A method, device, equipment and storage medium for detecting and warning malicious files

Abstract

The embodiment of the present application discloses a method, device, equipment and storage medium for detecting and warning malicious files, including: receiving suspicious files sent by a unified management platform, performing sandbox detection, semantic analysis and static detection on the suspicious files respectively, and obtaining sandbox detection results, semantic analysis results and static detection results; determining that the suspicious file is a malicious file when the sandbox detection results, semantic analysis results and static detection results match the malicious feature codes in the preset risk database; performing data analysis on the malicious feature codes in the malicious files based on the preset risk database, and obtaining security logs, disposal suggestions, emergency operation links and marking fields; inputting the security logs, disposal suggestions, emergency operation links and marking fields into the set alarm model, generating alarm information of malicious files and sending them to the unified management platform for alarm. The detection capability of feature codes of unknown new malicious files is improved, and the alarm information is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a method, device, equipment and storage medium for detecting and warning of malicious files. Background Art

[0002] Malicious files are program files with attack intent, which can perform malicious tasks when executed, such as spreading viruses, Trojans, and worms, etc. In the art, host intrusion detection systems are usually installed to monitor and analyze malicious files to ensure the integrity and security of the system.

[0003] In the related art, when detecting malicious code, a hexadecimal feature code of no more than 64 bytes is usually extracted from the malicious file, and the extracted feature code is matched with the feature code in the malicious code feature library. If the extracted feature code is the same as the feature code in the malicious code library, it is considered that there is maliciousness in the malicious file and an alarm message is sent to the client. However, the update of the malicious code feature library is delayed, and the alarm message is too simple. Criminals can create new feature codes through technical means such as automatic deformation and compression obfuscation to circumvent existing malicious detection methods, and the alarm message generally only contains the type of virus. Therefore, the existing technology lacks the means to detect the feature codes of unknown new malicious files, and the alarm information is incomplete, which affects the efficiency of operation and maintenance personnel in blocking attacks and cannot fully guarantee the security of the program. Summary of the invention

[0004] The embodiments of the present application provide a malicious file detection and alarm method, apparatus, device and storage medium, which solve the problems of delayed update of malicious code feature library, overly simple alarm information, inability of host intrusion detection system to detect feature codes of unknown new malicious files, and incomplete alarm information, improve the coverage and rapid update capability of the malicious code feature library, improve the host intrusion detection system's detection capability of feature codes of unknown new malicious files, further improve the alarm information, enable operation and maintenance personnel to directly block attack behaviors according to the alarm information, improve the efficiency of blocking attacks, and fully ensure the security of the program.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting and alerting malicious files, including:

[0006] Receiving suspicious files sent by the unified management platform, performing sandbox detection, semantic analysis and static detection on the suspicious files respectively, and obtaining sandbox detection results, semantic analysis results and static detection results;

[0007] In the case where the sandbox detection result, the semantic analysis result, and the static detection result match the malicious signature code in the preset risk database, determining that the suspicious file is a malicious file;

[0008] Perform security data analysis on the malicious signature code in the malicious file based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links and marking fields;

[0009] The security log, the disposal suggestion, the emergency operation link and the marking field are input into the set alarm model, and the alarm information of the malicious file is generated and sent to the unified management platform for alarm.

[0010] Optionally, the preset risk database includes a first sub-signature code library, a second sub-signature code library and a third sub-signature code library, and after receiving the suspicious file sent by the unified management platform, further includes:

[0011] Extracting hash files and source files from the suspicious files;

[0012] Accordingly, the sandbox detection result, the semantic analysis result, and the static detection result are matched with malicious signatures in a preset risk database, including:

[0013] The first sub-signature code library contains source codes matching the source file, the second sub-signature code library contains hash values ​​matching the hash file, and the third sub-signature code library contains attack feature data matching the suspicious file.

[0014] Optionally, performing a sandbox detection on the suspicious file to obtain a sandbox detection result includes:

[0015] Inputting the source file into a sandbox environment, and determining a traversal path of the source file in the sandbox environment;

[0016] Correspondingly, the first sub-signature code library contains source codes matching the source file, including:

[0017] The first sub-signature code library contains source codes matching the traversal path.

[0018] Optionally, performing semantic analysis on the suspicious file to obtain a semantic analysis result includes:

[0019] Perform semantic analysis on the hash file through the AI ​​big model to determine the high-risk calling interface corresponding to the hash file;

[0020] Correspondingly, the second sub-signature code library contains a hash value matching the hash file, including:

[0021] The second sub-signature code library contains a hash value matching the high-risk calling interface.

[0022] Optionally, the performing security data analysis on the malicious feature code in the malicious file based on the association relationship in the preset risk database to obtain a security log, a disposal suggestion, an emergency operation link, and a marking field includes:

[0023] Determining an operation and maintenance management platform associated with the preset risk database based on a database identifier in the preset risk database, searching the operation and maintenance management platform for alarm asset information corresponding to the malicious feature code in the malicious file, and automatically retrieving the security log associated with the malicious feature code within a preset time from the alarm asset information, and,

[0024] generating a cut-off interface for the malicious file according to the association between the malicious feature code and the cut-off interface in the preset risk database, generating an emergency operation link according to the cut-off interface, and,

[0025] generating a disposal suggestion for the malicious file based on the association relationship between the malicious signatures and the disposal suggestions in the first sub-signature library, the second sub-signature library, and the third sub-signature library, and,

[0026] The malicious feature code associated with the malicious file in the preset risk library is read, and the malicious field in the malicious feature code is marked to obtain a marked field.

[0027] Optionally, before receiving the suspicious file sent by the unified management platform, the method further includes:

[0028] Malicious intelligence files from various websites are collected through a crawler program, the malicious intelligence files are formatted according to the current intelligence library format, features are extracted from the formatted malicious intelligence files to obtain malicious feature codes, and the malicious feature codes are stored in a preset risk database.

[0029] Optionally, after generating the warning information of the malicious file, it also includes:

[0030] Sending the alarm information to the unified management platform so that the user can send a disconnection instruction by clicking an emergency operation link in the alarm information;

[0031] The cut-off instruction is received, and the threat path is cut off according to the cut-off interface and the operation behavior in the emergency operation link, wherein the operation behavior includes one or more of an isolation operation, a deletion operation, a restoration operation, and a whitelisting operation.

[0032] In a second aspect, an embodiment of the present application provides a malicious file detection and warning device, including:

[0033] The detection module is used to receive suspicious files sent by the unified management platform, perform sandbox detection, semantic analysis and static detection on the suspicious files, and obtain sandbox detection results, semantic analysis results and static detection results;

[0034] A malicious file judgment module, configured to determine that the suspicious file is a malicious file when the malicious feature codes in the sandbox detection result, the semantic analysis result, and the static detection result all match the malicious feature codes in a preset risk database;

[0035] A security data analysis module, used to perform security data analysis on the malicious feature codes in the malicious files based on the association relationship in the preset risk database, and obtain security logs, disposal suggestions, emergency operation links and marking fields;

[0036] The alarm module is used to input the security log, the disposal suggestion, the emergency operation link and the marking field into the set alarm model, generate alarm information of malicious files and send it to the unified management platform for alarm.

[0037] In a third aspect, an embodiment of the present application provides a malicious file detection and alarm device, the device comprising: one or more processors; a storage device configured to store one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the malicious file detection and alarm method described in the first aspect.

[0038] In a fourth aspect, an embodiment of the present application provides a storage medium comprising computer executable instructions, which, when executed by a computer processor, are used to execute the malicious file detection and alarm method as described in the first aspect.

[0039] The embodiment of the present application receives suspicious files sent by a unified management platform, performs sandbox detection, semantic analysis and static detection on the suspicious files, and obtains sandbox detection results, semantic analysis results and static detection results; when the sandbox detection results, semantic analysis results and static detection results match the malicious feature codes in a preset risk database, the suspicious file is determined to be a malicious file; security data analysis is performed on the malicious feature codes in the malicious files based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links and marking fields; the security logs, disposal suggestions, emergency operation links and marking fields are input into the set alarm model to generate alarm information of the malicious file and send it to the unified management platform for alarm. By performing multi-source analysis and detection on suspicious files, such as sandbox detection, semantic analysis, and static detection, the detection process is not limited to the comparison of historical malicious signatures of the current application, and the ability to discover and detect signatures of unknown new malicious files is improved. By performing security data analysis on malicious signatures in malicious files, security logs, disposal suggestions, emergency operation links, and marking fields are obtained, which can make the alarm information rich and detailed, including multi-dimensional analysis results, and can provide comprehensive support for the research and judgment strategies of operation and maintenance personnel, and correspondingly improve the maintenance efficiency of operation and maintenance personnel. By displaying the emergency operation link in the alarm information, it can ensure that the operation and maintenance personnel can quickly isolate the threat of malicious files with one click, avoiding the further spread of malicious behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of a malicious file detection and warning method provided by an embodiment of the present application;

[0041] Figure 2 This is a schematic diagram of an alarm model provided in an embodiment of the present application;

[0042] Figure 3 It is a flow chart of a security data analysis method for malicious signature codes provided in an embodiment of the present application;

[0043] Figure 4 It is a structural diagram of a malicious file detection and alarm device provided in an embodiment of the present application;

[0044] Figure 5 It is a structural diagram of a malicious file detection and alarm device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical scheme and advantages of the present application clearer, the specific embodiments of the present application are further described in detail below in conjunction with the accompanying drawings. It is understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for the convenience of description, only part of the present application is shown in the accompanying drawings, but not all of the content. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow chart describes each operation (or step) as a sequential process, many of the operations therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but it can also have additional steps not included in the accompanying drawings. The process can correspond to a method, a function, a procedure, a subroutine, a subprogram, etc.

[0046] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0047] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0048] The following, in conjunction with the accompanying drawings, describes in detail the malicious file detection and alarm method, device, equipment and medium provided by the embodiments of the present application through specific embodiments and their application scenarios.

[0049] The application scenario of the embodiment of the present application can be to analyze the data in the received suspicious file to determine whether the suspicious file is a malicious file with threat information. When the suspicious file is determined to be a malicious file with threat information, a complete alarm information is generated based on the data analysis result of the suspicious file, so that the operation and maintenance personnel can timely block the malicious file with threat according to the complete alarm information to ensure the security of the application. Based on the above usage scenario, it can be understood that the execution subject of this solution can be a host intrusion detection and defense system or a server.

[0050] Figure 1 is a flow chart of a malicious file detection and warning method provided by an embodiment of the present application, such as Figure 1 As shown, including:

[0051] Step S101: receiving a suspicious file sent by a unified management platform, performing sandbox detection, semantic analysis and static detection on the suspicious file, and obtaining a sandbox detection result, a semantic analysis result and a static detection result.

[0052] In one embodiment, the unified management platform is a platform for operation and maintenance personnel to maintain and manage data. A suspicious file may be a file containing threat information, which can be obtained by monitoring data through a monitoring device installed on a client. Sandbox detection is a security detection method based on isolation technology. By creating a virtual isolation environment, the code or file to be detected is placed in the virtual isolation environment for operation to detect whether there is a potential security risk. Sandbox detection can simulate the real operating environment, making the detection result more authentic and reliable. Semantic analysis is a logical stage of the compilation process. The task of semantic analysis is to review the context-related properties and type review of the structurally correct source program. Semantic analysis is to review whether the source program has semantic errors and collect type information for the code generation stage. Static detection refers to the use of dedicated software testing tools to review software documents or programs without executing the tested code, measure the static complexity of the program, and check whether the software meets the programming standards, so as to find the deficiencies of the written program and reduce the probability of errors. In one embodiment, after receiving a suspicious file sent by a unified management platform, the suspicious file is input into a sandbox environment for sandbox detection to determine whether there are potential security risks in the suspicious file. At the same time, a semantic analysis is performed on the data content in the suspicious file to determine whether there are semantic errors in the suspicious file. At the same time, a static detection is also performed on the suspicious file to check whether the code data in the file meets the programming standards.

[0053] Step S102: When the sandbox detection result, the semantic analysis result, and the static detection result match the malicious signature in a preset risk database, determining that the suspicious file is a malicious file.

[0054] The preset risk database is used to store malicious data with threats detected in history, and the malicious data may include malicious signature codes and data associated with different malicious signature codes. Among them, the data associated with the signature code may be the virus type corresponding to the malicious signature code, and the threat level corresponding to the malicious signature code. The malicious signature code may be a virus, malware, malicious code, and a specific identifier in the malicious code. A malicious file is a file containing a malicious signature code. In one embodiment, it can be determined that there is a potential security risk in a suspicious file according to the sandbox detection result, and the potential security risk can be represented in the form of a signature code. It is determined whether there is a logical error signature code in the suspicious file according to the semantic analysis result, and the logical error signature code is determined to be a malicious signature code. It is determined whether there is a written error signature code in the suspicious file according to the static detection result, and the written error signature code is determined to be a malicious signature code. The malicious signature code in any one of the sandbox detection result, the semantic analysis result, and the static detection result is compared with the malicious signature code stored in the preset risk database. If the comparison is successful, the suspicious file can be considered to be a malicious file. In another embodiment, the malicious feature codes in each of the sandbox detection results, semantic analysis results and static detection results are compared with the malicious feature codes stored in a preset risk database. If all comparisons are successful, the suspicious file can be considered to be a malicious file.

[0055] Step S103: Perform security data analysis on the malicious feature codes in the malicious files based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links, and marking fields.

[0056] Among them, security data analysis can be a method for analyzing the generation of malicious signature codes, analyzing the virus type and threat level to which the malicious signature codes belong, and can also analyze the quick processing solution for the malicious signature codes. The security log is used to record access records of suspicious files or malicious files or record operation records on suspicious files or malicious files. The disposal suggestion can be a method for processing the detected malicious signature code to prevent the application from being threatened by the malicious signature code. The emergency operation link can be an execution entry for quickly blocking malicious signature codes from attacking the application. The marking field is a marking field obtained by marking the malicious field in the malicious file. The specific field marking method can be identified according to actual needs, which will not be repeated here.

[0057] In one embodiment, after determining that the suspicious file is a malicious file, security data analysis is performed on the malicious signature code in the malicious file according to the data in the preset risk database. Exemplarily, the application corresponding to the malicious signature code is searched in the preset risk database according to the malicious signature code, and the malicious signature code and historical alarm request information are sent to the operation and maintenance personnel of the application, and the security log, disposal suggestion, emergency operation link and marking field are obtained by receiving the historical alarm information sent by the relevant operation and maintenance personnel.

[0058] Step S104: input the security log, the disposal suggestion, the emergency operation link and the marking field into the set alarm model, generate the alarm information of the malicious file and send it to the unified management platform for alarm.

[0059] The alarm model is a model that formats the data in the security data analysis results according to preset rules or sequences. Figure 2 is a schematic diagram of an alarm model provided in an embodiment of the present application, such as Figure 2 As shown, in the alarm model, the emergency operation link is output in the first line of the alarm information, followed by the output in the order of disposal suggestions, security logs, and marking fields. The alarm information can be information output after the data in the security data analysis results are sorted and sorted according to the rules. The alarm information also includes security logs, disposal suggestions, emergency operation links, and marking fields. The operation and maintenance personnel can quickly block malicious feature codes based on the received alarm information, and can further analyze the causes of the threat, as well as methods to prevent the threat. In one embodiment, the security log, disposal suggestions, emergency operation links, and marking fields obtained from the data security analysis are respectively input into the pre-set alarm model. The alarm model outputs the corresponding alarm information according to the preset information output order, and sends the alarm information to the unified management platform for alarm, so that the operation and maintenance personnel can timely block the malicious feature codes that pose a threat in the malicious files based on the alarm information, thereby ensuring the security of the application.

[0060] The embodiment of the present application receives suspicious files sent by a unified management platform, performs sandbox detection, semantic analysis and static detection on the suspicious files, and obtains sandbox detection results, semantic analysis results and static detection results; when the sandbox detection results, semantic analysis results and static detection results match the malicious feature codes in a preset risk database, the suspicious file is determined to be a malicious file; security data analysis is performed on the malicious feature codes in the malicious files based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links and marking fields; the security logs, disposal suggestions, emergency operation links and marking fields are input into the set alarm model to generate alarm information of the malicious file and send it to the unified management platform for alarm. By performing multi-source analysis and detection on suspicious files, such as sandbox detection, semantic analysis, and static detection, the detection process is not limited to the comparison of historical malicious signatures of the current application, and the ability to discover and detect signatures of unknown new malicious files is improved. By performing security data analysis on malicious signatures in malicious files, security logs, disposal suggestions, emergency operation links, and marking fields are obtained, which can make the alarm information rich and detailed, including multi-dimensional analysis results, and can provide comprehensive support for the research and judgment strategies of operation and maintenance personnel, and correspondingly improve the maintenance efficiency of operation and maintenance personnel. By displaying the emergency operation link in the alarm information, it can ensure that the operation and maintenance personnel can quickly isolate the threat of malicious files with one click, avoiding the further spread of malicious behavior.

[0061] In one embodiment, the preset risk database includes a first sub-signature code library, a second sub-signature code library and a third sub-signature code library, and after receiving the suspicious file sent by the unified management platform, further includes:

[0062] Extracting hash files and source files from the suspicious files;

[0063] Accordingly, the malicious signatures in the sandbox detection result, the semantic analysis result, and the static detection result are matched with the malicious signatures in the preset risk database, including:

[0064] The first sub-signature code library contains source codes matching the source file, the second sub-signature code library contains hash values ​​matching the hash file, and the third sub-signature code library contains attack feature data matching the suspicious file.

[0065] Among them, the first sub-signature database can be a multi-source database for storing collected multi-source intelligence files. The second sub-signature code library can be an expert knowledge base for storing data of specific practical experience, such as domain knowledge, rules, methods and skills. The third sub-signature code library can be a comprehensive log analysis platform built by Ruijie Network using big data technology, which is compatible with most brands of security equipment, network equipment, servers, host systems, middleware, etc. in the market, comprehensively analyzes heterogeneous security information, filters invalid data, presents network security situation, and provides customers with extremely simple network security analysis operations. Hash files, also known as hash files, are files organized using hash storage methods, also known as direct access files. It is similar to a hash table, that is, it can design a hash function and a method for handling conflicts based on the characteristics of keywords in the file, and hash the records to the storage device. In the hash file, a function can be used to complete a mapping of malicious signature codes to memory addresses (calling interfaces), and the target calling interface is obtained through function calculation based on the malicious signature code given by the user. Source file refers to the result of saving the code written in assembly language as a file. Assembly language is any low-level language used in electronic computers, microprocessors, microcontrollers or other programmable devices, also known as symbolic language. In different devices, assembly language corresponds to different machine language instruction sets and is converted into machine instructions through the assembly process. Attack signature data is the malicious signature code in suspicious files other than hash files and source files.

[0066] In one embodiment, after obtaining a suspicious file, a hash file and a source file in the suspicious file are extracted, a sandbox detection is performed on the source file in a sandbox environment, and by determining whether there is a source code matching the source file in the first sub-signature code library, it is determined whether there is a malicious signature code in the source file, and a semantic analysis is performed on the hash file by using a semantic analysis technology, and by determining whether there is a hash value matching the hash file in the second sub-signature code library, it is determined whether there is a malicious signature code in the hash file, and by using a static detection technology, data other than the hash file and the source file in the suspicious file is checked to determine whether there is a malicious signature code in the suspicious file. By determining whether there is a malicious signature code matching the malicious signature code other than the hash file and the source file in the third sub-signature code library, it is determined whether there are other malicious signature codes in the suspicious file.

[0067] In the above, by extracting the hash file and the source file from the suspicious file, there is a source code matching the source file in the first sub-signature library, a hash value matching the hash file in the second sub-signature library, and attack feature data matching the suspicious file in the third sub-signature library. By extracting data from the suspicious file and using different detection methods based on the different types of data extracted, the accuracy of malicious feature code detection can be improved, and the detection efficiency of malicious feature codes can be further improved.

[0068] In one embodiment, performing sandbox detection on the suspicious file to obtain a sandbox detection result includes:

[0069] Inputting the source file into a sandbox environment, and determining a traversal path of the source file in the sandbox environment;

[0070] Correspondingly, the first sub-signature code library contains source codes matching the source file, including:

[0071] The first sub-signature code library contains source codes matching the traversal path.

[0072] Among them, the traversal path can be the path of the malicious feature code to perform attack operations in the application. Exemplarily, when the source file is input into the sandbox environment, a series of high-risk behavior features such as traversing the intranet, actively connecting to the C&C server, loading memory to execute malicious payloads, etc. are tracked in the sandbox environment, then the traversal path of the source file is determined to be intranet-actively connecting to the C&C server-loading memory to execute malicious payloads, and the source code consistent with the traversal path is searched in the first sub-feature database. In one embodiment, after determining the traversal path, it is determined whether each independent source code in the traversal path is consistent with the source code in the first sub-feature database. Exemplarily, there is a source code consistent with any one or more of "intranet", "actively connecting to the C&C server", and "loading memory to execute malicious payloads" in the first sub-feature database. If so, the source file is determined to be a malicious file.

[0073] As described above, by inputting the source file into the sandbox environment, determining the traversal path of the source file in the sandbox environment, and judging whether there is a source code matching the traversal path in the first sub-signature code library, the attack status of the current data can be quickly determined based on the traversal path, thereby quickly generating a corresponding disposal strategy based on the traversal path.

[0074] In one embodiment, performing semantic analysis on the suspicious file to obtain a semantic analysis result includes:

[0075] Perform semantic analysis on the hash file through the AI ​​big model to determine the high-risk calling interface corresponding to the hash file;

[0076] Correspondingly, the second sub-signature code library contains a hash value matching the hash file, including:

[0077] The second sub-signature code library contains a hash value matching the high-risk calling interface.

[0078] Among them, AI big model refers to a machine learning model with super-large-scale parameters and super-powerful computing resources, which can process massive data and complete various complex tasks, such as natural language processing and image recognition. This model usually contains billions to tens of billions of parameters, and requires a large amount of computing resources and data for training and reasoning. The emergence of AI big model stems from the demand for improving the performance of deep learning models. They are high-precision deep learning models trained with large-scale data, algorithms and computing power, with a computing power of trillions of times, and can achieve human or even surpass human performance in the fields of speech recognition, natural language processing, image recognition, etc. Among them, the hash value can be used to represent the calling interface of data. Exemplarily, the hash file is semantically analyzed by the AI ​​big model, and it is found that the hash file contains high-risk calling interfaces such as memory read and write, network communication, etc. In the second sub-signature code library, it is searched whether there is a hash value identical to the memory read and write interface and the network communication interface. If so, the hash file is determined to be a malicious file.

[0079] As mentioned above, by using the AI ​​big model to perform semantic analysis on the hash file, the high-risk call interface corresponding to the hash file is determined, and it is determined that there is a hash value matching the high-risk call interface in the second sub-signature code library. By finding the matching data call interface, an emergency operation link can be generated, thereby improving the efficiency of blocking viruses.

[0080] In one embodiment, before receiving the suspicious file sent by the unified management platform, the method further includes:

[0081] Malicious intelligence files from various websites are collected through a crawler program, the malicious intelligence files are formatted according to the current intelligence library format, features are extracted from the formatted malicious intelligence files to obtain malicious feature codes, and the malicious feature codes are stored in a preset risk database.

[0082] Among them, the crawler program is a program or script that automatically crawls information in a specified area by disguising itself as a client server according to certain rules. The malicious intelligence file is a historical malicious file stored in each website, which contains malicious feature codes, corresponding disposal methods, and the causes of the malicious threat, etc. In one embodiment, since the data storage formats in each website are different, it is not convenient to perform security data analysis on the malicious feature codes in the malicious files. Therefore, it is necessary to format the malicious intelligence files of each website collected by the crawler program according to the same preset format, so that the data format in each malicious intelligence file is the same, and extract the malicious feature codes in the formatted malicious intelligence files, and store the malicious feature codes and their associated data in the preset risk database for subsequent security data analysis of the malicious feature codes.

[0083] As described above, malicious intelligence files from various websites are collected through crawler programs, the malicious intelligence files are formatted according to the current intelligence library format, features are extracted from the formatted malicious intelligence files to obtain malicious feature codes, and the malicious feature codes are stored in a preset risk database. Multi-source intelligence files can be integrated to enable the malicious code library to have extremely high coverage and rapid update capabilities, and by formatting data of different formats in the collected multi-source intelligence files, the data formats in the multi-source files are unified, which is convenient for subsequent security data analysis of malicious feature codes and correspondingly improves the efficiency of warnings for malicious files.

[0084] In one embodiment, after generating the warning information of the malicious file, the method further includes:

[0085] Sending the alarm information to the unified management platform so that the user can send a disconnection instruction by clicking an emergency operation link in the alarm information;

[0086] The cut-off instruction is received, and the threat path is cut off according to the cut-off interface and the operation behavior in the emergency operation link, wherein the operation behavior includes one or more of an isolation operation, a deletion operation, a restoration operation, and a whitelisting operation.

[0087] Among them, the cut-off interface is a high-risk interface that calls data through malicious signatures. The operation behavior can be an attack behavior or a threatening behavior against the application program through malicious signatures. The threat path can be a path traversed when the application program attacks. The isolation operation can refer to isolating the high-risk interface from the interface that calls other data in the application program to avoid endangering the security data. The deletion operation refers to deleting the data that has been attacked. The recovery operation refers to fully restoring the original data after performing antivirus operations on all data. The whitening operation refers to the operating system and software running on the computer being reinstalled after being tampered with, thereby invalidating the existing malicious program. In one embodiment, after sending the alarm information to the unified management platform, the operation and maintenance can send a cut-off instruction to the server or host intrusion detection and defense system by clicking the emergency operation link in the displayed alarm information. After receiving the cut-off instruction sent by the client, the server or host intrusion detection and defense system randomly selects an operation to block the virus from the isolation operation, the deletion operation, the recovery operation and the whitening operation to ensure the security of the data in the application program.

[0088] As mentioned above, by receiving the cut-off instruction, the threat path is cut off according to the cut-off interface and operation behavior in the emergency operation link. The operation behavior includes one or more of isolation operation, deletion operation, recovery operation and whitelisting operation. It can be quickly isolated with one click and effectively control the spread of risks. There is no need for operation and maintenance personnel to further determine the virus blocking method based on the alarm information, which further improves the efficiency of virus blocking.

[0089] Figure 3 is a flow chart of a method for security data analysis of malicious signatures provided in an embodiment of the present application, such as Figure 3 As shown, including:

[0090] Step S301: receiving suspicious files sent by a unified management platform, performing sandbox detection, semantic analysis and static detection on the suspicious files, and obtaining sandbox detection results, semantic analysis results and static detection results.

[0091] Step S302: When the sandbox detection result, the semantic analysis result, and the static detection result match the malicious signature in a preset risk database, determining that the suspicious file is a malicious file, wherein the preset risk database includes a first sub-signature library, a second sub-signature library, and a third sub-signature library.

[0092] Step S303: determine the operation and maintenance management platform associated with the preset risk database based on the database identifier in the preset risk database, search for the alarm asset information corresponding to the malicious feature code in the malicious file in the operation and maintenance management platform, and automatically retrieve the security log associated with the malicious feature code within a preset time from the alarm asset information.

[0093] Among them, the database identifier can be the name of the preset risk database. The operation and maintenance management platform is a platform for managing and maintaining the data in the application, which may include operation and maintenance logs, operation and maintenance operation records, etc. In order to improve the comprehensiveness of the search data, the database can be associated with the operation and maintenance management platform, and other data associated with the data in the database can be obtained in the associated operation and maintenance management platform according to the name of the database. The alarm asset information can be all information associated with the malicious feature code in the operation and maintenance management platform, and the alarm asset information may include the person in charge, business, and confidentiality level, etc. In one embodiment, the operation and maintenance management platform associated with the database is searched according to the database name of the preset risk database, and the alarm asset information such as the person in charge, business, and confidentiality level associated with the malicious feature code in the malicious file is searched in the operation and maintenance management platform, and the scheme record of accessing the alarm asset information within the preset time or the security log related to the feature code is retrieved in the alarm asset information. Exemplarily, the preset time is ten minutes before or after the current time.

[0094] Step S304: Generate a cut-off interface for the malicious file according to the association between the malicious feature code and the cut-off interface in the preset risk database, and generate an emergency operation link according to the cut-off interface.

[0095] Among them, the cut-off interface is a data call interface for blocking attacks. In one embodiment, while obtaining the security log, other data associated with the current malicious feature code can be determined based on the mapping relationship between the various data in the preset risk database. Optionally, the cut-off interface associated with the malicious feature code in the malicious file is determined by the association relationship between the malicious feature code and the call interface in the preset risk database, and an emergency operation link is generated based on the cut-off interface. The operation and maintenance personnel can directly determine the corresponding cut-off interface after clicking on the emergency operation link, and avoid attacks on other security data by blocking the cut-off interface.

[0096] Step S305: Generate a disposal suggestion for the malicious file based on the association relationship between the malicious signatures and the disposal suggestions in the first sub-signature library, the second sub-signature library, and the third sub-signature library.

[0097] In one embodiment, a first disposal suggestion associated with a malicious signature in the comparison result between a suspicious file and a first signature library is searched in the first signature library. A disposal suggestion associated with the malicious signature in the comparison result between a suspicious file and a second signature library is searched in the second signature library. A third disposal suggestion associated with the malicious signature in the comparison result between a suspicious file and a third signature library is searched in the third signature library, and the first disposal suggestion, the second disposal suggestion, and the third disposal suggestion are integrated to finally generate a complete disposal suggestion.

[0098] Step S306: read the malicious feature code associated with the malicious file in the preset risk library, and mark the malicious field in the malicious feature code to obtain a marked field.

[0099] Since the malicious features detected this time are all obtained based on comparison with the preset risk database, the malicious feature codes are stored in the preset risk database. Therefore, in one embodiment, while obtaining the security log and complete disposal suggestions, the malicious feature codes detected this time are read in the preset risk database, and the malicious fields in the malicious feature codes are marked. Different symbols can be used for marking according to different field types.

[0100] Step S307: input the security log, the disposal suggestion, the emergency operation link and the marking field into the set alarm model, generate the alarm information of the malicious file and send it to the unified management platform for alarm.

[0101] In the above, the operation and maintenance management platform associated with the preset risk database is determined based on the database identifier in the preset risk database, the alarm asset information corresponding to the malicious feature code in the malicious file is searched in the operation and maintenance management platform, and the security log associated with the malicious feature code within the preset time is automatically retrieved in the alarm asset information, and the malicious file cut-off interface is generated according to the association relationship between the malicious feature code and the cut-off interface in the preset risk database, and the emergency operation link is generated according to the cut-off interface, and the malicious file disposal suggestion is generated based on the association relationship between the malicious feature code and the processing suggestion in the first sub-feature code library, the second sub-feature code library and the third sub-feature code library, and the malicious feature code associated with the malicious file in the preset risk library is read, and the malicious field in the malicious feature code is marked to obtain the marking field. By performing security data analysis on the malicious feature code in the malicious file, the security log, the disposal suggestion, the emergency operation link and the marking field can be obtained, which can make the alarm information rich and detailed, including multi-dimensional analysis results, and can provide comprehensive support for the research and judgment strategy of the operation and maintenance personnel, and also correspondingly improve the maintenance efficiency of the operation and maintenance personnel.

[0102] Figure 4is a schematic diagram of the structure of a malicious file detection and warning device provided in an embodiment of the present application, such as Figure 4 As shown, including:

[0103] The detection module 41 is used to receive suspicious files sent by the unified management platform, perform sandbox detection, semantic analysis and static detection on the suspicious files, and obtain sandbox detection results, semantic analysis results and static detection results;

[0104] A malicious file determination module 42, configured to determine that the suspicious file is a malicious file when the malicious feature codes in the sandbox detection result, the semantic analysis result, and the static detection result all match the malicious feature codes in a preset risk database;

[0105] A security data analysis module 43, configured to perform security data analysis on the malicious signatures in the malicious files based on the associations in the preset risk database, and obtain security logs, disposal suggestions, emergency operation links, and marking fields;

[0106] The alarm module 44 is used to input the security log, the disposal suggestion, the emergency operation link and the marking field into the set alarm model, generate alarm information of malicious files and send it to the unified management platform for alarm.

[0107] The embodiment of the present application receives suspicious files sent by a unified management platform, performs sandbox detection, semantic analysis and static detection on the suspicious files, and obtains sandbox detection results, semantic analysis results and static detection results; when the sandbox detection results, semantic analysis results and static detection results match the malicious feature codes in a preset risk database, the suspicious file is determined to be a malicious file; security data analysis is performed on the malicious feature codes in the malicious files based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links and marking fields; the security logs, disposal suggestions, emergency operation links and marking fields are input into the set alarm model to generate alarm information of the malicious file and send it to the unified management platform for alarm. By performing multi-source analysis and detection on suspicious files, such as sandbox detection, semantic analysis, and static detection, the detection process is not limited to the comparison of historical malicious signatures of the current application, and the ability to discover and detect signatures of unknown new malicious files is improved. By performing security data analysis on malicious signatures in malicious files, security logs, disposal suggestions, emergency operation links, and marking fields are obtained, which can make the alarm information rich and detailed, including multi-dimensional analysis results, and can provide comprehensive support for the research and judgment strategies of operation and maintenance personnel, and correspondingly improve the maintenance efficiency of operation and maintenance personnel. By displaying the emergency operation link in the alarm information, it can ensure that the operation and maintenance personnel can quickly isolate the threat of malicious files with one click, avoiding the further spread of malicious behavior.

[0108] In a possible embodiment, the preset risk database includes a first sub-signature code library, a second sub-signature code library and a third sub-signature code library;

[0109] The malicious file detection and warning device also includes a file extraction module, which is used to:

[0110] Extracting hash files and source files from the suspicious files;

[0111] Malicious file determination module 42, used for:

[0112] The first sub-signature code library contains source codes matching the source file, the second sub-signature code library contains hash values ​​matching the hash file, and the third sub-signature code library contains attack feature data matching the suspicious file.

[0113] In a possible embodiment, the detection module 41 is used to:

[0114] Inputting the source file into a sandbox environment, and determining a traversal path of the source file in the sandbox environment;

[0115] Malicious file determination module 42, used for:

[0116] The first sub-signature code library contains source codes matching the traversal path.

[0117] In a possible embodiment, the detection module 41 is used to:

[0118] Perform semantic analysis on the hash file through the AI ​​big model to determine the high-risk calling interface corresponding to the hash file;

[0119] Malicious file determination module 42, used for:

[0120] The second sub-signature code library contains a hash value matching the high-risk calling interface.

[0121] In a possible embodiment, the security data analysis module 43 is used to:

[0122] Determining an operation and maintenance management platform associated with the preset risk database based on a database identifier in the preset risk database, searching the operation and maintenance management platform for alarm asset information corresponding to the malicious feature code in the malicious file, and automatically retrieving the security log associated with the malicious feature code within a preset time from the alarm asset information, and,

[0123] generating a cut-off interface for the malicious file according to the association between the malicious feature code and the cut-off interface in the preset risk database, generating an emergency operation link according to the cut-off interface, and,

[0124] generating a disposal suggestion for the malicious file based on the association relationship between the malicious signatures and the disposal suggestions in the first sub-signature library, the second sub-signature library, and the third sub-signature library, and,

[0125] The malicious feature code associated with the malicious file in the preset risk library is read, and the malicious field in the malicious feature code is marked to obtain a marked field.

[0126] The malicious file detection and warning device also includes a file collection module, which is used to:

[0127] Malicious intelligence files from various websites are collected through a crawler program, the malicious intelligence files are formatted according to the current intelligence library format, features are extracted from the formatted malicious intelligence files to obtain malicious feature codes, and the malicious feature codes are stored in a preset risk database.

[0128] In a possible embodiment, the malicious file detection and warning device further includes an information sending module and a path cutting module, wherein the information sending module is used to:

[0129] Sending the alarm information to the unified management platform so that the user can send a disconnection instruction by clicking an emergency operation link in the alarm information;

[0130] Path cutting module, used for:

[0131] The cut-off instruction is received, and the threat path is cut off according to the cut-off interface and the operation behavior in the emergency operation link, wherein the operation behavior includes one or more of an isolation operation, a deletion operation, a restoration operation, and a whitelisting operation.

[0132] The embodiment of the present application also provides a malicious file detection and alarm device, which can integrate a malicious file detection and alarm device provided in the embodiment of the present application. Figure 5 This is a schematic diagram of the structure of a malicious file detection and alarm device provided in an embodiment of the present application, referring to Figure 5 The malicious file detection and alarm device includes: an input device 53, an output device 54, a memory 52 and one or more processors 51; the memory 52 is used to store one or more programs; when one or more programs are executed by one or more processors 51, the one or more processors 51 implement the malicious file detection and alarm method provided in the above embodiment. The input device 53, the output device 54, the memory 52 and the processor 51 can be connected by a bus or other means. Figure 5 The example of connecting through bus is taken in the following.

[0133] The memory 52, as a computing device readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the malicious file detection and alarm method provided in any embodiment of the present application. The memory 52 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, at least one application required for a function; the data storage area may store data created according to the use of the device, etc. In addition, the memory 52 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 52 may further include a memory remotely arranged relative to the processor 51, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0134] The input device 53 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 54 may include a display device such as a display screen.

[0135] The processor 51 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 52, that is, implements the above-mentioned malicious file detection and alarm method.

[0136] The malicious file detection and warning apparatus, device and computer provided above can be used to execute the malicious file detection and warning method provided in any of the above embodiments, and have corresponding functions and beneficial effects.

[0137] The embodiment of the present application further provides a storage medium storing computer executable instructions. When the computer executable instructions are executed by a computer processor, they are used to execute the malicious file detection and warning method provided in the above embodiment. The malicious file detection and warning method includes:

[0138] Receiving suspicious files sent by the unified management platform, performing sandbox detection, semantic analysis and static detection on the suspicious files respectively, and obtaining sandbox detection results, semantic analysis results and static detection results;

[0139] In the case where the sandbox detection result, the semantic analysis result, and the static detection result match the malicious signature code in the preset risk database, determining that the suspicious file is a malicious file;

[0140] Perform security data analysis on the malicious signature code in the malicious file based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links and marking fields;

[0141] The security log, the disposal suggestion, the emergency operation link and the marking field are input into the set alarm model, and the alarm information of the malicious file is generated and sent to the unified management platform for alarm.

[0142] Storage medium - any of various types of memory devices or storage devices. The term "storage medium" is intended to include: installation media, such as CD-ROM, floppy disk or tape device; computer system memory or random access memory, such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (such as hard disk or optical storage); registers or other similar types of memory elements, etc. Storage media may also include other types of memory or combinations thereof. In addition, the storage medium may be located in the first computer system in which the program is executed, or may be located in a different second computer system, which is connected to the first computer system via a network (such as the Internet). The second computer system can provide program instructions to the first computer for execution. The term "storage medium" may include two or more storage media that may reside in different locations (for example, in different computer systems connected by a network). The storage medium may store program instructions (for example, embodied as a computer program) that can be executed by one or more processors.

[0143] Of course, the storage medium containing computer executable instructions provided in the embodiment of the present application is not limited to the malicious file detection and alarm method described above, and can also execute related operations in the malicious file detection and alarm method provided in any embodiment of the present application.

[0144] The malicious file detection and alarm apparatus, device and storage medium provided in the above embodiments can execute the malicious file detection and alarm method provided in any embodiment of the present application. For technical details not described in detail in the above embodiments, please refer to the malicious file detection and alarm method provided in any embodiment of the present application.

[0145] The above are only preferred embodiments of the present application and the technical principles used. The present application is not limited to the specific embodiments described herein, and various obvious changes, readjustments and substitutions that can be made by those skilled in the art will not deviate from the scope of protection of the present application. Therefore, although the present application is described in more detail through the above embodiments, the present application is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for detecting and warning malicious files, characterized in that: include: Receiving suspicious files sent by the unified management platform, performing sandbox detection, semantic analysis and static detection on the suspicious files respectively, and obtaining sandbox detection results, semantic analysis results and static detection results; In the case where the sandbox detection result, the semantic analysis result, and the static detection result match the malicious signature in a preset risk database, determining that the suspicious file is a malicious file, the preset risk database includes a first sub-signature database, a second sub-signature database, and a third sub-signature database; Perform security data analysis on the malicious signature code in the malicious file based on the preset risk database to obtain security logs, disposal suggestions, emergency operation links and marking fields; Input the security log, the disposal suggestion, the emergency operation link and the marking field into the set alarm model, generate the alarm information of the malicious file and send it to the unified management platform for alarm; Extracting hash files and source files from the suspicious files; The sandbox detection, semantic analysis and static detection are respectively performed on the suspicious file to obtain the sandbox detection result, the semantic analysis result and the static detection result, including: Performing sandbox detection on the source file in a sandbox environment, determining whether there is a malicious signature code in the source file by judging whether there is a source code matching the source file in the first sub-signature code library, performing semantic analysis on the hash file by using a semantic analysis technology, determining whether there is a malicious signature code in the hash file by judging whether there is a hash value matching the hash file in the second sub-signature code library, and checking data other than the hash file and the source file in the suspicious file by using a static detection technology to determine whether there is a malicious signature code in the suspicious file; Accordingly, the sandbox detection result, the semantic analysis result, and the static detection result are matched with malicious signatures in a preset risk database, including: The first sub-signature library contains source codes that match the source file, the second sub-signature library contains hash values ​​that match the hash file, and the third sub-signature library contains attack feature data that matches data in the suspicious file other than the hash file and the source file.

2. The method for detecting and warning malicious files according to claim 1, characterized in that: Performing sandbox detection on the suspicious file to obtain a sandbox detection result includes: Inputting the source file into a sandbox environment, and determining a traversal path of the source file in the sandbox environment; Correspondingly, the first sub-signature code library contains source codes matching the source file, including: The first sub-signature code library contains source codes matching the traversal path.

3. The malicious file detection and warning method according to claim 1 is characterized in that: Performing semantic analysis on the suspicious file to obtain semantic analysis results includes: Perform semantic analysis on the hash file through the AI ​​big model to determine the high-risk calling interface corresponding to the hash file; Correspondingly, the second sub-signature code library contains a hash value matching the hash file, including: The second sub-signature code library contains a hash value matching the high-risk calling interface.

4. The method for detecting and warning malicious files according to claim 1, characterized in that: The security data analysis of the malicious feature code in the malicious file based on the association relationship in the preset risk database to obtain the security log, disposal suggestion, emergency operation link and marking field includes: Determining an operation and maintenance management platform associated with the preset risk database based on a database identifier in the preset risk database, searching the operation and maintenance management platform for alarm asset information corresponding to the malicious feature code in the malicious file, and automatically retrieving the security log associated with the malicious feature code within a preset time from the alarm asset information, and, generating a cut-off interface for the malicious file according to the association between the malicious feature code and the cut-off interface in the preset risk database, generating an emergency operation link according to the cut-off interface, and, generating a disposal suggestion for the malicious file based on the association relationship between the malicious signatures and the disposal suggestions in the first sub-signature library, the second sub-signature library, and the third sub-signature library, and, The malicious feature code associated with the malicious file in the preset risk library is read, and the malicious field in the malicious feature code is marked to obtain a marked field.

5. The malicious file detection and warning method according to claim 1 is characterized in that: Before receiving the suspicious file sent by the unified management platform, the method further includes: Malicious intelligence files from various websites are collected through a crawler program, the malicious intelligence files are formatted according to the current intelligence library format, features are extracted from the formatted malicious intelligence files to obtain malicious feature codes, and the malicious feature codes are stored in a preset risk database.

6. The method for detecting and warning malicious files according to claim 1, characterized in that: After generating the warning information of malicious files, it also includes: Sending the alarm information to the unified management platform so that the user can send a disconnection instruction by clicking an emergency operation link in the alarm information; Receive the cut-off instruction, and cut off the threat path according to the cut-off interface and operation behavior in the emergency operation link. The operation behavior includes one or more of isolation operation, deletion operation, recovery operation and whitelisting operation. The whitelisting operation refers to the operation behavior of reinstalling the running operating system and software after being tampered with, so as to render the existing malicious program invalid.

7. A malicious file detection and warning device, characterized in that: include: The detection module is used to receive suspicious files sent by the unified management platform, perform sandbox detection, semantic analysis and static detection on the suspicious files, and obtain sandbox detection results, semantic analysis results and static detection results; A file extraction module, used to extract hash files and source files from the suspicious files; a malicious file judgment module, configured to determine that the suspicious file is a malicious file when the sandbox detection result, the semantic analysis result, and the static detection result match the malicious signature in a preset risk database, wherein the preset risk database includes a first sub-signature library, a second sub-signature library, and a third sub-signature library, and when the first sub-signature library contains a source code that matches the source file, the second sub-signature library contains a hash value that matches the hash file, and the third sub-signature library contains attack signature data that matches data in the suspicious file other than the hash file and the source file, the suspicious file is determined to be a malicious file; A security data analysis module, used to perform security data analysis on the malicious feature codes in the malicious files based on the association relationship in the preset risk database, and obtain security logs, disposal suggestions, emergency operation links and marking fields; An alarm module, used for inputting the security log, the disposal suggestion, the emergency operation link and the marking field into a set alarm model, generating alarm information of malicious files and sending it to the unified management platform for alarm; The detection module is specifically used to perform sandbox detection on the source file in a sandbox environment, determine whether there is a malicious signature code in the source file by judging whether there is a source code matching the source file in the first sub-signature code library, perform semantic analysis on the hash file by using semantic analysis technology, determine whether there is a malicious signature code in the hash file by judging whether there is a hash value matching the hash file in the second sub-signature code library, and check the data in the suspicious file except the hash file and the source file by using static detection technology to determine whether there is a malicious signature code in the suspicious file.

8. A malicious file detection and warning device, the device comprising: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, enables the one or more processors to implement the malicious file detection and alarm method as described in any one of claims 1-6.

9. A storage medium storing computer executable instructions, wherein the computer executable instructions, when executed by a computer processor, are used to execute the malicious file detection and warning method according to any one of claims 1 to 6.

Images