Threat data discovery method and device, storage medium and electronic equipment

Abstract

The invention discloses a threat data discovery method and device, a storage medium and electronic equipment, and the method comprises the steps: carrying out the filtering preprocessing of at least one piece of collected sample data based on a known threat type, and obtaining unknown sample data, performing operation detection processing on the unknown sample data by adopting a virtual environment corresponding to the unknown sample data to obtain an operation detection report of the unknown sample data, and obtaining threat sample data from the unknown sample data by adopting a threat data screening strategy and the operation detection report, and performing alarm processing on the threat sample data. By adopting the method and the device, the known threat data is filtered, and then the unknown threat sample data is screened out from the collected sample data by adopting an operation detection mode, so that the accuracy of obtaining the threat sample data is improved, and targeted defense processing on the threat sample data is facilitated.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a threat data discovery method, device, storage medium and electronic device. Background Art

[0002] With the popularization of the Internet and information technology, while the network provides people with a convenient living and working environment in all aspects, malicious attacks on the Internet are also increasing day by day. Malicious attacks on the Internet can infect the user's host with Trojan viruses, maliciously tamper with the host settings, etc. In order to prevent and block malicious attacks on the Internet, firewalls, anti-virus software and other applications are often installed in the host. However, firewalls and anti-virus software rely on known Internet threat data. However, with the development of information technology, the types and forms of malicious attacks on the Internet are also increasing. Therefore, it is necessary to propose a method for discovering threatening data in massive Internet data. Summary of the invention

[0003] The embodiments of the present application provide a threat data discovery method, device, storage medium and electronic device, which can filter known threat data and then screen out unknown threat sample data from collected sample data by running detection, thereby improving the accuracy of threat sample data acquisition and facilitating targeted defense processing of threat sample data. The technical solution is as follows:

[0004] In a first aspect, an embodiment of the present application provides a threat data discovery method, the method comprising:

[0005] Performing filtering and preprocessing on at least one collected sample data based on a known threat type to obtain unknown sample data;

[0006] Using the virtual environment corresponding to the unknown sample data to perform operation detection processing on the unknown sample data, and obtaining an operation detection report of the unknown sample data;

[0007] The threat data screening strategy and the operation detection report are adopted to obtain threat sample data from the unknown sample data, and an alarm process is performed on the threat sample data.

[0008] In a second aspect, an embodiment of the present application provides a threat data discovery device, the device comprising:

[0009] A preprocessing module, configured to filter and preprocess at least one collected sample data based on a known threat type to obtain unknown sample data;

[0010] An operation detection module, used to perform operation detection processing on the unknown sample data using the virtual environment corresponding to the unknown sample data, and obtain an operation detection report of the unknown sample data;

[0011] The high-threat alarm module is used to adopt the threat data screening strategy and the operation detection report, obtain threat sample data from the unknown sample data, and perform alarm processing on the threat sample data.

[0012] In a third aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0013] In a fourth aspect, an embodiment of the present application provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0014] In one or more embodiments of the present application, at least one collected sample data is filtered and preprocessed based on a known threat type to obtain unknown sample data, and the unknown sample data is run-detected using a virtual environment corresponding to the unknown sample data to obtain a run-detection report of the unknown sample data, and threat data screening strategies and the run-detection report are used to obtain threat sample data from the unknown sample data, and an alarm is performed on the threat sample data. By filtering the known threat data and then using the run-detection method to filter out the unknown threat sample data from the collected sample data, the accuracy of acquiring the threat sample data is improved, and targeted defense processing of the threat sample data is facilitated. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 This is an example schematic diagram of a threat sample data screening provided by an embodiment of the present application;

[0017] Figure 2 It is a flowchart of a threat data discovery method provided by an embodiment of the present application;

[0018] Figure 3 It is a flowchart of a threat data discovery method provided by an embodiment of the present application;

[0019] Figure 4 This is an example schematic diagram of an operation detection process provided by an embodiment of the present application;

[0020] Figure 5 It is a structural diagram of a threat data discovery device provided in an embodiment of the present application;

[0021] Figure 6 It is a structural diagram of a threat data discovery device provided in an embodiment of the present application;

[0022] Figure 7 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0024] The threat data discovery device can obtain at least one collected sample data, and the collected sample data can include user behavior, asset certificates, network traffic, host behavior, portable executable (PE) files, and uniform resource locators (URL) and other data. The collected sample data is various data related to Internet information security and user host security detected and obtained by the threat data discovery device on the Internet. The collected sample data can also be input into the threat data discovery device by relevant staff. It is understandable that the threat data discovery device can continuously obtain the collected sample data, and can process the obtained at least one collected sample data using a high threat data method according to a preset detection time interval, filter out a small amount of threat sample data from at least one collected sample data, and perform alarm processing on the threat sample data. Among them, the preset detection time interval can be the initial setting of the threat data discovery device, and can also be set by relevant staff. For example, the preset detection time interval can be 30 days. Then, the threat data discovery device can select threat sample data from all collected sample data acquired within 30 days after the last alarm processing, and perform alarm processing on these threat sample data. The alarm processing is used to prompt relevant staff that threat sample data has been detected, and instruct relevant staff to perform targeted processing such as analysis and prevention on the threat sample data. The threat data discovery method provided in the embodiment of the present application can be implemented by relying on a computer program, and can be run on a threat data discovery device based on the von Neumann system. The computer program can be integrated in an application, or it can be run as an independent tool application.

[0025] It is understandable that the amount of collected sample data is very large, including various types of sample data, and the collected sample data includes duplicate sample data, sample data that overlaps with known threat types and other invalid sample data. The threat data discovery device is used to obtain a small amount of valid threat sample data from the massive amount of collected sample data. Please refer to Figure 1 , an example schematic diagram of threat sample data screening is provided for an embodiment of the present application. The threat data discovery device can perform filtering preprocessing on at least one collected sample data. The filtering preprocessing can remove known sample data that matches a known threat type in at least one collected sample data. The known threat type can be a data type known to the threat data discovery device, which poses a threat to the Internet or a user host and may cause malicious attacks on the Internet or a user host. For example, it may include known Trojan viruses, macro viruses, ransomware applications, advertising plug-ins, etc. The known sample data is sample data that contains known threat type data.

[0026] The known sample data is data that can be found by the threat data discovery device according to the known threat type, which may generate attack behaviors on the Internet and the user host. It can be understood that the known threat type can be a data type that has been discovered by relevant staff or reported by users or hosts. Therefore, the threat data discovery device or the firewall, anti-virus application installed on the user's host can timely discover the known sample data and intercept, delete, etc. the known sample data during normal operation. Therefore, in the case where there is a firewall, anti-virus application or threat data discovery device on the Internet or the user's host, the known sample data is no longer a high threat to the Internet or the user's host. On the contrary, among the unknown sample data that cannot be matched with the known threat type in the collected sample data, it is more likely that there are sample data that may generate malicious attacks on the Internet or the user's host that have not been discovered by relevant staff, firewalls and anti-virus applications, and the threat data discovery device can remove sample data that really does not have threats and risks from the location sample data, and screen out a small amount of threat sample data that has abnormal behaviors and abnormal data during operation and may generate malicious attacks on the Internet and the user's host through operation detection processing.

[0027] It is understandable that threat sample data refers to data that does contain abnormal data and abnormal behavior, which may cause malicious attacks on the Internet and user hosts, but cannot be identified by existing firewalls and anti-virus applications, and cannot be matched with known threat types. Since threat sample data cannot be identified by existing firewalls, anti-virus applications, etc., threat sample data is highly threatening to the Internet and user hosts, and can easily bypass firewalls and anti-virus applications to enter the Internet and user hosts, thereby launching malicious attacks on the Internet and user hosts.

[0028] The threat data discovery method provided by the present application is described in detail below in conjunction with specific embodiments.

[0029] See also Figure 2 , which is a flowchart of a threat data discovery method provided by an embodiment of the present application. Figure 2 As shown, the method of the embodiment of the present application may include the following steps S101-S103.

[0030] S101, filtering and preprocessing at least one collected sample data based on a known threat type to obtain unknown sample data.

[0031] Specifically, the threat data discovery device can continuously acquire collected sample data, and perform filtering preprocessing on at least one collected sample data acquired according to a preset detection time interval, wherein the preset detection time interval can be the initial setting of the threat data discovery device, or can be set by relevant staff, for example, the preset detection time interval can be 30 days, then the threat data discovery device can perform filtering preprocessing on all collected sample data acquired within 30 days after the last filtering preprocessing. The filtering preprocessing can remove invalid known sample data such as duplicate sample data that matches a known threat type in at least one collected sample data, thereby obtaining unknown sample data, which is the sample data remaining after removing known sample data from at least one collected sample data.

[0032] Among them, the known threat types may be data types that are known to the threat data discovery device and pose a threat to the Internet or the user host and may cause malicious attacks to the Internet or the user host. For example, they may include known Trojan viruses, macro viruses, ransomware applications, advertising plug-ins, etc. The known sample data is sample data that contains known threat type data.

[0033] S102, using a virtual environment corresponding to the unknown sample data to perform operation detection processing on the unknown sample data, and obtaining an operation detection report of the unknown sample data.

[0034] Specifically, the threat data discovery device can create a virtual environment corresponding to the unknown sample data, and then use the virtual environment to perform operation detection processing on the unknown sample data, that is, put the unknown sample data into the virtual environment for operation, and obtain the operation detection report generated by the unknown sample data during the operation of the virtual environment. The operation detection report can report the operation behavior and data content of the unknown sample data during the operation process. For example, the operation behavior can be the unknown sample data calling a process, creating a task, connecting to a network, and releasing a file during the operation process. The data content can be the data carried by the unknown sample data itself, and can also include data generated by the unknown sample data during the operation process.

[0035] It is understandable that there may be multiple unknown sample data, so the threat data discovery device can create a virtual environment corresponding to each unknown sample data, allowing each unknown sample data to perform operation detection processing in the corresponding virtual environment, thereby achieving mutual isolation of the unknown sample data during the operation detection processing process.

[0036] S103, adopting the threat data screening strategy and running the detection report, obtaining threat sample data from the unknown sample data, and performing alarm processing on the threat sample data.

[0037] Specifically, the threat data discovery device can adopt the threat data screening strategy and the operation detection report to obtain the threat sample data from the unknown sample data, and perform alarm processing on the threat sample data. The alarm processing is used to prompt the relevant staff that the threat sample data has been detected, and instruct the relevant staff to perform targeted processing such as analysis and prevention on the threat sample data. The threat data screening strategy is used to determine whether the unknown sample data is threat sample data according to the operation detection report. The threat data discovery device can evaluate and process the operation behavior and data content of the unknown sample data during the operation process according to the threat data screening strategy and the operation detection report, so as to obtain the threat index of the unknown sample data. If the threat index is greater than the threat index threshold, the unknown sample data is threat sample data, wherein the threat index is used to indicate the threat of the unknown sample data. It can be understood that the higher the threat index, the more abnormal operation behaviors and abnormal data contents there are in the operation detection report, that is, the higher the threat of the unknown sample data. The threat index threshold is used to determine whether the unknown sample data is threat sample data. The threat index threshold can be the initial setting of the threat data discovery device, or it can be set by the relevant staff.

[0038] In an embodiment of the present application, at least one collected sample data is filtered and preprocessed based on a known threat type to obtain unknown sample data, and a virtual environment corresponding to the unknown sample data is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data, and a threat data screening strategy and the operation detection report are used to obtain threat sample data from the unknown sample data, and an alarm is performed on the threat sample data. By filtering the known threat data and then using the operation detection method to screen out the unknown threat sample data from the collected sample data, the accuracy of acquiring the threat sample data is improved, and targeted defense processing of the threat sample data is facilitated.

[0039] See also Figure 3 , which is a flowchart of a threat data discovery method provided by an embodiment of the present application. Figure 3 As shown, the method of the embodiment of the present application may include the following steps S201-S208.

[0040] S201: Acquire known sample data matching a known threat type from the at least one collected sample data.

[0041] Specifically, the threat data discovery device can continuously acquire collected sample data, and perform filtering preprocessing on at least one collected sample data acquired according to a preset detection time interval, wherein the preset detection time interval can be an initial setting of the threat data discovery device, or can be set by relevant staff, and the filtering preprocessing can remove invalid known sample data such as sample data that matches a known threat type in at least one collected sample data, thereby obtaining unknown sample data.

[0042] The threat data discovery device can obtain known sample data that matches the known threat type in at least one collected sample data. The known threat type may be a data type that is known to the threat data discovery device and poses a threat to the Internet or the user host and may cause malicious attacks to the Internet or the user host. For example, it may include known Trojan viruses, macro viruses, ransomware applications, advertising plug-ins, etc. The known sample data is sample data that contains known threat type data.

[0043] It is understandable that existing firewalls, antivirus applications, etc. can identify data of known threat types, so the threat data discovery device can use existing firewalls and antivirus applications to detect and process at least one collected sample data to obtain known sample data therein.

[0044] S202: Remove known sample data from at least one collected sample data to obtain unknown sample data.

[0045] Specifically, the threat data discovery device may perform filtering preprocessing on at least one collected sample data, remove known sample data from at least one collected sample data, and thereby obtain unknown sample data. The unknown sample data is sample data remaining after removing known sample data from at least one collected sample data.

[0046] Optionally, in addition to filtering and preprocessing at least one collected sample data, the threat data discovery device may also perform data standardization processing on at least one collected sample data based on a preset data format. The data standardization processing is used to unify the data format of the collected sample data into a preset data format, thereby facilitating subsequent processing of the collected sample data by the threat data discovery device. The preset data format can be the initial setting of the threat data discovery device, and can also be set by relevant staff.

[0047] Optionally, the threat data discovery device can also perform data deduplication processing on at least one collected sample data. The data deduplication processing is used to delete repeated collected sample data in at least one collected sample data. For example, if three collected sample data in at least one collected sample data are identical and repeated, namely sample A, sample B and sample C, then the threat data discovery device can delete any two of the collected sample data, leaving only one non-duplicate collected sample data, that is, sample A and sample B can be deleted, leaving only sample C.

[0048] Optionally, the threat data discovery device can also perform deep analysis processing on at least one collected sample data. The deep analysis processing is used to obtain deep data in the collected sample data. For example, it can decompress the compressed package in the collected sample data, obtain attachment data in the collected sample data, etc., to avoid missing the deep data in the collected sample data.

[0049] It is understandable that the threat data discovery device can perform filtering preprocessing, data standardization processing, data deduplication processing and deep analysis processing on at least one collected sample data, so as to obtain unknown sample data, wherein the execution order of filtering preprocessing, data standardization processing, data deduplication processing and deep analysis processing is not specific.

[0050] S203, obtaining attribute information of the unknown sample data, and obtaining a virtual environment corresponding to the unknown sample data based on the attribute information.

[0051] Specifically, the threat data discovery device can create a virtual environment corresponding to the unknown sample data, and then use the virtual environment to run the unknown sample data, that is, put the unknown sample data into the virtual environment for operation. The threat data discovery device can obtain the attribute information of the unknown sample data, and then obtain the virtual environment corresponding to the unknown sample data based on the attribute information, wherein the attribute information may include the system bit number and system version corresponding to the unknown sample data, and the threat discovery device can create a virtual environment corresponding to the system bit number and system version.

[0052] Optionally, the attribute information may also include an open application corresponding to the unknown sample data, that is, the unknown sample data requires a corresponding open application to be opened and run, and the high threat discovery device may create a virtual environment with the open application installed.

[0053] S204, using a virtual environment to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data.

[0054] Specifically, the threat data discovery device can use a virtual environment to perform operation detection processing on unknown sample data, and obtain an operation detection report generated by the unknown sample data during the operation of the virtual environment. The operation detection report can report the operation behavior and data content of the unknown sample data during the operation process. For example, the operation behavior can be the unknown sample data calling a process, creating a task, connecting to a network, and releasing a file during the operation process. The data content can be the data carried by the unknown sample data itself, and can also include data generated by the unknown sample data during the operation process.

[0055] It is understandable that there may be multiple unknown sample data, so the threat data discovery device can create a virtual environment corresponding to each unknown sample data, allowing each unknown sample data to perform operation detection processing in the corresponding virtual environment, thereby achieving mutual isolation of the unknown sample data during the operation detection processing process.

[0056] Optionally, the threat data discovery device can monitor the abnormal operation behavior and abnormal data content generated by the unknown sample data during the operation detection process of the unknown sample data, for example, the unknown sample data has abnormal operation behavior that exploits system vulnerabilities during the operation detection process, and abnormal data content containing Trojan programs released to the system memory. When the threat data discovery device detects that the unknown sample data has abnormal operation behavior and / or abnormal data content during the operation detection process, it can perform sample regression processing on the unknown sample data. The sample regression processing is used to allow the high threat discovery device to re-acquire a new virtual environment for the unknown sample data after the unknown sample data completes a run detection process, and use the new virtual environment to perform run detection processing on the unknown sample data, that is, return to step S203, the threat data discovery device can obtain the virtual environment corresponding to the unknown sample data again based on the attribute information. It can be understood that the new virtual environment is not the same virtual environment as the previous virtual environment, and there are differences in system version and patch, until the unknown sample data has been run detected in all adapted virtual environments, or the unknown sample data no longer has abnormal operation behavior and / or generates abnormal data content during the run detection process.

[0057] Please also see Figure 4 , an example schematic diagram of operation detection processing is provided for an embodiment of the present application. In the environment selection step, i.e., step S203, the threat data discovery device can obtain the virtual environment corresponding to the location sample data based on the attribute information. The threat data discovery device can first create a virtual environment A corresponding to the unknown sample data. The unknown sample data is subjected to operation detection processing in the virtual environment A to obtain report A. Report A is the operation detection report obtained by the unknown sample data in the virtual environment A. If the threat data discovery device detects that there are abnormal operation behaviors and abnormal data contents in report A, the unknown sample data is subjected to sample regression processing, and the process returns to the environment selection step, such as Figure 4The threat data discovery device shown can create a virtual environment B, use virtual environment B to obtain report B of unknown sample data, if it is detected that there are still abnormal operation behaviors and abnormal data content in report B, then perform sample regression processing again and return to environment selection processing, the threat data discovery device creates virtual environment C, uses virtual environment C to obtain report C of unknown sample data, if it is detected that there are still abnormal operation behaviors and abnormal data content in report C, then perform sample regression processing again and return to environment selection processing, the threat data discovery device creates virtual environment D, uses virtual environment D to obtain report D of unknown sample data, if there are no longer abnormal operation behaviors and abnormal data content in report D, or virtual environment A, virtual environment B, virtual environment C or virtual environment D are all virtual environments corresponding to unknown sample data, then no sample regression processing is performed. The threat data discovery device can merge all the obtained reports to obtain the operation detection report corresponding to the unknown sample data, that is, merge report A, report B, report C and report D to obtain the operation detection report.

[0058] Optionally, in addition to the operation behavior and data content of the unknown sample data, the operation detection report may also include a risk score for the unknown sample data. The risk score is obtained by the threat data discovery device based on the operation behavior and data content of the unknown sample data, and is used to indicate the risk score of the unknown sample data for the Internet and the user host. It is understandable that the higher the risk score, the higher the probability that the unknown sample data will be abnormal on the Internet and the user host during operation, wherein the risk score is not the same as the threat index. The threat data discovery device may use a risk assessment model to obtain the risk score of the unknown sample data, that is, input the operation behavior and data content of the unknown sample data into the risk assessment model, and the risk assessment model may output the risk score corresponding to the unknown sample data.

[0059] The risk assessment model is obtained after the threat data discovery device trains the initial risk assessment model. The threat data discovery device can obtain at least one training unknown sample data, the training operation behavior corresponding to each training unknown sample data in at least one training unknown sample data, the training data content corresponding to each training unknown sample data, and the training risk score corresponding to each training unknown sample data. The initial risk assessment model is trained with the training operation behavior corresponding to each training unknown sample data and the training data content corresponding to each training unknown sample data as input and the training risk score corresponding to each training unknown sample data as output, thereby obtaining the risk assessment model.

[0060] The threat data discovery device can obtain the risk score of the fourth sample data in the operation detection report, where the fourth sample data is any sample data in the unknown sample data. If the risk score of the fourth sample data is greater than the risk score threshold, the fourth sample is confirmed as risk sample data. The risk score threshold is used to determine whether the unknown sample data is risk sample data. It can be the initial setting of the threat data discovery device or can be set by relevant staff. The risk sample data means that there is a risk of abnormality during the operation process, but the risk sample data is not necessarily threat sample data.

[0061] Although the risk sample data can be run, when the user runs or receives the risk sample data on the user host, the user needs to be given a risk prompt. The risk prompt is used to prompt the user that the risk sample data has appeared. The user can continue to run the risk sample data based on the risk prompt, or choose to delete the risk sample data. Therefore, the threat data discovery device can obtain the identity information indicator of the risk sample data, and save the risk sample data, the identity information indicator and the risk score in the risk database. The risk database includes at least one risk sample data and the identity information indicator and risk score corresponding to each risk sample data in at least one risk sample data, wherein the identity information indicator is data that can represent the identity of the risk sample data, such as the hash value, domain name, Internet Protocol (IP) address, etc. of the risk sample data. When the threat data discovery device detects that data with the same identity information indicator as that in the risk database appears on the user host, a risk prompt can be given to the user host.

[0062] The risk score based on which the risk sample data enters the risk database is obtained based on the risk assessment model, but in the actual operation process of the risk sample data, the risk score can be updated. When the risk score of the risk sample data is less than the risk score threshold, the threat data discovery device can delete the risk sample data from the risk database. In addition to the identity information indicators and risk scores of the risk sample data, the risk database can also store the credibility corresponding to the risk score. The credibility indicates the accuracy of the risk score of the identity information indicator. It can be understood that the higher the credibility of the risk score, the more accurate the risk score. When the risk sample data enters the risk database, the credibility of the risk score can be 100%. Relevant staff and users can send a credibility adjustment instruction to the threat data discovery device for the risk sample data. The threat data discovery device can increase or decrease the credibility based on the credibility adjustment instruction. If the credibility of the risk score is less than the credibility threshold, the threat data discovery device can reduce the risk score. The credibility threshold can be the initial setting of the threat data discovery device, or it can be set by relevant staff, for example, it can be 50%.

[0063] For example, if the threat data discovery device receives a credibility adjustment instruction for the fifth sample data, wherein the fifth sample data is any risk sample data in the risk database, the risk score of the fifth sample data is the target score, and the credibility corresponding to the target score is the target credibility, if the credibility adjustment instruction is to reduce the target credibility, the threat data discovery device can reduce the target credibility; if the target credibility is less than the credibility threshold, the threat data discovery device can reduce the target score; if the target score is less than the risk score threshold, the threat data discovery device can delete the fifth sample data from the risk database.

[0064] S205: Perform threat assessment processing on the operation detection report based on the operation screening strategy and the content screening strategy to obtain a threat index of the unknown sample data.

[0065] Specifically, the threat data discovery device can adopt the threat data screening strategy and the operation detection report to obtain the threat sample data from the unknown sample data. The threat data screening strategy is used to determine whether the unknown sample data is the threat sample data according to the operation detection report. The threat data discovery device can evaluate and process the operation behavior and data content of the unknown sample data during the operation process according to the threat data screening strategy and the operation detection report, thereby obtaining the threat index of the unknown sample data. Among them, the threat data screening strategy may include the operation screening strategy and the content screening strategy. The operation screening strategy is used to evaluate and process the operation behavior of the unknown sample data during the operation process, and the content screening strategy is used to evaluate and process the data content of the unknown sample data during the operation process.

[0066] Optionally, the threat data discovery device can obtain first sample data and a target operation detection report corresponding to the first sample data, where the first sample data is any sample data in the unknown sample data, and the target operation detection report is an operation detection report obtained after the first sample data is subjected to operation detection processing. The threat data discovery device can evaluate and process the operation behavior of the first sample data in the target operation detection report based on the operation screening strategy to obtain a first index, and the first index is used to indicate the degree of abnormality of the operation behavior of the unknown sample data. It can be understood that the higher the first index, the more abnormal operation behaviors exist in the unknown sample data; the threat data discovery device can evaluate and process the data content of the first sample data in the target operation detection report based on the content screening strategy to obtain a second index, and it can be understood that the higher the second index, the more abnormal data content exists in the unknown sample data.

[0067] The threat data discovery device can combine the first index and the second index to obtain the threat index corresponding to the first sample. The threat data discovery device can sum the first index and the second index to obtain the threat index, or multiply the first index by the first weight to obtain the first weight index, multiply the second index by the second weight to obtain the second weight index, and then sum the first weight index and the second weight index to obtain the threat index. The sum of the first weight and the second weight is 1, and the values ​​of the first weight and the second weight can be the initial settings of the threat data discovery device, or can be set by relevant staff.

[0068] S206: Acquire threat sample data whose threat index is greater than a threat index threshold in the unknown sample data.

[0069] Specifically, the threat data discovery device can obtain high-threat samples in the unknown sample data whose threat index is greater than the threat index threshold, wherein the threat index is used to indicate the threat nature of the unknown sample data. It can be understood that the higher the threat index, the more abnormal operating behaviors and abnormal data content there are in the operation detection report, that is, the higher the threat nature of the unknown sample data. The threat index threshold is used to determine whether the unknown sample data is threat sample data. The threat index threshold can be the initial setting of the threat data discovery device, and can also be set by relevant staff.

[0070] Optionally, if the threat index of the second sample data is greater than the threat threshold, the threat data discovery device may confirm the second sample data as threat sample data, wherein the second sample data is any sample data among the unknown sample data.

[0071] S207: Perform alarm processing on the threat sample data.

[0072] Specifically, the threat data discovery device can perform alarm processing on the threat sample data obtained from at least one collected sample data. The alarm processing is used to prompt relevant staff that the threat sample data has been detected, and instruct relevant staff to perform targeted processing such as analysis and prevention on the threat sample data.

[0073] S208, performing association processing on the threat sample data based on the sample data characteristics to generate a threat data map.

[0074] Specifically, known sample data, threat sample data, and other malicious data may attack the Internet or user hosts. Some of these malicious data come from the same malicious gang or family, and often have correlations in sample data features, such as having the same IP address and the same data in the data content. Sample data features may be data that represent the operating behavior of sample data and the characteristics of data content, such as specific operating behavior of sample data, specific data content, as well as IP address, place of origin, etc.

[0075] The threat data discovery device can associate threat sample data according to sample data characteristics and generate a threat data map, that is, associate threat sample data with the same sample data characteristics and generate a visual threat data map. The threat data map can reflect which threat sample data are relevant, making it easier for relevant staff to confirm the source and ownership of the threat sample data, thereby improving the efficiency and accuracy of defense processing against threat sample data.

[0076] In an embodiment of the present application, known sample data matching the known threat type is obtained from at least one collected sample data, and the known sample data is removed from at least one collected sample data to obtain unknown sample data. At least one collected sample data can also be filtered and pre-processed, deduplicated, and deeply analyzed to remove more invalid data, avoid data errors, and improve subsequent processing efficiency. Attribute information of the unknown sample data is obtained, and the virtual environment corresponding to the unknown sample data is obtained based on the attribute information. The virtual environment is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data. If there are abnormal operation behaviors and abnormal data content in the operation detection processing, a new virtual environment can be used to perform operation detection processing on the unknown sample data again, and all reports are merged to obtain an operation detection report. Operation detection processing on different virtual environments enriches the operation detection report and improves the accuracy of the operation detection report. Based on the operation screening strategy and content screening strategy, the operation detection report is subjected to threat assessment processing, the threat index of unknown sample data is obtained, the threat sample data whose threat index is greater than the threat index threshold in the unknown sample data is obtained, and the threat sample data is subjected to alarm processing. By filtering the known threat data, and then using the operation detection method to screen out the unknown threat sample data from the collected sample data, the accuracy of obtaining the threat sample data is improved, and it is convenient to carry out targeted defense processing on the threat sample data. The threat sample data can also be associated based on the sample data characteristics to generate a threat data map, which is convenient for relevant staff to confirm the source and attribution of the threat sample data, and further improve the efficiency and accuracy of defense processing against the threat sample data. In addition, the operation detection report can also include the risk score of the unknown sample data, and the risk sample data is obtained based on the risk score. The risk sample data, identity information indicators and risk scores are stored in the risk database. When the threat data discovery device detects that data with the same identity information indicators as those in the risk database appear on the user host, the user host can be given a risk warning, which further ensures the security of the Internet and the user host.

[0077] The following will be combined with the attached Figure 5 -Attached Figure 6 , the threat data discovery device provided in the embodiment of the present application is introduced in detail. It should be noted that the attached Figure 5 -Attached Figure 6 The threat data discovery device in the present application is used to execute Figure 2-Figure 4 For the convenience of explanation, only the part related to the embodiment of the present application is shown. For the specific technical details not disclosed, please refer to the present application. Figure 2-Figure 4 The embodiment shown.

[0078] See also Figure 5, which shows a schematic diagram of the structure of a threat data discovery device provided by an exemplary embodiment of the present application. The threat data discovery device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes a preprocessing module 11, an operation detection module 12 and a high threat alarm module 13.

[0079] A preprocessing module 11, configured to filter and preprocess at least one collected sample data based on a known threat type to obtain unknown sample data;

[0080] An operation detection module 12 is used to perform operation detection processing on the unknown sample data using the virtual environment corresponding to the unknown sample data to obtain an operation detection report of the unknown sample data;

[0081] The high threat alarm module 13 is used to adopt the threat data screening strategy and the operation detection report to obtain threat sample data from the unknown sample data and perform alarm processing on the threat sample data.

[0082] In this embodiment, at least one collected sample data is filtered and preprocessed based on a known threat type to obtain unknown sample data, and a virtual environment corresponding to the unknown sample data is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data, and a threat data screening strategy and the operation detection report are used to obtain threat sample data from the unknown sample data, and an alarm is performed on the threat sample data. By filtering the known threat data and then using the operation detection method to screen out the unknown threat sample data from the collected sample data, the accuracy of obtaining the threat sample data is improved, and targeted defense processing of the threat sample data is facilitated.

[0083] See also Figure 6 , which shows a schematic diagram of the structure of a threat data discovery device provided by an exemplary embodiment of the present application. The threat data discovery device can be implemented as all or part of the device through software, hardware or a combination of both. The device 1 includes a preprocessing module 11, an operation detection module 12, a high threat alarm module 13, a risk assessment module 14 and a graph generation module 15.

[0084] A preprocessing module 11, configured to filter and preprocess at least one collected sample data based on a known threat type to obtain unknown sample data;

[0085] Optionally, the preprocessing module 11 is specifically used to obtain known sample data matching a known threat type from the at least one collected sample data;

[0086] The known sample data is removed from the at least one collected sample data to obtain unknown sample data.

[0087] An operation detection module 12 is used to perform operation detection processing on the unknown sample data using the virtual environment corresponding to the unknown sample data to obtain an operation detection report of the unknown sample data;

[0088] Optionally, the operation detection module 12 is specifically used to obtain attribute information of unknown sample data;

[0089] Acquire a virtual environment corresponding to the unknown sample data based on the attribute information;

[0090] The virtual environment is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data.

[0091] A high threat alarm module 13, configured to adopt a threat data screening strategy and the operation detection report, obtain threat sample data from the unknown sample data, and perform alarm processing on the threat sample data;

[0092] Optionally, the high threat alarm module 13 is specifically used to perform threat assessment processing on the operation detection report based on the operation screening strategy and the content screening strategy to obtain the threat index of the unknown sample data;

[0093] Acquire threat sample data whose threat index is greater than a threat index threshold value from the unknown sample data;

[0094] Performing alarm processing on the threat sample data.

[0095] Optionally, the high threat alarm module 13 is specifically used to obtain first sample data and a target operation detection report corresponding to the first sample data, where the first sample data is any sample data in the unknown sample data;

[0096] Based on the operation screening strategy, the operation behavior of the first sample data in the target operation detection report is evaluated and processed to obtain a first index;

[0097] Based on the content screening strategy, the data content of the first sample data in the target operation detection report is evaluated and processed to obtain a second index;

[0098] The threat index of the first sample data is obtained by combining the first index and the second index.

[0099] Optionally, the high threat alarm module 13 is specifically configured to confirm the second sample data as threat sample data if the threat index of the second sample data is greater than a threat threshold;

[0100] The second sample data is any sample data among the unknown sample data.

[0101] A risk assessment module 14, configured to obtain a risk score of fourth sample data in the operation detection report, wherein the fourth sample data is any sample data in the unknown sample data;

[0102] If the risk score of the fourth sample data is greater than the risk score threshold, confirming the fourth sample as risk sample data;

[0103] Acquire the identity information indicator of the risk sample data, and store the risk sample data and the identity information indicator in a risk database, wherein the risk database includes at least one risk sample data and the identity information indicator corresponding to each risk sample data in the at least one risk sample data;

[0104] The graph generation module 15 is used to perform association processing on the threat sample data based on sample data features to generate a threat data graph.

[0105] In this embodiment, known sample data matching the known threat type is obtained from at least one collected sample data, and the known sample data is removed from at least one collected sample data to obtain unknown sample data. At least one collected sample data can also be filtered and pre-processed, deduplicated, and deeply analyzed to remove more invalid data, avoid data errors, and improve subsequent processing efficiency. Attribute information of unknown sample data is obtained, and the virtual environment corresponding to the unknown sample data is obtained based on the attribute information. The virtual environment is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data. If there are abnormal operation behaviors and abnormal data content in the operation detection processing, a new virtual environment can be used to perform operation detection processing on the unknown sample data again, and all reports are merged to obtain an operation detection report. Operation detection processing on different virtual environments enriches the operation detection report and improves the accuracy of the operation detection report. Based on the operation screening strategy and content screening strategy, the operation detection report is subjected to threat assessment processing, the threat index of unknown sample data is obtained, the threat sample data whose threat index is greater than the threat index threshold in the unknown sample data is obtained, and the threat sample data is subjected to alarm processing. By filtering the known threat data, and then using the operation detection method to screen out the unknown threat sample data from the collected sample data, the accuracy of obtaining the threat sample data is improved, and it is convenient to carry out targeted defense processing on the threat sample data. The threat sample data can also be associated based on the sample data characteristics to generate a threat data map, which is convenient for relevant staff to confirm the source and attribution of the threat sample data, and further improve the efficiency and accuracy of defense processing against the threat sample data. In addition, the operation detection report can also include the risk score of the unknown sample data, and the risk sample data is obtained based on the risk score. The risk sample data, identity information indicators and risk scores are stored in the risk database. When the threat data discovery device detects that data with the same identity information indicators as those in the risk database appear on the user host, the user host can be given a risk warning, which further ensures the security of the Internet and the user host.

[0106] It should be noted that the threat data discovery device provided in the above embodiment only uses the division of the above functional modules as an example when executing the threat data discovery method. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the threat data discovery device provided in the above embodiment and the threat data discovery method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0107] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0108] The present application also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1-Figure 4 The threat data discovery method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 4 The specific description of the illustrated embodiment will not be repeated here.

[0109] The present application also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1-Figure 4 The threat data discovery method of the embodiment shown in the figure can be specifically executed by referring to Figure 1-Figure 4 The specific description of the illustrated embodiment will not be repeated here.

[0110] Please refer to Figure 7 , which shows a block diagram of the structure of an electronic device provided by an exemplary embodiment of the present application. The electronic device in the present application may include one or more of the following components: a processor 110, a memory 120, an input device 130, an output device 140, and a bus 150. The processor 110, the memory 120, the input device 130, and the output device 140 may be connected via the bus 150.

[0111] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire electronic device, and executes various functions and processes data of the terminal 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user pages, and applications; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0112] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). Optionally, the memory 120 includes a non-transitory computer-readable medium (Non-Transitory Computer-Readable Storage Medium). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc. The operating system may be an Android system, including a system deeply developed based on the Android system, an IOS system developed by Apple, including a system deeply developed based on the IOS system or other systems.

[0113] The memory 120 can be divided into an operating system space and a user space. The operating system runs in the operating system space, and native and third-party applications run in the user space. In order to ensure that different third-party applications can achieve good operating results, the operating system allocates corresponding system resources to different third-party applications. However, the requirements for system resources in different application scenarios in the same third-party application are also different. For example, in the local resource loading scenario, the third-party application has higher requirements for disk reading speed; in the animation rendering scenario, the third-party application has higher requirements for GPU performance. The operating system and third-party applications are independent of each other, and the operating system often cannot perceive the current application scenario of the third-party application in a timely manner, resulting in the operating system being unable to perform targeted system resource adaptation according to the specific application scenario of the third-party application.

[0114] In order for the operating system to distinguish the specific application scenarios of third-party applications, it is necessary to open up data communication between third-party applications and the operating system so that the operating system can obtain the current scenario information of third-party applications at any time, and then perform targeted system resource adaptation based on the current scenario.

[0115] The input device 130 is used to receive input commands or data, and includes but is not limited to a keyboard, a mouse, a camera, a microphone, or a touch device. The output device 140 is used to output commands or data, and includes but is not limited to a display device and a speaker. In one example, the input device 130 and the output device 140 can be combined, and the input device 130 and the output device 140 are touch screen displays.

[0116] The touch display screen can be designed as a full screen, a curved screen or a special-shaped screen. The touch display screen can also be designed as a combination of a full screen and a curved screen, or a combination of a special-shaped screen and a curved screen, which is not limited in the embodiments of the present application.

[0117] In addition, those skilled in the art will appreciate that the structure of the electronic device shown in the above drawings does not constitute a limitation on the electronic device, and the electronic device may include more or fewer components than shown, or combine certain components, or arrange the components differently. For example, the electronic device also includes a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (WiFi) module, a power supply, a Bluetooth module and other components, which will not be described in detail here.

[0118] exist Figure 7 In the electronic device shown, the processor 110 may be used to call the threat data discovery application stored in the memory 120, and specifically perform the following operations:

[0119] Performing filtering and preprocessing on at least one collected sample data based on a known threat type to obtain unknown sample data;

[0120] Using the virtual environment corresponding to the unknown sample data to perform operation detection processing on the unknown sample data, and obtaining an operation detection report of the unknown sample data;

[0121] The threat data screening strategy and the operation detection report are adopted to obtain threat sample data from the unknown sample data, and an alarm process is performed on the threat sample data.

[0122] In one embodiment, when the processor 110 performs filtering preprocessing on at least one collected sample data based on a known threat type to obtain unknown sample data, the processor 110 specifically performs the following operations:

[0123] Acquire known sample data matching a known threat type from the at least one collected sample data;

[0124] The known sample data is removed from the at least one collected sample data to obtain unknown sample data.

[0125] In one embodiment, the processor 110 performs the following operations when executing the threat data screening strategy and the running detection report, obtaining threat sample data from the unknown sample data, and performing alarm processing on the threat sample data:

[0126] Performing threat assessment processing on the operation detection report based on the operation screening strategy and the content screening strategy to obtain a threat index of the unknown sample data;

[0127] Acquire threat sample data whose threat index is greater than a threat index threshold value from the unknown sample data;

[0128] Performing alarm processing on the threat sample data.

[0129] In one embodiment, when the processor 110 performs threat assessment processing on the operation detection report based on the operation screening strategy and the content screening strategy to obtain the threat index of the unknown sample data, the processor 110 specifically performs the following operations:

[0130] Acquire first sample data and a target operation detection report corresponding to the first sample data, wherein the first sample data is any sample data among the unknown sample data;

[0131] Based on the operation screening strategy, the operation behavior of the first sample data in the target operation detection report is evaluated and processed to obtain a first index;

[0132] Based on the content screening strategy, the data content of the first sample data in the target operation detection report is evaluated and processed to obtain a second index;

[0133] The threat index of the first sample data is obtained by combining the first index and the second index.

[0134] In one embodiment, when the processor 110 acquires the threat sample data whose threat index is greater than the threat index threshold in the unknown sample data, the processor 110 specifically performs the following operations:

[0135] If the threat index of the second sample data is greater than the threat threshold, confirming the second sample data as threat sample data;

[0136] The second sample data is any sample data among the unknown sample data.

[0137] In one embodiment, when the processor 110 performs operation detection processing on the unknown sample data using the virtual environment corresponding to the unknown sample data to obtain the operation detection report of the unknown sample data, the processor 110 specifically performs the following operations:

[0138] Obtain attribute information of unknown sample data;

[0139] Acquire a virtual environment corresponding to the unknown sample data based on the attribute information;

[0140] The virtual environment is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data.

[0141] In one embodiment, when executing the threat data discovery method, the processor 110 further performs the following operations:

[0142] Obtaining a risk score of fourth sample data in the operation detection report, where the fourth sample data is any sample data among the unknown sample data;

[0143] If the risk score of the fourth sample data is greater than the risk score threshold, confirming the fourth sample as risk sample data;

[0144] The identity information indicator of the risk sample data is obtained, and the risk sample data and the identity information indicator are stored in a risk database, wherein the risk database includes at least one risk sample data and the identity information indicator corresponding to each risk sample data in the at least one risk sample data.

[0145] In one embodiment, when executing the threat data discovery method, the processor 110 further performs the following operations:

[0146] The threat sample data is associated with each other based on the sample data characteristics to generate a threat data map.

[0147] In this embodiment, known sample data matching the known threat type is obtained from at least one collected sample data, and the known sample data is removed from at least one collected sample data to obtain unknown sample data. At least one collected sample data can also be filtered and pre-processed, deduplicated, and deeply analyzed to remove more invalid data, avoid data errors, and improve subsequent processing efficiency. Attribute information of unknown sample data is obtained, and the virtual environment corresponding to the unknown sample data is obtained based on the attribute information. The virtual environment is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data. If there are abnormal operation behaviors and abnormal data content in the operation detection processing, a new virtual environment can be used to perform operation detection processing on the unknown sample data again, and all reports are merged to obtain an operation detection report. Operation detection processing on different virtual environments enriches the operation detection report and improves the accuracy of the operation detection report. Based on the operation screening strategy and content screening strategy, the operation detection report is subjected to threat assessment processing, the threat index of unknown sample data is obtained, the threat sample data whose threat index is greater than the threat index threshold in the unknown sample data is obtained, and the threat sample data is subjected to alarm processing. By filtering the known threat data, and then using the operation detection method to screen out the unknown threat sample data from the collected sample data, the accuracy of obtaining the threat sample data is improved, and it is convenient to carry out targeted defense processing on the threat sample data. The threat sample data can also be associated based on the sample data characteristics to generate a threat data map, which is convenient for relevant staff to confirm the source and attribution of the threat sample data, and further improve the efficiency and accuracy of the defense processing against the threat sample data. In addition, the operation detection report can also include the risk score of the unknown sample data, and the risk sample data is obtained based on the risk score. The risk sample data, identity information indicators and risk scores are stored in the risk database. When the threat data discovery device detects that data with the same identity information indicators as those in the risk database appear on the user host, the user host can be given a risk warning, which further ensures the security of the Internet and the user host.

[0148] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0149] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

[0150] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the collection of sample data, operation test reports, etc. involved in this specification are all obtained with full authorization.

Claims

1. A threat data discovery method, It is characterized in that The method comprises: Performing filtering and preprocessing on at least one collected sample data based on a known threat type to obtain unknown sample data; Using the virtual environment corresponding to the unknown sample data to perform operation detection processing on the unknown sample data, and obtaining an operation detection report of the unknown sample data; The threat data screening strategy and the operation detection report are adopted to obtain threat sample data from the unknown sample data, and an alarm process is performed on the threat sample data.

2. The method according to claim 1, It is characterized in that The filtering and preprocessing of at least one collected sample data based on the known threat type to obtain unknown sample data includes: Acquire known sample data matching a known threat type from the at least one collected sample data; The known sample data is removed from the at least one collected sample data to obtain unknown sample data.

3. The method according to claim 1, It is characterized in that The adopting of the threat data screening strategy and the running detection report, obtaining threat sample data from the unknown sample data, and performing alarm processing on the threat sample data include: Performing threat assessment processing on the operation detection report based on the operation screening strategy and the content screening strategy to obtain a threat index of the unknown sample data; Acquire threat sample data whose threat index is greater than a threat index threshold value from the unknown sample data; Performing alarm processing on the threat sample data.

4. The method according to claim 3, It is characterized in that The performing threat assessment processing on the operation detection report based on the operation screening strategy and the content screening strategy to obtain the threat index of the unknown sample data includes: Acquire first sample data and a target operation detection report corresponding to the first sample data, wherein the first sample data is any sample data among the unknown sample data; Based on the operation screening strategy, the operation behavior of the first sample data in the target operation detection report is evaluated and processed to obtain a first index; Based on the content screening strategy, the data content of the first sample data in the target operation detection report is evaluated and processed to obtain a second index; The threat index of the first sample data is obtained by combining the first index and the second index.

5. The method according to claim 3, It is characterized in that The acquiring of threat sample data having a threat index greater than a threat index threshold from the unknown sample data includes: If the threat index of the second sample data is greater than the threat threshold, confirming the second sample data as threat sample data; The second sample data is any sample data among the unknown sample data.

6. The method according to claim 1, It is characterized in that The step of performing operation detection processing on the unknown sample data using the virtual environment corresponding to the unknown sample data to obtain an operation detection report of the unknown sample data includes: Obtain attribute information of unknown sample data; Acquire a virtual environment corresponding to the unknown sample data based on the attribute information; The virtual environment is used to perform operation detection processing on the unknown sample data to obtain an operation detection report of the unknown sample data.

7. The method according to claim 1, It is characterized in that The method further comprises: Obtaining a risk score of fourth sample data in the operation detection report, where the fourth sample data is any sample data among the unknown sample data; If the risk score of the fourth sample data is greater than the risk score threshold, confirming the fourth sample as risk sample data; The identity information indicator of the risk sample data is obtained, and the risk sample data and the identity information indicator are stored in a risk database, wherein the risk database includes at least one risk sample data and the identity information indicator corresponding to each risk sample data in the at least one risk sample data.

8. The method according to claim 1, It is characterized in that The method further comprises: The threat sample data is associated with each other based on the sample data characteristics to generate a threat data map.

9. A threat data discovery device, It is characterized in that The device comprises: A preprocessing module, configured to filter and preprocess at least one collected sample data based on a known threat type to obtain unknown sample data; An operation detection module, used to perform operation detection processing on the unknown sample data using the virtual environment corresponding to the unknown sample data, and obtain an operation detection report of the unknown sample data; The high-threat alarm module is used to adopt the threat data screening strategy and the operation detection report, obtain threat sample data from the unknown sample data, and perform alarm processing on the threat sample data.

10. A computer storage medium, It is characterized in that The computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 8.

11. An electronic device, It is characterized in that include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 8.

Images