detection engine to detect abnormal files in pre-stored files; if it is detected that the to-be-identified original file is a binary file, performing keyword feature and file reverse analysis processing on the to-be-identified original file to generate parsed file information; determining static risk attribute information according to the parsed file information and pre-stored keyword information; performing dynamic analysis processing on the to-be-identified original file to generate sensitive action information; determining dynamic analysis data and log records according to the sensitive action information; determining dynamic risk attribute information according to the dynamic analysis data and the log records; inputting the static risk attribute information and the dynamic risk attribute information into a policy analysis and management engine to determine comprehensive risk information including risk scores and risk levels of the to-be-identified original file; if it is detected that the comprehensive risk information reaches a pre-set risk condition, generating an abnormal file detection result of the to-be-identified original file; sending the abnormal file detection result to the user terminal.

2. The method of claim 1, wherein, The pre-stored keyword information comprises a plurality of different instructions, and the static risk attribute information comprises a static risk score and a static risk level; correspondingly, the determination of the static risk attribute information according to the parsed file information and the pre-stored keyword information comprises: determining risk degree data corresponding to each instruction according to the parsed file information and the plurality of different instructions; performing risk score and accumulation calculation processing on the risk degree data corresponding to all instructions to determine a static risk score; determining a static risk level according to the static risk score.

3. The method of claim 1, wherein, The dynamic analysis processing comprises dynamic running processing and tracking analysis processing; correspondingly, the dynamic analysis processing on the to-be-identified original file to generate sensitive action information comprises: performing dynamic running processing on the to-be-identified original file to generate process dynamic information, wherein the dynamic running processing is an operation of a pre-set virtual environment in response to a pre-stored system instruction to start a pre-stored analysis tool; executing a pre-stored running process monitoring program to perform tracking analysis processing on the process dynamic information to generate sensitive action information.

4. The method of claim 1, wherein, The dynamic risk attribute information comprises a dynamic risk score and a dynamic risk level; correspondingly, the determination of the dynamic risk attribute information according to the dynamic analysis data and the log records comprises: determining risk score values corresponding to all sensitive actions according to the dynamic analysis data and the log records; performing accumulation calculation processing on the risk score values to determine a dynamic risk score; determining a dynamic risk level according to the dynamic risk score.

5. The method of claim 1, wherein, After the determination of the comprehensive risk information according to the static risk attribute information and the dynamic risk attribute information, the method further comprises: if it is detected that the comprehensive risk information meets a pre-set to-be-reviewed condition, determining an abnormal file detection result of the to-be-identified original file according to the comprehensive risk information and pre-stored file description information.

6. The method of claim 1, wherein, Before the sending of the abnormal file detection result to the user terminal, the method further comprises: determining an abnormal file detection strategy according to the abnormal file detection result; Send the abnormal file detection strategy to the user terminal, so that the user terminal performs an abnormal file detection operation according to the abnormal file detection strategy.

7. The method of claim 1, wherein, After receiving the to-be-identified original file sent by the user terminal, the method further includes: If it is detected that the to-be-identified original file is a normal script file, the steps of determining the static risk score and the static risk level and the subsequent steps are performed.

8. The method according to any one of claims 1 to 7, characterized in that, Further comprising: Building a blacklist library, a whitelist library, and a gray list library; Receiving the identified file information and the identified original file sent by the user terminal, wherein the identified file information and the identified original file are obtained when the user terminal starts a pre-stored detection engine to perform abnormal file detection on the pre-stored file; Performing file comparison processing on the identified file information and the pre-stored file information to generate list classification information; According to the identified original file and the list classification information, determine the black list original file and the white list original file; Storing the black list original file in the black list library; Storing the white list original file in the white list; and storing the to-be-identified original file in the gray list library; According to the abnormal file detection result, adjusting and updating the black list library, the white list library, and the gray list library to generate updated black list library, white list library, and gray list library.

9. An abnormal file detection method characterized by comprising: Including: Starting a pre-stored detection engine to perform abnormal file detection on a pre-stored file to obtain a to-be-identified original file; Sending the to-be-identified original file to the server, so that the server, if it is detected that the to-be-identified original file is a binary file, performs keyword feature and file reverse analysis processing on the to-be-identified original file to generate analysis file information, determines static risk attribute information according to the analysis file information and pre-stored keyword information, performs dynamic analysis processing on the to-be-identified original file to generate sensitive action information, determines dynamic analysis data and log records according to the sensitive action information, determines dynamic risk attribute information according to the dynamic analysis data and the log records, inputs the static risk attribute information and the dynamic risk attribute information into a strategy analysis and management engine, determines comprehensive risk information including risk score and risk level of the to-be-identified original file, and if it is detected that the comprehensive risk information meets a pre-set risk condition, generates an abnormal file detection result of the to-be-identified original file; Receiving the abnormal file detection result sent by the server.

10. The method of claim 9, wherein, Before receiving the abnormal file detection result sent by the server, the method further includes: Receiving an abnormal file detection strategy sent by the server, wherein the abnormal file detection strategy is determined by the server according to the abnormal file detection result; Performing an abnormal file detection operation according to the abnormal file detection strategy.

11. The method according to claim 9 or 10, characterized in that, Further comprising: Starting a pre-stored detection engine to perform abnormal file detection on a pre-stored file to obtain identified file information and an identified original file; The identified file information and the identified original file are sent to the server, so that the server builds a blacklist library, a whitelist library and a gray list library, performs file comparison processing on the identified file information and pre-stored file information, generates list classification information, determines a blacklist original file and a whitelist original file according to the identified original file and the list classification information, stores the blacklist original file into the blacklist library, stores the whitelist original file into the whitelist, stores the to-be-identified original file into the gray list library, adjusts and updates the blacklist library, the whitelist library and the gray list library according to the abnormal file detection result, and generates an updated blacklist library, an updated whitelist library and an updated gray list library.

12. An abnormal file detection device characterized by comprising: Comprise: A first receiving module is configured to receive a to-be-identified original file sent by a user terminal, wherein the to-be-identified original file is obtained when the user terminal starts a pre-stored detection engine to perform abnormal file detection on a pre-stored file; An analysis module is configured to, if it is detected that the to-be-identified original file is a binary file, perform keyword feature and file reverse analysis processing on the to-be-identified original file, and generate analysis file information; A static detection module is configured to determine static risk attribute information according to the analysis file information and pre-stored keyword information; A dynamic detection module is configured to perform dynamic analysis processing on the to-be-identified original file, and generate sensitive action information; The dynamic detection module is further configured to determine dynamic analysis data and log records according to the sensitive action information; and the dynamic detection module is further configured to determine dynamic risk attribute information according to the dynamic analysis data and the log records; A policy analysis and management module is configured to input the static risk attribute information and the dynamic risk attribute information into a policy analysis and management engine, and determine comprehensive risk information including risk score and risk level of the to-be-identified original file; The policy analysis and management module is further configured to, if it is detected that the comprehensive risk information reaches a preset risk condition, generate an abnormal file detection result of the to-be-identified original file; A first sending module is configured to send the abnormal file detection result to the user terminal.

13. An abnormal file detection device characterized by comprising: Comprise: A preliminary detection module is configured to start a pre-stored detection engine to perform abnormal file detection on a pre-stored file, and obtain a to-be-identified original file; The second sending module is configured to send the original file to be identified to the server, so that the server, if detecting that the original file to be identified is a binary file, performs keyword feature and file reverse analysis processing on the original file to be identified to generate analysis file information, determines static risk attribute information according to the analysis file information and pre-stored keyword information, performs dynamic analysis processing on the original file to be identified to generate sensitive action information, determines dynamic analysis data and log records according to the sensitive action information, determines dynamic risk attribute information according to the dynamic analysis data and the log records, inputs the static risk attribute information and the dynamic risk attribute information into a policy analysis and management engine, determines comprehensive risk information including risk score and risk level of the original file to be identified, and if detecting that the comprehensive risk information satisfies a preset risk condition, generates an abnormal file detection result of the original file to be identified. The second receiving module receives the abnormal file detection result sent by the server.

14. A server system, characterized by The method comprises: at least one processor and a memory; the memory stores computer execution instructions; the at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the abnormal file detection method according to any one of claims 1 to 8 or any one of claims 9 to 11.

15. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and when the processor executes the computer execution instructions, the abnormal file detection method according to any one of claims 1 to 8 or any one of claims 9 to 11 is realized.

Images