Malicious program detection method and related device

Abstract

The embodiment of the invention discloses a rogue program detection method and a related device, which are used for obtaining the flow of a target process accessing an intranet resource address and obtaining the flow of the target process accessing an extranet resource address by means of an SDP (Software Definition Protocol) software definition boundary client pre-installed in terminal equipment. According to the embodiment of the invention, similarity matching is carried out based on the bidirectional flow behavior of the target process to obtain the similarity index, and whether the malicious program is installed in the terminal equipment is determined according to the similarity index, so that the convenience and accuracy of detecting the malicious program are improved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a malicious program detection method and related devices. Background Art

[0002] With the continuous development of information technology, the risk of data leakage is also increasing. Some hackers or malware can obtain sensitive data through network attacks, data sniffing, social engineering, etc., resulting in data leakage.

[0003] When detecting malware or malicious programs, the existing technologies generally detect malware or malicious programs based on solutions such as Internet address threat intelligence technology, malicious code feature library technology or network traffic analysis technology. The above detection solutions all rely heavily on product intelligence libraries, feature libraries or rule libraries when detecting malicious programs or malware. However, product intelligence libraries, feature libraries or rule libraries can only detect known threats, but have no detection capabilities for newly emerging malicious programs, resulting in low detection accuracy for malicious programs. Summary of the invention

[0004] The embodiment of the present invention provides a malicious program detection method and related devices, which are used to obtain the traffic of a target process when accessing an intranet resource address and the traffic of a target process when accessing an extranet resource address with the help of a software defined perimeter (SDP) client pre-installed in a terminal device, perform similarity matching based on the two-way traffic behavior of the target process to obtain a similarity index, and determine whether a malicious program is installed in the terminal device based on the similarity index, thereby improving the convenience and accuracy of detecting malicious programs.

[0005] In a first aspect, the present application provides a malicious program detection method, which is applied to a terminal device, wherein an SDP software-defined boundary client is installed in the terminal device, and the method comprises:

[0006] If an operation of logging into the SDP client is detected, the SDP client is used to obtain the intranet resource address configured in the SDP server;

[0007] Using the SDP client to obtain traffic of a target process accessing the intranet resource address, the target process being any process installed in the terminal device;

[0008] Using the SDP client to obtain the traffic of the target process accessing the external network resource address;

[0009] Based on the preset traffic similarity matching rules, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined;

[0010] According to the similarity index, it is determined whether a malicious program is installed in the terminal device.

[0011] Optionally, the preset traffic similarity matching rule includes a similarity matching rule of actual sent and received traffic;

[0012] Based on the similarity matching rule of the actual sent and received traffic, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined, including:

[0013] In the first target time period, using the SDP client to obtain in real time the size of the intranet traffic of the intranet resource address accessed by the target process;

[0014] During the first target time period, using the SDP client to obtain in real time the size of the external network traffic of the external network resource address accessed by the target process;

[0015] Acquire a plurality of first differences between the size of the intranet traffic and the size of the extranet traffic at each statistical moment within the first target time period;

[0016] Comparing the multiple first difference values ​​with a preset first difference threshold value, so as to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result;

[0017] The determining, based on the similarity index, whether a malicious program is installed in the terminal device includes:

[0018] If the similarity index exceeds a first preset threshold, it is determined that a malicious program is installed in the terminal device.

[0019] Optionally, the preset traffic similarity matching rule includes an intermittent sending and receiving traffic similarity matching rule;

[0020] Based on the intermittent receiving and sending traffic similarity matching rule, a similarity comparison is performed on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed, and a similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed is determined, including:

[0021] In the second target time period, using the SDP client to obtain the cumulative intranet traffic size obtained by the target process in each of the first intermittent communication time periods with the intranet resource address during multiple first intermittent communication time periods;

[0022] In the second target time period, using the SDP client to obtain the cumulative external network traffic size obtained in each second intermittent communication time period in multiple second intermittent communication time periods between the target process and the external network resource address, wherein the second intermittent communication time period is set adjacent to the first intermittent communication time period;

[0023] Acquire multiple second differences between the cumulative external network traffic size in each second intermittent communication time period and the cumulative internal network traffic size in each first intermittent communication time period;

[0024] Compare the multiple second difference values ​​with the preset second difference threshold value respectively, so as to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed according to the comparison result;

[0025] The determining, based on the similarity index, whether a malicious program is installed in the terminal device includes:

[0026] If the similarity index exceeds a second preset threshold, it is determined that a malicious program is installed in the terminal device.

[0027] Optionally, the preset traffic similarity matching rule includes a cumulative sending and receiving traffic similarity matching rule;

[0028] Before performing a similarity comparison between the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on the cumulative sending and receiving traffic similarity matching rule, the method further includes:

[0029] If it is determined that the communication protocol between the target process and the intranet resource address is different from the communication protocol between the target process and the external network resource address, the step of performing a similarity comparison between the intranet resource address traffic accessed by the target process and the external network resource address traffic accessed based on the cumulative similarity matching rule of the received and sent traffic is triggered.

[0030] Optionally, based on the cumulative sending and receiving traffic similarity matching rule, performing a similarity comparison on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed, and determining a similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed, includes:

[0031] In a third target time period, using the SDP client to obtain the cumulative intranet traffic size of the target process in communicating with the intranet resource address;

[0032] During the third target time period, using the SDP client to obtain the external network cumulative traffic size of the target process in communicating with the external network resource address;

[0033] Obtaining a third difference between the cumulative flow size of the intranet and the cumulative flow size of the extranet within a preset time interval in the third target time period, wherein the preset time interval is any time interval within the third target time period;

[0034] Comparing the third difference with a preset third difference threshold value, to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result;

[0035] The determining, based on the similarity index, whether a malicious program is installed in the terminal device includes:

[0036] If the similarity index includes that the third difference is smaller than the preset third difference threshold, it is determined that a malicious program is installed in the terminal device.

[0037] Optionally, after determining whether a malicious program is installed in the terminal device according to the similarity index, the method further includes:

[0038] If it is determined that a malicious program is installed in the terminal device, the malicious program is reported to the SDP server through the SDP client, wherein the SDP server is used to generate a security warning event based on the malicious program.

[0039] Optionally, in addition to using the SDP client to obtain the intranet resource address configured in the SDP server, the method further includes:

[0040] Using the SDP client to obtain a security policy configured in the SDP server, the security policy including at least one of locking user information, locking terminal equipment, and blocking IP (Internet Protocol);

[0041] After determining that a malicious program is installed in the terminal device, the method further includes:

[0042] Acquire the terminal device association information for logging into the SDP client, wherein the terminal device association information includes user identity information, client identity information, and source IP information of the target process accessing the intranet resource address;

[0043] The malicious program and the terminal device association information are reported to the SDP server through the SDP client, wherein the SDP server is used to generate a security event based on the malicious program, the terminal device association information and the security policy.

[0044] Optionally, in addition to using the SDP client to obtain the intranet resource address configured in the SDP server, the method further includes:

[0045] Using the SDP client to obtain the latest version of the traffic similarity matching rule configured in the SDP server;

[0046] Before performing a similarity comparison between the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on a preset traffic similarity matching rule, the method further includes:

[0047] Determine whether the latest version of the traffic similarity matching rule is the same as the preset traffic similarity matching rule;

[0048] If they are not the same, the preset traffic similarity matching rule is updated to the latest version of the traffic similarity matching rule.

[0049] Optionally, before determining whether a malicious program is installed in the terminal device according to the similarity index, the method further includes:

[0050] During a fourth target time period, determining, based on the similarity index, whether a suspected malicious program is installed in the terminal device;

[0051] If determining whether a malicious program is installed in the terminal device according to the similarity index includes:

[0052] In a fifth target time period, it is determined whether a malicious program is installed in the terminal device according to the similarity index, wherein the fifth target time period is greater than the fourth target time period.

[0053] The method of the first aspect of the present application can be implemented by adopting the content of the second aspect of the present application during specific implementation.

[0054] A second aspect of an embodiment of the present application provides a terminal device, in which an SDP software-defined edge client is installed, and the terminal device includes:

[0055] An acquisition unit, configured to acquire an intranet resource address configured in an SDP server by using the SDP client if an operation of logging into the SDP client is detected;

[0056] The acquisition unit is further used to use the SDP client to acquire the traffic of the target process accessing the intranet resource address, where the target process is any process installed in the terminal device;

[0057] The acquisition unit is further used to use the SDP client to acquire the traffic of the target process accessing the external network resource address;

[0058] A determination unit, configured to perform a similarity comparison on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on a preset traffic similarity matching rule, and determine a similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed;

[0059] The determination unit is further configured to determine whether a malicious program is installed in the terminal device according to the similarity index.

[0060] A third aspect of an embodiment of the present application provides a computer device, comprising a processor, which, when executing a computer program stored in a memory, is used to implement the method described in the first aspect of the embodiment of the present application or any specific implementation of the first aspect.

[0061] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the computer program is used to implement the method described in the first aspect of the embodiment of the present application or any specific implementation manner of the first aspect.

[0062] A fifth aspect of an embodiment of the present application provides a computer program product having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, it is used to implement the method described in the first aspect of the embodiment of the present application or any specific implementation method of the first aspect.

[0063] It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

[0064] In an embodiment of the present application, if an operation of logging into the SDP client is detected, the SDP client is used to obtain the intranet resource address configured in the SDP server; the SDP client is used to obtain the traffic of the target process accessing the intranet resource address; the SDP client is used to obtain the traffic of the target process accessing the external network resource address; based on a preset traffic similarity matching rule, a similarity comparison is performed on the intranet resource address traffic accessed by the target process and the external network resource address traffic accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined; based on the similarity index, it is determined whether a malicious program is installed in the terminal device.

[0065] Because the embodiment of the present application is based on the traffic trend of the target process in the terminal device accessing the intranet resource address and the traffic trend of the target process accessing the extranet resource address to obtain a similarity index, and determines whether a malicious program is installed in the terminal device based on the similarity index. This comparison method based on the behavior characteristics of two-way traffic does not change because the behavior characteristics of two-way connectivity do not change, so that the detection process does not rely on updated rules for both previous malicious programs and newly emerging malicious programs. Therefore, the detection process of malicious programs in the embodiment of the present application has a higher detection accuracy rate than the existing technology that relies on the rule library. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0067] Figure 1 A schematic diagram of a system architecture provided for an embodiment of the present application;

[0068] Figure 2 A schematic diagram of a malicious program detection method provided in an embodiment of the present application;

[0069] Figure 3 A flow characteristic diagram provided for an embodiment of the present application;

[0070] Figure 4 A flow characteristic diagram provided for an embodiment of the present application;

[0071] Figure 5 A flow characteristic diagram provided for an embodiment of the present application;

[0072] Figure 6 A flow characteristic diagram provided for an embodiment of the present application;

[0073] Figure 7 A flow characteristic diagram provided for an embodiment of the present application;

[0074] Figure 8 A flow characteristic diagram provided for an embodiment of the present application;

[0075] Fig. 9 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application;

[0076] Fig.10 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0077] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0078] Before further elaborating on the method, objects and technologies that may be involved in the embodiments of the present application are first introduced.

[0079] 1. Zero Trust

[0080] Zero trust is a network security concept of "never trust, always verify", which is based on the assumption that no one, any device, or any data is trusted. Traditional network security models are usually based on the concept of trust within the network, that is, the internal network is considered to be trustworthy, while the external network is considered to be untrustworthy. In contrast, the zero trust model believes that there are threats within the network, and has developed a security framework of "identity-centric, continuous trust assessment, and dynamic access control", which strictly authenticates, controls access, and monitors in real time any person, device, or system that attempts to access the enterprise system before authorization. The mainstream technical implementations are software-defined perimeter SDP, unified identity management (IAM, Identity and Access Management), and micro-segmentation (MSG, Micro Segmentation).

[0081] 2. Software Defined Perimeter SDP

[0082] Software-defined perimeter (SDP) is a network security framework that implements the concept of zero trust. It provides a more flexible and dynamic security model by shifting the focus of network access control from the network perimeter to the applications and services themselves. SDP limits the users and devices that access applications and services by defining a set of security policies and rules. Access to specific applications or services is allowed only after verifying the user identity and device integrity. Therefore, SDP is closely related to the concept of zero trust and can be regarded as an implementation method of a zero-trust network security access control system. SDP products are generally composed of three major components: SDP control center and proxy gateway (ie, SDP server), and SDP connection initiation host (ie, SDP client).

[0083] 3. Remote Control Trojan

[0084] A remote control Trojan is a remote control Trojan virus / process. It is a program or malicious code used by network attackers to remotely control user (victim) terminals. A remote control Trojan parasitizes the control program or malicious code in the controlled user terminal, and performs illegal operations such as data theft and network attacks on the controlled terminal. It can also build a proxy channel on the controlled terminal to make it a springboard for attackers to access intranet resources. There are currently two main types of remote control Trojans: (1) remote control Trojans with independent processes. This type of Trojan has an independent process on the user terminal; (2) processless Trojans. Through dynamic link library (DLL) injection and other technologies, a malicious code is inserted into a trusted program (such as a browser) on the user terminal. It has no independent process of its own and is more concealed than remote control Trojans with independent processes.

[0085] 4. C&C (Command and Control) Server

[0086] The C&C server can be understood as the control end of the remote control Trojan program. Hackers communicate and control infected terminal devices through the C&C server. The C&C server is usually used to issue instructions to infected terminal devices, receive data sent by infected terminal devices, and monitor and manage infected terminal devices. Attackers can control multiple infected terminal devices through the C&C server and use multiple infected terminal devices to carry out attack activities.

[0087] See also Figure 1 , Figure 1 A schematic diagram of a system architecture provided in an embodiment of the present application, the system architecture may include an attacker C&C server, a terminal device (i.e. Figure 1 User terminals in the SDP server (i.e. Figure 1 The terminal device may be installed with an SDP client, and the terminal device may also be maliciously installed with malicious programs (such as Figure 1 The SDP server may include an SDP proxy gateway and an SDP control center. The enterprise intranet resources may include various information technology resources and services that can be used by employees in the enterprise intranet, such as file and data storage, internal websites and applications, communication and collaboration tools, development and testing environments, network services and infrastructure, business applications and services, and storage backup, etc. (in Figure 1In the example, resource A, resource B, and resource C are used to represent the resource A, resource B, and resource C, etc.). The SDP server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud databases, cloud services, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (CDN, Content Delivery Network), and big data and artificial intelligence platforms. The terminal device can be a smart phone, tablet computer, laptop computer, desktop computer, PDA, mobile Internet device (MID, Mobile Internet Device), wearable device (such as smart watch, smart bracelet, etc.), smart computer, smart car and other smart terminals. Among them, the SDP server can establish a communication connection with each terminal device, and a communication connection can also be established between each terminal device. The above-mentioned communication connection does not limit the connection method, and can be directly or indirectly connected by wired communication, or directly or indirectly connected by wireless communication, etc. It can be determined according to the actual application scenario, and the embodiments of the present application are not limited here.

[0088] It should be understood that Figure 1 Each terminal device shown in the figure can be installed with an SDP client, which runs on each terminal device and can communicate with Figure 1The SDP servers shown in the figure interact with each other. Specifically, the enterprise intranet resources will be accessed by the SDP server proxy, that is, the access request to the enterprise intranet resources will first pass through the SDP server, so the enterprise intranet resource address is configured in the SDP server. If the operation of logging in to the SDP client is detected, the SDP proxy gateway will communicate with the SDP control center, and the SDP control center will complete the configuration and send it. The configuration content sent may include specifying the access rights and scope of different users or devices to resources, access time restrictions and conditions, address lists of intranet resources, and configuration of data transmission encryption methods and security policies. The SDP client is used to obtain the intranet resource address sent by the SDP control center in the SDP server. If the process on the terminal device wants to access the enterprise intranet resources, the traffic of these intranet resource access requests will be monitored and hijacked by the SDP client installed on the terminal device. The traffic hijacked by the SDP client will be redirected and sent to the SDP server. The SDP server verifies and authorizes the request from the SDP client according to the predefined security policies and rules. The content of the verification may include user identity, terminal device information and the target resource requested. If the verification is successful, the SDP proxy gateway accesses the enterprise intranet resources and obtains the response data of the enterprise intranet resources. The SDP server forwards the response data of the intranet resources to the SDP client. After receiving the forwarded response data, the SDP client passes it to the process that originally accessed the enterprise intranet resources on the terminal device. Similarly, the SDP client can also monitor the traffic of the process accessing the Internet through the user terminal.

[0089] It should be noted that the methods provided in the embodiments of the present application can be implemented entirely on the terminal device side, or jointly implemented by the terminal device and the SDP server. The specific method can be determined according to the actual application scenario, and the embodiments of the present application are not limited here.

[0090] In related technologies, identifying malicious programs through security monitoring technology can timely detect and prevent malicious programs from invading and destroying the system, thereby ensuring the security of the system and data. Current technologies for identifying malicious programs include:

[0091] (1) Internet address threat intelligence technology: Firewalls deployed at the Internet egress and antivirus software on terminal devices can monitor the Internet addresses accessed by terminal devices and match them with the malicious address database in their threat intelligence database. If a match is found, it means that the terminal device is trying to connect to the attacker's server and may contain a remote control Trojan.

[0092] (2) Malicious code signature database technology: Antivirus software and Endpoint Detection and Response (EDR) products deployed on terminal devices can detect the file content and program code on the terminal device and compare them with the malicious code signature database. If there is a high degree of similarity, it indicates that a remote control Trojan may exist.

[0093] (3) Network traffic analysis technology: Firewalls, network WEB application firewalls and other products deployed in the customer's intranet can detect the traffic packets of terminal devices accessing intranet business assets and match them with their security rule base. If a match is found, it means that the terminal device is trying to attack intranet business assets and there may be a remote control Trojan.

[0094] The above security monitoring technology solutions such as Internet address threat intelligence technology, malicious code feature library technology, network traffic analysis technology, etc. are heavily dependent on the richness of the product intelligence library / feature library / rule library. If the product intelligence library / feature library / rule library is not updated in time, there will be a situation of missing threats. In addition, the intelligence library / feature library / rule library can only detect known threats, and has no detection capabilities for newly emerged attacker server address information, Trojan software, etc. Even if the rule matching threshold is lowered to capture more threats, a large number of false positives will be generated. At the same time, after traditional security products locate threats based on network IP, security experts still need to reversely check specific users and terminals through IP, and the timeliness of handling is insufficient, which further aggravates the security situation of unequal attack and defense confrontation.

[0095] To this end, an embodiment of the present application provides a malicious program detection method and related devices that do not rely on updated rules, but instead perform similarity matching based on the traffic trends of the target process in the terminal device accessing the intranet resource address and the traffic trends of the target process accessing the extranet resource address, thereby achieving accurate detection of malicious programs.

[0096] The various embodiments of the present application are described in further detail below in conjunction with the accompanying drawings.

[0097] See also Figure 2 The present application provides a specific embodiment of a malicious program detection method, which includes the following steps:

[0098] Step S201: If an operation of logging into the SDP client is detected, the SDP client is used to obtain the intranet resource address configured in the SDP server.

[0099] The SDP client is installed on the terminal device, and can perform security detection on the terminal device, especially various processes of the terminal device, and report to the SDP control center for security policy management. In actual applications, if it is detected that the user performs a login operation of the SDP client on the terminal (for example, enter a username and password and successfully log in), the random ID generated by the SDP client, the terminal information and user information of the SDP client (entered username and password) are used to verify the authority with the SDP control center of the SDP server. After successful verification, the SDP control center generates a unique identity for this SDP client and returns a verification success message to the SDP client. The unique identity generated here is also used for access requests initiated during the subsequent terminal user online cycle. When the terminal user goes online, the SDP client will establish a virtual communication channel with the SDP server. It can be understood from the above specification that the SDP server has been configured with an intranet resource address (for example, a server address, a database address, etc. within the enterprise), and the SDP client will request to obtain the intranet resource address configured in the SDP server. The SDP control center in the SDP server responds to the request and sends these intranet resource addresses to the SDP client.

[0100] Step S202: Use the SDP client to obtain the traffic of the target process accessing the intranet resource address.

[0101] Step S203: Use the SDP client to obtain the traffic of the target process accessing the external network resource address.

[0102] The SDP client monitors all running processes on the terminal device. The target process refers to a specific process that needs to be monitored at present. The target process is any process installed in the terminal device, which can be any application or service, such as a database service, an application that can transfer files, etc. In actual applications, the SDP client can be set with monitoring rules or use traffic hijacking and interception strategies to identify and monitor the target process. Specifically, the SDP client can hijack the network traffic generated by the target process through the network driver installed on the terminal or by using the network monitoring interface provided by the operating system. The SDP client can intercept all communication traffic initiated by the target process accessing the intranet resource address. The intranet resource address can be the address of the server, database, file server, etc. in the enterprise's internal network. The SDP client will record the detailed information of these communication traffic, including but not limited to the size of the data packet, the frequency of transmission, the source address, the destination address, the port number and the communication protocol. After the SDP client collects the detailed information of these communication traffic, it will classify and store them and mark them as intranet traffic. Similarly, the SDP client will also intercept all communication traffic initiated by the target process accessing the external network resource address. The external network resource address can be a server, cloud service, public Internet or a third-party cloud service platform in the enterprise's external network. Similar to intranet traffic monitoring, the SDP client will record detailed information about the communication traffic accessing the extranet, classify and store it, and mark it as extranet traffic.

[0103] It should be noted that the execution order of step S202 and step S203 is not limited and they can also be executed simultaneously, depending on the specific situation.

[0104] Step S204: Based on the preset traffic similarity matching rules, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the extranet resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed is determined.

[0105] The preset traffic similarity matching rules are used to determine the similarity between two or more traffic samples. The SDP client will classify all collected communication traffic according to the intranet and the extranet. Therefore, based on the preset traffic similarity matching rules, the intranet resource address traffic and the extranet resource address traffic accessed by the target process can be compared for similarity. These features include packet size and type, time interval, data transmission frequency, communication protocol and port number, source and destination IP address of the traffic, etc. The similarity comparison of the intranet and extranet traffic is performed based on the features / detailed information of these traffic. During the similarity comparison process, the above traffic features will be analyzed to determine the similarity indicators between two or more traffic samples.

[0106] The method for determining the similarity index between the intranet resource address traffic trend and the extranet resource address traffic trend can be to determine the similarity index by calculating the traffic ratio between the intranet resource address traffic and the extranet resource address traffic, cosine similarity, Pearson correlation coefficient, standardized difference value, etc. Specifically, the traffic ratio can be the ratio of the intranet traffic and the extranet traffic at each moment, such as traffic ratio = the size of the intranet traffic / the size of the extranet traffic. Calculating the cosine similarity is to calculate the dot product of the intranet traffic and the extranet traffic respectively, and to calculate the modulus length of the intranet traffic and the extranet traffic, and then use the cosine similarity formula to calculate the cosine similarity between the intranet traffic and the extranet traffic. The method of calculating cosine similarity, Pearson correlation coefficient, and standardized difference is a prior art and will not be repeated here.

[0107] Furthermore, the number of intranet resource address flows similar to the external network resource address flows at a specific moment or time period can also be counted through time series analysis, for example, the difference between the intranet flow size and the external network flow size at each moment / time period is calculated, and the number of differences less than a preset difference threshold is counted and used as a similarity index. In addition, the difference between the intranet flow and the external network flow in a certain time period can also be calculated, and the difference between the intranet flow size and the external network flow size in the time interval can be used as a similarity index.

[0108] Step S205: Determine whether a malicious program is installed in the terminal device according to the similarity index.

[0109] For example, the intranet resource address traffic and the extranet resource address traffic of the target process A can be compared for similarity. If the calculated traffic ratio, cosine similarity, Pearson correlation coefficient, and standardized difference value exceed the preset threshold, or the difference between the intranet traffic and the extranet traffic is less than the preset difference threshold, then it can be considered that there is a high similarity between the intranet traffic sample and the extranet traffic sample for similarity comparison, and it can be considered that the target process A is synchronizing data, or there is a risk of data leakage. It should be noted that the malicious program is not necessarily the target process A that initiates access to the intranet and the extranet, but can also be a malicious process that conducts malicious activities through the legitimate network access rights and communication channels of the infected or controlled normal target process A.

[0110] In this way, by using the preset traffic similarity matching rules, the traffic generated when the target process accesses internal and external network resources is compared and analyzed to determine the similarity index between the internal network traffic and the external network traffic, and based on the similarity index, it is determined whether a malicious program is installed in the terminal device, and potential security threats can be identified without relying on the rule base. Compared with the use of known malicious behavior feature libraries or signature libraries for comparison in related technologies, traffic similarity matching can analyze traffic data in real time and detect unknown threats in a timely manner. Compared with artificial intelligence models that require a large amount of training data, it consumes less system resources and is relatively simple and convenient to deploy.

[0111] The embodiment of the present application is based on the traffic trend of the target process in the terminal device accessing the intranet resource address and the traffic trend of the target process accessing the extranet resource address to obtain a similarity index, and determines whether a malicious program is installed in the terminal device based on the similarity index. This comparison method based on the behavior characteristics of two-way traffic does not change because the behavior characteristics of two-way connectivity do not change, so that the detection process does not rely on updated rules for both previous malicious programs and newly emerging malicious programs. Therefore, the detection process of malicious programs in the embodiment of the present application has a higher detection accuracy than the existing technology that relies on the rule library.

[0112] It should be pointed out that in order to timely adapt to changes in network environment and application architecture and respond to new threats and attack methods, in addition to using the SDP client to obtain the intranet resource address configured in the SDP server, the above also includes: using the SDP client to obtain the latest version of the traffic similarity matching rules configured in the SDP server;

[0113] Because the network environment and application architecture may change frequently due to the update of intranet resource addresses or the introduction of new extranet services, it is necessary to use the SDP client to obtain the latest version of the traffic similarity matching rules configured in the SDP server. By obtaining the latest version of the traffic similarity matching rules, more refined similarity matching rules can be obtained, which can more effectively distinguish normal behavior from potential malicious activities.

[0114] In a specific implementation, before performing a similarity comparison on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on the preset traffic similarity matching rules, it also includes: determining whether the latest version of the traffic similarity matching rules is the same as the preset traffic similarity matching rules; if not, updating the preset traffic similarity matching rules to the latest version of the traffic similarity matching rules.

[0115] Before performing traffic similarity comparison, it is necessary to ensure that the traffic similarity matching rules used are consistent with the latest version of the traffic similarity matching rules, so as to ensure that the system can more effectively and accurately identify potential malicious activities when detecting target process access behavior, improve the effectiveness of security protection, and ensure the reliability and adaptability of malicious program detection in complex and dynamic network environments.

[0116] The present application provides another specific embodiment of a malicious program detection method, which includes the following steps:

[0117] Step S301: If an operation of logging into the SDP client is detected, the SDP client is used to obtain the intranet resource address configured in the SDP server.

[0118] Step S302: Use the SDP client to obtain the traffic of the target process accessing the intranet resource address.

[0119] Step S303: Use the SDP client to obtain the traffic of the target process accessing the external network resource address.

[0120] Step S304: Based on the preset traffic similarity matching rules, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined.

[0121] Step S305: Determine whether a malicious program is installed in the terminal device according to the similarity index.

[0122] Step S306: If it is determined that a malicious program is installed in the terminal device, the malicious program is reported to the SDP server through the SDP client.

[0123] Specifically, the SDP client will report the detected malicious program information (e.g., program name, process ID, malicious behavior description, etc.) to the SDP server. Based on the reported malicious programs and malicious program information, the SDP server generates security warning events (e.g., recording event details, sending notifications to security administrators, triggering automatic execution of security policies or defense measures, etc.). The SDP server centrally collects and manages security events reported by all terminal devices, which can help the SDP server conduct more in-depth analysis, identify more complex attack patterns or advanced persistent threats, and help timely update the latest version of traffic similarity matching rules to achieve more efficient, comprehensive and accurate malicious program detection and security protection.

[0124] It should be noted that the operations of the above steps S301 to S305 are similar to those of steps S201 to S205, and will not be described in detail. The order of executing step S302 and step S303 is not limited, and they can also be executed simultaneously, depending on the specific situation.

[0125] In some specific embodiments, the specific implementation process of step S304 may include any of the following methods:

[0126] Method 1: The preset traffic similarity matching rule includes the similarity matching rule of the actual sent and received traffic; based on the similarity matching rule of the actual sent and received traffic, the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed are compared for similarity, and the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined, including: within a first target time period, using the SDP client to obtain the intranet traffic size of the intranet resource address accessed by the target process in real time; within the first target time period, using the SDP client to obtain the external network traffic size of the external network resource address accessed by the target process in real time; obtaining multiple first differences between the intranet traffic size and the external network traffic size at each statistical moment within the first target time period; comparing the multiple first differences with the preset first difference threshold value, so as to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed according to the comparison result; determining whether a malicious program is installed in the terminal device according to the similarity index, including: if the similarity index exceeds the first preset threshold value, determining that a malicious program is installed in the terminal device.

[0127] According to the aforementioned specification, after the SDP client receives the enterprise intranet resource data forwarded by the SDP server, it will be passed to the process in the terminal device that originally accessed the enterprise intranet resource. Therefore, the following situation may exist: after receiving the access request from the attacker, the malicious program will immediately initiate a request to access the intranet, and the SDP client will hijack the traffic accessing the intranet and forward it to the SDP server for proxy access. After obtaining the data from the intranet, it will also be sent to the external network immediately so as to be returned to the attacker. This process is extremely short and can be regarded as a real sending and receiving action. Therefore, by using the real sending and receiving traffic similarity matching rule of method one, the SDP client can be used to obtain the intranet traffic size of the intranet resource address accessed by the target process in the first target time period in real time, and the SDP client can be used to obtain the external network traffic size of the external network resource address accessed by the target process in the same time period in real time, calculate the first difference between the intranet traffic size and the external network traffic size at each statistical moment, and compare the calculated first difference with the preset first difference threshold to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed.

[0128] For example, see Figure 3 , Figure 3 The horizontal axis represents the time series with a time step of 1, and the vertical axis represents the flow size. For the convenience of explanation, Figure 3 The unit of the time step can be seconds, the unit of the traffic size can be kilobytes KB, the orange solid line represents the traffic received from the intranet, and the blue solid line represents the traffic sent to the extranet. The first target time period includes time 21 to time 25, and the SDP client obtains the intranet and extranet traffic size data of the target process at each statistical moment in the first target time period as follows:

[0129] Intranet traffic size: [time 21:32.5KB; time 22:1KB; time 23:7.3KB; time 24:25KB; time 5:44KB].

[0130] External network traffic size: [time 21:33.5KB; time 22:1.2KB; time 23:7.35KB; time 24:25KB; time 25:44.6KB].

[0131] The first difference between the intranet traffic size and the extranet traffic size at each statistical moment is calculated: [moment 21: 1KB; moment 22: 0.2KB; moment 23: 0.05KB; moment 24: 0KB; moment 5: 0.6KB].

[0132] If the preset first difference threshold is 5KB, the first difference of the above-mentioned first target time period, i.e., time 21-25, is smaller than the preset first difference threshold, and it can be determined that the traffic trend of the intranet resource address accessed by the target process is similar to the traffic trend of the extranet resource address accessed.

[0133] Specifically, in a possible implementation, the number of first differences between the size of the intranet traffic and the size of the extranet traffic that are less than a preset first difference threshold can be counted as a similarity indicator, and if the number of first differences that are less than the preset first difference threshold exceeds the first preset threshold, it is determined that a malicious program is installed in the terminal device. For example, if the first preset threshold is 3, and in the above-mentioned first target time period, i.e., time 21 to time 25, the number of first differences between the size of the intranet traffic and the size of the extranet traffic that are less than the preset first difference threshold is 5, it is determined that a malicious program is installed in the terminal device.

[0134] In another possible implementation, a similarity index (such as traffic ratio, cosine similarity, Pearson correlation coefficient, standardized difference value, etc.) can also be calculated based on the size of the traffic of the intranet resource address accessed at each statistical moment and the size of the traffic of the extranet resource address accessed. By way of example, the calculated cosine similarity is 0.997, and the first preset threshold is 0.85. If the similarity index exceeds the first preset threshold, it is determined that a malicious program is installed in the terminal device.

[0135] Method 2: The preset traffic similarity matching rule includes the intermittent sending and receiving traffic similarity matching rule; based on the intermittent sending and receiving traffic similarity matching rule, the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed are compared for similarity, and the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined, including: within the second target time period, using the SDP client to obtain the target process in multiple first intermittent communication time periods with the intranet resource address, the cumulative size of the intranet traffic obtained in each first intermittent communication time period; within the second target time period, using the SDP client to obtain multiple second intermittent communication time periods between the target process and the external network resource address The method comprises the following steps: obtaining the cumulative external network traffic size obtained in each second intermittent communication time period during the time period, wherein the second intermittent communication time period is adjacent to the first intermittent communication time period; obtaining a plurality of second differences between the cumulative external network traffic size in each second intermittent communication time period and the cumulative internal network traffic size in each first intermittent communication time period; comparing the plurality of second differences with a preset second difference threshold value, respectively, to determine a similarity index between a traffic trend of an internal network resource address accessed by a target process and a traffic trend of an external network resource address accessed according to the comparison result; and determining whether a malicious program is installed in a terminal device according to the similarity index, including: if the similarity index exceeds a second preset threshold value, determining that a malicious program is installed in the terminal device.

[0136] It should be understood that the malicious program may cache the access request from the attacker locally on the terminal device first. When the number of requests reaches a certain number or exceeds the time threshold, it will establish a link with the intranet (i.e. initiate an intranet access request). After obtaining data from the intranet, it will also be cached locally first. When the obtained data reaches a certain number or exceeds the time threshold, it will be sent to the external network and returned to the attacker. Therefore, the intermittent receiving and sending traffic matching rules of method 2 can be used. In the second target time period, the SDP client is used to obtain the cumulative intranet traffic size obtained in each of the first intermittent communication time periods between the target process and the intranet resource address; in the second target time period, the SDP client is used to obtain the cumulative extranet traffic size obtained in each of the second intermittent communication time periods between the target process and the extranet resource address, and then the cumulative extranet traffic size in each second intermittent communication time period is obtained, and multiple second differences between the cumulative extranet traffic size in each second intermittent communication time period and the cumulative intranet traffic size in each first intermittent communication time period are obtained; the multiple second differences are compared with the preset second difference threshold value respectively to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed.

[0137] See also Figures 4 to 7 , Figures 4 to 7 The horizontal axis represents the time series with a time step of 1, and the vertical axis represents the flow size. For the convenience of explanation, Figures 4 to 7 The unit of the time step can be seconds, the unit of the flow size can be kilobytes KB, the orange solid line represents the flow received from the intranet, and the blue solid line represents the flow sent to the external network. Intermittent communication refers to a period of time in which communication activities are not continuous, but there are intermittent interruptions or intervals. The communication activities in this time period can be manifested as obvious pauses or intervals in the sending and receiving of data packets, rather than continuous flow. The first intermittent communication time period can be understood as the duration of receiving resources from the intranet, that is, the time period from the moment of starting to receive intranet resources each time to the moment of stopping receiving intranet resources each time; similarly, the second intermittent communication time period can be understood as the duration of sending resources to the external network, that is, the time period from the moment of starting to send intranet resources to the external network each time to the moment of stopping sending intranet resources to the external network each time.

[0138] like Figure 4 As shown in the figure, it can be understood that when the number of intranet resources received by the target process reaches a certain amount, it will be immediately sent to the external network and then returned to the attacker. Figure 4The size of the traffic received from the intranet from time 0 to time 15 and the size of the traffic sent to the external network from time 15 to time 20, the size of the traffic received from the intranet from time 20 to time 25 and the size of the traffic sent to the external network from time 25 to time 30, etc. Exemplarily, time 0 to time 15, time 20 to time 25, and time 30 to time 35 are different first intermittent communication time periods, and similarly, time 15 to time 20, time 25 to time 30, and time 35 to time 40 are different second intermittent communication time periods. A second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 0 to time 15 and the cumulative extranet traffic size obtained from time 15 to time 20; another second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 20 to time 25 and the cumulative extranet traffic size obtained from time 25 to time 30, and so on, to obtain multiple second differences between the cumulative extranet traffic size in each second intermittent communication time period and the cumulative intranet traffic size in each first intermittent communication time period; the multiple second differences are compared with the preset second difference threshold value respectively to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed.

[0139] It should be noted that the target process can also send the acquired intranet resources to the external network and return them to the attacker after the number of intranet resources received exceeds a certain time threshold. Figure 5, the target process will receive resources from the intranet from time 0 to time 15, and the traffic size will no longer change after time 15, indicating that the currently received intranet resources have reached a certain amount. The target process can choose to cache the obtained intranet resources locally first, and after exceeding the time threshold (such as 5 moments), the target process will send the obtained intranet resources to the external network and return them to the attacker. Exemplarily, time 0-time 15, time 20-time 25, time 30-time 35 are different first intermittent communication time periods. Similarly, time 20-time 25, time 35-time 40, time 50-time 55 are different second intermittent communication time periods. Exemplarily, a second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 0 to time 15 and the cumulative extranet traffic size obtained from time 20 to time 25; another second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 20 to time 25 and the cumulative extranet traffic size obtained from time 35 to time 40, and so on, to obtain multiple second differences between the cumulative extranet traffic size in each second intermittent communication time period and the cumulative intranet traffic size in each first intermittent communication time period; and the multiple second differences are respectively compared with a preset second difference threshold to determine a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed.

[0140] Furthermore, the time or rate at which the target process receives the intranet resource may be different from the time or rate at which the obtained intranet resource is sent to the external network, but the cumulative intranet traffic size during the time of receiving the intranet resource is similar to the cumulative intranet traffic size during the time of sending the obtained intranet resource to the external network. Figure 6, the malicious program receives resources from the intranet from time 0 to time 20, and completes the operation of sending the intranet resources to the external network from time 20 to time 25. Exemplarily, time 0 to time 20, time 25 to time 35, and time 40 to time 50 are different first intermittent communication time periods, and similarly, time 20 to time 25, time 35 to time 40, and time 50 to time 55 are different second intermittent communication time periods. Exemplarily, a second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 0 to time 20 and the cumulative extranet traffic size obtained from time 20 to time 25; another second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 25 to time 35 and the cumulative extranet traffic size obtained from time 35 to time 40, and so on, to obtain multiple second differences between the cumulative extranet traffic size in each second intermittent communication time period and the cumulative intranet traffic size in each first intermittent communication time period; and the multiple second differences are respectively compared with a preset second difference threshold to determine a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed.

[0141] In addition, in addition to the difference between the time when the target process receives the internal network resources and the time when it sends the internal network resources to the external network, the target process may also send the internal network resources to the external network after a certain period of time after receiving the internal network resources. Figure 7 , the target process receives resources from the intranet from time 0 to time 20, and the traffic size does not change after time 20, indicating that the currently received intranet resources have reached a certain amount, and the target process will choose to cache them locally first. After exceeding the time threshold (such as 5 moments), the target process will send the acquired intranet resources to the external network and return them to the attacker within time 25 to time 30. Exemplarily, time 0 to time 20, time 25 to time 35, and time 40 to time 55 are different first intermittent communication time periods. Similarly, time 25 to time 30, time 40 to time 45, and time 55 to time 60 are different second intermittent communication time periods. Exemplarily, a second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 0 to time 20 and the cumulative extranet traffic size obtained from time 25 to time 30; another second difference is obtained by performing a difference operation on the cumulative intranet traffic size obtained from time 25 to time 35 and the cumulative extranet traffic size obtained from time 40 to time 45; and so on, multiple second differences between the cumulative extranet traffic size in each second intermittent communication time period and the cumulative intranet traffic size in each first intermittent communication time period are obtained; and the multiple second differences are compared with the preset second difference threshold value respectively to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed.

[0142] Based on the above-mentioned second embodiment, if multiple second differences are all smaller than the preset second difference threshold, it can be determined that the traffic trend of the intranet resource address accessed by the target process is similar to the traffic trend of the extranet resource address accessed.

[0143] Specifically, in a possible implementation, the number of multiple second difference values ​​less than a preset second difference threshold can be counted as a similarity index, and if the number of multiple second difference values ​​less than the preset second difference threshold obtained by counting exceeds the second preset threshold, it is determined that a malicious program is installed in the terminal device. For example, if the second preset threshold is 3, and the number of multiple second difference values ​​less than the preset second difference threshold is 5, it is determined that a malicious program is installed in the terminal device.

[0144] In another possible implementation, similarity indicators (such as flow ratio, cosine similarity, Pearson correlation coefficient, standardized difference value, etc.) can be calculated based on the cumulative flow size of the intranet in each first intermittent communication time period and the cumulative flow size of the extranet in each second intermittent communication time period adjacent to the first intermittent communication time period. Exemplarily, the calculated cosine similarity is 0.997, the second preset threshold is 0.85, and the similarity indicator exceeds the second preset threshold, then it is determined that a malicious program is installed in the terminal device.

[0145] In addition to the communication rules of hidden traffic characteristics provided by the aforementioned methods one and two, the target process may also complete the operation of sending intranet resources to the external network by using a communication protocol different from that when receiving intranet resources, making the intranet and external network traffic irregular and difficult to detect using methods one and two. Exemplarily, when receiving intranet resources, the target process uses the Hypertext Transfer Protocol (HTTP), and when sending intranet resources to the external network, the target process switches to using the Message Queuing Telemetry Transport Protocol (MQTT). In this scenario, method three, i.e., cumulative sending and receiving traffic similarity matching rules, can be used; by continuously observing the total amount of intranet and external network traffic within a specified time range and comparing them, in order to determine the similarity between the traffic of the accessed intranet resource address and the traffic of the accessed external network resource address.

[0146] Therefore, in a specific implementation method, the preset traffic similarity matching rule includes a cumulative sending and receiving traffic similarity matching rule; before performing a similarity comparison on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed based on the cumulative sending and receiving traffic similarity matching rule, it also includes: if it is determined that the communication protocol between the target process and the intranet resource address is different from the communication protocol between the target process and the external network resource address, then triggering a step of performing a similarity comparison on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed based on the cumulative sending and receiving traffic similarity matching rule.

[0147] Further, based on the similarity matching rule of the accumulated sending and receiving traffic, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined, including: within the third target time period, using the SDP client to obtain the cumulative size of the intranet traffic of the target process in communicating with the intranet resource address; within the third target time period, using the SDP client to obtain the cumulative size of the external network traffic of the target process in communicating with the external network resource address; obtaining the cumulative size of the external network traffic of the target process in communicating with the external network resource address in the third target time period; obtaining the cumulative size of the internal network traffic of the target process in communicating with the external network resource address in the third target time period ... A third difference between the cumulative traffic size of the intranet and the cumulative traffic size of the extranet within a preset time interval in the time period, wherein the preset time interval is any time interval within the third target time period; comparing the third difference with a preset third difference threshold to determine a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed according to the comparison result; determining whether a malicious program is installed in the terminal device according to the similarity index, including: if the similarity index includes that the third difference is less than the preset third difference threshold, then determining that a malicious program is installed in the terminal device.

[0148] For example, reference may be made to Figure 8 , Figure 8 The horizontal axis represents the time series with a time step of 1, and the vertical axis represents the flow size. For the convenience of explanation, Figure 8 The unit of the time step may be seconds, the unit of the flow size may be kilobytes KB, the orange solid line indicates the flow received from the intranet, and the blue solid line indicates the flow sent to the external network. Exemplarily, the third target time period may be time 1-13, and the preset time interval may be time 1 to time 8. The third difference between the change in flow received from the intranet between time 1 and time 8 (i.e., the cumulative flow size of the intranet) and the change in flow sent to the external network (i.e., the cumulative flow size of the external network) is calculated, and compared with the preset third difference threshold.

[0149] In one possible implementation, the similarity index includes a third difference value being less than a preset third difference threshold value, that is, a similarity comparison result such as "the third difference value is less than the preset third difference threshold value" is used as a similarity index to determine that the traffic trend of the intranet resource address accessed by the target process is similar to the traffic trend of the extranet resource address accessed, and ultimately determine that a malicious program is installed in the terminal device.

[0150] In another possible implementation, a similarity index (such as a traffic ratio, cosine similarity, Pearson correlation coefficient, standardized difference value, etc.) can be calculated based on the cumulative traffic size of the intranet and the cumulative traffic size of the extranet in the preset time interval in the third target time period. Exemplarily, the calculated cosine similarity is 0.997, the third preset threshold is 0.85, and the similarity index exceeds the third preset threshold, then it is determined that a malicious program is installed in the terminal device.

[0151] It should be noted that the "moment" mentioned in the embodiments of the present application can be understood as the moment of network traffic, specifically at certain specific time points. For example, it can be a specific time unit, such as seconds, minutes, hours, etc., depending on the time interval for monitoring traffic, which is not specifically limited in the embodiments of the present application. In addition, in each of the embodiments of the above-mentioned methods 1 to 3, there is an operation of calculating the difference between the intranet traffic and the extranet traffic. In a feasible embodiment, calculating the difference between the intranet traffic and the extranet traffic can also be calculating the absolute value of the difference between the intranet traffic and the extranet traffic, and using the absolute value of the difference for similarity comparison.

[0152] It should be noted that, in order to facilitate the explanation in the above embodiments, Figure 3-Figure 8 The example of "the orange solid line represents the traffic received from the intranet (i.e., the intranet traffic), the blue solid line represents the traffic sent to the extranet (i.e., the extranet traffic), the unit of the time step is seconds, and the unit of the traffic size is kilobytes KB" is used for explanatory explanation, and is not a limitation of the present invention. In other embodiments, different colors or line types can be used to represent the traffic received from the intranet or sent from the extranet according to specific needs, and different time step units such as minutes, hours, etc. can also be used. Different traffic size units such as bytes, megabytes MB, etc. can also be used, and the embodiments of the present application do not limit this. In addition, in order to reduce the noise in the intranet traffic data and the extranet traffic data, and make the changing trend of the intranet and extranet traffic more obvious, polynomial fitting, linear regression and other methods are often used for the original intranet and extranet traffic data to perform function fitting on the intranet and extranet traffic data. In this way, the corresponding fitting value can be obtained after moving average and exponential smoothing of multiple data points, so as to describe the overall trend of the intranet and extranet traffic data through the fitting value.

[0153] In practical applications, Figure 3-Figure 8The traffic characteristic diagram showing the traffic change trend can also be displayed on the monitoring dashboard of the network administrator or developer, or on the monitoring screen of the Security Operations Center (SOC), or integrated into the enterprise-level management platform interface or monitoring system, which will help relevant personnel to better monitor, manage and optimize network resources and help quickly identify and respond to abnormal situations.

[0154] Considering that corresponding countermeasures should be configured after the malicious program is determined, in addition to using the SDP client to obtain the intranet resource address configured in the SDP server, it also includes: using the SDP client to obtain the security policy configured in the SDP server, the security policy includes at least one of locking user information, locking terminal devices and blocking IP;

[0155] The acquisition and application of security policies is to enable quick and effective defensive measures when malicious programs are detected. In the above description, it is mentioned that these security policies are pre-configured in the SDP server and can be specifically set according to the enterprise security needs and policies. It can be understood that locking user information is to prevent infected users from continuing to access sensitive resources; locking terminal devices is to isolate infected devices to prevent them from continuing to spread threats in the network; and blocking IPs, that is, blocking IP addresses, is to prevent all network requests from specified IP addresses to prevent further spread of external attacks or internal infections. Furthermore, security policies may also include: traffic hijacking and interception policies (such as limiting the type of hijacked traffic, intercepting specific Uniform Resource Locators (URLs), IP addresses or domain name access requests); SMS authentication (verifying user identity by sending a one-time verification code via SMS, etc.); brute force authentication (after multiple failed login attempts, temporarily or permanently locking the account, or requiring the entry of a verification code, or increasing the delay time for the next attempt, or blacklisting IP addresses that have failed multiple login attempts to prevent further access attempts); user level authority authentication (ensuring that users can only access resources allowed by their user roles), etc.

[0156] In a specific implementation, after determining that a malicious program is installed in the terminal device, it also includes: obtaining terminal device association information of the logged-in SDP client, wherein the terminal device association information includes user identity information, client identity information, and source IP information of the target process accessing the intranet resource address; reporting the malicious program and terminal device association information to the SDP server through the SDP client, wherein the SDP server is used to generate security events based on the malicious program, terminal device association information, and security policies.

[0157] After confirming the existence of malicious programs, the purpose of obtaining the associated information of the terminal device is to more accurately locate the infected users and devices, so as to facilitate targeted threat handling. The associated information of malicious programs and terminal devices is reported to the SDP server, which uses this information to generate security events. By generating security events, it is convenient for security administrators to review and respond to abnormal situations.

[0158] In order to further confirm and reduce false alarms and improve the accuracy of detection, before determining whether a malicious program is installed in the terminal device based on the similarity index, it also includes: within a fourth target time period, determining whether a suspected malicious program is installed in the terminal device based on the similarity index; if determining whether a malicious program is installed in the terminal device based on the similarity index, it includes: within a fifth target time period, determining whether a malicious program is installed in the terminal device based on the similarity index, wherein the fifth target time period is greater than the fourth target time period.

[0159] Specifically, generally before detecting the similarity between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed, a fourth target time period (such as within 5 minutes) will be set, and the malicious program detection method provided by the embodiment of the present application will be executed within the fourth target time period to obtain a similarity index, and based on the similarity index obtained within the fourth target time period, it is determined whether a suspected malicious program is installed in the terminal device. If so, it is determined that a suspected malicious program is installed in the terminal device; further, a longer fifth target time period (such as within 30 minutes) is set. Within the fifth target time period, the malicious program detection method provided by the embodiment of the present application is executed to obtain a similarity index, and then based on the similarity index obtained within the fifth target time period, it is determined that a malicious program is installed in the terminal device.

[0160] This method can effectively detect and confirm malicious programs in terminal devices through two stages: preliminary detection and further confirmation, combined with short-term and long-term traffic trend analysis. This phased detection can quickly screen out potential threats, reduce false positives, and improve detection accuracy.

[0161] See also Fig. 9 The embodiment of the present application provides a specific example of a terminal device, in which an SDP software-defined edge client is installed, and the terminal device includes:

[0162] The acquisition unit 901 is configured to acquire the intranet resource address configured in the SDP server by using the SDP client if an operation of logging into the SDP client is detected;

[0163] The acquisition unit 901 is further configured to use the SDP client to acquire traffic of a target process accessing the intranet resource address, where the target process is any process installed in the terminal device;

[0164] The acquisition unit 901 is further used to use the SDP client to acquire the traffic of the target process accessing the external network resource address;

[0165] The determination unit 902 is used to perform a similarity comparison on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on a preset traffic similarity matching rule, and determine a similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed;

[0166] The determination unit 902 is further configured to determine whether a malicious program is installed in the terminal device according to the similarity index.

[0167] In one embodiment, the acquisition unit 901 is further configured to acquire, by using the SDP client, in real time within the first target time period, the size of the intranet traffic of the intranet resource address accessed by the target process;

[0168] The acquisition unit 901 is further configured to acquire, by using the SDP client, in real time, the size of the external network traffic of the external network resource address accessed by the target process within the first target time period;

[0169] The acquisition unit 901 is further configured to acquire, at each statistical moment in the first target time period, a plurality of first differences between the size of the intranet traffic and the size of the extranet traffic;

[0170] The determination unit 902 is further configured to compare the multiple first difference values ​​with a preset first difference threshold value, so as to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result;

[0171] The determination unit 902 is further configured to determine that a malicious program is installed in the terminal device if the similarity index exceeds a first preset threshold.

[0172] In one embodiment, the acquisition unit 901 is further configured to use the SDP client to acquire, within the second target time period, the cumulative intranet traffic size acquired by the target process within each of the first intermittent communication time periods with the intranet resource address within the multiple first intermittent communication time periods;

[0173] The acquisition unit 901 is further configured to acquire, by using the SDP client, a plurality of second intermittent communication time periods between the target process and the external network resource address, within the second target time period, the external network cumulative traffic size acquired within each second intermittent communication time period, wherein the second intermittent communication time period is adjacent to the first intermittent communication time period;

[0174] The acquisition unit 901 is further configured to acquire a plurality of second differences between the cumulative external network traffic size in each second intermittent communication time period and the cumulative internal network traffic size in each first intermittent communication time period;

[0175] The determination unit 902 is further configured to compare the plurality of second difference values ​​with a preset second difference threshold value, respectively, to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result;

[0176] The determination unit 902 is further configured to determine that a malicious program is installed in the terminal device if the similarity index exceeds a second preset threshold.

[0177] In one embodiment, the terminal device further includes: a trigger unit;

[0178] A trigger unit is used to trigger the step of performing similarity comparison on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on the accumulated sending and receiving traffic similarity matching rules if it is determined that the communication protocol between the target process and the intranet resource address is different from the communication protocol between the target process and the extranet resource address.

[0179] In one embodiment, the acquisition unit 901 is further configured to acquire, by using the SDP client, the cumulative intranet traffic size of the target process in communication with the intranet resource address within a third target time period;

[0180] The acquisition unit 901 is further configured to acquire, by using the SDP client, the external network accumulated traffic size of the target process in communication with the external network resource address within the third target time period;

[0181] The acquisition unit 901 is further configured to acquire a third difference between the cumulative flow size of the intranet and the cumulative flow size of the extranet within a preset time interval in the third target time period, wherein the preset time interval is any time interval within the third target time period;

[0182] The determination unit 902 is further configured to compare the third difference with a preset third difference threshold value, so as to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result;

[0183] The determination unit 902 is further configured to determine that a malicious program is installed in the terminal device if the similarity index includes that the third difference is smaller than the preset third difference threshold.

[0184] In one embodiment, the terminal device further includes: a reporting unit;

[0185] A reporting unit is used to report the malicious program to the SDP server through the SDP client if it is determined that a malicious program is installed in the terminal device, wherein the SDP server is used to generate a security warning event based on the malicious program.

[0186] In one embodiment, the acquisition unit 901 is further used to use the SDP client to acquire a security policy configured in the SDP server, wherein the security policy includes at least one of locking user information, locking terminal devices, and blocking IP addresses;

[0187] The acquisition unit 901 is further used to acquire the terminal device association information for logging into the SDP client, wherein the terminal device association information includes user identity information, client identity information, and source IP information of the target process accessing the intranet resource address;

[0188] The reporting unit is further used to report the malicious program and the terminal device association information to the SDP server through the SDP client, wherein the SDP server is used to generate a security event based on the malicious program, the terminal device association information and the security policy.

[0189] In one embodiment, the terminal device further includes: a judgment unit and an updating unit;

[0190] The acquisition unit 901 is further configured to use the SDP client to acquire the latest version of the traffic similarity matching rule configured in the SDP server;

[0191] A judging unit, used to judge whether the latest version of the traffic similarity matching rule is the same as the preset traffic similarity matching rule;

[0192] An updating unit is used to update the preset traffic similarity matching rule to the latest version of the traffic similarity matching rule if they are not the same.

[0193] In one embodiment, the determination unit 902 is further configured to determine whether a suspected malicious program is installed in the terminal device according to the similarity index within a fourth target time period;

[0194] The determination unit 902 is further configured to determine whether a malicious program is installed in the terminal device according to the similarity index within a fifth target time period, wherein the fifth target time period is greater than the fourth target time period.

[0195] In the embodiment of the present application, the operations performed by each unit of the terminal device are similar to the operations described in the first aspect or any specific method embodiment of the first aspect, and will not be described in detail here. Of course, the specific implementation process of each operation in the first aspect of the present application can also refer to the relevant description of the second aspect.

[0196] The terminal device in the embodiment of the present application is described above from the perspective of modular functional entities. The computer device in the embodiment of the present application is described below from the perspective of hardware processing:

[0197] See also Fig.10 An embodiment of the present application provides a specific example of a computer device, which includes a processor, and when the processor executes a computer program stored in a memory, it is used to implement the method described in the first aspect of the embodiment of the present application or any specific implementation method of the first aspect.

[0198] It is understandable that when the processor in the computer device described above executes the computer program, it can also implement the functions of the various units in the above-mentioned corresponding device embodiments, which will not be repeated here. Exemplarily, the computer program can be divided into one or more modules / units, one or more modules / units are stored in the memory, and executed by the processor to complete the present application. One or more modules / units can be a series of computer program instruction segments that can perform specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device. For example, the computer program can be divided into the various units in the above-mentioned terminal device, and each unit can implement the specific functions described in the above-mentioned corresponding terminal device.

[0199] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The computer device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the processor and the memory are merely examples of computer devices and do not constitute a limitation of the computer device. The computer device may include more or fewer components, or a combination of certain components, or different components. For example, the computer device may also include input and output devices, network access devices, buses, etc.

[0200] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of a computer device, and uses various interfaces and lines to connect various parts of the entire computer device.

[0201] The memory can be used to store computer programs and / or modules. The processor realizes various functions of the computer device by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the terminal, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SMC, Smart Media Card), a secure digital (SD, Secure Digital) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0202] The present application also provides a computer-readable storage medium, which is used to implement the functions of a terminal device, and has a computer program stored thereon. When the computer program is executed by a processor, the processor can be used to implement the method described in the first aspect of the embodiment of the present application or any specific implementation method of the first aspect.

[0203] An embodiment of the present application also provides a computer program product having a computer program / instruction stored thereon. When the computer program / instruction is executed by a processor, it is used to implement the method described in the first aspect of the embodiment of the present application or any specific implementation of the first aspect.

[0204] The terms "first", "second", "third", "fourth", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0205] It is understandable that, in various embodiments of the present invention, the sequence numbers of the above steps do not mean the order of execution. The order of execution of the steps should be determined by their functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0206] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0207] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0208] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0209] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0210] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0211] As described above, the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting malicious programs, characterized in that: Applied to a terminal device, the terminal device has an SDP software-defined edge client installed in it, and the method includes: If an operation of logging into the SDP client is detected, the SDP client is used to obtain the intranet resource address configured in the SDP server; Using the SDP client to obtain traffic of a target process accessing the intranet resource address, the target process being any process installed in the terminal device; Using the SDP client to obtain the traffic of the target process accessing the external network resource address; Based on the preset traffic similarity matching rules, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined; According to the similarity index, it is determined whether a malicious program is installed in the terminal device.

2. The method according to claim 1, characterized in that: The preset traffic similarity matching rule includes the actual sent and received traffic similarity matching rule; Based on the similarity matching rule of the actual sent and received traffic, a similarity comparison is performed on the traffic of the intranet resource address accessed by the target process and the traffic of the external network resource address accessed, and a similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the external network resource address accessed is determined, including: In the first target time period, using the SDP client to obtain in real time the size of the intranet traffic of the intranet resource address accessed by the target process; During the first target time period, using the SDP client to obtain in real time the size of the external network traffic of the external network resource address accessed by the target process; Acquire a plurality of first differences between the size of the intranet traffic and the size of the extranet traffic at each statistical moment within the first target time period; Comparing the multiple first difference values ​​with a preset first difference threshold value, so as to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result; The determining, based on the similarity index, whether a malicious program is installed in the terminal device includes: If the similarity index exceeds a first preset threshold, it is determined that a malicious program is installed in the terminal device.

3. The method according to claim 1, characterized in that The preset traffic similarity matching rule includes an intermittent receiving and sending traffic similarity matching rule; Based on the intermittent receiving and sending traffic similarity matching rule, a similarity comparison is performed on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed, and a similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed is determined, including: In the second target time period, using the SDP client to obtain the cumulative intranet traffic size obtained by the target process in each of the first intermittent communication time periods with the intranet resource address during multiple first intermittent communication time periods; In the second target time period, using the SDP client to obtain the cumulative external network traffic size obtained in each second intermittent communication time period in multiple second intermittent communication time periods between the target process and the external network resource address, wherein the second intermittent communication time period is set adjacent to the first intermittent communication time period; Acquire multiple second differences between the cumulative external network traffic size in each second intermittent communication time period and the cumulative internal network traffic size in each first intermittent communication time period; Compare the multiple second difference values ​​with the preset second difference threshold value respectively, so as to determine the similarity index between the traffic trend of the intranet resource address accessed by the target process and the traffic trend of the extranet resource address accessed according to the comparison result; The determining, based on the similarity index, whether a malicious program is installed in the terminal device includes: If the similarity index exceeds a second preset threshold, it is determined that a malicious program is installed in the terminal device.

4. The method according to claim 1, characterized in that: The preset traffic similarity matching rule includes a cumulative receiving and sending traffic similarity matching rule; Before performing a similarity comparison between the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on the cumulative sending and receiving traffic similarity matching rule, the method further includes: If it is determined that the communication protocol between the target process and the intranet resource address is different from the communication protocol between the target process and the external network resource address, the step of performing a similarity comparison between the intranet resource address traffic accessed by the target process and the external network resource address traffic accessed based on the cumulative similarity matching rule of the received and sent traffic is triggered.

5. The method according to claim 4, characterized in that The similarity comparison between the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on the similarity matching rule of the accumulated sending and receiving traffic is performed to determine the similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed, including: In a third target time period, using the SDP client to obtain the cumulative intranet traffic size of the target process in communicating with the intranet resource address; During the third target time period, using the SDP client to obtain the external network cumulative traffic size of the target process in communicating with the external network resource address; Obtaining a third difference between the cumulative flow size of the intranet and the cumulative flow size of the extranet within a preset time interval in the third target time period, wherein the preset time interval is any time interval within the third target time period; Comparing the third difference with a preset third difference threshold value, to determine a similarity index between a traffic trend of an intranet resource address accessed by the target process and a traffic trend of an extranet resource address accessed by the target process according to the comparison result; The determining, based on the similarity index, whether a malicious program is installed in the terminal device includes: If the similarity index includes that the third difference is smaller than the preset third difference threshold, it is determined that a malicious program is installed in the terminal device.

6. The method according to claim 1, characterized in that After determining whether a malicious program is installed in the terminal device according to the similarity index, the method further includes: If it is determined that a malicious program is installed in the terminal device, the malicious program is reported to the SDP server through the SDP client, wherein the SDP server is used to generate a security warning event based on the malicious program.

7. The method according to claim 1, characterized in that In addition to using the SDP client to obtain the intranet resource address configured in the SDP server, the method also includes: Using the SDP client to obtain a security policy configured in the SDP server, the security policy including at least one of locking user information, locking terminal devices, and blocking IP; After determining that a malicious program is installed in the terminal device, the method further includes: Acquire the terminal device association information for logging into the SDP client, wherein the terminal device association information includes user identity information, client identity information, and source IP information of the target process accessing the intranet resource address; The malicious program and the terminal device association information are reported to the SDP server through the SDP client, wherein the SDP server is used to generate a security event based on the malicious program, the terminal device association information and the security policy.

8. The method according to claim 1, characterized in that In addition to using the SDP client to obtain the intranet resource address configured in the SDP server, the method also includes: Using the SDP client to obtain the latest version of the traffic similarity matching rule configured in the SDP server; Before performing a similarity comparison between the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on a preset traffic similarity matching rule, the method further includes: Determine whether the latest version of the traffic similarity matching rule is the same as the preset traffic similarity matching rule; If they are not the same, the preset traffic similarity matching rule is updated to the latest version of the traffic similarity matching rule.

9. The method according to any one of claims 1 to 8, characterized in that Before determining whether a malicious program is installed in the terminal device according to the similarity index, the method further includes: During a fourth target time period, determining, based on the similarity index, whether a suspected malicious program is installed in the terminal device; If determining whether a malicious program is installed in the terminal device according to the similarity index includes: In a fifth target time period, it is determined whether a malicious program is installed in the terminal device according to the similarity index, wherein the fifth target time period is greater than the fourth target time period.

10. A terminal device, characterized in that: The terminal device is installed with an SDP software-defined edge client, and the terminal device includes: An acquisition unit, configured to acquire an intranet resource address configured in an SDP server by using the SDP client if an operation of logging into the SDP client is detected; The acquisition unit is further used to use the SDP client to acquire the traffic of the target process accessing the intranet resource address, where the target process is any process installed in the terminal device; The acquisition unit is further used to use the SDP client to acquire the traffic of the target process accessing the external network resource address; A determination unit, configured to perform a similarity comparison on the intranet resource address traffic accessed by the target process and the extranet resource address traffic accessed based on a preset traffic similarity matching rule, and determine a similarity index between the intranet resource address traffic trend accessed by the target process and the extranet resource address traffic trend accessed; The determination unit is further configured to determine whether a malicious program is installed in the terminal device according to the similarity index.

11. A computer device comprising a processor, characterized in that: When executing a computer program stored in the memory, the processor is used to implement the malicious program detection method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it is used to implement the malicious program detection method according to any one of claims 1 to 9.

13. A computer program product having a computer program / instructions stored thereon, characterized in that: When the computer program / instruction is executed by a processor, it is used to implement the malicious program detection method according to any one of claims 1 to 9.

Images