Compressed package security detection method and device based on embedded similar file names

Abstract

The present invention discloses a method and device for security detection of compressed packages based on embedded similar file names, and relates to the technical field of compressed package detection. The method comprises: performing depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtaining the subfile names in each layer of subdirectories, and obtaining a file name set; performing similarity detection on the file names in the file name set, and obtaining the number of similar file names with similar file names; judging whether the number of similar file names exceeds a first threshold, and if it exceeds the first threshold, accumulating the value of the similar file name group; judging whether the value of the similar file name group exceeds a second threshold, and if it does not exceed the second threshold, continuing to perform depth-first traversal on the compressed package to be detected; if it exceeds the second threshold, judging that the compressed package to be detected is a package bomb, and exiting the detection. The present invention is suitable for security detection of compressed packages.

Description

Technical Field

[0001] The present invention relates to the field of compressed package detection and defense technology, and in particular to a compressed package security detection method and device based on embedded similar file names. Background Art

[0002] Arc.Bomb is a compressed package virus. It is usually only a few hundred KB, but after decompression, it will become a behemoth of hundreds of MB / TB. At present, the efficiency and effect of compressed package security detection are not high. The basic principle of detecting compressed package bombs is to compare the size of the file after decompression with the original compressed size. However, if hackers use tools to construct several files with high compression ratios, rename the same files to form multiple files with the same content, and then compress them twice, repeating the above work, the final files will require a large amount of memory and disk resources if all are decompressed and released, and may even exceed the number of disk resources, forming a real compressed package bomb. If the anti-virus engine decompresses and releases such files one by one, according to the existing detection strategy, it will not only consume a lot of system resources, but also may cause detection timeout, resulting in failure to report the malicious sample as a compressed package bomb, resulting in detection failure. Summary of the invention

[0003] In view of the above problems, the present invention provides a method and device for security detection of compressed packages based on embedded similar file names, so as to speed up the detection time and reduce the occupation of system resources.

[0004] According to one aspect of the present invention, a method for security detection of compressed packages based on embedded similar file names is provided, comprising:

[0005] Perform a depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtain the subfile names in each layer of subdirectories, and obtain a file name set;

[0006] Performing similarity detection on the file names in the file name set to obtain the number of similar file names;

[0007] Determine whether the number of similar file names exceeds a first threshold, and if so, accumulate similar file name group values;

[0008] Determine whether the value of the similar file name group exceeds a second threshold. If it does not exceed the second threshold, continue to perform depth-first traversal on the compressed package to be detected; if it exceeds the second threshold, determine that the compressed package to be detected is a package bomb and exit detection.

[0009] In an optional manner, performing similarity detection on the file names in the file name set further includes:

[0010] Splitting the file names in the file name set into tokens according to the separator to obtain a token set;

[0011] Dynamically construct an inverted index according to the token set, wherein each token in the inverted index corresponds to a list of file names containing the token;

[0012] For each file name, find the file name list corresponding to its token in the inverted index, and determine the similarity by calculating the ratio or number of shared tokens of the file names.

[0013] In an optional manner, before performing similarity detection on the file names in the file name set, the method further includes:

[0014] Determine the number of similar files in the compressed package. If it exceeds a preset ratio, it is determined to be a package bomb.

[0015] In an optional manner, before performing similarity detection on the file names in the file name set, the method further includes:

[0016] The first threshold and the second threshold are dynamically adjusted according to the size of the compressed package to be detected, the compression ratio of each layer of subdirectories, the number of files in each layer of subdirectories, and the average file name length of each layer of subdirectories.

[0017] In an optional manner, the adjustment formula of the first threshold is:

[0018]

[0019] in, The number of levels or preset number of levels for the directory; is the number of files in the i-th level subdirectory; is the average file name length in the i-th level subdirectory; is the average or maximum compression ratio in the i-th level subdirectory; is the size of the compressed package; and is a constant factor;

[0020] The adjustment formula of the second threshold is:

[0021]

[0022] in, The number of levels or preset number of levels for the directory; is the number of files in the i-th level subdirectory; is the average or maximum compression ratio in the i-th level subdirectory; is the size of the compressed package; and is a constant factor, is a constant factor.

[0023] In an optional manner, after the number of similar file names exceeds a first threshold, the method further includes:

[0024] Detecting the file compression ratio of each of the similar files;

[0025] If the compression ratio of one of the files exceeds a third threshold, the compressed package to be detected is determined to be a package bomb, and the detection is exited;

[0026] or,

[0027] Detecting each of the similar files to obtain the total number of similar file groups;

[0028] If the total number of the file groups exceeds the third threshold, the compressed package to be detected is determined to be a package bomb, and the detection is exited.

[0029] In an optional manner, after determining that the compressed package to be detected is a package bomb, the method further includes:

[0030] The key features of the compressed package determined to be a package bomb are added to the blacklist database; wherein the key features include similar file names, file compression ratios and corresponding abnormal file types.

[0031] In an optional manner, during the traversal of the compressed package to be detected, the method further includes:

[0032] During the traversal of the compressed package to be detected, the changes of system resources are monitored in real time; wherein the system resources include CPU usage, memory occupancy and disk I / O;

[0033] Analyze the changes in the system resources to obtain an abnormal resource consumption threshold;

[0034] If the abnormal resource consumption threshold exceeds a fourth threshold, the traversal of the compressed package to be detected is suspended, it is determined to be a possible package bomb, and the user is prompted whether to continue the decompression operation.

[0035] In an optional manner, while performing depth-first traversal on each layer of subdirectories of the compressed package to be detected, the method further includes:

[0036] Monitor the user's sensitive operation behaviors in the current session or application through hook functions; wherein the sensitive operation behaviors include payment, password input, and information input behaviors;

[0037] Associating the sensitive operation behavior with the traversal operation of the compressed package to be detected to obtain the associated time and associated behavior;

[0038] The first threshold and the second threshold are dynamically adjusted according to the association time and the association behavior.

[0039] In an optional manner, the hook function includes a keyboard hook and a shell hook to capture the user's current keyboard input mode and application window information; wherein the application window information includes an application name and a window title;

[0040] Monitoring the user's sensitive operation behaviors in the current session or application through hook functions further includes:

[0041] By analyzing the keyboard input mode and application window information, the sensitive operation behavior of the user in the current session or application is obtained.

[0042] According to another aspect of the present invention, there is provided a compressed package security detection device based on embedded similar file names, comprising:

[0043] A depth traversal module is used to perform a depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtain the names of subfiles in each layer of subdirectories, and obtain a file name set;

[0044] A similarity detection module is used to perform similarity detection on the file names in the file name set to obtain the number of similar file names;

[0045] A first judging module, configured to judge whether the number of similar file names exceeds a first threshold, and if so, to accumulate similar file name group values;

[0046] The second judgment module is used to judge whether the value of the similar file name group exceeds a second threshold. If it does not exceed the second threshold, the depth-first traversal of the compressed package to be detected continues; if it exceeds the second threshold, the compressed package to be detected is determined to be a package bomb and the detection is exited.

[0047] An embodiment of the present invention also provides an electronic device, comprising: one or more processors; a memory; one or more executable program codes are stored in the memory, and the one or more processors read the executable program codes stored in the memory and run programs corresponding to the executable program codes to execute the compressed package security detection method based on embedded similar file names described in any of the aforementioned embodiments.

[0048] According to the scheme provided by the present invention, a depth-first traversal is performed on each layer of subdirectories of the compressed package to be detected, and the subfile names in the subdirectories of each layer are obtained to obtain a file name set; a similarity test is performed on the file names in the file name set to obtain the number of similar file names with similar file names; it is determined whether the number of similar file names exceeds a first threshold, and if it exceeds the first threshold, the similar file name group values ​​are accumulated; it is determined whether the similar file name group values ​​exceed a second threshold, and if it does not exceed the second threshold, the depth-first traversal is continued for the compressed package to be detected; if it exceeds the second threshold, it is determined that the compressed package to be detected is a package bomb, and the detection is exited. The present invention reduces the occupation of system resources while speeding up the detection time, providing strong support for network defense.

[0049] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0051] Figure 1 A schematic diagram of the process of a compressed package security detection method based on embedded similar file names according to an embodiment of the present invention is shown;

[0052] Figure 2a to Figure 2e A schematic diagram of an embedded file in an embodiment of the present invention is shown;

[0053] Figure 3 A schematic diagram of a framework of a compressed package security detection device based on embedded similar file names according to an embodiment of the present invention is shown.

[0054] Figure 4 This is a schematic diagram of the structure of an embodiment of the electronic device of the present application. DETAILED DESCRIPTION

[0055] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0056] Figure 1 FIG. 1 is a flow chart of a method for security detection of compressed packages based on embedded similar file names according to an embodiment of the present invention. Specifically, Figure 1 As shown, the following steps are included:

[0057] Step S101 , performing a depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtaining the names of subfiles in each layer of subdirectories, and obtaining a file name set.

[0058] In this embodiment, all subdirectories and files in the compressed package can be traversed through depth-first traversal, and no potential malicious content (such as compressed packages hidden deeper) will be missed. Among them, the depth-first search algorithm (DFS) is an algorithm for traversing or searching a tree or graph, searching the branches of the tree as deeply as possible. When all the edges where the node v is located have been explored, the search will trace back to the starting node of the edge where the node v was found. This process continues until all nodes reachable from the source node have been found. If there are still undiscovered nodes, one of them is selected as the source node and the above process is repeated. The whole process is repeated until all nodes are visited.

[0059] Step S102, performing similarity detection on the file names in the file name set to obtain the number of similar file names.

[0060] The similarity between file names is calculated by similarity algorithms such as edit distance, cosine similarity, and Jaccard similarity, and a corresponding similarity threshold is set. If the similarity of the file names exceeds the similarity threshold, they are considered similar file names.

[0061] In an optional manner, performing similarity detection on the file names in the file name set further includes:

[0062] Splitting the file names in the file name set into tokens according to the separator to obtain a token set;

[0063] Dynamically construct an inverted index according to the token set, wherein each token in the inverted index corresponds to a list of file names containing the token;

[0064] For each file name, find the list of file names corresponding to its token in the inverted index (such as Figure 2a to Figure 2e ), similarity is determined by calculating the ratio or number of shared tokens in the file names.

[0065] In this embodiment, the file name is divided into tokens using predefined separators (such as spaces, underscores, dots, etc.), the tokens obtained by the division are stored in a token set, and duplicates are removed.

[0066] Initialize the hash table as an inverted index and iterate over each token in the token collection. For each token, create an entry in the inverted index if one does not already exist and associate a list of all file names containing that token with that entry.

[0067] Iterate through each file name in the file name collection, and for each file name, split it into tokens. For each token in the file name, find the corresponding file name list in the inverted index.

[0068] Count the number of tokens that the file name shares with each other file name in the list, and calculate the ratio of the number of shared tokens to the total number of tokens in the file name. Then use the average or maximum of these ratios as the similarity score.

[0069] Alternatively, count the number of tokens that the file name shares with each other file name in the list and evaluate the similarity based on that number. If the number of shared tokens exceeds a preset threshold, the two file names are considered similar.

[0070] Based on a threshold of similarity score or number of shared tokens, determine which file names are similar and count the total number of similar file names.

[0071] Step S103, determining whether the number of similar file names exceeds a first threshold, and if so, accumulating similar file name group values.

[0072] Step S104, determining whether the value of the similar file name group exceeds a second threshold value, if not, continuing to perform a depth-first traversal on the compressed package to be detected; if exceeding the second threshold value, determining that the compressed package to be detected is a package bomb, and exiting the detection.

[0073] In an optional manner, before performing similarity detection on the file names in the file name set, the method further includes:

[0074] The first threshold and the second threshold are dynamically adjusted according to the size of the compressed package to be detected, the compression ratio of each layer of subdirectories, the number of files in each layer of subdirectories, and the average file name length of each layer of subdirectories.

[0075] Static threshold settings often fail to maintain optimal performance in all situations. For example, some legitimate compressed packages may be falsely reported as package bombs due to excessively high static thresholds, while some malicious compressed packages may be missed due to too low thresholds. By dynamically adjusting the threshold based on the characteristics of the compressed package, potential package bombs can be more accurately identified, reducing false positives and missed negatives.

[0076] In an optional manner, the adjustment formula of the first threshold is:

[0077]

[0078] in, The number of levels or preset number of levels for the directory; is the number of files in the i-th level subdirectory; is the average file name length in the i-th level subdirectory; is the average or maximum compression ratio in the i-th level subdirectory; is the size of the compressed package; and is a constant factor;

[0079] The adjustment formula of the second threshold is:

[0080]

[0081] in, The number of levels or preset number of levels for the directory; is the number of files in the i-th level subdirectory; is the average or maximum compression ratio in the i-th level subdirectory; is the size of the compressed package; and is a constant factor, is a constant factor.

[0082] In an optional manner, while performing depth-first traversal on each layer of subdirectories of the compressed package to be detected, the method further includes:

[0083] Monitor the user's sensitive operation behaviors in the current session or application through hook functions; wherein the sensitive operation behaviors include payment, password input, and information input behaviors;

[0084] Associating the sensitive operation behavior with the traversal operation of the compressed package to be detected to obtain the associated time and associated behavior;

[0085] The first threshold and the second threshold are dynamically adjusted according to the association time and the association behavior.

[0086] In this embodiment, by monitoring the user's sensitive operation behavior, the actual behavior of the user in the current session or application is obtained. This not only relies on the characteristics of the compressed package itself, but also takes into account the rationality and security of the user's behavior. It can more accurately determine whether the appearance of the compressed package to be detected is related to the user's sensitive operation, thereby more effectively resisting malicious attacks.

[0087] For example, by associating sensitive operation behaviors with compressed package traversal operations, it is possible to quickly identify compressed packages that appear when users perform important operations (such as payment, password input, etc.), conduct more stringent detection of potential threats, and improve the pertinence and timeliness of detection. By intelligently adjusting the detection threshold, it is possible to reduce unnecessary detection interference while ensuring security. For example, when users perform normal file operations, warnings will not pop up frequently or interrupt the user process, thereby improving the user experience. It not only relies on the characteristics of the compressed package itself, but also takes into account the rationality and security of user behavior.

[0088] In an optional manner, the hook function includes a keyboard hook and a shell hook to capture the user's current keyboard input mode and application window information; wherein the application window information includes an application name and a window title;

[0089] By analyzing the keyboard input mode and application window information, the sensitive operation behavior of the user in the current session or application is obtained.

[0090] In this embodiment, with user authorization, the user's keyboard input (such as key sequence, input speed, etc.) and application window (such as application name, window title, etc.) are captured in real time through the hook function, which can assist in determining whether the user is performing sensitive operations, thereby assisting in discovering and preventing potential malicious operations and enhancing the security protection capabilities of the system. For example, the user's keyboard input is captured through a keyboard hook (such as WH_KEYBOARD or WH_KEYBOARD_LL). The system Shell events, including the startup and shutdown of the application and the creation and destruction of the window, are monitored through a shell hook (such as WH_SHELL), so as to obtain the application window information. The captured keyboard input data is analyzed to identify specific input modes, such as password input mode (continuous input of numbers, letters, special characters, etc.). Combined with the application window information, it is determined whether the user is performing sensitive operations in a specific application or window. According to the analysis results, it is determined whether the user is performing sensitive operations.

[0091] In an optional manner, after the number of similar file names exceeds a first threshold, the method further includes:

[0092] Detecting the file compression ratio of each of the similar files;

[0093] If the compression ratio of one of the files exceeds a third threshold, the compressed package to be detected is determined to be a package bomb, and the detection is exited;

[0094] or,

[0095] Detecting each of the similar files to obtain the total number of similar file groups;

[0096] If the total number of the file groups exceeds the third threshold, the compressed package to be detected is determined to be a package bomb, and the detection is exited.

[0097] In this embodiment, by using the file compression ratio as a judgment basis, compressed packages with similar file names but highly compressed contents can be more accurately identified, thereby effectively preventing the intrusion of package bombs and reducing the risk of malicious code execution.

[0098] Alternatively, if there are multiple files with similar file names in the compressed package, similar files are grouped and counted, such as "aa.txt, aa1.txt, bb.txt, bb1.txt" four file names have two similar file groups. Since normal users rarely compress and distribute a large number of files with similar file names at the same time, when the total number of similar file groups exceeds a certain threshold, it can be used as a basis for determining package bombs. By using the similarity association between the names of various files, false positives caused by the similarity of individual file names can be reduced.

[0099] In an optional manner, after determining that the compressed package to be detected is a package bomb, the method further includes:

[0100] The key features of the compressed package determined to be a package bomb are added to the blacklist database; wherein the key features include similar file names, file compression ratios and corresponding abnormal file types.

[0101] In an optional manner, during the traversal of the compressed package to be detected, the method further includes:

[0102] Real-time monitoring of changes in system resources, including CPU usage, memory usage, and disk I / O;

[0103] Analyze the changes in the system resources to obtain an abnormal resource consumption threshold;

[0104] If the abnormal resource consumption threshold exceeds a fourth threshold, the traversal of the compressed package to be detected is suspended, it is determined to be a possible package bomb, and the user is prompted whether to continue the decompression operation.

[0105] By real-time monitoring of key system resources such as CPU usage, memory occupancy, and disk I / O, potential abnormal resource consumption can be discovered immediately. Intervention can be performed before malicious compressed packages such as package bombs begin to consume a large amount of system resources. When abnormal resource consumption is detected and it is determined to be a package bomb, the user is reminded whether to continue the decompression operation to avoid potential risks caused by automatic decompression of malicious compressed packages and prevent malicious compressed packages from further consuming system resources, thereby protecting the stability and availability of the system.

[0106] According to the scheme provided by the present invention, a depth-first traversal is performed on each layer of subdirectories of the compressed package to be detected, and the subfile names in the subdirectories of each layer are obtained to obtain a file name set; a similarity test is performed on the file names in the file name set to obtain the number of similar file names with similar file names; it is determined whether the number of similar file names exceeds a first threshold, and if it exceeds the first threshold, the similar file name group values ​​are accumulated; it is determined whether the similar file name group values ​​exceed a second threshold, and if it does not exceed the second threshold, the depth-first traversal is continued for the compressed package to be detected; if it exceeds the second threshold, it is determined that the compressed package to be detected is a package bomb, and the detection is exited. The present invention reduces the occupation of system resources while speeding up the detection time, providing strong support for network defense.

[0107] Figure 3 The schematic diagram of the framework of the compressed package security detection device based on embedded similar file names according to an embodiment of the present invention is shown. The compressed package security detection device based on embedded similar file names includes:

[0108] A depth traversal module 310 is used to perform a depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtain the subfile names in each layer of subdirectories, and obtain a file name set;

[0109] A similarity detection module 320 is used to perform similarity detection on the file names in the file name set to obtain the number of similar file names.

[0110] A first judging module 330 is used to judge whether the number of similar file names exceeds a first threshold, and if so, to accumulate similar file name group values;

[0111] The second judgment module 340 is used to judge whether the value of the similar file name group exceeds a second threshold. If it does not exceed the second threshold, the depth-first traversal of the compressed package to be detected continues; if it exceeds the second threshold, the compressed package to be detected is determined to be a package bomb and the detection is exited.

[0112] According to the scheme provided by the present invention, a depth-first traversal is performed on each layer of subdirectories of the compressed package to be detected, and the subfile names in the subdirectories of each layer are obtained to obtain a file name set; a similarity test is performed on the file names in the file name set to obtain the number of similar file names with similar file names; it is determined whether the number of similar file names exceeds a first threshold, and if it exceeds the first threshold, the similar file name group values ​​are accumulated; it is determined whether the similar file name group values ​​exceed a second threshold, and if it does not exceed the second threshold, the depth-first traversal is continued for the compressed package to be detected; if it exceeds the second threshold, it is determined that the compressed package to be detected is a package bomb, and the detection is exited. The present invention reduces the occupation of system resources while speeding up the detection time, providing strong support for network defense.

[0113] Figure 4 This is a schematic block diagram of the architecture of an embodiment of an electronic device of the present application. Based on the technical concept basically the same as that of the aforementioned embodiment 1, the electronic device provided by the embodiment of the present application includes: one or more processors; a memory; one or more executable program codes are stored in the memory, and the one or more processors read the executable program codes stored in the memory to run the program corresponding to the executable program code, so as to execute the compressed package security detection method described in any of the aforementioned embodiments.

[0114] The above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program codes; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, so as to execute the compressed package security detection method described in any of the above-mentioned embodiments.

[0115] The specific execution process of the processor 42 for the above steps and the steps further executed by the processor 42 by running the executable program code can be found in the description of Example 1 of the present application, which will not be repeated here.

[0116] The electronic device exists in many forms, including but not limited to:

[0117] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, feature phones, and low-end phones.

[0118] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0119] (3) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0120] (4) Other electronic devices with data interaction functions.

[0121] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and further may be divided into multiple submodules or subunits or subcomponents. All features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination, except that at least some of such features and / or processes or units are mutually exclusive. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose. In addition, those skilled in the art will appreciate that, although some embodiments herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present invention and to form different embodiments. For example, in the following claims, any one of the claimed embodiments may be used in any combination. The present invention may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several means, several of these means may be embodied by the same hardware item. The steps in the above embodiments should not be understood as limiting the execution order unless otherwise specified.

Claims

1. A method for security detection of compressed packages based on embedded similar file names, characterized in that: include: Perform a depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtain the subfile names in each layer of subdirectories, and obtain a file name set; Performing similarity detection on the file names in the file name set to obtain the number of similar file names; Determine whether the number of similar file names exceeds a first threshold, and if so, accumulate similar file name group values; Determine whether the value of the similar file name group exceeds a second threshold value, if not, continue to perform depth-first traversal on the compressed package to be detected; if exceeding the second threshold value, determine that the compressed package to be detected is a package bomb, and exit detection; The similarity detection of the file names in the file name set includes: dividing the file names in the file name set into tokens according to the separator to obtain a token set; dynamically constructing an inverted index according to the token set, wherein each token in the inverted index corresponds to a list of file names containing the token; for each file name, searching for a list of file names corresponding to its token in the inverted index, and determining the similarity by calculating the proportion or number of tokens shared by the file names; Before performing similarity detection on the file names in the file name set, the method further includes: dynamically adjusting the first threshold and the second threshold according to the size of the compressed package to be detected, the compression ratio of each layer of subdirectories, the number of files in each layer of subdirectories, and the average file name length of each layer of subdirectories; The adjustment formula of the first threshold is: ； in, The number of levels or preset number of levels for the directory; is the number of files in the i-th level subdirectory; is the average file name length in the i-th level subdirectory; is the average or maximum compression ratio in the i-th level subdirectory; is the size of the compressed package; and is a constant factor; The adjustment formula of the second threshold is: ； in, The number of levels or preset number of levels for the directory; is the number of files in the i-th level subdirectory; is the average or maximum compression ratio in the i-th level subdirectory; is the size of the compressed package; and is a constant factor, is a constant factor.

2. The method for security detection of compressed packages based on embedded similar file names according to claim 1 is characterized in that: After the number of similar file names exceeds a first threshold, the method further includes: Detecting the file compression ratio of each of the similar files; If the compression ratio of one of the files exceeds a third threshold, the compressed package to be detected is determined to be a package bomb, and the detection is exited; or, Detecting each of the similar files to obtain the total number of similar file groups; If the total number of the file groups exceeds the third threshold, the compressed package to be detected is determined to be a package bomb, and the detection is exited.

3. The method for security detection of compressed packages based on embedded similar file names according to claim 1, characterized in that: After determining that the compressed package to be detected is a package bomb, the method further includes: The key features of the compressed package determined to be a package bomb are added to the blacklist database; wherein the key features include similar file names, file compression ratios and corresponding abnormal file types.

4. The method for security detection of compressed packages based on embedded similar file names according to claim 1, characterized in that: During the traversal of the compressed package to be detected, the method further includes: Real-time monitoring of changes in system resources, including CPU usage, memory usage, and disk I / O; Analyze the changes in the system resources to obtain an abnormal resource consumption threshold; If the abnormal resource consumption threshold exceeds a fourth threshold, the traversal of the compressed package to be detected is suspended, it is determined to be a possible package bomb, and the user is prompted whether to continue the decompression operation.

5. The method for security detection of compressed packages based on embedded similar file names according to claim 1, characterized in that: While performing depth-first traversal on each layer of subdirectories of the compressed package to be detected, the method further includes: Monitor the user's sensitive operation behaviors in the current session or application through hook functions; wherein the sensitive operation behaviors include payment, password input, and information input behaviors; Associating the sensitive operation behavior with the traversal operation of the compressed package to be detected to obtain the associated time and associated behavior; The first threshold and the second threshold are dynamically adjusted according to the association time and the association behavior.

6. The method for security detection of compressed packages based on embedded similar file names according to claim 5 is characterized in that: The hook function includes a keyboard hook and a shell hook to capture the user's current keyboard input mode and application window information; wherein the application window information includes an application name and a window title; The monitoring of the user's sensitive operation behavior in the current session or application through the hook function further includes: By analyzing the keyboard input mode and application window information, the sensitive operation behavior of the user in the current session or application is obtained.

7. A compressed package security detection device based on embedded similar file names, characterized in that: Used to execute the compressed package security detection method based on embedded similar file names as described in any one of claims 1 to 6, the compressed package security detection device comprises: A depth traversal module is used to perform a depth-first traversal on each layer of subdirectories of the compressed package to be detected, obtain the names of subfiles in each layer of subdirectories, and obtain a file name set; A similarity detection module is used to perform similarity detection on the file names in the file name set to obtain the number of similar file names; A first judging module, configured to judge whether the number of similar file names exceeds a first threshold, and if so, to accumulate similar file name group values; The second judgment module is used to judge whether the value of the similar file name group exceeds a second threshold. If it does not exceed the second threshold, the depth-first traversal of the compressed package to be detected continues; if it exceeds the second threshold, the compressed package to be detected is determined to be a package bomb and the detection is exited.

8. An electronic device, characterized in that: include: One or more processors; Memory; One or more executable program codes are stored in the memory, and the one or more processors read the executable program codes stored in the memory and run the programs corresponding to the executable program codes to execute the compressed package security detection method based on embedded similar file names as described in any one of claims 1 to 6.

Images