Malicious file detection method and device for industrial internet, and storage medium

Abstract

The invention relates to the technical field of network security, and discloses an industrial internet malicious file detection method, equipment, a storage medium and a device, and the method comprises the steps: extracting feature data from a suspicious file sample, predicting the dynamic state of the suspicious file sample, obtaining a dynamic prediction result, and monitoring the propagation behavior of the suspicious file sample. Obtaining a behavior monitoring result, and detecting a malicious file based on the feature data, the dynamic prediction result and the behavior monitoring result; according to the invention, through feature extraction, dynamic prediction and behavior monitoring of the suspicious file samples, malicious files in the industrial internet can be accurately detected, and the security of the industrial internet is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious file detection method, equipment, storage medium and device for industrial Internet. Background Art

[0002] Industrial Internet is a deep integration of emerging communication technology and industrial economy. Its derivative products include new automation infrastructure, application models and industrial ecology. Through the full connection of people, machines, objects and methods in industrial elements, a new industrial service system with full value chain and full industrial chain is constructed, providing a new path for the development and innovation of the "four modernizations" of industry: digitalization, automation, intelligence and networking. Industrial Internet is not a simple application of the Internet in the industrial field, but a connotation and extension after deep integration. It belongs to a new form of business. The manifestation of empowerment, intelligence and value-added of new industries can effectively promote the rapid quality improvement, cost reduction, efficiency increase and safe development of my country's real economy.

[0003] With the rapid development of the industrial Internet, various network security issues continue to emerge. The existing technology lacks prevention and control measures for the industrial Internet and cannot accurately detect malicious files in the industrial Internet.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide a malicious file detection method, equipment, storage medium and device for the Industrial Internet, aiming to solve the technical problems in the prior art that there is a lack of prevention and control measures for the Industrial Internet and that malicious files in the Industrial Internet cannot be accurately detected.

[0006] To achieve the above object, the present invention provides a malicious file detection method for industrial Internet, and the malicious file detection method for industrial Internet comprises the following steps:

[0007] Extracting feature data from suspicious file samples;

[0008] Predicting the dynamics of the suspicious file sample to obtain a dynamic prediction result;

[0009] Monitor the propagation behavior of the suspicious file sample to obtain behavior monitoring results;

[0010] Malicious files are detected based on the feature data, the dynamic prediction results, and the behavior monitoring results.

[0011] Optionally, the step of monitoring the propagation behavior of the suspicious file sample and obtaining the behavior monitoring result includes:

[0012] Obtaining a propagation scenario of the suspicious file sample;

[0013] The propagation behavior of the suspicious file sample is monitored based on the propagation scenario to obtain a behavior monitoring result.

[0014] Optionally, the step of monitoring the propagation behavior of the suspicious file sample based on the propagation scenario to obtain the behavior monitoring result includes:

[0015] When the propagation scenario is an intranet scenario, obtaining the file type, process parameters, and file path of the suspicious file sample;

[0016] The propagation behavior of the suspicious file sample is monitored based on the file type, the process parameter, and the file path to obtain a behavior monitoring result.

[0017] Optionally, the step of monitoring the propagation behavior of the suspicious file sample based on the propagation scenario to obtain the behavior monitoring result includes:

[0018] When the transmission scenario is an external network scenario, detecting whether the characteristic data contains an abnormal identification;

[0019] The propagation behavior of the suspicious file sample is monitored according to the detection result to obtain a behavior monitoring result.

[0020] Optionally, before the step of extracting feature data from the suspicious file sample, the step further includes:

[0021] Determine suspicious files in the network to be detected through preset probes;

[0022] The suspicious file is induced to carry out a network attack by using preset induction resources to obtain a suspicious file sample.

[0023] Optionally, the step of determining suspicious files in the network to be detected by using a preset probe includes:

[0024] Acquire network information of the network to be detected through a preset probe, and analyze the network information;

[0025] Restore the file based on the analysis results to obtain the suspicious file.

[0026] Optionally, the step of inducing the suspicious file to perform a network attack by using a preset induction resource to obtain a suspicious file sample includes:

[0027] Build a virtual network;

[0028] The suspicious file is induced to carry out a network attack through the virtual network and the preset induction resources to obtain a suspicious file sample.

[0029] Optionally, the step of predicting the dynamics of the suspicious file sample to obtain a dynamic prediction result includes:

[0030] The dynamics of the suspicious file sample are predicted based on a preset bidirectional long short-term memory network model to obtain a dynamic prediction result.

[0031] Optionally, the characteristic data is IPR characteristic data.

[0032] Optionally, after the step of detecting malicious files based on the feature data, the dynamic prediction results, and the behavior monitoring results, the method further includes:

[0033] When a malicious file is detected, intercepting the malicious file;

[0034] Generate warning information corresponding to the malicious file.

[0035] Optionally, the step of generating warning information corresponding to the malicious file includes:

[0036] Obtaining the source address and target address of the malicious file;

[0037] Generate warning information corresponding to the malicious file according to the source address and the target address.

[0038] In addition, to achieve the above-mentioned objectives, the present invention also proposes a malicious file detection device for the Industrial Internet, which includes a memory, a processor, and a malicious file detection program for the Industrial Internet stored in the memory and executable on the processor, and the malicious file detection program for the Industrial Internet is configured to implement the malicious file detection method for the Industrial Internet as described above.

[0039] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a malicious file detection program for the industrial Internet is stored. When the malicious file detection program for the industrial Internet is executed by a processor, the malicious file detection method for the industrial Internet as described above is implemented.

[0040] In addition, to achieve the above-mentioned purpose, the present invention also proposes a malicious file detection device for industrial Internet, the malicious file detection device for industrial Internet comprises: a data extraction module, a dynamic prediction module, a behavior monitoring module and a file detection module;

[0041] The data extraction module is used to extract feature data from suspicious file samples;

[0042] The dynamic prediction module is used to predict the dynamics of the suspicious file sample and obtain a dynamic prediction result;

[0043] The behavior monitoring module is used to monitor the propagation behavior of the suspicious file sample and obtain behavior monitoring results;

[0044] The file detection module is used to detect malicious files based on the feature data, the dynamic prediction results and the behavior monitoring results.

[0045] Optionally, the behavior monitoring module is further used to obtain the propagation scenario of the suspicious file sample;

[0046] The behavior monitoring module is further used to monitor the propagation behavior of the suspicious file sample based on the propagation scenario to obtain a behavior monitoring result.

[0047] Optionally, the behavior monitoring module is further used to obtain the file type, process parameters and file path of the suspicious file sample when the propagation scenario is an intranet scenario;

[0048] The behavior monitoring module is further used to monitor the propagation behavior of the suspicious file sample based on the file type, the process parameter and the file path to obtain a behavior monitoring result.

[0049] Optionally, the behavior monitoring module is further used to detect whether the characteristic data contains an abnormal identification when the propagation scenario is an external network scenario;

[0050] The behavior monitoring module is also used to monitor the propagation behavior of the suspicious file sample according to the detection result to obtain the behavior monitoring result.

[0051] Optionally, the malicious file detection device for the industrial Internet further includes: a sample acquisition module;

[0052] The sample acquisition module is used to determine suspicious files in the network to be detected through a preset probe;

[0053] The sample acquisition module is also used to induce the suspicious file to carry out a network attack through preset induction resources to obtain a suspicious file sample.

[0054] Optionally, the sample acquisition module is further used to acquire network information of the network to be detected through a preset probe, and analyze the network information;

[0055] The sample acquisition module is also used to restore files according to the analysis results to obtain suspicious files.

[0056] Optionally, the sample acquisition module is also used to build a virtual network;

[0057] The sample acquisition module is also used to induce the suspicious file to carry out a network attack through the virtual network and preset induction resources to obtain a suspicious file sample.

[0058] The present invention discloses extracting characteristic data from suspicious file samples, predicting the dynamics of the suspicious file samples, obtaining dynamic prediction results, monitoring the propagation behavior of the suspicious file samples, obtaining behavior monitoring results, and detecting malicious files based on the characteristic data, dynamic prediction results and behavior monitoring results; because the present invention extracts characteristics of suspicious file samples, dynamically predicts and monitors behavior, it is possible to accurately detect malicious files in the Industrial Internet and improve the security of the Industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is a structural diagram of a malicious file detection device for the industrial Internet in a hardware operating environment involved in an embodiment of the present invention;

[0060] Figure 2 This is a flow chart of the first embodiment of the malicious file detection method for the industrial Internet of the present invention;

[0061] Figure 3 This is a flow chart of a second embodiment of a malicious file detection method for the industrial Internet of the present invention;

[0062] Figure 4 A schematic diagram of a flow chart of a third embodiment of a malicious file detection method for the industrial Internet of the present invention;

[0063] Figure 5 This is a structural block diagram of the first embodiment of the malicious file detection device for the industrial Internet of the present invention.

[0064] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0065] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0066] Reference Figure 1 , Figure 1 This is a schematic diagram of the structure of a malicious file detection device for the industrial Internet in the hardware operating environment involved in an embodiment of the present invention.

[0067] like Figure 1As shown, the malicious file detection device of the industrial Internet may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The wired interface of the user interface 1003 may be a USB interface in the present invention. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable memory (Non-volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0068] Those skilled in the art will understand that Figure 1 The structure shown in does not constitute a limitation on the malicious file detection device for the Industrial Internet, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0069] like Figure 1 As shown, the memory 1005 identified as a computer storage medium may include an operating system, a network communication module, a user interface module, and a malicious file detection program for the industrial Internet.

[0070] exist Figure 1 In the malicious file detection device for the industrial Internet shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the user device; the malicious file detection device for the industrial Internet calls the malicious file detection program for the industrial Internet stored in the memory 1005 through the processor 1001, and executes the malicious file detection method for the industrial Internet provided in an embodiment of the present invention.

[0071] Based on the above hardware structure, an embodiment of the malicious file detection method for the industrial Internet of the present invention is proposed.

[0072] Reference Figure 2 , Figure 2 The present invention is a flowchart of a first embodiment of a method for detecting malicious files in the Industrial Internet. The present invention is proposed as a first embodiment of a method for detecting malicious files in the Industrial Internet.

[0073] In a first embodiment, the malicious file detection method of the industrial Internet includes the following steps:

[0074] Step S10: extracting feature data from suspicious file samples.

[0075] It should be understood that the executor of the method of this embodiment can be a malicious file detection device of the industrial Internet with data processing, network communication and program running functions, such as a server, etc., or other electronic devices that can achieve the same or similar functions. This embodiment does not impose any restrictions on this.

[0076] It should be noted that the suspicious file samples can be pre-set or obtained by the malicious file detection device of the industrial Internet from the network to be detected, and this embodiment does not limit this. Among them, the network to be detected can be a network that needs to perform malicious file detection of the industrial Internet, for example, the network to be detected can be the industrial Internet.

[0077] It is understandable that extracting characteristic data from the suspicious file sample may be to extract characteristic data from the suspicious file sample based on the data identifier to obtain the characteristic data, wherein the data identifier is used to distinguish each data.

[0078] Step S20: predicting the dynamics of the suspicious file sample to obtain a dynamic prediction result.

[0079] It should be understood that in order to determine whether a suspicious file will endanger network security in the future, in this embodiment, the dynamics of the suspicious file sample is also predicted.

[0080] It is understandable that predicting the dynamics of suspicious file samples and obtaining dynamic prediction results can be performed by predicting the dynamics of suspicious file samples through a preset prediction model to obtain dynamic prediction results. The preset prediction model can be pre-set and used to predict the dynamics of files. For example, the preset prediction model can be a neural network model.

[0081] Step S30: monitor the propagation behavior of the suspicious file sample to obtain behavior monitoring results.

[0082] It should be understood that in order to determine whether the current propagation behavior of the suspicious file endangers network security, in this embodiment, the propagation behavior of the suspicious file sample is also monitored.

[0083] It is understandable that monitoring the propagation behavior of the suspicious file sample may be to obtain propagation information of the suspicious file sample and monitor the propagation behavior of the suspicious file sample according to the propagation information.

[0084] Step S40: Detect malicious files based on the feature data, the dynamic prediction results, and the behavior monitoring results.

[0085] It should be understood that when the feature data is malicious feature data, or the dynamic prediction result is that there will be malicious dynamics in the future, or the behavior monitoring result is that there will be malicious behavior, the suspicious file will be regarded as a malicious file.

[0086] In the first embodiment, it is disclosed to extract feature data from suspicious file samples, predict the dynamics of the suspicious file samples, obtain dynamic prediction results, monitor the propagation behavior of the suspicious file samples, obtain behavior monitoring results, and detect malicious files based on the feature data, dynamic prediction results and behavior monitoring results; since this embodiment extracts features of suspicious file samples, dynamically predicts and monitors behavior, it can accurately detect malicious files in the Industrial Internet and improve the security of the Industrial Internet.

[0087] Reference Figure 3 , Figure 3 This is a flow chart of the second embodiment of the malicious file detection method for the industrial Internet of the present invention, based on the above Figure 2 The first embodiment shown proposes a second embodiment of the malicious file detection method for the industrial Internet of the present invention.

[0088] In the second embodiment, the characteristic data is IPR characteristic data, and the step S10 includes:

[0089] Step S10': extracting IPR feature data from suspicious file samples.

[0090] It should be understood that in order to improve the accuracy of malicious file detection in the Industrial Internet, in this embodiment, the feature data may specifically be IPR feature data.

[0091] It should be noted that IPR (i.e. I / O request packet) is a data structure in which the upper-level user program sends a user request to the lower-level I / O manager. When the upper layer sends a request to the lower layer, many fields in the IPR and its stack structure contain various information related to the current file behavior. By analyzing the IPR, the specific request content of the user can be reversely parsed.

[0092] It is understandable that the IPR feature data can analyze the IRP sequence of the mapping file behavior of the suspicious file sample.

[0093] In the second embodiment, the step S20 includes:

[0094] Step S20': predicting the dynamics of the suspicious file sample based on a preset bidirectional long short-term memory network model to obtain a dynamic prediction result.

[0095] It should be understood that in order to improve the accuracy of dynamic prediction results, in this embodiment, a preset bidirectional long short-term memory network model is introduced to predict the dynamics of suspicious file samples.

[0096] It should be noted that the bidirectional long short-term memory network (LSTM) model can be used to predict the dynamics of suspicious file samples.

[0097] In the second embodiment, a preset bidirectional long short-term memory network model is additionally introduced to predict the dynamics of suspicious file samples, thereby improving the accuracy of dynamic prediction results.

[0098] In the second embodiment, the step S30 includes:

[0099] Step S301: Obtain the propagation scenario of the suspicious file sample.

[0100] It should be understood that in actual applications, the propagation behavior of suspicious files is different in different scenarios. Therefore, in order to improve the accuracy of propagation behavior monitoring, in this embodiment, the propagation behavior of suspicious file samples is also monitored based on the propagation scenario of the suspicious file samples to obtain behavior monitoring results.

[0101] It should be noted that the propagation scenario may be a network scenario when the suspicious file is propagated, for example, an intranet scenario or an extranet scenario.

[0102] Step S302: monitoring the propagation behavior of the suspicious file sample based on the propagation scenario to obtain a behavior monitoring result.

[0103] It is understandable that different propagation scenarios correspond to different monitoring strategies. Therefore, monitoring the propagation behavior of suspicious file samples based on the propagation scenario and obtaining the behavior monitoring result can be to find the monitoring strategy corresponding to the propagation scenario, and monitor the propagation behavior of suspicious file samples based on the monitoring strategy to obtain the behavior monitoring result.

[0104] It should be understood that searching for the monitoring strategy corresponding to the propagation scenario may be searching for the monitoring strategy corresponding to the propagation scenario in a preset strategy table, wherein the preset strategy table includes the correspondence between the propagation scenario and the monitoring strategy, and the correspondence between the propagation scenario and the monitoring strategy may be preset.

[0105] In the second embodiment, a propagation scenario for obtaining suspicious file samples is disclosed, and the propagation behavior of the suspicious file samples is monitored based on the propagation scenario to obtain behavior monitoring results; since this embodiment also monitors the propagation behavior of the suspicious file samples based on the propagation scenario of the suspicious file samples to obtain behavior monitoring results, the accuracy of propagation behavior monitoring can be improved.

[0106] Furthermore, in order to obtain reliable behavior monitoring results when the propagation scenario is an intranet scenario, the step S302 includes:

[0107] When the propagation scenario is an intranet scenario, obtaining the file type, process parameters, and file path of the suspicious file sample;

[0108] The propagation behavior of the suspicious file sample is monitored based on the file type, the process parameter, and the file path to obtain a behavior monitoring result.

[0109] It should be understood that in order to obtain reliable behavior monitoring results when the propagation scenario is an intranet scenario, in this embodiment, the propagation behavior of suspicious file samples is monitored based on the file type, process parameters and file path of the suspicious file samples.

[0110] It is understandable that monitoring the propagation behavior of suspicious file samples based on file type, process parameters and file path can be to determine that the suspicious file sample has malicious propagation behavior when at least one of the file type, process parameters and file path does not exist.

[0111] Furthermore, in order to obtain reliable behavior monitoring results when the propagation scenario is an external network scenario, the step S302 further includes:

[0112] When the transmission scenario is an external network scenario, detecting whether the characteristic data contains an abnormal identification;

[0113] The propagation behavior of the suspicious file sample is monitored according to the detection result to obtain a behavior monitoring result.

[0114] It should be understood that in order to obtain reliable behavior monitoring results when the propagation scenario is an external network scenario, in this embodiment, the propagation behavior of the suspicious file sample is monitored by detecting whether the feature data contains an abnormal identification.

[0115] It should be noted that, in order to improve the accuracy of propagation behavior monitoring, in this embodiment, the characteristic data may specifically be IPR characteristic data. The abnormal flag may be pre-set.

[0116] In the second embodiment, the step S40 includes:

[0117] Step S40': Detect malicious files based on the IPR feature data, the dynamic prediction results and the behavior monitoring results.

[0118] It should be understood that when the IPR feature data is malicious feature data, or the dynamic prediction result is that there will be malicious dynamics in the future, or the behavior monitoring result is that there will be malicious behavior, the suspicious file will be regarded as a malicious file.

[0119] Reference Figure 4 , Figure 4 This is a flow chart of the third embodiment of the malicious file detection method for the Industrial Internet of the present invention. Based on the above embodiments, the third embodiment of the malicious file detection method for the Industrial Internet of the present invention is proposed.

[0120] In the third embodiment, before step S10, the method further includes:

[0121] Step S01: Determine suspicious files in the network to be detected by using a preset probe.

[0122] It should be understood that in actual applications, even if industrial enterprises are not connected to the industrial Internet, malicious files can still carry out network attacks by moving horizontally according to their landing points. Therefore, in order to effectively capture suspicious file samples, in this embodiment, suspicious file samples are also captured based on probes and honeypots.

[0123] It should be noted that the preset probe can be pre-set. In this embodiment, the transverse moving probe is taken as an example for description.

[0124] Furthermore, in order to improve the accuracy of suspicious file detection, step S01 includes:

[0125] Acquire network information of the network to be detected through a preset probe, and analyze the network information;

[0126] Restore the file based on the analysis results to obtain the suspicious file.

[0127] It is understandable that in order to improve the accuracy of suspicious file detection, in this embodiment, the network information of the network to be detected is first obtained through a preset probe, and the network information is analyzed, and the file is restored according to the analysis result to obtain the suspicious file.

[0128] It should be noted that the network to be detected may be a network that needs to perform malicious file detection on the industrial Internet. For example, the network to be detected may be the industrial Internet. The network information may be flow information and / or log information, which is not limited in this embodiment.

[0129] It should be understood that analyzing network information and restoring files based on the analysis results to obtain suspicious files can be done by first analyzing traffic information and / or log information to determine files with illegal behaviors, and then restoring files with illegal behaviors to obtain suspicious files.

[0130] In a specific implementation, for example, the lateral movement probe method can be to first distinguish the byte stream data of the read request and response according to the Message ID of the service message block (SMB) network communication protocol header, and then determine the file with illegal behavior based on the byte stream data. By exporting and merging the data field and the grouped byte stream data, the original file format of the file with illegal behavior can be restored to obtain the suspicious file.

[0131] Step S02: Induce the suspicious file to carry out a network attack through a preset induction resource to obtain a suspicious file sample.

[0132] It should be noted that the preset induction resource can be pre-set. In this embodiment and other embodiments, the honeypot is taken as an example for description.

[0133] It should be understood that honeypots are essentially a technology that deceives attackers. By placing some hosts, network services or information as bait, attackers are lured to attack them, thereby capturing and analyzing attack behaviors, understanding the tools and methods used by attackers, and inferring attack intentions and motives. This allows defenders to clearly understand the security threats they face and enhance the security protection capabilities of the actual system through technical and management means.

[0134] Furthermore, in order to better induce suspicious files to carry out network attacks, the step S02 includes:

[0135] Build a virtual network;

[0136] The suspicious file is induced to carry out a network attack through the virtual network and the preset induction resources to obtain a suspicious file sample.

[0137] It should be understood that in order to better induce suspicious files to carry out network attacks, in this embodiment, a virtual network is first constructed, and the virtual network and honeypot are used to lure suspicious files to carry out network attacks at pre-set "weak points" to obtain suspicious file samples.

[0138] It is understandable that in a specific implementation, a virtual network, a weak password, and a honeypot can also be used to lure suspicious files to conduct network attacks. Among them, a weak password can be a password with a low security level and is easy to be attacked.

[0139] In the third embodiment, it is disclosed that suspicious files in the network to be detected are determined by preset probes, and suspicious files are induced to carry out network attacks by preset induction resources to obtain suspicious file samples; since the suspicious file samples are captured based on probes and honeypots in this embodiment, suspicious file samples can be effectively captured.

[0140] In the third embodiment, after step S40, the method further includes:

[0141] Step S50: When a malicious file is detected, the malicious file is intercepted.

[0142] It should be understood that in order to prevent the malicious file from causing harm, in this embodiment, when the malicious file is detected, the malicious file is intercepted.

[0143] It is understandable that intercepting a malicious file may mean not allowing the malicious file to continue to spread in the network.

[0144] Step S60: Generate warning information corresponding to the malicious file.

[0145] It should be understood that in order to promptly inform the user of the existence of a malicious file, this embodiment also generates warning information corresponding to the malicious file after intercepting the malicious file.

[0146] It is understandable that generating the warning information corresponding to the malicious file may be to use the preset warning information as the warning information corresponding to the malicious file. The preset warning information may be pre-set, for example, "there is a malicious file in the network, which has been intercepted" is used as the preset warning information.

[0147] The third embodiment intercepts the malicious file and generates warning information corresponding to the malicious file when the malicious file is detected, thereby preventing the malicious file from causing harm and notifying the user of the existence of the malicious file in a timely manner.

[0148] Furthermore, in order to facilitate the user to learn more malicious file information, the step S60 includes:

[0149] Obtaining the source address and target address of the malicious file;

[0150] Generate warning information corresponding to the malicious file according to the source address and the target address.

[0151] It should be understood that in order to facilitate users to learn more about malicious file information, this embodiment may generate warning information in combination with the source address and target address of the malicious file.

[0152] It should be noted that the source address may be the source address of the malicious file when it is propagated, and the target address may be the destination address of the malicious file when it is propagated.

[0153] It is understandable that generating the warning information corresponding to the malicious file according to the source address and the target address may be writing the source address and the target address into a preset warning template to generate the warning information corresponding to the malicious file. The preset warning template may be pre-set.

[0154] In addition, an embodiment of the present invention also proposes a storage medium, on which a malicious file detection program for the industrial Internet is stored. When the malicious file detection program for the industrial Internet is executed by a processor, the malicious file detection method for the industrial Internet as described above is implemented.

[0155] In addition, refer to Figure 5 , the embodiment of the present invention also proposes a malicious file detection device for industrial Internet, the malicious file detection device for industrial Internet includes: a dynamic prediction module 10, a behavior monitoring module 20 and a file detection module 30;

[0156] The data extraction module 10 is used to extract feature data from suspicious file samples.

[0157] It should be noted that the suspicious file samples can be pre-set or obtained by the malicious file detection device of the industrial Internet from the network to be detected, and this embodiment does not limit this. Among them, the network to be detected can be a network that needs to perform malicious file detection of the industrial Internet, for example, the network to be detected can be the industrial Internet.

[0158] It is understandable that extracting characteristic data from the suspicious file sample may be to extract characteristic data from the suspicious file sample based on the data identifier to obtain the characteristic data, wherein the data identifier is used to distinguish each data.

[0159] The dynamic prediction module 20 is used to predict the dynamics of the suspicious file sample to obtain a dynamic prediction result.

[0160] It should be understood that in order to determine whether a suspicious file will endanger network security in the future, in this embodiment, the dynamics of the suspicious file sample is also predicted.

[0161] It is understandable that predicting the dynamics of suspicious file samples and obtaining dynamic prediction results can be performed by predicting the dynamics of suspicious file samples through a preset prediction model to obtain dynamic prediction results. The preset prediction model can be pre-set and used to predict the dynamics of files. For example, the preset prediction model can be a neural network model.

[0162] The behavior monitoring module 30 is used to monitor the propagation behavior of the suspicious file sample and obtain a behavior monitoring result.

[0163] It should be understood that in order to determine whether the current propagation behavior of the suspicious file endangers network security, in this embodiment, the propagation behavior of the suspicious file sample is also monitored.

[0164] It is understandable that monitoring the propagation behavior of the suspicious file sample may be to obtain propagation information of the suspicious file sample and monitor the propagation behavior of the suspicious file sample according to the propagation information.

[0165] The file detection module 40 is used to detect malicious files based on the feature data, the dynamic prediction results and the behavior monitoring results.

[0166] It should be understood that when the feature data is malicious feature data, or the dynamic prediction result is that there will be malicious dynamics in the future, or the behavior monitoring result is that there will be malicious behavior, the suspicious file will be regarded as a malicious file.

[0167] In this embodiment, it is disclosed to extract feature data from suspicious file samples, predict the dynamics of suspicious file samples, obtain dynamic prediction results, monitor the propagation behavior of suspicious file samples, obtain behavior monitoring results, and detect malicious files based on the feature data, dynamic prediction results and behavior monitoring results; because this embodiment extracts features of suspicious file samples, dynamically predicts and monitors behavior, it can accurately detect malicious files in the Industrial Internet and improve the security of the Industrial Internet.

[0168] Other embodiments or specific implementation methods of the malicious file detection device for the industrial Internet described in the present invention can refer to the above-mentioned method embodiments and will not be repeated here.

[0169] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0170] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0171] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0172] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0173] The present invention discloses A1, a malicious file detection method for industrial Internet, the malicious file detection method for industrial Internet comprising the following steps:

[0174] Extracting feature data from suspicious file samples;

[0175] Predicting the dynamics of the suspicious file sample to obtain a dynamic prediction result;

[0176] Monitor the propagation behavior of the suspicious file sample to obtain behavior monitoring results;

[0177] Malicious files are detected based on the feature data, the dynamic prediction results, and the behavior monitoring results.

[0178] A2. In the malicious file detection method for the industrial Internet as described in A1, the step of monitoring the propagation behavior of the suspicious file sample and obtaining the behavior monitoring result comprises:

[0179] Obtaining a propagation scenario of the suspicious file sample;

[0180] The propagation behavior of the suspicious file sample is monitored based on the propagation scenario to obtain a behavior monitoring result.

[0181] A3. In the malicious file detection method for the industrial Internet as described in A2, the step of monitoring the propagation behavior of the suspicious file sample based on the propagation scenario and obtaining the behavior monitoring result includes:

[0182] When the propagation scenario is an intranet scenario, obtaining the file type, process parameters, and file path of the suspicious file sample;

[0183] The propagation behavior of the suspicious file sample is monitored based on the file type, the process parameter, and the file path to obtain a behavior monitoring result.

[0184] A4. In the malicious file detection method for the industrial Internet as described in A2, the step of monitoring the propagation behavior of the suspicious file sample based on the propagation scenario and obtaining the behavior monitoring result includes:

[0185] When the transmission scenario is an external network scenario, detecting whether the characteristic data contains an abnormal identification;

[0186] The propagation behavior of the suspicious file sample is monitored according to the detection result to obtain a behavior monitoring result.

[0187] A5. The malicious file detection method for the industrial Internet as described in any one of A1 to A4, before the step of extracting feature data from the suspicious file sample, further comprising:

[0188] Determine suspicious files in the network to be detected through preset probes;

[0189] The suspicious file is induced to carry out a network attack by using preset induction resources to obtain a suspicious file sample.

[0190] A6. In the method for detecting malicious files in the industrial Internet as described in A5, the step of determining suspicious files in the network to be detected by using a preset probe comprises:

[0191] Acquire network information of the network to be detected through a preset probe, and analyze the network information;

[0192] Restore the file based on the analysis results to obtain the suspicious file.

[0193] A7. In the method for detecting malicious files in the industrial Internet as described in A5, the step of inducing the suspicious file to perform a network attack by presetting an induction resource to obtain a suspicious file sample comprises:

[0194] Build a virtual network;

[0195] The suspicious file is induced to carry out a network attack through the virtual network and the preset induction resources to obtain a suspicious file sample.

[0196] A8. In the malicious file detection method for the industrial Internet as described in any one of A1 to A4, the step of predicting the dynamics of the suspicious file sample to obtain a dynamic prediction result comprises:

[0197] The dynamics of the suspicious file sample are predicted based on a preset bidirectional long short-term memory network model to obtain a dynamic prediction result.

[0198] A9. In the malicious file detection method for the industrial Internet as described in any one of A1 to A4, the characteristic data is IPR characteristic data.

[0199] A10. The method for detecting malicious files in the industrial Internet as described in any one of A1 to A4, after the step of detecting malicious files based on the feature data, the dynamic prediction results and the behavior monitoring results, further includes:

[0200] When a malicious file is detected, intercepting the malicious file;

[0201] Generate warning information corresponding to the malicious file.

[0202] A11. In the malicious file detection method for the industrial Internet as described in A10, the step of generating the warning information corresponding to the malicious file comprises:

[0203] Obtaining the source address and target address of the malicious file;

[0204] Generate warning information corresponding to the malicious file according to the source address and the target address.

[0205] The present invention also discloses B12, a malicious file detection device for the Industrial Internet, the malicious file detection device for the Industrial Internet comprising: a memory, a processor, and a malicious file detection program for the Industrial Internet stored in the memory and executable on the processor, the malicious file detection program for the Industrial Internet, when executed by the processor, implements the malicious file detection method for the Industrial Internet as described above.

[0206] The present invention also discloses C13, a storage medium, on which a malicious file detection program for the industrial Internet is stored. When the malicious file detection program for the industrial Internet is executed by a processor, the malicious file detection method for the industrial Internet as described above is implemented.

[0207] The present invention also discloses D14, a malicious file detection device for industrial Internet, the malicious file detection device for industrial Internet comprises: a data extraction module, a dynamic prediction module, a behavior monitoring module and a file detection module;

[0208] The data extraction module is used to extract feature data from suspicious file samples;

[0209] The dynamic prediction module is used to predict the dynamics of the suspicious file sample and obtain a dynamic prediction result;

[0210] The behavior monitoring module is used to monitor the propagation behavior of the suspicious file sample and obtain behavior monitoring results;

[0211] The file detection module is used to detect malicious files based on the feature data, the dynamic prediction results and the behavior monitoring results.

[0212] D15. The malicious file detection device for the industrial Internet as described in D14, wherein the behavior monitoring module is further used to obtain the propagation scenario of the suspicious file sample;

[0213] The behavior monitoring module is further used to monitor the propagation behavior of the suspicious file sample based on the propagation scenario to obtain a behavior monitoring result.

[0214] D16. The malicious file detection device for the industrial Internet as described in D15, wherein the behavior monitoring module is further used to obtain the file type, process parameters and file path of the suspicious file sample when the propagation scenario is an intranet scenario;

[0215] The behavior monitoring module is further used to monitor the propagation behavior of the suspicious file sample based on the file type, the process parameter and the file path to obtain a behavior monitoring result.

[0216] D17, as described in D15, the malicious file detection device of the industrial Internet, the behavior monitoring module is further used to detect whether the feature data contains an abnormal identification when the propagation scenario is an external network scenario;

[0217] The behavior monitoring module is also used to monitor the propagation behavior of the suspicious file sample according to the detection result to obtain the behavior monitoring result.

[0218] D18. The malicious file detection device for the industrial Internet as described in any one of D14 to D17, wherein the malicious file detection device for the industrial Internet further includes: a sample acquisition module;

[0219] The sample acquisition module is used to determine suspicious files in the network to be detected through a preset probe;

[0220] The sample acquisition module is also used to induce the suspicious file to carry out a network attack through preset induction resources to obtain a suspicious file sample.

[0221] D19. In the malicious file detection device for the industrial Internet as described in D18, the sample acquisition module is further used to obtain network information of the network to be detected through a preset probe and analyze the network information;

[0222] The sample acquisition module is also used to restore files according to the analysis results to obtain suspicious files.

[0223] D20, the malicious file detection device for the industrial Internet as described in D18, wherein the sample acquisition module is also used to build a virtual network;

[0224] The sample acquisition module is also used to induce the suspicious file to carry out a network attack through the virtual network and preset induction resources to obtain a suspicious file sample.

Claims

1. A malicious file detection method for industrial Internet, characterized in that: The malicious file detection method of the industrial Internet includes the following steps: Extracting feature data from suspicious file samples; Predicting the dynamics of the suspicious file sample to obtain a dynamic prediction result; Monitor the propagation behavior of the suspicious file sample to obtain behavior monitoring results; Malicious files are detected based on the feature data, the dynamic prediction results, and the behavior monitoring results.

2. The malicious file detection method for the industrial Internet as claimed in claim 1, characterized in that: The step of monitoring the propagation behavior of the suspicious file sample and obtaining the behavior monitoring result includes: Obtaining a propagation scenario of the suspicious file sample; The propagation behavior of the suspicious file sample is monitored based on the propagation scenario to obtain a behavior monitoring result.

3. The malicious file detection method for the industrial Internet as claimed in claim 2, characterized in that: The step of monitoring the propagation behavior of the suspicious file sample based on the propagation scenario to obtain the behavior monitoring result includes: When the propagation scenario is an intranet scenario, obtaining the file type, process parameters, and file path of the suspicious file sample; The propagation behavior of the suspicious file sample is monitored based on the file type, the process parameter, and the file path to obtain a behavior monitoring result.

4. The malicious file detection method for the industrial Internet as claimed in claim 2, characterized in that: The step of monitoring the propagation behavior of the suspicious file sample based on the propagation scenario to obtain the behavior monitoring result includes: When the transmission scenario is an external network scenario, detecting whether the characteristic data contains an abnormal identification; The propagation behavior of the suspicious file sample is monitored according to the detection result to obtain a behavior monitoring result.

5. The malicious file detection method for the industrial Internet according to any one of claims 1 to 4, characterized in that: Before the step of extracting characteristic data from the suspicious file sample, the method further includes: Determine suspicious files in the network to be detected through preset probes; The suspicious file is induced to carry out a network attack by using preset induction resources to obtain a suspicious file sample.

6. The malicious file detection method for the industrial Internet as claimed in claim 5, characterized in that: The step of determining suspicious files in the network to be detected by using a preset probe includes: Acquire network information of the network to be detected through a preset probe, and analyze the network information; Restore the file based on the analysis results to obtain the suspicious file.

7. The malicious file detection method for the industrial Internet as claimed in claim 5, characterized in that: The step of inducing the suspicious file to perform a network attack by using a preset induction resource to obtain a suspicious file sample includes: Build a virtual network; The suspicious file is induced to carry out a network attack through the virtual network and the preset induction resources to obtain a suspicious file sample.

8. A malicious file detection device for industrial Internet, characterized in that: The malicious file detection device for the industrial Internet includes: a memory, a processor, and a malicious file detection program for the industrial Internet stored in the memory and executable on the processor. When the malicious file detection program for the industrial Internet is executed by the processor, the malicious file detection method for the industrial Internet as described in any one of claims 1 to 7 is implemented.

9. A storage medium, characterized in that: The storage medium stores a malicious file detection program for the industrial Internet, and when the malicious file detection program for the industrial Internet is executed by the processor, the malicious file detection method for the industrial Internet as described in any one of claims 1 to 7 is implemented.

10. A malicious file detection device for industrial Internet, characterized in that: The malicious file detection device of the industrial Internet includes: a data extraction module, a dynamic prediction module, a behavior monitoring module and a file detection module; The data extraction module is used to extract feature data from suspicious file samples; The dynamic prediction module is used to predict the dynamics of the suspicious file sample and obtain a dynamic prediction result; The behavior monitoring module is used to monitor the propagation behavior of the suspicious file sample and obtain behavior monitoring results; The file detection module is used to detect malicious files based on the feature data, the dynamic prediction results and the behavior monitoring results.

Images