A malicious code protection method, storage medium and device based on timestamp

Abstract

The present invention relates to the field of malicious code protection technology, and in particular to a malicious code protection method, storage medium and device based on timestamp. It includes: when the creation timestamp or the last modification timestamp of any file in the target terminal is modified, the attribute information of the file in which the timestamp modification behavior occurs in the target terminal in the corresponding preset search time period is obtained; if the number of modified files determined according to the attribute information is greater than the file modification number threshold, then all modified files are subjected to correlation analysis to generate protection alarm information. The present invention first determines whether the modification behavior of the timestamp is caused by malicious code by comparing the number of modified files with the file modification number threshold. In addition, directory name matching operations and malicious vector similarity calculations are used to further confirm whether the file modification is caused by malicious code, so as to further improve the detection accuracy and reduce false alarms.

Description

Background Art

[0002] With the widespread application of information technology, data security and integrity issues in computer systems have received increasing attention. During their attack, malware often hides its activity tracks by tampering with the timestamp information of files, making it difficult for security analysts to accurately track their behavior. This camouflage technology allows malware to bypass many time series-based detection mechanisms, misleading event tracing analysis and increasing the difficulty of malicious behavior detection and evidence collection.

[0003] Traditional file system monitoring methods mainly focus on monitoring changes in file content, while the detection of tampering with file metadata (such as timestamps) is relatively weak. Many malware evade detection by security systems by modifying the creation, modification, or access time of files to make them appear to have already existed or not been tampered with. This disguise method is particularly common in attacks such as ransomware and worm viruses, posing huge security risks to victims.

[0004] At the same time, during the operation of the software, the creation or modification time of the relevant files may be modified due to software updates or to change the software priority. These timestamp modification behaviors are normal. However, the existing method of regularly actively scanning and real-time monitoring of timestamp changes in the file system through the system will also generate false alarms for these normal timestamp modification behaviors, thereby reducing the detection and protection accuracy of malicious files. Summary of the invention

[0005] In view of the above technical problems, the technical solution adopted by the present invention is:

[0006] According to one aspect of the present invention, a malicious code protection method based on timestamp is provided, the method comprising the following steps:

[0007] When the creation timestamp or last modification timestamp of any file in the target terminal is modified, the attribute information of the file whose timestamp modification behavior occurs in the target terminal in the corresponding preset search time period is obtained; the timestamp modification behavior includes creation timestamp modification, last modification timestamp modification and last access timestamp modification;

[0008] If the number of modified files determined according to the attribute information is greater than the file modification number threshold, then a correlation analysis is performed on all modified files;

[0009] The correlation analysis includes:

[0010] Perform a directory name matching operation on the storage path of the folder to which each modified file belongs, and determine the application information to which each modified file belongs;

[0011] If all application information contains multiple applications, an operation behavior vector is generated according to the modification time and file type of each modified file; each element in the operation behavior vector is a feature value of the file type corresponding to the modified file, and all feature values ​​are arranged in the order of modification time of the corresponding modified files; the file types include user data files, system configuration files, network configuration files, system permission files and user credential files;

[0012] The similarity between the operation behavior vector and each attack behavior vector in the preset malicious attack library is calculated, and the highest similarity is used as the malicious feature value corresponding to the operation behavior vector; the similarity calculation is to perform sliding matching calculation between the operation behavior vector and the attack behavior vector;

[0013] If the malicious feature value corresponding to the operation behavior vector is greater than the preset malicious threshold, a protection alarm message is generated.

[0014] Further, the time when the creation timestamp is modified or the time when the timestamp is last modified is within a preset search time period.

[0015] Furthermore, after determining the application information to which each modified file belongs, the method further includes:

[0016] If all application information contains only one application, a blacklist and whitelist match is performed on the application;

[0017] If the application belongs to the blacklist, a protection alarm message is generated.

[0018] Furthermore, the similarity calculation is performed between the operation behavior vector and each attack behavior vector in the preset malicious attack library, including:

[0019] If the two vectors are of different lengths, the shorter vector is slid from the head to the tail of the longer vector, with each sliding step being one element.

[0020] Each time you slide, calculate the cosine similarity between the shorter vector and the corresponding partial vector in the longer vector;

[0021] The maximum value of all cosine similarities generated by sliding matching is taken as the malicious feature value corresponding to the operation behavior vector.

[0022] Furthermore, after generating the malicious feature value corresponding to the operation behavior vector, the method further includes:

[0023] If the malicious feature value corresponding to the operation behavior vector is less than or equal to the preset malicious threshold, no protection alarm information is generated.

[0024] Furthermore, the attribute information includes the modification time, file type, file name and storage path of the folder to which the modified file belongs.

[0025] Further, a directory name matching operation is performed on the storage path of the folder to which each modified file belongs to determine the application information to which each modified file belongs, including:

[0026] Get the installation directory names corresponding to the installation files of all applications in the target terminal;

[0027] A directory name matching operation is performed on each installation directory name and the storage path of the folder to which each modified file belongs; the directory name matching operation starts from the highest-level directory name in the storage path.

[0028] Furthermore, after obtaining the attribute information of the files in which the timestamp modification behavior occurs in the target terminal in the corresponding preset search time period, the method further includes:

[0029] If the last modification time of a file is earlier than the creation time of the file, or the last modification time of a file is earlier than the current time, or the interval between the time corresponding to the timestamp after the file is modified and the time corresponding to the timestamp before the file is modified is greater than the preset time interval, a protection alarm message is generated.

[0030] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned timestamp-based malicious code protection method is implemented.

[0031] According to a third aspect of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned timestamp-based malicious code protection method when executing the computer program.

[0032] The present invention has at least the following beneficial effects:

[0033] In the present invention, if a modification behavior of the creation timestamp or the last modification timestamp is detected in the target terminal, the attribute information of the files that have changed in the preset search time period corresponding to the current trigger time will be obtained. Then, these attribute information are used to determine how many files have been modified. Usually, since malicious code will limit its own attack activities in a short period of time in order to reduce the risk of being discovered, the number of files modified by malicious code during attack activities is relatively small compared to software updates or system updates. Therefore, based on this feature, the present invention first determines whether the modification behavior of the timestamp is caused by malicious code by comparing the number of modified files with the file modification number threshold.

[0034] In addition, when the number of modified files is greater than the file modification number threshold, in order to further determine whether it is caused by malicious code, a directory name matching operation is required to determine the number and name of applications, so as to further match and confirm the black and white lists. At the same time, since malicious code has certain similarities when attacking, when the application information contains multiple applications, the operation behavior vector corresponding to the attack link determined by the modification operation is also required to further confirm whether the file modification is caused by malicious code, so as to further improve the detection accuracy and reduce false alarms. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 A flowchart of a malicious code protection method based on timestamp provided by an embodiment of the present invention.

[0037] Figure 2 A flowchart of correlation analysis provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0039] As a possible embodiment of the present invention, Figure 1 As shown, a malicious code protection method based on timestamp is provided, and the method comprises the following steps:

[0040] S100: When the creation timestamp or last modification timestamp of any file in the target terminal is modified, the attribute information of the file in the target terminal that has the timestamp modification behavior in the corresponding preset search time period is obtained. The timestamp modification behavior includes the creation timestamp modification, the last modification timestamp modification and the last access timestamp modification.

[0041] Specifically, the time when the creation timestamp is modified or the time when the timestamp is last modified is within the preset search time period. The time when the creation timestamp is modified or the time when the timestamp is last modified in this embodiment is actually the departure time that triggers the execution of this method. Usually, the preset search time period can be a time period between a few minutes before and a few minutes after the trigger time. For example, if the trigger time is 22:00, the corresponding preset search time period can be 21:59-22:04.

[0042] Specifically, in order to monitor the actions of modifying the above timestamp, the file system event notification mechanism of the operating system can be used to monitor the timestamp changes of all files in real time. For example, on Windows systems, the ReadDirectoryChangesW function can be used for monitoring, which generates a notification record containing the file change type and the corresponding file name. First, use the CreateFile function to obtain the handle of the target directory, which will be used for subsequent monitoring operations. Then use the ReadDirectoryChangesW function to set the monitoring event and specify the event to be monitored as FILE_NOTIFY_CHANGE_CREATION (creation time). These notification mechanisms can monitor file creation, modification, access and other operations, and record detailed information about timestamp changes. The module will run continuously to ensure that any file operation can be captured and processed immediately.

[0043] In addition, the monitoring intensity of the modification of different file timestamps in this embodiment can also be dynamically adjusted according to factors such as file type, folder location, and operation frequency. For example, system key directories (such as system folders, program directories) and important data files (such as documents, database files) can be more strictly monitored. For temporary files or cache files, monitoring can be appropriately relaxed. Through this strategy, this embodiment can not only improve the efficiency of monitoring, but also more accurately capture potential threat behaviors. The operation history of each file will be recorded in detail, including file name, file path, operation type (such as creation, modification, deletion, etc.), operation time, and operator information. All this information will be stored in a secure database for subsequent analysis. These records help to restore the operation track of the file and help analysts accurately judge the legitimacy and security of the file operation during post-analysis. In this embodiment, the attribute information may include the modification time, file type, file name, and storage path of the folder to which the modified file belongs. The above attribute information can also be obtained in the log of the corresponding period.

[0044] Because, when malicious code is carrying out an attack, the usual attack behavior includes trying to access sensitive files or key locations in the system in order to achieve its attack goals. These goals may include but are not limited to obtaining sensitive information, elevating permissions, implanting backdoors, destroying system functions, etc. When achieving the above attack goals, it is inevitable to access, read, download or modify the files therein. Once these operations are performed, they will inevitably lead to the modification and change of the file's creation timestamp, last modification timestamp or last access timestamp, which is the timestamp modification behavior in this embodiment.

[0045] S200: If the number of modified files determined according to the attribute information is greater than the file modification number threshold, then a correlation analysis is performed on all modified files.

[0046] Specifically, since the attribute information includes the modification time, file type, file name and storage path of the folder to which the modified file belongs, the number of modified files can be determined based on this information, such as the number of file names in the attribute information.

[0047] Usually, in order to reduce the risk of being discovered, malicious code will limit its own attack activities in a short period of time. Therefore, compared with software updates or system updates, the number of files modified by malicious code during attack activities is relatively small. Therefore, based on this feature, the present invention first determines whether the modification behavior of the timestamp is caused by malicious code by comparing the number of modified files with the file modification number threshold. If the number of modified files included in the attribute information is less than the file modification number threshold, it can be roughly determined that it is caused by malicious code, and a protection alarm message can be generated.

[0048] If the number of modified files determined based on the attribute information is greater than the file modification number threshold, a more detailed analysis, namely, subsequent correlation analysis, is required to further determine whether it is caused by malicious code or other normal timestamp modification behaviors.

[0049] like Figure 2 As shown, the correlation analysis includes:

[0050] S201: performing a directory name matching operation on the storage path of the folder to which each modified file belongs, and determining application information to which each modified file belongs.

[0051] S201 includes:

[0052] S211: Obtain the installation directory names corresponding to the installation files of all application programs in the target terminal.

[0053] Usually when installing an application on a terminal, it will be installed in a corresponding installation file (that is, installation directory), and in order to more clearly distinguish different software, the installation directory name of the application is generally highly correlated with the name of the software, such as the installation directory name is the full pinyin name of the software name. Therefore, the installation directory name corresponding to each application on the target terminal can be obtained regularly by manual search, and then a corresponding installation directory table can be formed for subsequent directory matching.

[0054] S221: Perform a directory name matching operation on each installation directory name and the storage path of the folder to which each modified file belongs. The directory name matching operation starts from the highest level directory name in the storage path.

[0055] Specifically, when the match is successful, the application corresponding to the modified file can be determined. If the match is not successful, the application corresponding to the modified file can be marked as a unique program ID. Usually the installation directory of normal files will be set in a relatively shallow system disk, such as D disk or E disk or a folder in E disk. Therefore, the path of the first 3-4 levels in the storage path can be used as the application name. Later, the name of the application corresponding to the modified file can be further determined through manual analysis.

[0056] The storage path of a folder refers to the location of the folder in the computer's file system. The storage path is usually composed of a series of directory (folder) names and their hierarchies to indicate the exact location of the folder.

[0057] In Windows, a path usually starts with a drive letter, such as C:\ or D:\, followed by a folder hierarchy, such as C:\Users\Username\Documents.

[0058] In Linux and macOS systems, the path usually starts from the root directory / , followed by the folder hierarchy, such as / Users / username / Documents. Therefore, based on the characteristics of the above storage path, the names of each file directory in the storage path can be obtained through regular formulas or existing text recognition technology.

[0059] Since the installation directory of the file is generally located closer to the system root directory, that is, at a higher level in the storage path, in this embodiment, when performing the directory name matching operation, the matching starts from the highest-level directory name in the storage path, thereby finding the installation directory more quickly.

[0060] S231: If all the application information contains only one application, a blacklist and whitelist match is performed on the application.

[0061] S241: If the application belongs to the blacklist, a protection alarm message is generated.

[0062] In this embodiment, the directory name matching operation can be used to determine whether the modified file is a file used by the same application program when it is running. When the software is updated, multiple files in the installation directory are usually modified or replaced to ensure that the new version of the software can run normally and contains the latest functions and security patches. Such as the main program file (.exe file), dynamic link library (.dll file), configuration files used by the software (such as .ini, .conf, .xml files) and the software license file (such as .lic file).

[0063] When malicious code attacks, it involves obtaining sensitive data, increasing its own operating permissions, and changing the system's security protection functions. Therefore, it usually modifies files in folders in multiple different locations, such as files that store sensitive information, configuration files for system permissions, and system security protection files.

[0064] In summary, based on the above characteristics, by matching the directory name, we can further determine whether the file modification operation is caused by malicious code or a normal software update operation. At the same time, after determining the application name, we can further determine whether the corresponding application belongs to the program corresponding to the malicious code by matching the blacklist and whitelist.

[0065] S202: If all application information contains multiple applications, an operation behavior vector is generated according to the modification time and file type of each modified file. Each element in the operation behavior vector is a feature value of the file type corresponding to the modified file, and all feature values ​​are arranged in the order of the modification time of the corresponding modified file. File types include user data files, system configuration files, network configuration files, system permission files, and user credential files.

[0066] If all application information contains multiple applications, it is possible that malicious code is obtaining relevant data of users in different applications, or implanting code in different applications without authorization, and modifying the source code or binary file of the application to insert additional functions or features. It is also possible that the software is being updated in batches or the system is being updated. However, the file types targeted by the modification behavior performed by the malicious code when implementing the attack are different from the file types targeted by the software update or system update. At the same time, the attack links formed by the modification behavior performed by the same malicious code when implementing the attack are highly similar. Therefore, in this embodiment, the modification behavior of the file is formed according to the chronological order of occurrence to form an operation behavior vector.

[0067] S203: Calculate the similarity between the operation behavior vector and each attack behavior vector in the preset malicious attack library, and use the highest similarity as the malicious feature value corresponding to the operation behavior vector. The similarity calculation is to perform sliding matching calculation between the operation behavior vector and the attack behavior vector.

[0068] The attack behavior vector in the preset malicious attack library can be formed by the attack link implemented in each attack cycle when the determined malicious code is attacking. The method of determining the elements in the vector is the same as the method of generating the operation behavior vector in S202.

[0069] Specifically, similarity calculation includes:

[0070] S213: If the lengths of the two vectors are different, the shorter vector is slid and matched sequentially from the head to the tail of the longer vector, and the sliding step length of each time is one element.

[0071] S223: After each sliding, the cosine similarity between the shorter vector and the corresponding partial vector in the longer vector is calculated.

[0072] S233: The maximum value of all cosine similarities generated by sliding matching is used as the malicious feature value corresponding to the operation behavior vector.

[0073] S204: If the malicious feature value corresponding to the operation behavior vector is greater than a preset malicious threshold, a protection alarm message is generated.

[0074] S205: If the malicious feature value corresponding to the operation behavior vector is less than or equal to the preset malicious threshold, no protection alarm information is generated.

[0075] Since the preset search time period in this embodiment is artificially determined, it may happen that the time period cannot completely include a complete attack cycle, or the time period is greater than a complete attack cycle, so the corresponding operation behavior vector may lack elements or contain noise elements. Therefore, when performing vector matching, a sliding matching method is used to calculate the similarity, and the highest similarity is used as the corresponding malicious feature value, thereby avoiding the influence of the missing elements or noise elements mentioned above, so as to improve the accuracy of the similarity calculation.

[0076] The present invention can quickly detect the timestamp forged by malicious software by real-time monitoring of the changes in the timestamp, making it difficult for malicious behavior to be hidden by tampering with time information, thereby improving the detection capability of malicious code.

[0077] After the malicious code is identified, protection alarm information is generated. At the same time, the operation history of the malicious file can be recorded in detail through the log, including every detail of the timestamp change. By comparing the historical log and real-time data, the operation history of the source file can be accurately traced, thereby improving the audit capability of the system.

[0078] In addition, in order to ensure the integrity and authenticity of the log, the present invention can also use encrypted signature technology to protect the timestamps recorded in the log. This means that each timestamp will be encrypted and digitally signed when it is recorded to ensure that it cannot be tampered with during storage or transmission. Only authorized users with the correct key can verify these signatures, thereby ensuring the credibility of the log data. The log is protected by encrypted signature technology to ensure that it cannot be tampered with. This greatly enhances the ability of event tracing and auditing, and helps to quickly locate the source of malicious behavior.

[0079] You can also regularly generate audit reports of file timestamp operations based on the detection and protection results, and display the history and analysis results of file operations in the form of charts, data tables, etc. The audit report will record in detail the operation behavior of each file, the abnormal timestamp changes detected, and the response measures taken by the user. These reports not only help users fully understand the operation of system files, but also provide a strong basis for security analysis.

[0080] After S100, the method further includes:

[0081] S300: If the last modification time of the file is earlier than the creation time of the file, or the last modification time of the file is earlier than the current time, or the interval between the time corresponding to the timestamp after the file is modified and the time corresponding to the timestamp before the file is modified is greater than the preset time interval, a protection alarm message is generated.

[0082] The determination scheme of this step can directly determine the modification of the timestamp by the following malicious code:

[0083] Time reversal: The modification time of a file is tampered with to be earlier than its creation time, or the modification time of a file is modified to a time earlier than the current time. This is usually done by malware to avoid security detection based on time period filtering for recent periods. For example, a certain NET worm will copy itself to a newly created folder and create a shortcut in the Windows startup directory. It can automatically run at each system startup to ensure persistence between system restarts. In addition, it will also modify the creation and modification dates of its files to a time earlier than the current time to avoid suspicion when users manually check recently installed software.

[0084] Time jump: The timestamp of a file suddenly jumps significantly into the future or past, usually caused by malware to cover up its operation traces.

[0085] When the above or other abnormal timestamp changes are detected, the alarm mechanism will be triggered immediately, and the user will be notified through pop-up windows, emails, SMS, etc. The alarm information will include the affected files, the type of abnormality detected, and the recommended treatment measures.

[0086] In addition, the method in S300 can also be applied to the periodic detection of the timestamp information of all files in scan-sensitive locations (such as system folders, temporary folders, startup folders, etc.). During the scanning process, the creation time, modification time and access time of the file will be checked for consistency. For files with unreasonable timestamps, such as the modification time is earlier than the creation time, the timestamp is set to a certain time point in the future, and the files in the system folder have no digital signature but the timestamp is the same as the system file (files in the system folder should usually be signed by trusted developers. If a file has no signature but shares the same timestamp as the system file, it may be malicious code), when the scan finds the file in the above situation, it is determined that the file is abnormal and a protection alarm message is generated.

[0087] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0088] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0089] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0090] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0091] The electronic device according to this embodiment of the present invention is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0092] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one storage device mentioned above, and a bus connecting different system components (including storage devices and processors).

[0093] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0094] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0095] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0096] The bus may represent one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0097] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication may be performed through an input / output (I / O) interface. In addition, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. The network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0098] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0099] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0100] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0101] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0102] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0103] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0104] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0105] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0106] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A malicious code protection method based on timestamp, characterized in that: The method comprises the following steps: When the creation timestamp or last modification timestamp of any file in the target terminal is modified, the attribute information of the file in the target terminal that has the timestamp modification behavior in the corresponding preset search time period is obtained; the timestamp modification behavior includes creation timestamp modification, last modification timestamp modification and last access timestamp modification; If the number of modified files determined according to the attribute information is greater than the file modification number threshold, then performing a correlation analysis on all the modified files; The correlation analysis includes: Perform a directory name matching operation on the storage path of the folder to which each modified file belongs, and determine the application information to which each modified file belongs; If all the application information contains multiple application programs, an operation behavior vector is generated according to the modification time and file type of each modified file; each element in the operation behavior vector is a feature value of the file type corresponding to the modified file, and all feature values ​​are arranged in the order of modification time of the corresponding modified files; the file types include user data files, system configuration files, network configuration files, system permission files and user credential files; Calculate the similarity between the operation behavior vector and each attack behavior vector in a preset malicious attack library, and use the highest similarity as the malicious feature value corresponding to the operation behavior vector; the similarity calculation is to perform a sliding matching calculation between the operation behavior vector and the attack behavior vector; If the malicious feature value corresponding to the operation behavior vector is greater than a preset malicious threshold, a protection alarm message is generated; Calculating the similarity between the operation behavior vector and each attack behavior vector in a preset malicious attack library includes: If the lengths of the two vectors are different, the shorter vector is slid from the head to the tail of the longer vector, with each sliding step being one element. Each time you slide, calculate the cosine similarity between the shorter vector and the corresponding partial vector in the longer vector; The maximum value of all the cosine similarities generated by sliding matching is used as the malicious feature value corresponding to the operation behavior vector; Perform a directory name matching operation on the storage path of the folder to which each modified file belongs to determine the application information to which each modified file belongs, including: Obtaining the names of installation directories corresponding to the installation files of all applications in the target terminal; A directory name matching operation is performed on each of the installation directory names and the storage path of the folder to which each modified file belongs; the directory name matching operation is performed starting from the highest-level directory name in the storage path.

2. The method according to claim 1, characterized in that The time when the creation timestamp is modified or the time when the timestamp is last modified is within the preset search time period.

3. The method according to claim 1, characterized in that After determining the application information to which each modified file belongs, the method further includes: If all the application information contains only one application, a blacklist and whitelist match is performed on the application; If the application belongs to the blacklist, a protection alarm message is generated.

4. The method according to claim 1, characterized in that After generating the malicious feature value corresponding to the operation behavior vector, the method further includes: If the malicious feature value corresponding to the operation behavior vector is less than or equal to the preset malicious threshold, no protection alarm information is generated.

5. The method according to claim 1, characterized in that The attribute information includes the modification time, file type, file name and storage path of the folder to which the modified file belongs.

6. The method according to claim 1, characterized in that After acquiring the attribute information of the file in which the timestamp modification behavior occurs in the target terminal in the corresponding preset search time period, the method further includes: If the last modification time of a file is earlier than the creation time of the file, or the last modification time of a file is earlier than the current time, or the interval between the time corresponding to the timestamp after the file is modified and the time corresponding to the timestamp before the file is modified is greater than the preset time interval, a protection alarm message is generated.

7. A non-transitory computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for protecting against malicious code based on timestamp as described in any one of claims 1 to 6 is implemented.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the malicious code protection method based on timestamp as described in any one of claims 1 to 6 is implemented.

Images