Sandbox determination method, device, medium and equipment for files to be detected

Abstract

The present application provides a sandbox determination method, device, medium and equipment for files to be detected, which relates to the field of information security. The method includes: obtaining the device characteristics of the source device corresponding to the file to be detected to obtain the device characteristic vector to be detected, obtaining the matching degree between the above-mentioned device characteristic vector to be detected and the comparison characteristic vector corresponding to each preset sandbox in a plurality of preset sandboxes, and obtaining a matching degree list; determining the preset sandbox corresponding to the largest matching degree in the above-mentioned matching degree list as the target sandbox. The present application makes it difficult for malicious files to determine that they are running in a sandbox environment, and can perform malicious behaviors normally, and then the sandbox can determine whether it is malicious and record its malicious behaviors.

Description

Background Art

[0002] A sandbox is a security mechanism for executing code in a controlled environment to prevent potentially malicious files from causing damage to the host system.

[0003] Malicious files can determine whether they are running in a sandbox by detecting the movement of the cursor. In order to prevent malicious files from detecting that they are running in a sandbox, it is necessary to simulate the cursor operation of the sandbox. There are multiple types of sandboxes. Different types of sandboxes correspond to different cursor operation simulation methods, and different cursor operation simulation methods have different adaptability to malicious files. If they are not compatible, the probability that the sandbox cursor operation simulation method will be recognized by malicious files is high. Therefore, there is an urgent need for a method to improve the authenticity and adaptability of the sandbox's cursor operation simulation for malicious files. Summary of the invention

[0004] In view of this, the present application provides a sandbox determination method, device, medium and equipment for a file to be detected, which at least partially solves the technical problems existing in the prior art. The technical solution adopted by the present application is:

[0005] According to one aspect of the present application, a sandbox determination method for a file to be detected is provided, wherein the file to be detected has a corresponding estimated risk level; the method comprises:

[0006] The device characteristics of the source device corresponding to the file to be detected are obtained to obtain a feature vector of the device to be detected.

[0007] Obtain the degree of match between the feature vector of the device to be detected and the comparison feature vector corresponding to each preset sandbox in a number of preset sandboxes, and obtain a matching degree list; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest degree of match between the central device feature vector of the preset sandbox and all the device feature vectors corresponding to the preset sandbox.

[0008] The preset sandbox corresponding to the largest matching degree in the above matching degree list is determined as the target sandbox; wherein the above target sandbox is used to run the above file to be detected, and when running the above file to be detected, any cursor movement simulation program corresponding to the target sandbox is executed to control the cursor in the target sandbox to move according to the executed cursor movement simulation program.

[0009] In an exemplary embodiment of the present application, the target sandbox is further used to perform the following steps:

[0010] According to a preset determination rule, a target cursor movement simulation program is determined from each cursor movement simulation program corresponding to the target sandbox.

[0011] The file to be detected is controlled to run in the target sandbox, and when the file to be detected is run, a target cursor movement simulation program is executed to control the cursor in the target sandbox to move according to the target cursor movement simulation program.

[0012] In an exemplary embodiment of the present application, the above-mentioned file to be detected has a corresponding movement simulation duration, and each cursor movement simulation program has a corresponding movement duration; wherein the above-mentioned determining the target cursor movement simulation program from each cursor movement simulation program corresponding to the target sandbox according to a preset determination rule includes:

[0013] The time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each cursor movement simulation program is obtained.

[0014] The device matching degree between the device feature vector to be detected corresponding to the file to be detected and the device feature vector corresponding to each cursor movement simulation program is obtained.

[0015] According to the time period matching degree, the device matching degree, the time period importance coefficient corresponding to the time period matching degree and the device importance coefficient corresponding to the device matching degree, the target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained.

[0016] The cursor movement simulation program corresponding to the greatest target matching degree is determined as the target cursor movement simulation program.

[0017] In an exemplary embodiment of the present application, each cursor movement simulation program has a corresponding front-end interface; wherein the above-mentioned determining the target cursor movement simulation program from each cursor movement simulation program corresponding to the target sandbox according to a preset determination rule includes:

[0018] Get the target interface type attribute corresponding to the front-end interface when the target sandbox is running.

[0019] According to the target interface type attribute, several key cursor movement simulation programs corresponding to the target sandbox are determined; wherein the interface type attribute of the front-end interface corresponding to the above key cursor movement simulation programs is the same as the target interface type attribute.

[0020] According to the movement simulation duration corresponding to the file to be detected and the device feature vector to be detected, and the movement duration and device feature vector corresponding to each key cursor movement simulation program, the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained.

[0021] The key cursor movement simulation program corresponding to the greatest key matching degree is determined as the target cursor movement simulation program.

[0022] In an exemplary embodiment of the present application, the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained according to the movement simulation duration corresponding to the file to be detected and the feature vector of the device to be detected, and the movement duration and device feature vector corresponding to each key cursor movement simulation program, including:

[0023] The key time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each key cursor movement simulation program is obtained.

[0024] The key device matching degree between the device feature vector to be detected corresponding to the file to be detected and the device feature vector corresponding to each key cursor movement simulation program is obtained.

[0025] According to the above-mentioned key time period matching degree, the above-mentioned key device matching degree, the key time period importance coefficient corresponding to the above-mentioned key time period matching degree and the key device importance coefficient corresponding to the above-mentioned key device matching degree, the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained.

[0026] In an exemplary embodiment of the present application, the matching degree SD of the i-th time period is i Meet the following conditions:

[0027] SD i =MT i / YT i

[0028] Among them, MT i YT is the overlapping time length between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to the i-th cursor movement simulation program corresponding to the target sandbox; i The length of time corresponding to the movement duration of the i-th cursor movement simulation program.

[0029] In an exemplary embodiment of the present application, several preset sandboxes are obtained by the following steps:

[0030] In a target time window, corresponding cursor movement data of a plurality of devices in a plurality of front-end interfaces are collected to generate a plurality of cursor movement simulation programs.

[0031] According to the device feature vector corresponding to each cursor movement simulation program, a plurality of the cursor movement simulation programs are clustered to obtain n cluster sets; wherein any cluster set includes at least one cursor movement simulation program.

[0032] A corresponding sandbox environment is constructed according to each of the above clustering sets to obtain n preset sandboxes.

[0033] According to one aspect of the present application, a sandbox determination device for a file to be detected is provided, wherein the file to be detected has a corresponding estimated risk level; the device comprises:

[0034] The vector acquisition unit is used to acquire the device characteristics of the source device corresponding to the file to be detected to obtain the device characteristic vector to be detected.

[0035] A matching degree acquisition unit is used to obtain the matching degree between the above-mentioned device feature vector to be detected and the comparison feature vector corresponding to each preset sandbox in a number of preset sandboxes, and obtain a matching degree list; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree between all device feature vectors corresponding to the preset sandbox and the central device feature vector of the preset sandbox.

[0036] A determination unit is used to determine the preset sandbox corresponding to the largest matching degree in the above matching degree list as the target sandbox; wherein the above target sandbox is used to run the above file to be detected, and when running the above file to be detected, any cursor movement simulation program corresponding to the target sandbox is executed to control the cursor in the target sandbox to move according to the executed cursor movement simulation program.

[0037] According to one aspect of the present application, a non-transitory computer-readable storage medium is provided, in which at least one instruction or at least one program is stored. The at least one instruction or the at least one program is loaded and executed by a processor to implement the above-mentioned sandbox determination method for files to be detected.

[0038] According to one aspect of the present application, an electronic device is provided, comprising a processor and the above-mentioned non-transitory computer-readable storage medium.

[0039] This application has at least the following beneficial effects:

[0040] The sandbox determination method for the file to be detected in the present application has a corresponding estimated risk level, that is, when its estimated risk level is high, it may be a malicious file, and because the malicious file developers are constantly developing new technologies to evade sandbox detection. New malicious files often have a detection mechanism that can determine whether they are running in a sandbox environment. Once it is detected that it is in a sandbox, the file to be detected will usually stop executing malicious behavior, thereby evading detection and analysis. Therefore, the present application first selects a target sandbox for detection based on the device feature vector of the device to be detected corresponding to the device feature of the source device of the file to be detected, and the comparison feature vector corresponding to each preset sandbox; the target sandbox here is used to simulate the cursor movement of the above-mentioned file to be detected. Different sandboxes have different environments, and the corresponding cursor movement simulation programs are different. According to the device feature vector of the device to be detected corresponding to the file to be detected, a sandbox with a higher similarity is selected, and then the corresponding cursor movement simulation program is used for simulation. The simulation has a high degree of authenticity and restoration, so that it is difficult for malicious files to determine that they are running in a sandbox environment and can perform malicious behavior normally. Then, the sandbox can determine whether it is malicious and record its malicious behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0042] Figure 1 A flow chart of a sandbox determination method for a file to be detected provided by the present application;

[0043] Figure 2 This is a structural block diagram of a sandbox determination device for a file to be detected provided in this application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0045] like Figure 1 As shown, a sandbox determination method for a file to be detected is provided according to an embodiment of the present application, wherein the file to be detected has a corresponding estimated risk level. The method comprises the following steps:

[0046] Step S100, obtaining device characteristics of a source device corresponding to a file to be detected, so as to obtain a device characteristic vector to be detected.

[0047] Specifically, the above-mentioned file to be detected has a corresponding estimated risk level, and the above-mentioned estimated risk level is used to indicate the estimated maliciousness of the file to be detected, that is, the higher the estimated risk level, the higher the maliciousness of the file to be detected. The estimated risk level of the file to be detected can be obtained by a person skilled in the art according to any estimated risk level acquisition method in the art, which will not be repeated here. The feature vector of the device to be detected can contain multiple device features; as an example: the feature vector of the device to be detected includes the interface type attribute features corresponding to all applications installed on the source device corresponding to the file to be detected, the quantity features corresponding to each interface type attribute, the usage time period features corresponding to each interface type attribute, the file type features of the source device corresponding to the file to be detected, the flow features of the source device corresponding to the file to be detected in the preset target time period, the hardware parameter features of the source device corresponding to the file to be detected, the system version features of the source device corresponding to the file to be detected, the system type features and user personalized settings features corresponding to the source device corresponding to the file to be detected, etc. Among them, the feature vector of the device to be detected can reflect the comprehensive information such as the software and hardware features of the source device of the file to be detected. It should be noted that the above-mentioned interface type attribute is the application type of each application installed on the source device corresponding to the file to be detected, such as: video playback, game, etc.

[0048] Step S200, obtain the matching degree between the above-mentioned device feature vector to be detected and the comparison feature vector corresponding to each preset sandbox in several preset sandboxes, and obtain a matching degree list; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree between all device feature vectors corresponding to the preset sandbox and the central device feature vector of the preset sandbox.

[0049] Step S300, determining the preset sandbox corresponding to the largest matching degree in the above matching degree list as the target sandbox; wherein the above target sandbox is used to run the above file to be detected, and when running the above file to be detected, execute any cursor movement simulation program corresponding to the target sandbox to control the cursor in the target sandbox to move according to the executed cursor movement simulation program.

[0050] Specifically, a sandbox is a security mechanism used to execute code in a controlled environment to prevent potential malware from causing damage to the host system. Among them, several preset sandboxes are obtained by the following steps:

[0051] Step S201, within a target time window, collecting corresponding cursor movement data of a plurality of devices in a plurality of front-end interfaces to generate a plurality of cursor movement simulation programs.

[0052] As an example: the target time window may be 12 hours, and the front-end interface is a front-end interface corresponding to the collection of the corresponding cursor movement data. Further, the cursor movement simulation program is obtained by the following steps:

[0053] Step S201a, obtaining the number of cursor movement times in each acquisition time period in the target time window according to the cursor movement data.

[0054] Here, the cursor movement data is the movement data of the cursor during the control process of the cursor by the cursor control device (mouse, etc.). As an example: each acquisition time period can be 1 minute. The target time window includes several consecutive acquisition time periods, and the number of cursor movements in each acquisition time period is obtained.

[0055] Step S201b, if the interface type attribute of the corresponding front-end interface is a preset interface type attribute, the corresponding collection time periods are determined as available time periods; if the interface type attribute of the corresponding front-end interface is a non-preset interface type attribute, the collection time period in which the cursor moves more than the preset number of times is determined as an available time period; otherwise, it is determined as a non-available time period.

[0056] Here, the preset interface type attribute can be the interface type attribute (application type) corresponding to the front-end interface with a relatively small number of cursor movements. For example, the preset interface type attribute is a video playback application because the video playback application is used to play videos, and there is no need to frequently move or operate the cursor during video playback. At this time, if the interface type attribute of the corresponding front-end interface is the preset interface type attribute, if the number of mouse clicks corresponding to the corresponding collection time period is relatively small, it may be in the video viewing state. If the number of mouse clicks is relatively large, it may be in the video selection or search state. Therefore, if the interface type attribute of the corresponding front-end interface is the preset interface type attribute, the corresponding collection time period will be determined as a valid collection time period (that is, no matter how many times the cursor moves, it may be normal and valid).

[0057] On the contrary, if the interface type attribute of the corresponding front-end interface is a non-preset interface type attribute, for example: if the interface type attribute of the corresponding front-end interface is a game application. The corresponding cursor movement may be relatively frequent. At this time, if the number of cursor movements in the corresponding collection time period is small, it may be a rest time, or the user has left the device and has not operated. In this case, the collection time period with a small number of corresponding cursor movements (less than or equal to the preset number) is determined as an invalid collection time period, and the collection time period with a number of cursor movements greater than the preset number is determined as a valid collection time period. In this way, the accuracy of the initial data can be improved.

[0058] Step S201c: Generate a corresponding cursor movement simulation program according to the cursor movement data corresponding to each available time period in a number of continuous available time periods greater than a preset number of continuous time periods.

[0059] If the number of the above-mentioned consecutive valid collection time periods is greater than the preset number of consecutive time periods, the cursor movement data corresponding to the consecutive valid collection time periods are determined as a cursor movement simulation program, which has a corresponding movement duration and a corresponding interface type attribute of the front-end interface.

[0060] Step S202 , clustering the cursor movement simulation programs according to the device feature vector corresponding to each cursor movement simulation program to obtain n cluster sets; wherein any cluster set includes at least one cursor movement simulation program.

[0061] As mentioned above, each cursor movement simulation program has a corresponding source device, and the device feature vector of the corresponding source device is obtained (including the interface type attribute characteristics corresponding to all applications installed in the source device, the quantity characteristics corresponding to each interface type attribute, the usage time period characteristics corresponding to each interface type attribute, the file type characteristics corresponding to the source device, the flow characteristics of the source device in the preset target time period, the hardware parameter characteristics corresponding to the source device, the system version characteristics corresponding to the source device, the system type characteristics corresponding to the source device, and the user personalized setting characteristics of the source device, etc.), each device feature has a corresponding feature value, and the arrangement of the device feature values ​​and features in the vector included in each device feature item vector is the same as the above-mentioned device feature vector to be detected. According to the device feature vector corresponding to each cursor movement simulation program, a number of the above-mentioned cursor movement simulation programs are clustered. Here, a clustering method that does not specify a cluster set is used, such as the DBSCAN clustering method, etc., to obtain n cluster sets, and then, each cluster set has at least one corresponding cursor movement simulation program, and each cluster set has a corresponding comparison feature vector.

[0062] Step S203: construct a corresponding sandbox environment according to each of the above cluster sets to obtain n preset sandboxes.

[0063] It should be noted that the contrast feature vector corresponding to each preset sandbox is the contrast feature vector of the corresponding cluster set, and the contrast feature vector is determined according to the following steps:

[0064] Step S203a, obtaining a central device feature vector corresponding to each preset sandbox according to the device feature vector corresponding to each cursor movement simulation program corresponding to each preset sandbox;

[0065] Step S203b: Determine the device feature vector corresponding to the cursor movement simulation program with the greatest matching degree with the corresponding central device feature vector in the cluster set corresponding to each preset sandbox as the comparison feature vector of the preset sandbox.

[0066] First, according to the device feature vectors corresponding to all cursor movement simulation programs included in each cluster set, the central device feature vector corresponding to each preset sandbox is obtained. Here, since the system version and the like are standard data, the feature value obtained after averaging is not standard data. For example, the system version feature may include 1.0, 2.0 and 3.0, and the system version feature corresponding to the central device feature vector obtained may be 1.5, and the system version in the central device feature vector cannot be determined.

[0067] Therefore, after obtaining the central device feature vector, the device feature vector corresponding to the cursor movement simulation program with the highest matching degree with the corresponding central device feature vector in each cluster set is determined as the comparison feature vector of the preset sandbox, so that each feature value in each comparison feature vector obtained is standard data, thereby improving the confidence of feature matching.

[0068] Therefore, the target sandbox is the preset sandbox corresponding to the comparison feature vector with the highest matching degree between the feature vector of the device to be detected. That is, each preset sandbox has a different sandbox environment. The sandbox environment here is determined according to each cursor movement simulation program in its corresponding cluster set. As an example: the sandbox environment may include an environment corresponding to frequent cursor movements, an environment corresponding to fewer cursor movements, etc., corresponding to the device characteristics of the above-mentioned cursor movement simulation program. The target sandbox is the most compatible with the feature vector of the device to be detected, that is, the corresponding sandbox environment is most similar to the feature vector of the device to be detected. The simulation of the file to be detected in the target sandbox has a higher degree of restoration and authenticity.

[0069] In summary, the sandbox environment of each preset sandbox is different, and the application types built into the sandbox are also different. And each preset sandbox has at least one corresponding cursor movement simulation program.

[0070] Additionally, the target sandbox described above is used to perform the following steps:

[0071] Step S210 , determining a target cursor movement simulation program from each cursor movement simulation program corresponding to the target sandbox according to a preset determination rule.

[0072] In one embodiment, the above-mentioned file to be detected has a corresponding movement simulation duration, and each cursor movement simulation program has a corresponding movement duration; wherein the above-mentioned step S210 includes:

[0073] Step S211, obtaining the time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each cursor movement simulation program.

[0074] The same device may perform different tasks in different time periods. For example, device A may be using office software to work from 9 to 11 in the morning, and may be using game software to play games from 3 to 5 in the afternoon. Therefore, the time period matching degree indicates the similarity between the corresponding movement simulation duration of the file to be detected and the movement duration corresponding to each cursor movement simulation program.

[0075] Here, the matching degree SD of the i-th time period is i Meet the following conditions:

[0076] SD i =MT i / YT i

[0077] Among them, MT i YT is the overlapping time length between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to the i-th cursor movement simulation program corresponding to the target sandbox; i The length of time corresponding to the movement duration of the i-th cursor movement simulation program.

[0078] Here, the longer the overlapping time length corresponding to a certain cursor movement simulation program is, the longer the overlap time between the movement simulation time length corresponding to the file to be detected and the movement time length of the cursor movement simulation program is. At this time, if the corresponding movement time length corresponding to the corresponding cursor movement simulation program is longer, even if the movement simulation time length corresponding to the file to be detected is completely within the movement time length corresponding to the cursor movement simulation program, but because the movement time length corresponding to the cursor movement simulation program is too long, in addition to the movement simulation time length corresponding to the file to be detected, other tasks of different categories may also be processed, then the adaptability of the cursor movement simulation program simulating the target sandbox with this segment of the cursor movement simulation program may be low. If the corresponding overlapping time length corresponding to the corresponding cursor movement simulation program is longer and the movement time length is shorter, it means that the overlap degree between the movement simulation time length corresponding to the file to be detected and the movement time length of the cursor movement simulation program is higher, that is, in addition to the movement simulation time length corresponding to the file to be detected, only a small amount of time is left. Therefore, the time period matching degree is proportional to the overlapping time length and inversely proportional to the movement time length corresponding to the cursor movement simulation program.

[0079] As an example: the movement simulation time corresponding to the file to be detected is 3-4 pm, and the movement time corresponding to the cursor movement simulation program A1 is 3-5 pm, and the movement time corresponding to the cursor movement simulation program A2 is 11-12 am; the movement time corresponding to the cursor movement simulation program A3 is 3-4 pm; that is, SD A1 =0.5; SD A2 =0; SD A3 =1.

[0080] Step S212, obtaining the device matching degree between the device feature vector to be detected corresponding to the file to be detected and the device feature vector corresponding to each cursor movement simulation program.

[0081] It is understandable that the device matching degree here can be calculated according to cosine distance, Euclidean distance, etc.

[0082] Step S213, obtaining the target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox according to the time period matching degree, the device matching degree, the time period importance coefficient corresponding to the time period matching degree and the device importance coefficient corresponding to the device matching degree.

[0083] Here, both the time period matching degree and the device matching degree have corresponding weights (time period importance coefficient and device importance coefficient), which can be set by technical personnel in this field according to actual conditions. The larger the corresponding weight, the more important the matching degree is to the target matching degree, and vice versa.

[0084] Step S214: determine the cursor movement simulation program corresponding to the largest target matching degree as the target cursor movement simulation program.

[0085] Here, the highest target matching degree means that the movement duration of the corresponding cursor movement simulation program and the movement simulation duration corresponding to the file to be detected have the highest overlap ratio, that is, the movement duration of the corresponding cursor movement simulation program and the movement simulation duration corresponding to the file to be detected are basically in the same period. On the other hand, the device characteristics of the source device of the cursor movement simulation program are also most similar to the device characteristics of the source device of the file to be detected. Therefore, for the file to be detected, the cursor movement operation is performed using the cursor movement simulation program in the target sandbox, which is closest to the actual cursor movement of the real user in the corresponding movement simulation duration in the target sandbox environment, and is least likely to be detected by the file to be detected.

[0086] In another embodiment, each cursor movement simulation program has a corresponding front-end interface; the front-end interface has a corresponding interface type attribute. The step S210 further includes:

[0087] Step S215, obtaining a target interface type attribute corresponding to the front-end interface when the target sandbox is running.

[0088] Step S216, determining a number of key cursor movement simulation programs corresponding to the target sandbox according to the target interface type attribute; wherein the interface type attribute of the front-end interface corresponding to the key cursor movement simulation program is the same as the target interface type attribute.

[0089] Step S217, obtaining the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox according to the movement simulation duration corresponding to the file to be detected and the device feature vector to be detected, and the movement duration and device feature vector corresponding to each key cursor movement simulation program.

[0090] Wherein, step S217 includes:

[0091] Step S217a, obtaining the key time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each key cursor movement simulation program.

[0092] Step S217b, obtaining the key device matching degree between the device feature vector corresponding to the file to be detected and the device feature vector corresponding to each key cursor movement simulation program.

[0093] Step S217c, based on the above-mentioned key time period matching degree, the above-mentioned key device matching degree, the key time period importance coefficient corresponding to the above-mentioned key time period matching degree and the key device importance coefficient corresponding to the above-mentioned key device matching degree, obtain the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox.

[0094] Step S218: determining the key cursor movement simulation program corresponding to the greatest key matching degree as the target cursor movement simulation program.

[0095] Compared with the embodiment of steps S211-S213, this embodiment performs a preliminary screening according to the target interface type attribute corresponding to the front-end interface when the target sandbox is running and the interface type attribute corresponding to each cursor movement simulation program before obtaining the above-mentioned time period matching degree and device matching degree, that is, the cursor movement simulation program whose corresponding interface type attribute is the same as the target interface type attribute is determined as the target cursor movement simulation program. Here, since the interface type attribute has a greater impact on the simulation authenticity of the sandbox environment, that is, if the interface type attribute of the front-end interface when the target sandbox is running is office type, and the cursor movement simulation program is video playback type, the corresponding cursor movement simulation program has a lower adaptability. Therefore, in this embodiment, the cursor movement simulation program whose corresponding interface type attribute is different from the target interface type attribute is filtered out and then matched, which improves the adaptability of the target cursor movement simulation program and the target sandbox, that is, improves the authenticity of the actual cursor movement simulation in the target sandbox environment, making it difficult to be detected by the file to be detected.

[0096] In another embodiment, the above step S210 further includes:

[0097] Step S219a, obtaining the attribute matching degree between the target interface type attribute and the interface type attribute of the front-end interface of each cursor movement simulation program corresponding to the target sandbox.

[0098] Step S219b, obtains the target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox based on the above-mentioned time period matching degree, the above-mentioned device matching degree, the above-mentioned attribute matching degree, the time period importance coefficient corresponding to the above-mentioned time period matching degree, the device importance coefficient corresponding to the above-mentioned device matching degree, and the attribute importance coefficient corresponding to the above-mentioned attribute matching degree; wherein the above-mentioned attribute importance coefficient is greater than the time period importance coefficient, and greater than the device importance coefficient.

[0099] In this embodiment, the attribute matching degree between the target interface type attribute and the interface type attribute of the front-end interface of each cursor movement simulation program corresponding to the target sandbox is obtained. Here, if they are consistent, the corresponding attribute matching degree is 1, otherwise it is 0. Since the cursor movement simulation programs corresponding to different interface type attributes are quite different, the interface type attribute has a greater impact on the simulation realism of the sandbox environment. Therefore, the attribute importance coefficient corresponding to the above attribute matching degree is set larger, which can improve the authenticity of the actual cursor movement simulation in the target sandbox environment and make it difficult to be detected by the file to be detected.

[0100] Step S220, controlling the file to be detected to run in the target sandbox, and executing the target cursor movement simulation program when running the file to be detected to control the cursor in the target sandbox to move according to the target cursor movement simulation program.

[0101] Specifically, after determining the target cursor movement simulation program, the file to be detected is controlled to run in the target sandbox according to the movement simulation duration corresponding to the file to be detected, and the target cursor movement simulation program is executed when running the above file to be detected to control the cursor in the target sandbox to move according to the target cursor movement simulation program.

[0102] In an exemplary embodiment of the present application, each file to be detected has a corresponding estimated risk level.

[0103] Here, each file to be detected has a corresponding estimated risk level. In this embodiment, the estimated risk level of the file to be detected can be a preset risk level and a non-preset risk level. The preset risk level in this embodiment is a high risk level, and the length of time required for the mobile simulation is greater than the length of time for the mobile simulation corresponding to the non-preset risk level. This is because the maliciousness of the file to be detected with the preset risk level (high risk level) is higher, that is, it may have a certain incubation period, or its ability to detect whether it is in a sandbox is stronger. At this time, a longer cursor movement simulation time is required to make the file to be detected be "deceived", even if it cannot detect that it is in the sandbox, so as to normally execute the corresponding malicious behavior.

[0104] It can be understood that the movement duration corresponding to the cursor movement simulation program generated according to the collected cursor movement data in the present application is less than the movement simulation duration corresponding to the preset risk level. Therefore, for the above-mentioned target cursor movement simulation program that is most suitable for the current file to be detected, since the length of its corresponding movement duration is less than the movement simulation duration corresponding to the current file to be detected (preset risk level), and in the actual operation of the user, there is a high probability that there will be idle time (time when the mouse is not operated) caused by rest, etc. in the long-term cursor movement data. Therefore, in order to improve the authenticity of the cursor movement simulation program under a longer movement simulation duration (the movement simulation duration corresponding to the file to be detected with the preset risk level), it is necessary to fill part of the idle time in it on the basis of copying the currently determined target cursor movement simulation program. According to the above steps, when generating several cursor movement simulation programs, the invalid collection time period is used as the segmentation time period, so each cursor movement simulation program has adjacent invalid collection time periods. Furthermore, after generating several preset sandboxes according to several cursor movement simulation programs, each preset sandbox has a corresponding invalid collection time period list. Furthermore, this embodiment obtains the updated cursor movement simulation program through the following steps:

[0105] Therefore, after step S210, the above method further includes:

[0106] Step S230, if the estimated risk level corresponding to the above-mentioned file to be detected is the preset risk level, determine the target unavailable time period according to the movement simulation duration corresponding to the file to be detected, the movement duration corresponding to the above-mentioned target cursor movement simulation program and the unavailable time period list corresponding to the target sandbox.

[0107] The time length ST corresponding to the above movement simulation time length, the time length JT corresponding to the above movement time length of the target cursor movement simulation program, and the time length FT corresponding to the target unavailable time period meet the following conditions:

[0108] rounddown(x(JT+FT) / ST)=1

[0109] And JT / FT∈(QD xin , QD xax )

[0110] Among them, QD xin The lower limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the target cursor movement simulation program; QD xax is the upper limit value of the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the target cursor movement simulation program; x is the preset coefficient; rounddown() is the preset floor function.

[0111] In this embodiment, first, according to the preset time ratio range corresponding to the interface type attribute of the front-end interface corresponding to the target cursor movement simulation program, an invalid collection time period with a suitable time length is selected from the invalid collection time period list corresponding to the target sandbox, that is, the target invalid collection time period, and then the number of target cursor movement simulation programs and the number of target invalid collection time periods are controlled to be consistent, and the spliced ​​time length is equal to or greater than the time length ST corresponding to the movement simulation duration, and can be infinitely close to the time length ST corresponding to the movement simulation duration.

[0112] Step S240 , combining each available time period in the intermediate cursor movement simulation program with the target unavailable time period to obtain an updated target cursor movement simulation program.

[0113] Here, the splicing may be random splicing or evenly spaced splicing. After splicing the same number of target cursor movement simulation programs and target invalid acquisition time periods, an updated target cursor movement simulation program is obtained.

[0114] like Figure 2 As shown, a sandbox determination device 100 for a file to be detected is provided according to an embodiment of the present application.

[0115] The above-mentioned sandbox determination device 100 for a file to be detected includes:

[0116] The vector acquisition unit 110 is used to acquire the device characteristics of the source device corresponding to the file to be detected, so as to obtain the device characteristic vector to be detected.

[0117] The matching degree acquisition unit 120 is used to obtain the matching degree between the above-mentioned device feature vector to be detected and the comparison feature vector corresponding to each preset sandbox in a number of preset sandboxes, and obtain a matching degree list; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each cursor movement simulation program has a corresponding device feature vector; the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree between all device feature vectors corresponding to the preset sandbox and the central device feature vector of the preset sandbox.

[0118] The determination unit 130 is used to determine the preset sandbox corresponding to the largest matching degree in the above matching degree list as the target sandbox; wherein the above target sandbox is used to run the above file to be detected, and when running the above file to be detected, any cursor movement simulation program corresponding to the target sandbox is executed to control the cursor in the target sandbox to move according to the executed cursor movement simulation program.

[0119] An embodiment of the present application further provides a computer program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the method according to various exemplary embodiments of the present application described above in this specification.

[0120] In addition, although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0121] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation method of the present application.

[0122] In an exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided.

[0123] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0124] The electronic device according to this embodiment of the present application is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one storage device mentioned above, and a bus connecting different system components (including storage devices and processors).

[0126] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps described in the above “Exemplary Method” section of this specification according to various exemplary embodiments of the present application.

[0127] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0128] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0129] The bus may represent one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0130] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. This communication may be performed through an input / output (I / O) interface. In addition, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. As shown in the figure, the network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0131] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software, or by combining software with necessary hardware. Therefore, the technical solution according to the implementation method of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation method of the present application.

[0132] In an exemplary embodiment of the present application, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present application described in the above "Exemplary Method" section of the present specification.

[0133] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, a system, device or component of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0134] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0136] Program code for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0137] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present application, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0138] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0139] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A sandbox determination method for a file to be detected, characterized in that: The file to be detected has a corresponding estimated risk level; the method comprises: Obtaining device characteristics of the source device corresponding to the file to be detected to obtain a feature vector of the device to be detected; Obtaining the degree of match between the feature vector of the device to be detected and the comparison feature vector corresponding to each preset sandbox in a plurality of preset sandboxes, and obtaining a matching degree list; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each cursor movement simulation program has a corresponding device feature vector; and the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest degree of match between the central device feature vector of the preset sandbox and all the device feature vectors corresponding to the preset sandbox; The preset sandbox corresponding to the largest matching degree in the matching degree list is determined as the target sandbox; wherein the target sandbox is used to run the file to be detected, and when running the file to be detected, any cursor movement simulation program corresponding to the target sandbox is executed to control the cursor in the target sandbox to move according to the executed cursor movement simulation program; The target sandbox is also used to perform the following steps: Determine the target cursor movement simulation program from each cursor movement simulation program corresponding to the target sandbox according to a preset determination rule; Controlling the file to be detected to run in the target sandbox, and executing the target cursor movement simulation program when running the file to be detected to control the cursor in the target sandbox to move according to the target cursor movement simulation program; The file to be detected has a corresponding movement simulation duration, and each cursor movement simulation program has a corresponding movement duration; wherein, determining the target cursor movement simulation program from each cursor movement simulation program corresponding to the target sandbox according to a preset determination rule comprises: Obtaining the time period matching degree between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to each cursor movement simulation program; Obtaining a device matching degree between a device feature vector to be detected corresponding to the file to be detected and a device feature vector corresponding to each cursor movement simulation program; Obtaining a target matching degree of each cursor movement simulation program corresponding to the file to be detected and the target sandbox according to the time period matching degree, the device matching degree, the time period importance coefficient corresponding to the time period matching degree, and the device importance coefficient corresponding to the device matching degree; Determine the cursor movement simulation program corresponding to the largest target matching degree as the target cursor movement simulation program; Each cursor movement simulation program has a corresponding front-end interface; wherein, determining the target cursor movement simulation program from each cursor movement simulation program corresponding to the target sandbox according to a preset determination rule comprises: Get the target interface type attribute corresponding to the front-end interface when the target sandbox is running; According to the target interface type attribute, determining a plurality of key cursor movement simulation programs corresponding to the target sandbox; wherein the interface type attribute of the front-end interface corresponding to the key cursor movement simulation program is the same as the target interface type attribute; According to the movement simulation duration corresponding to the file to be detected and the feature vector of the device to be detected, and the movement duration and device feature vector corresponding to each key cursor movement simulation program, the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained; The key cursor movement simulation program corresponding to the largest key matching degree is determined as the target cursor movement simulation program.

2. The sandbox determination method for a file to be detected according to claim 1, characterized in that: The step of obtaining the key matching degree of the file to be detected and each key cursor movement simulation program corresponding to the target sandbox according to the movement simulation duration corresponding to the file to be detected and the device feature vector to be detected, and the movement duration and device feature vector corresponding to each key cursor movement simulation program includes: Obtaining a key time period matching degree between a movement simulation duration corresponding to the file to be detected and a movement duration corresponding to each key cursor movement simulation program; Obtaining a key device matching degree between a device feature vector corresponding to the file to be detected and a device feature vector corresponding to each key cursor movement simulation program; According to the key time period matching degree, the key device matching degree, the key time period importance coefficient corresponding to the key time period matching degree and the key device importance coefficient corresponding to the key device matching degree, the key matching degree of each key cursor movement simulation program corresponding to the file to be detected and the target sandbox is obtained.

3. The sandbox determination method for a file to be detected according to claim 1, characterized in that: Matching degree SD of the i-th time period i Meet the following conditions: SD i =MT i / YT i Among them, MT i YT is the overlapping time length between the movement simulation duration corresponding to the file to be detected and the movement duration corresponding to the i-th cursor movement simulation program corresponding to the target sandbox; i The length of time corresponding to the movement duration of the i-th cursor movement simulation program.

4. The sandbox determination method for a file to be detected according to claim 1, characterized in that: Several preset sandboxes are obtained by following the steps below: In a target time window, corresponding cursor movement data of a plurality of devices when they are in a plurality of front-end interfaces are collected to generate a plurality of cursor movement simulation programs; Clustering a number of cursor movement simulation programs according to a device feature vector corresponding to each cursor movement simulation program to obtain n cluster sets; wherein any cluster set includes at least one cursor movement simulation program; A corresponding sandbox environment is constructed according to each of the cluster sets to obtain n preset sandboxes.

5. A sandbox determination device for a file to be detected, characterized in that: Used to implement the sandbox determination method for a file to be detected according to any one of claims 1 to 4, wherein the file to be detected has a corresponding estimated risk level; the device comprises: A vector acquisition unit, used to acquire device characteristics of a source device corresponding to the file to be detected, so as to obtain a device characteristic vector to be detected; A matching degree acquisition unit is used to acquire the matching degree between the feature vector of the device to be detected and the comparison feature vector corresponding to each preset sandbox in a plurality of preset sandboxes, and obtain a matching degree list; wherein each preset sandbox has at least one corresponding cursor movement simulation program; and each cursor movement simulation program has a corresponding device feature vector; and the comparison feature vector corresponding to each preset sandbox is the device feature vector with the highest matching degree with the central device feature vector of the preset sandbox among all device feature vectors corresponding to the preset sandbox; A determination unit is used to determine the preset sandbox corresponding to the largest matching degree in the matching degree list as a target sandbox; wherein the target sandbox is used to run the file to be detected, and when running the file to be detected, any cursor movement simulation program corresponding to the target sandbox is executed to control the cursor in the target sandbox to move according to the executed cursor movement simulation program.

6. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the sandbox determination method for a file to be detected as described in any one of claims 1-4.

7. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 6.

Images