Cursor movement simulation method, device, medium and equipment in sandbox

Abstract

The present application provides a method, device, medium and equipment for simulating cursor movement in a sandbox, which relates to the field of information security. The method includes: obtaining at least one cursor movement simulation program; in response to receiving a file to be detected, if the estimated risk level corresponding to the above-mentioned file to be detected is a preset risk level, then obtaining a target cursor movement simulation program corresponding to the file to be detected according to each of the above-mentioned cursor movement simulation programs and the preset simulation program splicing rules. The present application allows malicious code to be "deceived" so that it can normally execute the corresponding malicious behavior even if it cannot detect that it is in a sandbox. Its malicious behavior can be recorded by the sandbox.

Description

Background Art

[0002] In the field of malicious file detection, using sandboxes for detection is a common detection method. In an isolated environment, the sandbox allows malicious files to execute and monitors their behavior in real time. Dynamic analysis is the core of sandbox detection. It determines whether a malicious file is malicious by capturing its network activities, file operations, registry changes and other behavioral characteristics during runtime.

[0003] In order to avoid sandbox detection, malicious files can reversely determine whether they are running in a sandbox by moving the cursor. Different malicious files have different risk levels. Malicious files with higher risk levels have more accurate reverse judgments on whether they are running in a sandbox. Therefore, for malicious files with different risk levels, how to avoid detection of themselves running in a sandbox is an urgent problem to be solved in this field. Summary of the invention

[0004] In view of this, the present application provides a method, device, medium and equipment for simulating cursor movement in a sandbox, which at least partially solve the technical problems existing in the prior art. The technical solution adopted by the present application is:

[0005] According to one aspect of the present application, a method for simulating cursor movement in a sandbox is provided, the method comprising:

[0006] Obtain at least one cursor movement simulation program; wherein each of the above cursor movement simulation programs has a corresponding movement duration; the movement duration is determined according to the interface type attributes of the front-end interface and the number of cursor movements when the corresponding cursor movement simulation program is generated.

[0007] In response to receiving a file to be detected, if the estimated risk level corresponding to the above file to be detected is the preset risk level, then a target cursor movement simulation program corresponding to the file to be detected is obtained according to each of the above cursor movement simulation programs and the preset simulation program splicing rules; wherein the above file to be detected has a corresponding movement simulation duration; the movement simulation duration corresponding to the file to be detected whose estimated risk level is the preset risk level is greater than the movement duration corresponding to any cursor movement simulation program; and the movement duration corresponding to the target cursor movement simulation program is equal to or greater than the movement simulation duration corresponding to the file to be detected; the above target cursor movement simulation program is used to control the movement of the cursor in the sandbox when the above file to be detected is running in the sandbox.

[0008] In an exemplary embodiment of the present application, the obtaining of at least one cursor movement simulation program includes:

[0009] In a target time window, corresponding cursor movement data of a plurality of devices in a plurality of front-end interfaces are collected to obtain the number of cursor movement times in each collection time period in the target time window.

[0010] If the interface type attribute of the corresponding front-end interface is a preset interface type attribute, the corresponding collection time periods are determined as available time periods; if the interface type attribute of the corresponding front-end interface is a non-preset interface type attribute, the collection time periods in which the cursor moves more than the preset number of times are determined as available time periods; otherwise, they are determined as non-available time periods.

[0011] A corresponding cursor movement simulation program is generated according to the cursor movement data corresponding to each available time period in a number of continuous available time periods greater than the preset number of continuous time periods.

[0012] In an exemplary embodiment of the present application, the target cursor movement simulation program corresponding to the file to be detected is obtained according to each of the above-mentioned cursor movement simulation programs and the preset simulation program splicing rule, including:

[0013] According to the file to be detected and each of the above cursor movement simulation programs, an intermediate cursor movement simulation program is obtained.

[0014] Get the motion simulation duration corresponding to the file to be detected.

[0015] The target unavailable time period is determined according to the movement simulation time period, the movement time period corresponding to the intermediate cursor movement simulation program, and the unavailable time period list corresponding to the target sandbox.

[0016] Each available time period in the intermediate cursor movement simulation program is spliced ​​with the target unavailable time period to obtain a corresponding target cursor movement simulation program.

[0017] In an exemplary embodiment of the present application, the intermediate cursor movement simulation program is obtained according to the file to be detected and each of the cursor movement simulation programs, including:

[0018] According to each of the above-mentioned cursor movement simulation programs, several preset sandboxes are obtained; wherein each preset sandbox has at least one corresponding cursor movement simulation program; each preset sandbox has a corresponding comparison feature vector; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree with the central device feature vector of the preset sandbox.

[0019] According to the feature vector of the device to be detected, a target sandbox is determined from a number of preset sandboxes; wherein the target sandbox is determined based on the feature vector of the device to be detected and a comparison feature vector corresponding to each preset sandbox; the target sandbox is used to run the file to be detected, and when running the file to be detected, a target cursor movement simulation program is executed to control the cursor in the target sandbox to move according to the target cursor movement simulation program.

[0020] The target matching degree between the file to be detected and each cursor movement simulation program corresponding to the target sandbox is obtained respectively.

[0021] The cursor movement simulation program with the highest target matching degree is determined as the middle cursor movement simulation program.

[0022] In an exemplary embodiment of the present application, according to each of the above cursor movement simulation programs, a plurality of preset sandboxes are obtained, including:

[0023] The device characteristics of the source device corresponding to each cursor movement simulation program are obtained to obtain the device characteristic vector corresponding to each cursor movement simulation program.

[0024] According to the device feature vector corresponding to each cursor movement simulation program, a plurality of the cursor movement simulation programs are clustered to obtain n cluster sets; wherein any cluster set includes at least one cursor movement simulation program.

[0025] A corresponding sandbox environment is constructed according to each of the above clustering sets to obtain n preset sandboxes; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each preset sandbox has a corresponding comparison feature vector.

[0026] In an exemplary embodiment of the present application, the time length ST corresponding to the above-mentioned movement simulation time length, the time length JT corresponding to the movement time length of the above-mentioned intermediate cursor movement simulation program, and the time length FT corresponding to the target unavailable time period meet the following conditions:

[0027] rounddown(x(JT+FT) / ST)=1

[0028] And JT / FT∈(QD xin , QD xax )

[0029] Among them, QD xin The lower limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the middle cursor movement simulation program; QD xax is the upper limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the middle cursor movement simulation program; x is the preset coefficient; rounddown() is the preset floor function.

[0030] In an exemplary embodiment of the present application, the above-mentioned file to be detected has a corresponding movement simulation duration, and each cursor movement simulation program has a corresponding movement duration; respectively obtaining the target matching degree between the file to be detected and each cursor movement simulation program corresponding to the target sandbox includes:

[0031] The time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each cursor movement simulation program is obtained.

[0032] The device matching degree between the device feature vector to be detected corresponding to the file to be detected and the device feature vector corresponding to each cursor movement simulation program is obtained.

[0033] According to the time period matching degree, the device matching degree, the time period importance coefficient corresponding to the time period matching degree, and the device importance coefficient corresponding to the device matching degree, the target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained.

[0034] According to one aspect of the present application, a device for simulating cursor movement in a sandbox is provided, the device comprising:

[0035] An acquisition unit is used to acquire at least one cursor movement simulation program; wherein each of the above cursor movement simulation programs has a corresponding movement duration; the movement duration is determined based on the interface type attributes of the front-end interface and the number of cursor movements when the corresponding cursor movement simulation program is generated.

[0036] A determination unit is used for, in response to receiving a file to be detected, if the estimated risk level corresponding to the above-mentioned file to be detected is a preset risk level, obtaining a target cursor movement simulation program corresponding to the file to be detected according to each of the above-mentioned cursor movement simulation programs and the preset simulation program splicing rules; wherein the above-mentioned file to be detected has a corresponding movement simulation duration; the movement simulation duration corresponding to the file to be detected whose estimated risk level is the preset risk level is greater than the movement duration corresponding to any cursor movement simulation program; and the movement duration corresponding to the target cursor movement simulation program is equal to or greater than the movement simulation duration corresponding to the file to be detected; the above-mentioned target cursor movement simulation program is used to control the movement of the cursor in the sandbox when the above-mentioned file to be detected is run in the sandbox.

[0037] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the above-mentioned method of simulating cursor movement in a sandbox.

[0038] According to one aspect of the present application, an electronic device is provided, comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0039] This application has at least the following beneficial effects:

[0040] The cursor movement simulation method in the sandbox of the present application first obtains at least one cursor movement simulation program, each of which has a corresponding movement duration; the movement duration is determined according to the interface type attribute of the front-end interface and the number of cursor movements when the corresponding cursor movement simulation program is generated. Furthermore, if the risk level corresponding to the file to be detected is the preset risk level, its ability to detect whether it is in the sandbox is stronger, and a longer mouse operation simulation time is required. And because the length of the movement simulation duration corresponding to the preset risk level is greater than the movement duration of each initial cursor movement simulation program, it is necessary to perform a preset splicing process on the initial cursor movement simulation program to make its duration longer, so as to obtain the corresponding target cursor movement simulation program. The malicious code is "deceived" so that even if it cannot detect that it is in the sandbox, the corresponding malicious behavior is normally executed. Its malicious behavior can be recorded by the sandbox. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 A flowchart of a method for simulating cursor movement in a sandbox provided by the present application;

[0043] Figure 2 This is a structural block diagram of the cursor movement simulation device in the sandbox provided by this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0045] like Figure 1 As shown, a method for simulating cursor movement in a sandbox is provided according to an embodiment of the present application. The method comprises the following steps:

[0046] Step S100, obtaining at least one cursor movement simulation program; wherein each of the above cursor movement simulation programs has a corresponding movement duration; the movement duration is determined according to the interface type attributes of the front-end interface when the corresponding cursor movement simulation program is generated and the number of cursor movements.

[0047] Specifically, the cursor movement simulation program is obtained through the following steps:

[0048] Step S110, within the target time window, collecting the cursor movement data corresponding to the plurality of devices in the plurality of front-end interfaces, so as to obtain the number of cursor movement times within each collection time period within the target time window.

[0049] As an example: the target time window may be 12 hours, and the above front-end interface is a front-end interface corresponding to the collection of the corresponding cursor movement data.

[0050] Step S120, if the interface type attribute of the corresponding front-end interface is a preset interface type attribute, the corresponding collection time periods are determined as available time periods; if the interface type attribute of the corresponding front-end interface is a non-preset interface type attribute, the collection time period in which the cursor moves more than the preset number of times is determined as an available time period; otherwise, it is determined as a non-available time period.

[0051] Here, the preset interface type attribute can be the interface type attribute (application type) corresponding to the front-end interface with a relatively small number of cursor movements. For example, the preset interface type attribute is a video playback application because the video playback application is used to play videos, and there is no need to frequently move or operate the cursor during video playback. At this time, if the interface type attribute of the corresponding front-end interface is the preset interface type attribute, if the number of mouse clicks corresponding to the corresponding collection time period is relatively small, it may be in the video viewing state. If the number of mouse clicks is relatively large, it may be in the video selection or search state. Therefore, if the interface type attribute of the corresponding front-end interface is the preset interface type attribute, the corresponding collection time period will be determined as a valid collection time period (that is, no matter how many times the cursor moves, it may be normal and valid).

[0052] On the contrary, if the interface type attribute of the corresponding front-end interface is a non-preset interface type attribute, for example: if the interface type attribute of the corresponding front-end interface is a game application. The corresponding cursor movement may be relatively frequent. At this time, if the number of cursor movements in the corresponding collection time period is small, it may be a rest time, or the user has left the device and has not operated. In this case, the collection time period with a small number of corresponding cursor movements (less than or equal to the preset number) is determined as an invalid collection time period, and the collection time period with a number of cursor movements greater than the preset number is determined as a valid collection time period. In this way, the accuracy of the initial data can be improved.

[0053] Step S130 , generating a corresponding cursor movement simulation program according to the cursor movement data corresponding to each available time period in a number of continuous available time periods greater than a preset number of continuous time periods.

[0054] If the number of the above-mentioned consecutive valid collection time periods is greater than the preset number of consecutive time periods, the cursor movement data corresponding to the consecutive valid collection time periods are determined as a cursor movement simulation program, which has a corresponding movement duration and a corresponding interface type attribute of the front-end interface.

[0055] Step S200, in response to receiving a file to be detected, if the estimated risk level corresponding to the above-mentioned file to be detected is a preset risk level, then a target cursor movement simulation program corresponding to the file to be detected is obtained according to each of the above-mentioned cursor movement simulation programs and the preset simulation program splicing rules; wherein the above-mentioned file to be detected has a corresponding movement simulation duration; the movement simulation duration corresponding to the file to be detected whose estimated risk level is the preset risk level is greater than the movement duration corresponding to any cursor movement simulation program; and the movement duration corresponding to the target cursor movement simulation program is equal to or greater than the movement simulation duration corresponding to the file to be detected; the above-mentioned target cursor movement simulation program is used to control the movement of the cursor in the sandbox when the above-mentioned file to be detected is run in the sandbox.

[0056] Specifically, the above-mentioned file to be detected has a corresponding estimated risk level, which is used to indicate the estimated maliciousness of the file to be detected. The estimated risk level of the file to be detected can be obtained by a person skilled in the art according to any estimated risk level acquisition method in the art, which will not be described in detail here. The file to be detected has a corresponding device feature vector to be detected, and the above-mentioned device feature vector to be detected can include multiple device features; as an example: the device feature vector to be detected includes interface type attribute features corresponding to all applications installed on the source device corresponding to the file to be detected, quantity features corresponding to each interface type attribute, usage time period features corresponding to each interface type attribute, file type features of the source device corresponding to the file to be detected, flow features of the source device corresponding to the file to be detected in a preset target time period, hardware parameter features of the source device corresponding to the file to be detected, system version features of the source device corresponding to the file to be detected, system type features of the source device corresponding to the file to be detected, and user personalized settings features. Among them, the above-mentioned device feature vector to be detected can reflect comprehensive information such as software and hardware features of the source device of the file to be detected. It should be noted that the above-mentioned interface type attribute is the application type of each application installed on the source device corresponding to the file to be detected, such as video playback, game, etc.

[0057] In this embodiment, the estimated risk level of the file to be detected can be a preset risk level and a non-preset risk level. The preset risk level in this embodiment is a high risk level, and the length of the mobile simulation time required is greater than the length of the mobile simulation time corresponding to the non-preset risk level. This is because the maliciousness of the file to be detected at the preset risk level (high risk level) is higher, that is, it may have a certain incubation period, or its ability to detect whether it is in the sandbox is stronger. At this time, a longer cursor movement simulation time is required to make the file to be detected be "deceived", even if it cannot detect that it is in the sandbox, so as to normally execute the corresponding malicious behavior.

[0058] It can be understood that the movement duration corresponding to the cursor movement simulation program generated according to the collected cursor movement data in the present application is less than the movement simulation duration corresponding to the preset risk level. Therefore, for the above-determined target cursor movement simulation program that is most suitable for the current file to be detected, since the length of its corresponding movement duration is less than the movement simulation duration corresponding to the current file to be detected (preset risk level), and in the actual operation of the user, there is a high probability that there will be idle time (time when the mouse is not operated) caused by rest, etc. in the long-term cursor movement data. Therefore, in order to improve the authenticity of the cursor movement simulation program under a longer movement simulation duration (the movement simulation duration corresponding to the file to be detected with the preset risk level), it is necessary to fill part of the idle time in it on the basis of copying the currently determined target cursor movement simulation program. According to the above steps, when generating several cursor movement simulation programs, the invalid collection time period is used as the segmentation time period, so each cursor movement simulation program has adjacent invalid collection time periods. Furthermore, after generating several preset sandboxes according to several cursor movement simulation programs, each preset sandbox has a corresponding invalid collection time period list.

[0059] The step of obtaining the target cursor movement simulation program corresponding to the file to be detected according to each of the above cursor movement simulation programs and the preset simulation program splicing rule includes:

[0060] Step S210, obtaining an intermediate cursor movement simulation program according to the file to be detected and each of the above cursor movement simulation programs.

[0061] Here, the above step S210 includes the following steps:

[0062] Step S211, according to each of the above-mentioned cursor movement simulation programs, a number of preset sandboxes are obtained; wherein each preset sandbox has at least one corresponding cursor movement simulation program; each preset sandbox has a corresponding comparison feature vector; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree with the central device feature vector of the preset sandbox.

[0063] It should be noted that a sandbox is a security mechanism used to execute code in a controlled environment to prevent potential malware from causing damage to the host system. Among them, several preset sandboxes are obtained through the following steps:

[0064] Step S211a, acquiring device characteristics of the source device corresponding to each cursor movement simulation program to obtain a device characteristic vector corresponding to each cursor movement simulation program.

[0065] The device feature vector of the source device corresponding to each cursor movement simulation program may include multiple device features; as an example: the device feature vector includes interface type attribute features corresponding to all applications installed on the source device, quantity features corresponding to each interface type attribute, usage time period features corresponding to each interface type attribute, file type features of the source device, traffic features of the source device within a preset target time period, hardware parameter features of the source device, system version features of the source device, system type features corresponding to the source device, and user personalized settings features, etc. Among them, the above-mentioned device feature vector can reflect comprehensive information such as software and hardware features of the source device. It should be noted that the above-mentioned interface type attribute is the application type of each application installed on the source device corresponding to the file to be detected, such as: video playback, game, etc.

[0066] Step S211b, clustering the cursor movement simulation programs according to the device feature vector corresponding to each cursor movement simulation program to obtain n cluster sets; wherein any cluster set includes at least one cursor movement simulation program;

[0067] As mentioned above, each cursor movement simulation program has a corresponding source device, and the device feature vector of the corresponding source device is obtained (including the interface type attribute characteristics corresponding to all applications installed in the source device, the quantity characteristics corresponding to each interface type attribute, the usage time period characteristics corresponding to each interface type attribute, the file type characteristics corresponding to the source device, the traffic characteristics of the source device within the preset target time period, the hardware parameter characteristics corresponding to the source device, the system version characteristics corresponding to the source device, the system type characteristics corresponding to the source device, and the user personalized setting characteristics of the source device, etc.), each device feature has a corresponding feature value, and each device feature item vector includes the device feature values ​​and the arrangement of the features in the vector in the same way as the above-mentioned device feature vector to be detected. According to the device feature vector corresponding to each cursor movement simulation program, several of the above-mentioned cursor movement simulation programs are clustered. Here, a clustering method that does not specify a cluster set is used, such as the DBSCAN clustering method, etc., to obtain n cluster sets, and then, each cluster set has at least one corresponding cursor movement simulation program, and

[0068] Step S211c, constructing a corresponding sandbox environment according to each of the above clustering sets to obtain n preset sandboxes; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each preset sandbox has a corresponding comparison feature vector.

[0069] The above-mentioned comparison feature vector is obtained according to the device feature item vector corresponding to each cluster set, which is determined according to the following steps:

[0070] Step S211c1, according to the device feature vector corresponding to each cursor movement simulation program included in the cluster set corresponding to each preset sandbox, obtain the central device feature vector corresponding to each cluster set.

[0071] Step S211c2: Determine the device feature vector corresponding to the cursor movement simulation program with the highest matching degree with the corresponding central device feature vector in each cluster set as the comparison feature vector of the preset sandbox.

[0072] First, according to the device feature vectors corresponding to all cursor movement simulation programs included in each cluster set, the central device feature vector corresponding to each cluster set is obtained. Here, since the system version and the like are standard data, the feature value obtained after averaging is not standard data. For example, the system version feature may include 1.0, 2.0 and 3.0, and the system version feature corresponding to the central device feature vector obtained may be 1.5, and the system version in the central device feature vector cannot be determined.

[0073] Therefore, after obtaining the central device feature vector, the device feature vector corresponding to the cursor movement simulation program with the highest matching degree with the corresponding central device feature vector in each cluster set is determined as the comparison feature vector of the preset sandbox, so that each feature value in each comparison feature vector obtained is standard data, thereby improving the confidence of feature matching.

[0074] In summary, each preset sandbox environment is different, and the types of applications built into the sandbox are also different. And each preset sandbox has at least one corresponding cursor movement simulation program.

[0075] Step S212, according to the feature vector of the device to be detected, determine the target sandbox from several preset sandboxes; wherein the target sandbox is determined based on the feature vector of the device to be detected and the comparison feature vector corresponding to each preset sandbox; the target sandbox is used to run the file to be detected, and when running the file to be detected, a target cursor movement simulation program is executed to control the cursor in the target sandbox to move according to the target cursor movement simulation program.

[0076] Here, the target sandbox is the preset sandbox corresponding to the comparison feature vector with the highest matching degree between the feature vector of the device to be detected. That is, each preset sandbox has a different sandbox environment. The sandbox environment here is determined according to each cursor movement simulation program in its corresponding cluster set. As an example: the sandbox environment may include an environment corresponding to frequent cursor movements, an environment corresponding to fewer cursor movements, etc., corresponding to the device characteristics of the above-mentioned cursor movement simulation program. The target sandbox is the most compatible with the feature vector of the device to be detected, that is, the corresponding sandbox environment is most similar to the feature vector of the device to be detected. The simulation of the file to be detected in the target sandbox has a higher degree of restoration and authenticity.

[0077] Step S213, respectively obtaining the target matching degree between the file to be detected and each cursor movement simulation program corresponding to the target sandbox.

[0078] In one embodiment, the above-mentioned file to be detected has a corresponding movement simulation duration, and each cursor movement simulation program has a corresponding movement duration; step S213 includes:

[0079] Step S2131, obtaining the time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each cursor movement simulation program.

[0080] The same device may perform different tasks in different time periods. For example, device A may be using office software to work from 9 to 11 in the morning, and may be using game software to play games from 3 to 5 in the afternoon. Therefore, the time period matching degree indicates the similarity between the corresponding movement simulation duration of the file to be detected and the movement duration corresponding to each cursor movement simulation program.

[0081] Among them, the matching degree SD of the i-th time period i Meet the following conditions:

[0082] SD i =MT i / YT i

[0083] Among them, MT i YT is the overlapping time length between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to the i-th cursor movement simulation program corresponding to the target sandbox; i The length of time corresponding to the movement duration of the i-th cursor movement simulation program.

[0084] Here, the longer the overlapping time length corresponding to a certain cursor movement simulation program is, the longer the overlap time between the movement simulation time length corresponding to the file to be detected and the movement time length of the cursor movement simulation program is. At this time, if the corresponding movement time length corresponding to the corresponding cursor movement simulation program is longer, even if the movement simulation time length corresponding to the file to be detected is completely within the movement time length corresponding to the cursor movement simulation program, but because the movement time length corresponding to the cursor movement simulation program is too long, in addition to the movement simulation time length corresponding to the file to be detected, other tasks of different categories may also be processed, then the adaptability of the cursor movement simulation program simulating the target sandbox with this segment of the cursor movement simulation program may be low. If the corresponding overlapping time length corresponding to the corresponding cursor movement simulation program is longer and the movement time length is shorter, it means that the overlap degree between the movement simulation time length corresponding to the file to be detected and the movement time length of the cursor movement simulation program is higher, that is, in addition to the movement simulation time length corresponding to the file to be detected, only a small amount of time is left. Therefore, the time period matching degree is proportional to the overlapping time length and inversely proportional to the movement time length corresponding to the cursor movement simulation program.

[0085] As an example: the movement simulation time corresponding to the file to be detected is 3-4 pm, and the movement time corresponding to the cursor movement simulation program A1 is 3-5 pm, and the movement time corresponding to the cursor movement simulation program A2 is 11-12 am; the movement time corresponding to the cursor movement simulation program A3 is 3-4 pm; that is, SD A1 =0.5; SD A2 =0; SD A3 =1.

[0086] Step S2132, obtaining the device matching degree between the device feature vector to be detected corresponding to the file to be detected and the device feature vector corresponding to each cursor movement simulation program.

[0087] It is understandable that the device matching degree here can be calculated according to cosine distance, Euclidean distance, etc.

[0088] Step S2133, based on the time period matching degree, the device matching degree, the time period importance coefficient corresponding to the time period matching degree and the device importance coefficient corresponding to the device matching degree, obtain the target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox.

[0089] Here, both the time period matching degree and the device matching degree have corresponding weights (time period importance coefficient and device importance coefficient), which can be set by technical personnel in this field according to actual conditions. The larger the corresponding weight, the more important the matching degree is to the target matching degree, and vice versa.

[0090] In another embodiment, each cursor movement simulation program has a corresponding front-end interface; the front-end interface has a corresponding interface type attribute. Step S213 also includes:

[0091] Step S2134, obtaining the target interface type attribute corresponding to the front-end interface when the target sandbox is running.

[0092] Step S2135, determining a number of key cursor movement simulation programs corresponding to the target sandbox according to the target interface type attribute; wherein the interface type attribute of the front-end interface corresponding to the above key cursor movement simulation program is the same as the target interface type attribute.

[0093] Step S2136, obtain the target matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox according to the movement simulation duration corresponding to the file to be detected and the device feature vector to be detected, and the movement duration and device feature vector corresponding to each key cursor movement simulation program.

[0094] Step S2136 includes:

[0095] Step S2136a, obtaining a key time period match between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each key cursor movement simulation program.

[0096] Step S2136b, obtaining the key device matching degree between the device feature vector corresponding to the file to be detected and the device feature vector corresponding to each key cursor movement simulation program.

[0097] Step S2136c, based on the above-mentioned key time period matching degree, the above-mentioned key device matching degree, the key time period importance coefficient corresponding to the above-mentioned key time period matching degree and the key device importance coefficient corresponding to the above-mentioned key device matching degree, obtain the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox.

[0098] Compared with the previous embodiment, this embodiment performs a preliminary screening based on the target interface type attribute corresponding to the front-end interface when the target sandbox is running and the interface type attribute corresponding to each cursor movement simulation program before obtaining the above-mentioned time period matching degree and device matching degree. Here, since the interface type attribute has a greater impact on the simulation realism of the sandbox environment, that is, if the interface type attribute of the front-end interface when the target sandbox is running is office type, and the cursor movement simulation program is video playback type, the corresponding cursor movement simulation program has a lower adaptability. Therefore, in this embodiment, the cursor movement simulation program whose corresponding interface type attribute is different from the target interface type attribute is filtered out and then matched, thereby improving the adaptability of the target cursor movement simulation program and the target sandbox.

[0099] In another embodiment, the above step S213 further includes:

[0100] Step S2137, obtaining the attribute matching degree between the target interface type attribute and the interface type attribute of the front-end interface of each cursor movement simulation program corresponding to the target sandbox.

[0101] Step S2138, based on the above-mentioned time period matching degree, the above-mentioned device matching degree, the above-mentioned attribute matching degree, the time period importance coefficient corresponding to the above-mentioned time period matching degree, the device importance coefficient corresponding to the above-mentioned device matching degree, and the attribute importance coefficient corresponding to the above-mentioned attribute matching degree, obtain the target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox; wherein the above-mentioned attribute importance coefficient is greater than the time period importance coefficient, and greater than the device importance coefficient.

[0102] In this embodiment, the attribute matching degree between the target interface type attribute and the interface type attribute of the front-end interface of each cursor movement simulation program corresponding to the target sandbox is obtained. Here, if they are consistent, the corresponding attribute matching degree is 1, otherwise it is 0. Since the cursor movement simulation programs corresponding to different interface type attributes are quite different, the interface type attribute has a greater impact on the simulation realism of the sandbox environment, so the attribute importance coefficient corresponding to the above attribute matching degree is set to be larger.

[0103] Step S214: determine the cursor movement simulation program with the highest target matching degree as the middle cursor movement simulation program.

[0104] Here, the target matching degree is the highest, that is, the target cursor movement simulation program and the corresponding cursor movement simulation program have the highest adaptability.

[0105] In the present application, the movement duration corresponding to the cursor movement simulation program generated according to the collected cursor movement data is less than the movement simulation duration corresponding to the preset risk level. Therefore, for the intermediate cursor movement simulation program determined above that is most suitable for the current file to be detected, since the length of its corresponding movement duration is less than the movement simulation duration corresponding to the current file to be detected (preset risk level), and in the actual operation of the user, there is a high probability that there will be idle time (time when the mouse is not operated) caused by rest, etc. in the long-term cursor movement data. Therefore, in order to improve the authenticity of the cursor movement simulation program under a longer movement simulation duration (the movement simulation duration corresponding to the file to be detected with the preset risk level), it is necessary to fill part of the idle time in the intermediate cursor movement simulation program determined currently on the basis of copying it. According to the above steps, when generating several cursor movement simulation programs, the invalid collection time period is used as the segmentation time period, so each cursor movement simulation program has adjacent invalid collection time periods. Furthermore, after generating several preset sandboxes according to several cursor movement simulation programs, each preset sandbox has a corresponding invalid collection time period list.

[0106] Step S220, obtaining the motion simulation duration corresponding to the file to be detected.

[0107] Step S230, determining a target unavailable time period according to the movement simulation time period, the movement time period corresponding to the intermediate cursor movement simulation program, and the unavailable time period list corresponding to the target sandbox.

[0108] Here, the time length ST corresponding to the above movement simulation time length, the time length JT corresponding to the movement time length of the above intermediate cursor movement simulation program, and the time length FT corresponding to the target unavailable time period meet the following conditions:

[0109] rounddown(x(JT+FT) / ST)=1

[0110] And JT / FT∈(QD xin , QD xax )

[0111] Among them, QD xin The lower limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the middle cursor movement simulation program; QD xax is the upper limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the middle cursor movement simulation program; x is the preset coefficient; rounddown() is the preset floor function.

[0112] In this embodiment, first, according to the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the intermediate cursor movement simulation program, an invalid collection time period with a suitable time length is selected from the invalid collection time period list corresponding to the target sandbox, that is, the target invalid collection time period, and then the number of intermediate cursor movement simulation programs is controlled to be consistent with the number of target invalid collection time periods, and the spliced ​​time length is made greater than the time length ST corresponding to the movement simulation duration, and can be infinitely close to the time length ST corresponding to the movement simulation duration.

[0113] Step S240 , combining each available time period in the intermediate cursor movement simulation program with the target unavailable time period to obtain a corresponding target cursor movement simulation program.

[0114] Here, the splicing may be random splicing or evenly spaced splicing. After splicing the same number of target cursor movement simulation programs and target invalid acquisition time periods, an updated target cursor movement simulation program is obtained.

[0115] like Figure 2 As shown, a cursor movement simulation device 100 in a sandbox is provided according to an embodiment of the present application.

[0116] The cursor movement simulation device 100 in the sandbox includes:

[0117] The acquisition unit 110 is used to acquire at least one cursor movement simulation program; wherein each of the above cursor movement simulation programs has a corresponding movement duration; the movement duration is determined according to the interface type attributes of the front-end interface and the number of cursor movements when the corresponding cursor movement simulation program is generated.

[0118] The determination unit 120 is used for obtaining, in response to receiving a file to be detected, a target cursor movement simulation program corresponding to the file to be detected according to each of the above-mentioned cursor movement simulation programs and the preset simulation program splicing rules in response to receiving the file to be detected, if the estimated risk level corresponding to the above-mentioned file to be detected is a preset risk level; wherein the above-mentioned file to be detected has a corresponding movement simulation duration; the movement simulation duration corresponding to the file to be detected whose estimated risk level is the preset risk level is greater than the movement duration corresponding to any cursor movement simulation program; and the movement duration corresponding to the target cursor movement simulation program is equal to or greater than the movement simulation duration corresponding to the file to be detected; the above-mentioned target cursor movement simulation program is used to control the movement of the cursor in the sandbox when the above-mentioned file to be detected is run in the sandbox.

[0119] An embodiment of the present application further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present application described above in this specification.

[0120] In addition, although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0121] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROx, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0122] In an exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided.

[0123] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0124] The electronic device according to this embodiment of the present application is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one storage device mentioned above, and a bus connecting different system components (including storage devices and processors).

[0126] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0127] The storage may include readable media in the form of volatile storage, such as random access storage (RAx) and / or cache storage, and may further include read-only storage (ROx).

[0128] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0129] The bus may represent one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0130] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. This communication may be performed through an input / output (I / O) interface. In addition, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0131] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROx, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0132] In an exemplary embodiment of the present application, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present application described in the above "Exemplary Method" section of the present specification.

[0133] The program product can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetism, infrared rays, or semiconductor, or any combination thereof. The more specific example (non-exhaustive list) of the readable storage medium includes: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAx), a read-only memory (ROx), an erasable programmable read-only memory (EPROx or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROx), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0134] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0136] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0137] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0138] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0139] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for simulating cursor movement in a sandbox, characterized in that: The method comprises: Acquire at least one cursor movement simulation program; wherein each of the cursor movement simulation programs has a corresponding movement duration; the movement duration is determined according to the interface type attribute of the front-end interface and the number of cursor movements when the corresponding cursor movement simulation program is generated; In response to receiving a file to be detected, if the estimated risk level corresponding to the file to be detected is a preset risk level, a target cursor movement simulation program corresponding to the file to be detected is obtained according to each of the cursor movement simulation programs and the preset simulation program splicing rule; wherein the file to be detected has a corresponding movement simulation duration; the movement simulation duration corresponding to the file to be detected whose estimated risk level is the preset risk level is greater than the movement duration corresponding to any cursor movement simulation program; and the movement duration corresponding to the target cursor movement simulation program is equal to or greater than the movement simulation duration corresponding to the file to be detected; the target cursor movement simulation program is used to control the movement of the cursor in the sandbox when the file to be detected is run in the sandbox; The obtaining of at least one cursor movement simulation program comprises: In the target time window, the cursor movement data corresponding to the plurality of devices in the plurality of front-end interfaces are collected to obtain the number of cursor movement in each collection time period in the target time window; If the interface type attribute of the corresponding front-end interface is a preset interface type attribute, the corresponding collection time periods are all determined as available time periods; if the interface type attribute of the corresponding front-end interface is a non-preset interface type attribute, the collection time period in which the cursor movement times are greater than the preset times is determined as an available time period; otherwise, it is determined as a non-available time period; Generate a corresponding cursor movement simulation program according to the cursor movement data corresponding to each available time period in a number of continuous available time periods greater than a preset number of continuous time periods; The step of obtaining a target cursor movement simulation program corresponding to the file to be detected according to each of the cursor movement simulation programs and a preset simulation program splicing rule includes: Obtaining an intermediate cursor movement simulation program according to the file to be detected and each of the cursor movement simulation programs; Get the mobile simulation duration corresponding to the file to be detected; Determine a target unavailable time period according to the movement simulation duration, the movement duration corresponding to the intermediate cursor movement simulation program, and the unavailable time period list corresponding to the target sandbox; Each available time period in the intermediate cursor movement simulation program is spliced ​​with the target unavailable time period to obtain a corresponding target cursor movement simulation program.

2. The method for simulating cursor movement in a sandbox according to claim 1, characterized in that: The step of obtaining an intermediate cursor movement simulation program according to the file to be detected and each of the cursor movement simulation programs comprises: According to each of the cursor movement simulation programs, a plurality of preset sandboxes are obtained; wherein each preset sandbox has at least one corresponding cursor movement simulation program; each preset sandbox has a corresponding comparison feature vector; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree with the central device feature vector of the preset sandbox; According to the feature vector of the device to be detected, a target sandbox is determined from a plurality of preset sandboxes; wherein the target sandbox is determined according to the feature vector of the device to be detected and a comparison feature vector corresponding to each preset sandbox; the target sandbox is used to run the file to be detected, and when running the file to be detected, a target cursor movement simulation program is executed to control the cursor in the target sandbox to move according to the target cursor movement simulation program; respectively obtaining a target matching degree between the file to be detected and each cursor movement simulation program corresponding to the target sandbox; The cursor movement simulation program with the highest target matching degree is determined as the middle cursor movement simulation program.

3. The method for simulating cursor movement in a sandbox according to claim 2, characterized in that: According to each of the cursor movement simulation programs, a plurality of preset sandboxes are obtained, including: Acquire device characteristics of source devices corresponding to each cursor movement simulation program to obtain device characteristic vectors corresponding to each cursor movement simulation program; Clustering a number of cursor movement simulation programs according to a device feature vector corresponding to each cursor movement simulation program to obtain n cluster sets; wherein any cluster set includes at least one cursor movement simulation program; A corresponding sandbox environment is constructed according to each of the cluster sets to obtain n preset sandboxes.

4. The method for simulating cursor movement in a sandbox according to claim 1, characterized in that: The time length ST corresponding to the movement simulation duration, the time length JT corresponding to the movement duration of the intermediate cursor movement simulation program, and the time length FT corresponding to the target unavailable time period meet the following conditions: rounddown(x(JT+FT) / ST)=1 and JT / FT ∈ (QD xin , QD xax ) Among them, QD xin The lower limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the middle cursor movement simulation program; QD xax is the upper limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the middle cursor movement simulation program; x is the preset coefficient; rounddown() is the preset floor function.

5. The method for simulating cursor movement in a sandbox according to claim 1, characterized in that: The file to be detected has a corresponding movement simulation duration, and each cursor movement simulation program has a corresponding movement duration; Obtaining the target matching degree between the file to be detected and each cursor movement simulation program corresponding to the target sandbox respectively, including: Obtaining the time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each cursor movement simulation program; Obtaining a device matching degree between a device feature vector to be detected corresponding to the file to be detected and a device feature vector corresponding to each cursor movement simulation program; According to the time period matching degree, the device matching degree, the time period importance coefficient corresponding to the time period matching degree, and the device importance coefficient corresponding to the device matching degree, a target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained.

6. A device for simulating cursor movement in a sandbox, characterized in that: The device is used to implement the method for simulating cursor movement in a sandbox according to any one of claims 1 to 5, comprising: An acquisition unit, used for acquiring at least one cursor movement simulation program; wherein each of the cursor movement simulation programs has a corresponding movement duration; the movement duration is determined according to the interface type attribute of the front-end interface and the number of cursor movements when the corresponding cursor movement simulation program is generated; A determination unit is used for, in response to receiving a file to be detected, if the estimated risk level corresponding to the file to be detected is a preset risk level, obtaining a target cursor movement simulation program corresponding to the file to be detected according to each of the cursor movement simulation programs and the preset simulation program splicing rules; wherein the file to be detected has a corresponding movement simulation duration; the movement simulation duration corresponding to the file to be detected whose estimated risk level is the preset risk level is greater than the movement duration corresponding to any cursor movement simulation program; and the movement duration corresponding to the target cursor movement simulation program is equal to or greater than the movement simulation duration corresponding to the file to be detected; the target cursor movement simulation program is used to control the movement of the cursor in the sandbox when the file to be detected is run in the sandbox.

7. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the cursor movement simulation method in the sandbox as claimed in any one of claims 1 to 5.

8. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 7.

Images