Industrial internet ransomware virus analysis method, device and equipment and storage medium

Abstract

The invention belongs to the technical field of virus analysis, and discloses an industrial internet ransomware virus analysis method, device and equipment and a storage medium. The method comprises the following steps: acquiring information of a to-be-analyzed virus during running in a preset sandbox to obtain an interface behavior sequence corresponding to the to-be-analyzed virus; performing type identification on the interface behavior sequence through a preset virus identification model, and determining whether the to-be-analyzed virus is a ransomware virus or not; and if the to-be-analyzed virus is the ransomware virus, determining a virus family classification to which the to-be-analyzed virus belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint database. Whether the to-be-analyzed virus is the ransomware virus or not is identified according to the interface behavior sequence of the to-be-analyzed virus through the pre-trained preset virus identification model, the overall identification process is rapid, and after the to-be-analyzed virus is determined to be the ransomware virus, the virus family classification of the to-be-analyzed virus can be determined, so that targeted processing can be ensured, infection and transmission of the ransomware virus can be prevented, and the accuracy of the identification process is improved. And the security and defense capability are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an industrial Internet ransomware analysis method, device, equipment and storage medium. Background Art

[0002] Ransomware is a new type of Internet virus that spreads mainly through encrypted files in the form of program Trojans, emails or web pages. The nature of this ransomware is very bad and extremely harmful. Once infected, it will cause irreparable losses to industrial Internet companies. For example, after the "WannaRen" ransomware spread, most antivirus software could not identify and intercept it. However, due to the low manufacturing cost, simple attack method and high ransom revenue of the ransomware itself, the ransomware is constantly developing towards diversified and professional attack methods.

[0003] However, traditional analysis methods or detection methods are generally based on manual reverse methods or heuristic detection and analysis methods. These methods have great limitations, lags, static analysis, and a serious imbalance between input and return. They are simply unable to cope with the continuous upgrade and iteration speed of ransomware, let alone the spread of ransomware variants such as obfuscation, packing, and dynamic mapping.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide an industrial Internet ransomware analysis method, device, equipment and storage medium, aiming to solve the technical problem that the existing technology cannot cope with the spread of ransomware.

[0006] To achieve the above object, the present invention provides an industrial Internet ransomware virus analysis method, the method comprising the following steps:

[0007] Collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed;

[0008] Performing type recognition on the interface behavior sequence by using a preset virus recognition model to determine whether the virus to be analyzed is a ransomware virus;

[0009] If the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library.

[0010] Optionally, before the step of collecting information about the virus to be analyzed when it is running in a preset sandbox and obtaining the interface behavior sequence corresponding to the virus to be analyzed, the step further includes:

[0011] When receiving a virus analysis request, extracting the virus to be analyzed and the virus running environment from the virus analysis request;

[0012] Determine sandbox configuration parameters according to the virus running environment;

[0013] Adjusting the environment of the preset sandbox according to the sandbox configuration parameters;

[0014] When the adjustment is completed, the virus to be analyzed is input into the preset sandbox for execution.

[0015] Optionally, the step of collecting information when the virus to be analyzed is running in a preset sandbox to obtain an interface behavior sequence corresponding to the virus to be analyzed includes:

[0016] Activate the virus to be analyzed in a preset sandbox, monitor the dynamic behavior of the virus to be analyzed through a sandbox monitoring tool corresponding to the preset sandbox, and generate a corresponding dynamic behavior log;

[0017] An interface behavior sequence corresponding to the virus to be analyzed is constructed according to the dynamic behavior log.

[0018] Optionally, the step of constructing the interface behavior sequence corresponding to the virus to be analyzed according to the dynamic behavior log includes:

[0019] Extracting a behavior information set corresponding to each behavior type from the dynamic behavior log;

[0020] Sorting the behavior information in the behavior information set according to the execution time of each behavior, and combining the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result;

[0021] The dynamic behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0022] Optionally, the step of aggregating the dynamic behavior sequences corresponding to each behavior type to obtain the interface behavior sequence corresponding to the virus to be analyzed includes:

[0023] Detecting whether there is a repeated subsequence in the dynamic behavior sequence;

[0024] If it exists, deduplication processing is performed on the dynamic behavior sequence to obtain a deduplication behavior sequence;

[0025] The deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0026] Optionally, the step of determining the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library includes:

[0027] Compare the interface behavior sequence with each virus fingerprint sequence in a preset virus fingerprint library to obtain sequence similarity with each virus fingerprint sequence;

[0028] Taking the maximum value among the sequence similarities as the maximum similarity;

[0029] Taking the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence;

[0030] The virus family corresponding to the target virus sequence is classified as the virus family to which the virus to be analyzed belongs.

[0031] Optionally, the step of using the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence includes:

[0032] Comparing the maximum similarity with a preset similarity threshold;

[0033] If the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0034] Optionally, after the step of comparing the maximum similarity with a preset similarity threshold, the method further includes:

[0035] If the maximum similarity is less than the preset similarity threshold, the virus family to which the virus to be analyzed belongs is determined to be classified as an unknown virus family;

[0036] An unknown determination report is constructed based on the sequence similarity with each virus fingerprint sequence, and the unknown determination report is displayed.

[0037] Optionally, if the maximum similarity is greater than or equal to the preset similarity threshold, the step of using the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence includes:

[0038] If the maximum similarity is greater than or equal to the preset similarity threshold, then respectively calculating the similarity difference between the sequence similarity with each virus fingerprint sequence and the maximum similarity;

[0039] If there is no similarity difference less than the preset difference threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0040] Optionally, if the maximum similarity is greater than or equal to the preset similarity threshold, after the step of respectively calculating the similarity difference between the sequence similarity with each virus fingerprint sequence and the maximum similarity, the method further includes:

[0041] If there is a similarity difference value that is less than a preset difference threshold value, the virus family to which the virus to be analyzed belongs is determined to be classified as an unknown virus family;

[0042] The virus fingerprint sequence corresponding to the similarity difference less than the preset difference threshold is regarded as an unknown judgment sequence;

[0043] An unknown determination report is generated according to the unknown determination sequence, and the unknown determination report is displayed.

[0044] Optionally, if the virus to be analyzed is a ransomware virus, after the step of determining the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library, the method further includes:

[0045] Extracting attack behavior information from the attack behavior log corresponding to the virus to be analyzed;

[0046] The preset virus fingerprint library is updated according to the attack behavior information, the interface behavior sequence and the virus family classification to which the virus to be analyzed belongs.

[0047] In addition, to achieve the above-mentioned purpose, the present invention also proposes an industrial Internet ransomware virus analysis device, which includes the following modules:

[0048] An information collection module is used to collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed;

[0049] A type identification module, used to identify the type of the interface behavior sequence through a preset virus identification model to determine whether the virus to be analyzed is a ransomware virus;

[0050] The virus classification module is used to determine the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library if the virus to be analyzed is a ransomware virus.

[0051] Optionally, the information collection module is also used to extract the virus to be analyzed and the virus operating environment from the virus analysis request when receiving the virus analysis request; determine the sandbox configuration parameters according to the virus operating environment; adjust the environment of the preset sandbox according to the sandbox configuration parameters; when the adjustment is completed, input the virus to be analyzed into the preset sandbox for execution.

[0052] Optionally, the information collection module is also used to activate the virus to be analyzed in a preset sandbox, monitor the dynamic behavior of the virus to be analyzed through a sandbox monitoring tool corresponding to the preset sandbox, and generate a corresponding dynamic behavior log; and construct an interface behavior sequence corresponding to the virus to be analyzed based on the dynamic behavior log.

[0053] Optionally, the information collection module is also used to extract a behavior information set corresponding to each behavior type from the dynamic behavior log; sort the behavior information in the behavior information set according to the execution time of each behavior, and combine the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result; aggregate the dynamic behavior sequences corresponding to each behavior type to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0054] Optionally, the information collection module is also used to detect whether there are repeated subsequences in the dynamic behavior sequence; if so, the dynamic behavior sequence is deduplicated to obtain a deduplicated behavior sequence; the deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain an interface behavior sequence corresponding to the virus to be analyzed.

[0055] Optionally, the virus classification module is also used to compare the interface behavior sequence with each virus fingerprint sequence in a preset virus fingerprint library to obtain sequence similarity with each virus fingerprint sequence; take the maximum value of the sequence similarities as the maximum similarity; take the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence; and classify the virus family corresponding to the target virus sequence as the virus family to which the virus to be analyzed belongs.

[0056] Optionally, the virus classification module is further used to compare the maximum similarity with a preset similarity threshold; if the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0057] In addition, to achieve the above-mentioned purpose, the present invention also proposes a virus analysis device, which includes: a processor, a memory, and a virus analysis program stored in the memory and executable on the processor, and the virus analysis program, when executed by the processor, implements the steps of the industrial Internet ransomware virus analysis method as described above.

[0058] In addition, to achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium, on which a virus analysis program is stored, and when the virus analysis program is executed, the steps of the industrial Internet ransomware virus analysis method as described above are implemented.

[0059] The present invention obtains the interface behavior sequence corresponding to the virus to be analyzed by collecting information when the virus to be analyzed is running in a preset sandbox; the interface behavior sequence is type-identified by a preset virus recognition model to determine whether the virus to be analyzed is a ransomware virus; if the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined based on the interface behavior sequence and each virus fingerprint sequence in the preset virus fingerprint library. Since the pre-trained preset virus recognition model is used to identify whether the virus to be analyzed is a ransomware virus based on the interface behavior sequence of the virus to be analyzed, the overall recognition process is fast, and after determining that it is a ransomware virus, the virus family classification of the virus to be analyzed will be determined, ensuring that targeted processing can be carried out to stop the infection and spread of the ransomware virus, thereby improving security and defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a schematic diagram of the structure of an electronic device in a hardware operating environment involved in an embodiment of the present invention;

[0061] Figure 2 This is a flow chart of the first embodiment of the industrial Internet ransomware analysis method of the present invention;

[0062] Figure 3 This is a flow chart of the second embodiment of the industrial Internet ransomware analysis method of the present invention;

[0063] Figure 4 This is a flow chart of the third embodiment of the industrial Internet ransomware analysis method of the present invention;

[0064] Figure 5 This is a schematic diagram of the execution flow of an embodiment of an industrial Internet ransomware analysis method of the present invention;

[0065] Figure 6 This is a structural block diagram of the first embodiment of the industrial Internet ransomware analysis device of the present invention.

[0066] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0067] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0068] Reference Figure 1 , Figure 1 The figure is a schematic diagram of the structure of a virus analysis device in the hardware operating environment involved in the embodiment of the present invention.

[0069] like Figure 1As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0070] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the electronic device, and may include more or less components than shown in the figure, or combine certain components, or arrange the components differently.

[0071] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a virus analysis program.

[0072] exist Figure 1 In the electronic device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in a virus analysis device, and the electronic device calls the virus analysis program stored in the memory 1005 through the processor 1001, and executes the industrial Internet ransomware virus analysis method provided by an embodiment of the present invention.

[0073] The embodiment of the present invention provides an industrial Internet ransomware virus analysis method, referring to Figure 2 , Figure 2 This is a flow chart of a first embodiment of an industrial Internet ransomware analysis method of the present invention.

[0074] In this embodiment, the industrial Internet ransomware virus analysis method includes the following steps:

[0075] Step S10: Collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed.

[0076] It should be noted that the executor of this embodiment can be the virus analysis device, and the virus analysis device can be an electronic device such as a personal computer or a server, or a terminal device such as a smart phone or a tablet computer, or other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment and the following embodiments, the industrial Internet ransomware virus analysis method of the present invention is described by taking the virus analysis device as an example.

[0077] It should be noted that the virus to be analyzed can be a file uploaded by a user that is suspected of being a ransomware virus, or a file collected by a virus analysis device that is suspected of being a ransomware virus. The preset sandbox can be an isolated sandbox pre-created by a sandbox building tool. The interface (API) behavior sequence can be a sequence composed of various call behaviors, wherein the call behavior can include but is not limited to registry call behavior, service call behavior, file call behavior, network call behavior, process call behavior and other call behaviors.

[0078] In a specific implementation, information about the virus to be analyzed when it is running in a preset sandbox is collected to obtain an interface behavior sequence corresponding to the virus to be analyzed. This can be accomplished by collecting various calling behaviors of the virus to be analyzed when it is running in the preset sandbox, and sorting and aggregating the calling behaviors according to the calling sequence, thereby obtaining an interface behavior sequence.

[0079] Furthermore, in order to ensure that the real interface behavior sequence of the virus to be analyzed can be accurately collected, before step S10 in this embodiment, the following may also be included:

[0080] When receiving a virus analysis request, extracting the virus to be analyzed and the virus running environment from the virus analysis request;

[0081] Determine sandbox configuration parameters according to the virus running environment;

[0082] Adjusting the environment of the preset sandbox according to the sandbox configuration parameters;

[0083] When the adjustment is completed, the virus to be analyzed is input into the preset sandbox for execution.

[0084] It should be noted that the virus analysis request may be a request sent when submitting a file suspected of being a ransomware virus to the virus analysis device, which may include the virus to be analyzed and the virus running environment. The virus running environment may include the system environment parameters of the device where the virus to be analyzed originally resides, such as: system type (such as Windows, Mac, Android, etc.), system version, memory size, video memory size and other information.

[0085] In actual use, determining the sandbox configuration parameters according to the virus running environment may be to compare the virus running environment with the standard sandbox environment, determine the parameters that need to be adjusted, and thus generate the sandbox configuration parameters. The standard sandbox environment may be the environment parameters of the preset sandbox at the current moment. Adjusting the preset sandbox according to the sandbox configuration parameters may be to adjust the sandbox running environment of the preset sandbox according to the sandbox configuration parameters.

[0086] It can be understood that after the adjustment, the system environment in the sandbox can be kept consistent with the system environment of the device where the virus to be analyzed was originally located. At this time, the behavior of the virus to be analyzed will be consistent with before. Therefore, it can be guaranteed that the real interface behavior sequence of the virus to be analyzed can be accurately collected, thereby ensuring the accuracy of subsequent analysis.

[0087] Step S20: performing type identification on the interface behavior sequence using a preset virus identification model to determine whether the virus to be analyzed is a ransomware virus.

[0088] It should be noted that the preset virus recognition model can be a model obtained by pre-training the initial recognition model with a model training set, and the preset virus recognition model can determine whether the virus to be analyzed is a ransomware virus according to the interface behavior sequence. The initial recognition model can be a convolutional neural network model (CNN), a random forest, an SVM support vector machine, a Bayesian model, and the like. After actual evaluation of the recall rate and precision rate of the model, preferably, the recall rate and precision rate of the convolutional neural network model are better.

[0089] In a specific implementation, the model training set can be constructed using a large number of interface behavior sequences that have been determined to be ransomware. The initial recognition model can include at least model layers such as convolutional layers, pooling layers, and fully connected layers. Of course, more model layers can also be included according to actual needs, and this embodiment does not limit this.

[0090] In actual use, when training the initial recognition model, the difference between the output value of the initial recognition model and the target value corresponding to the model training sample used can be obtained. If the error is within the preset allowable range, the model test set can be verified and analyzed, and when the verification passes, the verified initial recognition model can be used as the preset virus recognition model; if the error is not within the preset allowable range, the model parameters can be adjusted and training can continue.

[0091] Step S30: If the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library.

[0092] It should be noted that the preset virus fingerprint library may be a database storing a large number of virus fingerprint sequences of virus files determined to be ransomware viruses, wherein the virus fingerprint sequences may be behavior sequences of virus files.

[0093] In actual use, if it is determined that the virus to be analyzed is a ransomware virus, then in order to facilitate processing, it is also necessary to determine the virus family classification to which the virus to be analyzed belongs, so as to determine the corresponding processing method. Therefore, the interface behavior sequence corresponding to the virus to be analyzed can be compared with the virus fingerprint sequence of each virus in the preset virus fingerprint library to determine the virus family classification of the virus to be analyzed.

[0094] Furthermore, in order to enhance the ability to identify viruses, after step S30 in this embodiment, the following may also be included:

[0095] Extracting attack behavior information from the attack behavior log corresponding to the virus to be analyzed;

[0096] The preset virus fingerprint library is updated according to the attack behavior information, the interface behavior sequence and the virus family classification to which the virus to be analyzed belongs.

[0097] It should be noted that the attack behavior information may include the attack object, attack address, attack result, and the correlation between the attack and the alarm. The attack behavior log may be a log generated by the sandbox monitoring tool when monitoring the attack behavior of the virus to be analyzed when it is running in the sandbox. Extracting the attack behavior information from the attack behavior log corresponding to the virus to be analyzed may be to obtain the attack object, attack address, attack result, and whether the attack generates an alarm from the attack behavior log, thereby generating the attack behavior information.

[0098] In actual use, updating the preset virus fingerprint library according to the attack behavior information, interface behavior sequence and virus family classification of the virus to be analyzed can be to construct a virus fingerprint sequence according to the interface behavior sequence, set its corresponding virus family classification, and then bind the attack behavior information as auxiliary information to the virus fingerprint sequence for storage.

[0099] It can be understood that by updating the preset virus fingerprint library according to the attack behavior information corresponding to the virus to be analyzed, the interface behavior sequence and the virus family classification described by the virus to be analyzed, the amount of data in the preset virus fingerprint library can be gradually increased. After the suspected virus file is subsequently obtained, the virus family classification described therein can be more easily identified, thereby improving the ability to identify the virus.

[0100] This embodiment obtains the interface behavior sequence corresponding to the virus to be analyzed by collecting information when the virus to be analyzed is running in a preset sandbox; the interface behavior sequence is identified by a preset virus recognition model to determine whether the virus to be analyzed is a ransomware virus; if the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined based on the interface behavior sequence and each virus fingerprint sequence in the preset virus fingerprint library. Since the pre-trained preset virus recognition model is used to identify whether the virus to be analyzed is a ransomware virus based on the interface behavior sequence of the virus to be analyzed, the overall recognition process is fast, and after determining that it is a ransomware virus, the virus family classification of the virus to be analyzed will be determined, ensuring that targeted processing can be carried out to stop the infection and spread of the ransomware virus, thereby improving security and defense capabilities.

[0101] refer to Figure 3 , Figure 3 This is a flow chart of a second embodiment of an industrial Internet ransomware analysis method of the present invention.

[0102] Based on the above first embodiment, step S10 of the industrial Internet ransomware virus analysis method of this embodiment includes:

[0103] Step S101: activating a virus to be analyzed in a preset sandbox, monitoring the dynamic behavior of the virus to be analyzed by a sandbox monitoring tool corresponding to the preset sandbox, and generating a corresponding dynamic behavior log.

[0104] It should be noted that the sandbox monitoring tool can be a tool that can monitor the behavior of malware running in the sandbox, such as the cuckoo open source sandbox tool. Dynamic behavior can include registry call behavior, service call behavior, file call behavior, network call behavior, and process call behavior.

[0105] Step S102: constructing an interface behavior sequence corresponding to the virus to be analyzed according to the dynamic behavior log.

[0106] It is understandable that by sorting, aggregating, and other processing the dynamic behaviors recorded in the dynamic behavior log according to the time when the behaviors were executed, the interface behavior sequence corresponding to the virus to be analyzed can be constructed.

[0107] In a specific implementation, in order to quickly and accurately construct an interface behavior sequence, step S102 in this embodiment may include:

[0108] Extracting a behavior information set corresponding to each behavior type from the dynamic behavior log;

[0109] Sorting the behavior information in the behavior information set according to the execution time of each behavior, and combining the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result;

[0110] The dynamic behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0111] It should be noted that the behavior type may include a variety of different behaviors such as registry calls, service calls, file calls, network calls, process calls, etc. Extracting the behavior information set corresponding to each behavior type from the dynamic behavior log may be to group the dynamic behavior log according to the corresponding behavior type, divide it into log subsets corresponding to each behavior type, and then extract the behavior information in each log subset respectively, so as to obtain the behavior information set corresponding to each behavior type. Among them, the behavior information may include information such as call type and execution time, and the call type may include: addition, modification, deletion, permission change, etc.

[0112] In actual use, sorting the behavior information in the behavior information set according to the execution time of each behavior, and combining the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result can be to sort each behavior information in the behavior information set from small to large according to the corresponding execution implementation, and then combining each behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting order in the sorting result.

[0113] Furthermore, in order to improve the efficiency of virus analysis, the step of aggregating the dynamic behavior sequences corresponding to each behavior type to obtain the interface behavior sequence corresponding to the virus to be analyzed in this embodiment may include:

[0114] Detecting whether there is a repeated subsequence in the dynamic behavior sequence;

[0115] If it exists, deduplication processing is performed on the dynamic behavior sequence to obtain a deduplication behavior sequence;

[0116] The deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0117] It should be noted that when a virus attacks, it may perform repeated operations multiple times, or it may write multiple files or data at the same location (such as: repeatedly trying to add registry data B at registry location A multiple times, or repeatedly trying to write C and D files in the system / XX / XX path). In this process, a large number of repeated dynamic sequences may be generated, and the complexity of the sequence will affect the complexity of the analysis. If such repeated dynamic sequences are not excluded, the subsequent preset virus recognition model will take more time to perform type recognition. Therefore, when obtaining the dynamic behavior sequence corresponding to each behavior type, it is also necessary to detect whether there are repeated dynamic sequences in each dynamic behavior sequence, that is, repeated subsequences. If so, it is necessary to deduplicate the dynamic behavior sequence, and then aggregate the obtained deduplicated behavior sequences into the interface behavior sequence of the virus to be analyzed.

[0118] It can be understood that when there are repeated subsequences, deduplication of the dynamic behavior sequence can reduce the complexity of the interface behavior sequence finally obtained, thereby reducing the time complexity of the preset virus recognition model when performing type recognition, thereby reducing the time consumed during recognition and improving the overall execution efficiency.

[0119] This embodiment activates the virus to be analyzed in a preset sandbox, monitors the dynamic behavior of the virus to be analyzed through the sandbox monitoring tool corresponding to the preset sandbox, and generates a corresponding dynamic behavior log; and constructs an interface behavior sequence corresponding to the virus to be analyzed based on the dynamic behavior log. Since the virus to be analyzed is activated in the preset sandbox, and the dynamic behavior of the virus to be analyzed is monitored by the sandbox monitoring tool corresponding to the preset sandbox, a complete behavior log of the virus to be analyzed when it is running in the preset sandbox can be guaranteed, thereby ensuring the comprehensiveness of the interface behavior sequence constructed subsequently, making it more accurate to determine whether the virus to be analyzed is a ransomware virus.

[0120] refer to Figure 4 , Figure 4 This is a flow chart of a third embodiment of an industrial Internet ransomware analysis method of the present invention.

[0121] Based on the above first embodiment, step S30 of the industrial Internet ransomware virus analysis method of this embodiment includes:

[0122] Step S301: performing a similarity comparison between the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library to obtain a sequence similarity with each virus fingerprint sequence.

[0123] It should be noted that the interface behavior sequence and each virus fingerprint sequence in the preset virus fingerprint library can be compared for similarity through a preset similarity comparison algorithm to obtain the sequence similarity of each virus fingerprint sequence, wherein the preset similarity comparison algorithm can be a similarity comparison algorithm, a sequence coverage algorithm, a longest common substring algorithm, or other similar algorithms, which is not limited in this embodiment.

[0124] In actual use, depending on the different preset similarity comparison algorithms used, when performing sequence comparison, multiple sequences may be used for similarity comparison, or local sequence fragments in the sequence may be used for similarity comparison, which is not limited in this embodiment.

[0125] Step S302: taking the maximum value of the sequence similarities as the maximum similarity.

[0126] It should be noted that taking the maximum value among the sequence similarities as the maximum similarity may be to obtain the maximum value among the sequence similarities between the interface behavior sequence and each virus fingerprint sequence, and taking the maximum value as the maximum similarity.

[0127] Step S303: taking the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence.

[0128] It should be noted that taking the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence may be marking the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence.

[0129] Further, in order to improve the classification accuracy of virus family classification, step S303 in this embodiment may include:

[0130] Comparing the maximum similarity with a preset similarity threshold;

[0131] If the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0132] It should be noted that the preset similarity threshold can be pre-set by the administrator of the virus analysis device according to actual needs, for example, the preset similarity threshold is set to 70%. Of course, it can also be set higher or lower according to actual needs.

[0133] It is understandable that the interface behavior sequence corresponding to the virus to be analyzed may have a low similarity with each virus fingerprint sequence recorded in the preset virus fingerprint library. At this time, if the virus fingerprint sequence corresponding to the maximum value is used as the target virus sequence, it may cause family classification errors. In order to avoid this phenomenon, after obtaining the maximum similarity, the maximum similarity can be compared with the preset similarity threshold. When the maximum similarity is greater than or equal to the preset similarity threshold, that is, the similarity between the virus fingerprint sequence corresponding to the maximum similarity and the interface behavior sequence exceeds the preset threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence, which can avoid classification errors when the similarities are low.

[0134] In a specific implementation, when the maximum similarity is less than a preset similarity threshold, it means that the similarity between the virus to be analyzed and all the virus fingerprint sequences in the preset virus fingerprint library is low, and it may be a new type of ransomware virus. At this time, the virus family classification of the virus cannot be determined. In order to cope with this situation, after the step of comparing the maximum similarity with the preset similarity threshold in this embodiment, the following may also be included:

[0135] If the maximum similarity is less than the preset similarity threshold, the virus family to which the virus to be analyzed belongs is determined to be classified as an unknown virus family;

[0136] An unknown determination report is constructed based on the sequence similarity with each virus fingerprint sequence, and the unknown determination report is displayed.

[0137] It can be understood that when the maximum similarity is less than the preset similarity threshold, it means that the similarity between the virus to be analyzed and all the virus fingerprint sequences in the preset virus fingerprint library is low. At this time, the virus analysis device cannot determine the virus family classification of the virus to be analyzed. Therefore, an unknown judgment report can be constructed based on the sequence similarity with each virus fingerprint sequence, and then the unknown judgment report can be displayed to the management personnel or equipment security personnel of the virus analysis equipment for manual analysis.

[0138] Furthermore, since the interface behavior sequence may have a high similarity with multiple different virus fingerprint sequences at the same time, at this time, the virus to be analyzed may not belong to a known virus family, but a new type of ransomware virus. In order to cope with this situation, if the maximum similarity is greater than or equal to the preset similarity threshold, the step of using the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence in this embodiment includes:

[0139] If the maximum similarity is greater than or equal to the preset similarity threshold, then respectively calculating the similarity difference between the sequence similarity with each virus fingerprint sequence and the maximum similarity;

[0140] If there is no similarity difference less than the preset difference threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0141] It should be noted that the preset difference threshold can be set by the administrator of the virus analysis equipment according to the actual situation. Make settings in advance, for example, set the preset difference threshold to 10%.

[0142] In actual use, in order to cope with the phenomenon that the interface behavior sequence has a high similarity with multiple different virus fingerprint sequences at the same time, when it is determined that the maximum similarity is greater than or equal to the preset similarity threshold, the similarity difference between the sequence similarity of each virus fingerprint sequence and the maximum similarity can be calculated respectively. For example: assuming that the preset difference threshold is 10%, there are 5 sequence similarities, namely 20%, 40%, 40%, 50%, and 80%. At this time, the maximum similarity is 80%, and the similarity differences are: 60%, 40%, 40%, 30%, and 0%.

[0143] It is understandable that by comparing each similarity difference with a preset difference threshold, it can be determined whether the interface behavior sequence has a high similarity with multiple different virus fingerprint sequences at the same time, depending on whether there is a similarity difference less than the preset difference threshold. If there is no similarity difference less than the preset difference threshold, it means that the interface behavior sequence does not have a high similarity with multiple different virus fingerprint sequences at the same time, and therefore, the virus fingerprint sequence corresponding to the maximum similarity can be used as the target virus sequence.

[0144] In a specific implementation, if there is a similarity difference less than a preset difference threshold, it means that the interface behavior sequence has a high similarity with multiple different virus fingerprint sequences at the same time, and the virus to be analyzed may be a new type of ransomware virus. Therefore, if the maximum similarity is greater than or equal to the preset similarity threshold, the step of respectively calculating the sequence similarity with each virus fingerprint sequence and the similarity difference between the maximum similarity in this embodiment may also include:

[0145] If there is a similarity difference value that is less than a preset difference threshold value, the virus family to which the virus to be analyzed belongs is determined to be classified as an unknown virus family;

[0146] The virus fingerprint sequence corresponding to the similarity difference less than the preset difference threshold is regarded as an unknown judgment sequence;

[0147] An unknown determination report is generated according to the unknown determination sequence, and the unknown determination report is displayed.

[0148] It can be understood that if there is a similarity difference less than the preset difference threshold, it means that the interface behavior sequence has a high similarity with multiple different virus fingerprint sequences at the same time. At this time, the virus to be analyzed may be a new type of ransomware virus, and the virus family classification of the virus to be analyzed cannot be determined. Therefore, it can be set to an unknown virus family, and then the virus fingerprint sequence corresponding to the reason for the inability to determine the virus family, that is, the similarity difference less than the preset difference threshold, is used as an unknown judgment sequence, and an unknown judgment report is generated based on the position judgment sequence, and then the unknown judgment report is displayed to the manager of the virus analysis equipment or the equipment security personnel for manual analysis.

[0149] Step S304: classifying the virus family corresponding to the target virus sequence as the virus family to which the virus to be analyzed belongs.

[0150] It can be understood that since the sequence similarity corresponding to the target virus sequence is the largest among all virus fingerprint sequences, it means that the target virus sequence has the highest similarity with the interface behavior sequence. Therefore, it can be determined that the virus to be analyzed and the virus family described by the target virus sequence are the same virus family. Therefore, the virus family corresponding to the target virus sequence can be classified as the virus family described by the virus to be analyzed.

[0151] For ease of understanding, now combined Figure 5 The industrial Internet ransomware virus analysis method of the present invention is described, but this solution is not limited. Figure 5 This is a schematic diagram of the execution flow of the industrial Internet ransomware analysis method of the present invention. As shown in the figure, after receiving the ransomware sample (i.e., the virus to be analyzed), the present invention will input the virus to be analyzed into a sandbox (i.e., the preset sandbox) for operation, and then perform information collection and API behavior sequence extraction to finally obtain the API behavior sequence, and then pre-process the behavior sequence (i.e., deduplicate the repeated subsequences therein), and then input it into the trained CNN model for virus analysis to determine whether it is a ransomware virus, and when it is determined to be a ransomware virus, perform similarity calculation between its corresponding API behavior sequence and the virus fingerprint sequence in the fingerprint sequence library to determine the virus family classification to which it belongs.

[0152] This embodiment compares the interface behavior sequence with each virus fingerprint sequence in the preset virus fingerprint library for similarity, obtains the sequence similarity with each virus fingerprint sequence; takes the maximum value of the sequence similarities as the maximum similarity; takes the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence; and takes the virus family corresponding to the target virus sequence as the virus family classification to which the virus to be analyzed belongs. Since the interface behavior sequence is compared with each virus fingerprint sequence in the preset virus fingerprint library for similarity, the virus fingerprint sequence with the highest similarity is taken as the target virus sequence, and the virus family corresponding to the target virus sequence is taken as the virus family classification to which the virus to be analyzed belongs, thereby ensuring the rapid determination of the virus family classification to which the virus to be analyzed belongs, and improving the execution efficiency of the industrial Internet ransomware virus analysis method of the present invention.

[0153] In addition, an embodiment of the present invention also proposes a storage medium, on which a virus analysis program is stored. When the virus analysis program is executed by a processor, the steps of the industrial Internet ransomware virus analysis method described above are implemented.

[0154] Reference Figure 6 , Figure 6 This is a structural block diagram of the first embodiment of the industrial Internet ransomware analysis device of the present invention.

[0155] like Figure 6 As shown, the industrial Internet ransomware analysis device proposed in the embodiment of the present invention includes:

[0156] The information collection module 10 is used to collect information when the virus to be analyzed is running in a preset sandbox, and obtain the interface behavior sequence corresponding to the virus to be analyzed;

[0157] A type identification module 20 is used to identify the type of the interface behavior sequence by using a preset virus identification model to determine whether the virus to be analyzed is a ransomware virus;

[0158] The virus classification module 30 is used to determine the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library if the virus to be analyzed is a ransomware virus.

[0159] This embodiment obtains the interface behavior sequence corresponding to the virus to be analyzed by collecting information when the virus to be analyzed is running in a preset sandbox; the interface behavior sequence is identified by a preset virus recognition model to determine whether the virus to be analyzed is a ransomware virus; if the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined based on the interface behavior sequence and each virus fingerprint sequence in the preset virus fingerprint library. Since the pre-trained preset virus recognition model is used to identify whether the virus to be analyzed is a ransomware virus based on the interface behavior sequence of the virus to be analyzed, the overall recognition process is fast, and after determining that it is a ransomware virus, the virus family classification of the virus to be analyzed will be determined, ensuring that targeted processing can be carried out to stop the infection and spread of the ransomware virus, thereby improving security and defense capabilities.

[0160] Furthermore, the information collection module 10 is also used to extract the virus to be analyzed and the virus operating environment from the virus analysis request when receiving the virus analysis request; determine the sandbox configuration parameters according to the virus operating environment; adjust the environment of the preset sandbox according to the sandbox configuration parameters; when the adjustment is completed, input the virus to be analyzed into the preset sandbox for execution.

[0161] Furthermore, the information collection module 10 is also used to activate the virus to be analyzed in a preset sandbox, monitor the dynamic behavior of the virus to be analyzed through the sandbox monitoring tool corresponding to the preset sandbox, and generate a corresponding dynamic behavior log; and construct an interface behavior sequence corresponding to the virus to be analyzed based on the dynamic behavior log.

[0162] Furthermore, the information collection module 10 is also used to extract a behavior information set corresponding to each behavior type from the dynamic behavior log; sort the behavior information in the behavior information set according to the execution time of each behavior, and combine the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result; aggregate the dynamic behavior sequences corresponding to each behavior type to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0163] Furthermore, the information collection module 10 is also used to detect whether there are repeated subsequences in the dynamic behavior sequence; if so, the dynamic behavior sequence is deduplicated to obtain a deduplicated behavior sequence; the deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0164] Furthermore, the virus classification module 30 is also used to compare the interface behavior sequence with each virus fingerprint sequence in a preset virus fingerprint library to obtain sequence similarity with each virus fingerprint sequence; take the maximum value of the sequence similarities as the maximum similarity; take the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence; and take the virus family corresponding to the target virus sequence as the virus family classification to which the virus to be analyzed belongs.

[0165] Furthermore, the virus classification module 30 is also used to compare the maximum similarity with a preset similarity threshold; if the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0166] Furthermore, the virus classification module 30 is also used to determine that the virus family to which the virus to be analyzed belongs is classified as an unknown virus family if the maximum similarity is less than the preset similarity threshold; construct an unknown determination report based on the sequence similarity with each virus fingerprint sequence, and display the unknown determination report.

[0167] Furthermore, the virus classification module 30 is also used to calculate the similarity difference between the sequence similarity with each virus fingerprint sequence and the maximum similarity if the maximum similarity is greater than or equal to the preset similarity threshold; if there is no similarity difference less than the preset difference threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0168] Furthermore, the virus classification module 30 is also used to determine that the virus family to which the virus to be analyzed belongs is classified as an unknown virus family if there is a similarity difference that is less than a preset difference threshold; use the virus fingerprint sequence corresponding to the similarity difference that is less than the preset difference threshold as an unknown determination sequence; generate an unknown determination report based on the unknown determination sequence, and display the unknown determination report.

[0169] Furthermore, the virus classification module 30 is also used to extract attack behavior information from the attack behavior log corresponding to the virus to be analyzed; and update the preset virus fingerprint library according to the attack behavior information, the interface behavior sequence and the virus family classification to which the virus to be analyzed belongs.

[0170] It should be understood that the above is only an example and does not constitute any limitation on the technical solution of the present invention. In specific applications, technicians in this field can make settings as needed, and the present invention does not limit this.

[0171] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.

[0172] In addition, for technical details not fully described in this embodiment, please refer to the industrial Internet ransomware analysis method provided in any embodiment of the present invention, and will not be repeated here.

[0173] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0174] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0175] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0176] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0177] The present invention discloses A1, an industrial Internet ransomware virus analysis method, the industrial Internet ransomware virus analysis method comprising the following steps:

[0178] Collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed;

[0179] Performing type recognition on the interface behavior sequence by using a preset virus recognition model to determine whether the virus to be analyzed is a ransomware virus;

[0180] If the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library.

[0181] A2. The method for analyzing industrial Internet ransomware viruses as described in A1, before the step of collecting information of the virus to be analyzed when it is running in a preset sandbox and obtaining the interface behavior sequence corresponding to the virus to be analyzed, further includes:

[0182] When receiving a virus analysis request, extracting the virus to be analyzed and the virus running environment from the virus analysis request;

[0183] Determine sandbox configuration parameters according to the virus running environment;

[0184] Adjusting the environment of the preset sandbox according to the sandbox configuration parameters;

[0185] When the adjustment is completed, the virus to be analyzed is input into the preset sandbox for execution.

[0186] A3. In the industrial Internet ransomware virus analysis method described in A1, the step of collecting information when the virus to be analyzed is running in a preset sandbox and obtaining the interface behavior sequence corresponding to the virus to be analyzed includes:

[0187] Activate the virus to be analyzed in a preset sandbox, monitor the dynamic behavior of the virus to be analyzed through a sandbox monitoring tool corresponding to the preset sandbox, and generate a corresponding dynamic behavior log;

[0188] An interface behavior sequence corresponding to the virus to be analyzed is constructed according to the dynamic behavior log.

[0189] A4. In the industrial Internet ransomware virus analysis method as described in A3, the step of constructing an interface behavior sequence corresponding to the virus to be analyzed according to the dynamic behavior log comprises:

[0190] Extracting a behavior information set corresponding to each behavior type from the dynamic behavior log;

[0191] Sorting the behavior information in the behavior information set according to the execution time of each behavior, and combining the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result;

[0192] The dynamic behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0193] A5. In the industrial Internet ransomware virus analysis method described in A4, the step of aggregating the dynamic behavior sequences corresponding to each behavior type to obtain the interface behavior sequence corresponding to the virus to be analyzed includes:

[0194] Detecting whether there is a repeated subsequence in the dynamic behavior sequence;

[0195] If it exists, deduplication processing is performed on the dynamic behavior sequence to obtain a deduplication behavior sequence;

[0196] The deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

[0197] A6. In the industrial Internet ransomware virus analysis method described in A1, the step of determining the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in the preset virus fingerprint library comprises:

[0198] Compare the interface behavior sequence with each virus fingerprint sequence in a preset virus fingerprint library to obtain sequence similarity with each virus fingerprint sequence;

[0199] Taking the maximum value among the sequence similarities as the maximum similarity;

[0200] Taking the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence;

[0201] The virus family corresponding to the target virus sequence is classified as the virus family to which the virus to be analyzed belongs.

[0202] A7. In the industrial Internet ransomware virus analysis method as described in A6, the step of using the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence comprises:

[0203] Comparing the maximum similarity with a preset similarity threshold;

[0204] If the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0205] A8. The method for analyzing industrial Internet ransomware viruses as described in A7, after the step of comparing the maximum similarity with a preset similarity threshold, further comprising:

[0206] If the maximum similarity is less than the preset similarity threshold, the virus family to which the virus to be analyzed belongs is determined to be classified as an unknown virus family;

[0207] An unknown determination report is constructed based on the sequence similarity with each virus fingerprint sequence, and the unknown determination report is displayed.

[0208] A9. The industrial Internet ransomware virus analysis method as described in A7, wherein if the maximum similarity is greater than or equal to the preset similarity threshold, the step of using the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence includes:

[0209] If the maximum similarity is greater than or equal to the preset similarity threshold, then respectively calculating the similarity difference between the sequence similarity with each virus fingerprint sequence and the maximum similarity;

[0210] If there is no similarity difference less than the preset difference threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0211] A10. The method for analyzing industrial Internet ransomware viruses as described in A9, wherein if the maximum similarity is greater than or equal to the preset similarity threshold, after the step of respectively calculating the similarity difference between the sequence similarity with each virus fingerprint sequence and the maximum similarity, further comprises:

[0212] If there is a similarity difference value that is less than a preset difference threshold value, the virus family to which the virus to be analyzed belongs is determined to be classified as an unknown virus family;

[0213] The virus fingerprint sequence corresponding to the similarity difference less than the preset difference threshold is regarded as an unknown judgment sequence;

[0214] An unknown determination report is generated according to the unknown determination sequence, and the unknown determination report is displayed.

[0215] A11. The method for analyzing industrial Internet ransomware viruses as described in any one of A1-A10, wherein if the virus to be analyzed is a ransomware virus, after the step of determining the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library, the method further comprises:

[0216] Extracting attack behavior information from the attack behavior log corresponding to the virus to be analyzed;

[0217] The preset virus fingerprint library is updated according to the attack behavior information, the interface behavior sequence and the virus family classification to which the virus to be analyzed belongs.

[0218] The present invention also discloses B12, an industrial Internet ransomware virus analysis device, wherein the industrial Internet ransomware virus analysis device comprises the following modules:

[0219] An information collection module is used to collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed;

[0220] A type identification module, used to identify the type of the interface behavior sequence through a preset virus identification model to determine whether the virus to be analyzed is a ransomware virus;

[0221] The virus classification module is used to determine the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library if the virus to be analyzed is a ransomware virus.

[0222] B13. In the industrial Internet ransomware analysis device as described in B12, the information collection module is further used to extract the virus to be analyzed and the virus operating environment from the virus analysis request when receiving the virus analysis request; determine the sandbox configuration parameters according to the virus operating environment; adjust the environment of the preset sandbox according to the sandbox configuration parameters; when the adjustment is completed, input the virus to be analyzed into the preset sandbox for execution.

[0223] B14. In the industrial Internet ransomware analysis device as described in B12, the information collection module is also used to activate the virus to be analyzed in a preset sandbox, monitor the dynamic behavior of the virus to be analyzed through a sandbox monitoring tool corresponding to the preset sandbox, and generate a corresponding dynamic behavior log; and construct an interface behavior sequence corresponding to the virus to be analyzed according to the dynamic behavior log.

[0224] B15. In the industrial Internet ransomware analysis device as described in B14, the information collection module is also used to extract a behavior information set corresponding to each behavior type from the dynamic behavior log; sort the behavior information in the behavior information set according to the execution time of each behavior, and combine the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result; aggregate the dynamic behavior sequences corresponding to each behavior type to obtain an interface behavior sequence corresponding to the virus to be analyzed.

[0225] B16. In the industrial Internet ransomware analysis device as described in B15, the information collection module is also used to detect whether there are repeated subsequences in the dynamic behavior sequence; if so, the dynamic behavior sequence is deduplicated to obtain a deduplicated behavior sequence; the deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain an interface behavior sequence corresponding to the virus to be analyzed.

[0226] B17. In the industrial Internet ransomware analysis device as described in B12, the virus classification module is further used to compare the interface behavior sequence with each virus fingerprint sequence in a preset virus fingerprint library to obtain sequence similarity with each virus fingerprint sequence; take the maximum value of the sequence similarities as the maximum similarity; take the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence; and classify the virus family corresponding to the target virus sequence as the virus family to which the virus to be analyzed belongs.

[0227] B18. In the industrial Internet ransomware analysis device as described in B17, the virus classification module is also used to compare the maximum similarity with a preset similarity threshold; if the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

[0228] The present invention also discloses C19, a virus analysis device, which includes: a processor, a memory, and a virus analysis program stored in the memory and executable on the processor, and when the virus analysis program is executed by the processor, the steps of the industrial Internet ransomware virus analysis method as described above are implemented.

[0229] The present invention also discloses D20, a computer-readable storage medium, on which a virus analysis program is stored, and when the virus analysis program is executed, the steps of the industrial Internet ransomware virus analysis method as described above are implemented.

Claims

1. A method for analyzing industrial Internet ransomware, characterized in that: The industrial Internet ransomware virus analysis method comprises the following steps: Collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed; Performing type recognition on the interface behavior sequence by using a preset virus recognition model to determine whether the virus to be analyzed is a ransomware virus; If the virus to be analyzed is a ransomware virus, the virus family classification to which the virus to be analyzed belongs is determined according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library.

2. The industrial Internet ransomware virus analysis method according to claim 1, characterized in that: Before the step of collecting information of the virus to be analyzed when it is running in a preset sandbox and obtaining the interface behavior sequence corresponding to the virus to be analyzed, the method further includes: When receiving a virus analysis request, extracting the virus to be analyzed and the virus running environment from the virus analysis request; Determine sandbox configuration parameters according to the virus running environment; Adjusting the environment of the preset sandbox according to the sandbox configuration parameters; When the adjustment is completed, the virus to be analyzed is input into the preset sandbox for execution.

3. The industrial Internet ransomware virus analysis method according to claim 1, characterized in that: The step of collecting information of the virus to be analyzed when it is running in a preset sandbox to obtain the interface behavior sequence corresponding to the virus to be analyzed includes: Activate the virus to be analyzed in a preset sandbox, monitor the dynamic behavior of the virus to be analyzed through a sandbox monitoring tool corresponding to the preset sandbox, and generate a corresponding dynamic behavior log; An interface behavior sequence corresponding to the virus to be analyzed is constructed according to the dynamic behavior log.

4. The industrial Internet ransomware virus analysis method according to claim 3, characterized in that: The step of constructing the interface behavior sequence corresponding to the virus to be analyzed according to the dynamic behavior log includes: Extracting a behavior information set corresponding to each behavior type from the dynamic behavior log; Sorting the behavior information in the behavior information set according to the execution time of each behavior, and combining the behavior information in the behavior information set into a corresponding dynamic behavior sequence according to the sorting result; The dynamic behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

5. The industrial Internet ransomware virus analysis method according to claim 4, characterized in that: The step of aggregating the dynamic behavior sequences corresponding to each behavior type to obtain the interface behavior sequence corresponding to the virus to be analyzed includes: Detecting whether there is a repeated subsequence in the dynamic behavior sequence; If it exists, deduplication processing is performed on the dynamic behavior sequence to obtain a deduplication behavior sequence; The deduplicated behavior sequences corresponding to each behavior type are aggregated to obtain the interface behavior sequence corresponding to the virus to be analyzed.

6. The industrial Internet ransomware virus analysis method according to claim 1, characterized in that: The step of determining the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library comprises: Compare the interface behavior sequence with each virus fingerprint sequence in a preset virus fingerprint library to obtain sequence similarity with each virus fingerprint sequence; Taking the maximum value among the sequence similarities as the maximum similarity; Taking the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence; The virus family corresponding to the target virus sequence is classified as the virus family to which the virus to be analyzed belongs.

7. The industrial Internet ransomware virus analysis method according to claim 6, characterized in that: The step of using the virus fingerprint sequence corresponding to the maximum similarity as the target virus sequence includes: Comparing the maximum similarity with a preset similarity threshold; If the maximum similarity is greater than or equal to the preset similarity threshold, the virus fingerprint sequence corresponding to the maximum similarity is used as the target virus sequence.

8. An industrial Internet ransomware virus analysis device, characterized in that: The industrial Internet ransomware analysis device includes the following modules: An information collection module is used to collect information about the virus to be analyzed when it is running in a preset sandbox, and obtain an interface behavior sequence corresponding to the virus to be analyzed; A type identification module, used to identify the type of the interface behavior sequence through a preset virus identification model to determine whether the virus to be analyzed is a ransomware virus; The virus classification module is used to determine the virus family classification to which the virus to be analyzed belongs according to the interface behavior sequence and each virus fingerprint sequence in a preset virus fingerprint library if the virus to be analyzed is a ransomware virus.

9. A virus analysis device, characterized in that: The virus analysis device includes: a processor, a memory, and a virus analysis program stored in the memory and executable on the processor. When the virus analysis program is executed by the processor, the steps of the industrial Internet ransomware virus analysis method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a virus analysis program, which, when executed, implements the steps of the industrial Internet ransomware virus analysis method as described in any one of claims 1 to 7.

Images