File detection method, device, equipment, medium and program product

Abstract

This disclosure provides a file detection method, apparatus, device, medium, and program product, which can be applied to the fields of information security, computer technology, and financial technology. The method includes: determining the file content of the file to be detected based on its filename and file path, wherein the file content includes multiple commands to be detected; performing syntactic analysis on each command to determine its command semantics; matching the command semantics against a risk command database to obtain a matching result, wherein the risk command database includes natural language descriptions of multiple risk commands; identifying the command to be detected as an alarm command if the matching result indicates a successful match between the command and a risk command; and generating a file detection result for issuing an alarm if an alarm command exists in the file to be detected, based on the risk category of the risk command that successfully matches the alarm command and the position of the alarm command in the file to be detected.

Description

Technical Field

[0001] This disclosure relates to the fields of information security, computer technology, and financial technology, and specifically to a document detection method, apparatus, device, medium, and program product. Background Technology

[0002] In modern computing environments, command files are commonly used for task automation and system administration. They contain a series of commands to perform specific operations, such as file operations, system configuration changes, and network communications. These command files can be script files, batch files, or configuration files, and they play a crucial role in the operating system. However, the automation nature of command files also introduces security risks. Some commands may be designed to perform high-risk operations, such as deleting files, modifying system settings, or executing remote code. If these high-risk operations are maliciously exploited, they can lead to data loss, system corruption, privacy breaches, or other security problems. Therefore, identifying and managing high-risk commands in command files is a critical step in ensuring system security. Related technologies typically utilize auditing tools to monitor and record all commands executed in the system, and technicians perform static analysis of the command files to identify potential security risks.

[0003] In implementing this disclosure, the inventors discovered that the prior art suffers from at least the following problems: manual analysis of documents makes it difficult to guarantee analysis efficiency and accuracy. Furthermore, because the series of commands in command documents are typically highly specialized, requiring a high level of technical expertise from technicians, this results in high labor costs. Summary of the Invention

[0004] In view of the above problems, this disclosure provides a document detection method, apparatus, device, medium and program product.

[0005] According to a first aspect of this disclosure, a file detection method is provided, comprising: determining the file content of the file to be detected based on the filename and file path of the file to be detected, wherein the file content includes multiple commands to be detected; performing syntactic analysis on each command to be detected to determine the command semantics of the command to be detected; performing matching in a risk command library based on the command semantics to obtain a matching result, wherein the risk command library includes natural language descriptions of multiple risk commands; identifying the command to be detected as an alarm command if the matching result indicates that the command to be detected matches a risk command successfully; and generating a file detection result for issuing an alarm if an alarm command exists in the file to be detected, based on the risk category of the risk command that matches the alarm command successfully and the position of the alarm command in the file to be detected.

[0006] According to embodiments of this disclosure, for each command to be detected, syntactic analysis is performed to determine the command semantics of the command to be detected, including: performing lexical analysis on the command to be detected to determine the character type of each of the multiple characters in the command to be detected; determining the character level of each character in the syntactic rules based on the character type of each of the multiple characters and the syntactic rules of the command to be detected; establishing an abstract syntax tree corresponding to the command to be detected based on the character level; and determining the command semantics of the command to be detected based on the abstract syntax tree.

[0007] According to embodiments of this disclosure, determining the command semantics of a command to be detected based on an abstract syntax tree includes: determining the characters corresponding to multiple tree nodes in the abstract syntax tree and determining the character type of the characters; determining the character semantics of the characters based on the character type and syntax rules; and determining the command semantics based on the character semantics of the characters corresponding to multiple tree nodes and the abstract syntax tree.

[0008] According to embodiments of this disclosure, determining the file content of a file to be detected based on its filename and file path includes: determining the filename and file path of the file to be detected; concatenating the filename and file path to obtain a file address parameter; obtaining the file to be detected based on the file address parameter; and reading the file to be detected, parsing its content, and determining multiple commands to be detected.

[0009] According to embodiments of this disclosure, matching is performed in a risk command database based on command semantics to obtain matching results, including: determining the natural language descriptions of multiple risk commands in the risk command database; using a natural language processing method to determine one or more synonyms of the command semantics, wherein the one or more synonyms have the same meaning as the command semantics but are expressed differently; and matching the one or more synonyms with the natural language descriptions of the multiple risk commands to determine matching results.

[0010] According to embodiments of this disclosure, a file detection result for issuing an alarm is generated based on the risk category of a risk command that successfully matches an alarm command and the location of the alarm command in the file to be detected. This includes: determining the risk category of a risk command that successfully matches an alarm command based on a risk command library; determining the location of the alarm command in the file to be detected based on the file content; determining the alarm content for the alarm command based on the risk category and location; and generating the file detection result based on the alarm content.

[0011] According to embodiments of this disclosure, the file detection method further includes: generating a file detection result to indicate that the file to be detected has passed the detection when no alarm command is present in the file to be detected; and generating and storing a result file based on the file detection result used to issue an alarm or the file detection result used to indicate that the file to be detected has passed the detection.

[0012] A second aspect of this disclosure provides a document inspection apparatus, comprising:

[0013] The content determination module is used to determine the file content of the file to be detected based on the file name and file path of the file to be detected. The file content includes multiple commands to be detected.

[0014] The semantic determination module is used to determine each command to be detected.

[0015] Perform syntactic analysis to determine the command semantics of the command to be detected;

[0016] The command matching module is used to perform matching in the risk command library based on command semantics and obtain matching results. The risk command library includes natural language descriptions of multiple risk commands.

[0017] The command determination module is used to determine the command to be detected as an alarm command when the matching result indicates that the command to be detected successfully matches a risk command; and

[0018] The result generation module is used to generate file detection results for issuing alarms when alarm commands exist in the file to be detected, based on the risk category of the risk command that successfully matches the alarm command and the position of the alarm command in the file to be detected.

[0019] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0020] A fourth aspect of this disclosure also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0021] The fifth aspect of this disclosure also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0022] According to embodiments of this disclosure, by reading the file to be detected, multiple commands to be detected are identified, and the command semantics of each command are determined. The command semantics are then matched with the natural language descriptions of multiple risk commands in a risk command library. Based on the matching results of each command, a file detection result for the file to be detected is generated. Since the high-risk command library is constructed from the natural language descriptions of risk commands, when new risk commands need to be added, there is no need to use command-line language settings; it can be flexibly expanded using natural language, lowering the technical threshold for adjusting the high-risk command library. By using syntactic analysis to determine the command semantics of the commands to be detected and then matching them with risk commands, fuzzy matching can be performed through semantics without requiring the commands to be detected to be completely identical to the risk commands, improving matching accuracy and thus enhancing the accuracy of risk command identification, ensuring system security. Attached Figure Description

[0023] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 The illustrations depict application scenarios of document detection methods, apparatus, devices, media, and program products according to embodiments of the present disclosure.

[0025] Figure 2 A flowchart illustrating a document detection method according to an embodiment of the present disclosure is shown schematically.

[0026] Figure 3 A schematic diagram of a syntax tree of a command to be detected, established according to an embodiment of the present disclosure, is shown.

[0027] Figure 4 A schematic block diagram of a document detection apparatus according to an embodiment of the present disclosure is shown; and

[0028] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a document detection method according to an embodiment of the present disclosure. Detailed Implementation

[0029] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0030] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0031] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0032] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0033] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0034] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0035] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this disclosure all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0036] Embodiments of this disclosure provide a file detection method, comprising: determining the file content of the file to be detected based on the filename and file path of the file to be detected, wherein the file content includes multiple commands to be detected; performing syntactic analysis on each command to be detected to determine the command semantics of the command to be detected; performing matching in a risk command library based on the command semantics to obtain a matching result, wherein the risk command library includes natural language descriptions of multiple risk commands; if the matching result indicates that the command to be detected matches a risk command successfully, identifying the command to be detected as an alarm command; and if an alarm command exists in the file to be detected, generating a file detection result for issuing an alarm based on the risk category of the risk command that matches the alarm command successfully and the position of the alarm command in the file to be detected.

[0037] Figure 1 The illustration shows an application scenario of a document detection method, apparatus, device, medium, and program product according to embodiments of the present disclosure.

[0038] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0039] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0040] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0041] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0042] It should be noted that the file detection method provided in this embodiment can generally be executed by server 105. Correspondingly, the file detection device provided in this embodiment can generally be located in server 105. The file detection method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the file detection device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0043] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0044] The following will be based on Figure 1 The described scene, through Figures 2-3 The document detection method of the disclosed embodiments will be described in detail.

[0045] Figure 2 A flowchart illustrating a document detection method according to an embodiment of the present disclosure is shown schematically.

[0046] like Figure 2 As shown, the file detection method in this embodiment includes operations S210 to S250.

[0047] In operation S210, based on the filename and file path of the file to be detected, the file content of the file to be detected is determined, wherein the file content includes multiple commands to be detected.

[0048] According to embodiments of this disclosure, the file to be detected may be a script file containing multiple commands.

[0049] According to embodiments of this disclosure, the filename of the file to be detected includes the main filename and extension of the file to be detected, which are separated by a delimiter, and the file path includes the path from the system root directory to the folder where the file to be detected is located.

[0050] According to the embodiments of this disclosure, since there may be two files with the same name in different folders in the system, the file to be detected cannot be uniquely determined by the file name alone. In the same folder under the same file path, there will not be two files with the same name. Therefore, the file to be detected can be determined based on the file name and file path, and further, the multiple commands to be detected included in the file content of the file to be detected can be determined.

[0051] In operation S220, for each command to be detected, a syntax analysis is performed to determine the command semantics of the command to be detected.

[0052] According to embodiments of this disclosure, for each command to be detected, syntactic analysis is performed on the command to be detected to determine the command semantics of the command to be detected. The command semantics may include the actions performed by the system after executing the command to be detected, such as deleting a file or moving a file.

[0053] In operation S230, a match is performed in the risk command library based on command semantics to obtain the matching result.

[0054] According to embodiments of this disclosure, the risk command library includes natural language descriptions of multiple risk commands. Risk commands include commands that may affect system stability or system security after execution. The natural language descriptions of the risk commands included in the risk command library can be added, deleted, or modified by the administrator.

[0055] According to embodiments of this disclosure, command semantics are matched with natural language descriptions of multiple risk commands to obtain matching results. These matching results can be used to characterize whether the command to be detected and the risk command are successfully matched. If the command semantics of the command to be detected are included in the risk command library, the matching result indicates a successful match between the command to be detected and the risk command. If the command semantics of the command to be detected are not included in the risk command library, the matching result indicates a failed match between the command to be detected and the risk command.

[0056] In operation S240, if the matching result indicates that the command to be detected successfully matches the risk command, the command to be detected is identified as an alarm command.

[0057] According to embodiments of this disclosure, when the command to be detected successfully matches a risk command, it can be determined that the command semantics of the command to be detected are the same as the command semantics of a certain risk command among multiple risk commands. The command to be detected can be identified as an alarm command, that is, if the command to be detected is executed in the system, it will affect the system stability or system security.

[0058] In operation S250, if an alarm command exists in the file to be detected, a file detection result for issuing an alarm is generated based on the risk category of the risk command that successfully matches the alarm command and the position of the alarm command in the file to be detected.

[0059] According to embodiments of this disclosure, the risk category of a risk command can be determined based on the natural language description of the risk command, the location of an alarm command in the file to be detected can be determined based on the file content, and the file detection result can include the risk category corresponding to the alarm command in the file to be detected and the location of the alarm command in the file to be detected.

[0060] According to embodiments of this disclosure, by reading the file to be detected, multiple commands to be detected are identified, and the command semantics of each command are determined. The command semantics are then matched with the natural language descriptions of multiple risk commands in a risk command library. Based on the matching results of each command, a file detection result for the file to be detected is generated. Since the high-risk command library is constructed from the natural language descriptions of risk commands, when new risk commands need to be added, there is no need to use command-line language settings; it can be flexibly expanded using natural language, lowering the technical threshold for adjusting the high-risk command library. By using syntactic analysis to determine the command semantics of the commands to be detected and then matching them with risk commands, fuzzy matching can be performed through semantics without requiring the commands to be detected to be completely identical to the risk commands, improving matching accuracy and thus enhancing the accuracy of risk command identification, ensuring system security.

[0061] According to embodiments of this disclosure, for each command to be detected, syntactic analysis is performed to determine the command semantics of the command to be detected, including: performing lexical analysis on the command to be detected to determine the character type of each of the multiple characters in the command to be detected; determining the character level of each character in the syntactic rules based on the character type of each of the multiple characters and the syntactic rules of the command to be detected; establishing an abstract syntax tree corresponding to the command to be detected based on the character level; and determining the command semantics of the command to be detected based on the abstract syntax tree.

[0062] According to embodiments of this disclosure, lexical analysis is performed on the command to be detected to determine the character type of each of the multiple characters in the command to be detected. The lexical analysis may include performing word segmentation on the command to be detected to determine the multiple characters in the command to be detected, and to determine characters of different character types such as keywords, symbols and parameters in the command to be detected.

[0063] According to embodiments of this disclosure, the priority order among multiple characters is determined based on their respective character types and the syntax rules of the command to be detected, thereby determining the character level of each character in the syntax rules. For example, if multiple characters include both delimiters and operators, and the syntax rules of the command to be detected stipulate that the compilation priority of the delimiter is lower than that of the operator, then the character level of the operator is higher than that of the delimiter.

[0064] According to embodiments of this disclosure, based on the order of multiple characters in the command to be detected and the character level of each character, the position of the tree node corresponding to each character in the abstract syntax tree is determined, thereby suggesting an abstract syntax tree corresponding to the command to be detected. Among multiple characters at the same character level, the tree node corresponding to the character that appears earlier in the command to be detected is located earlier in that level of the abstract syntax tree.

[0065] According to embodiments of this disclosure, variables or functions at different character levels are determined based on an abstract syntax tree, and the command semantics of the command to be detected are determined according to the tree structure of the abstract syntax tree.

[0066] According to embodiments of this disclosure, lexical analysis is used to determine the character type of each character in the command to be detected, so as to distinguish the characters in the command at the character level according to the syntax rules of the command. Based on the character level, the abstract syntax tree can be accurately determined, thereby accurately reflecting the syntactic structure of the command to be detected, so as to quickly determine the command semantics and improve the efficiency of file detection.

[0067] According to embodiments of this disclosure, determining the command semantics of a command to be detected based on an abstract syntax tree includes: determining the characters corresponding to multiple tree nodes in the abstract syntax tree and determining the character type of the characters; determining the character semantics of the characters based on the character type and syntax rules; and determining the command semantics based on the character semantics of the characters corresponding to multiple tree nodes and the abstract syntax tree.

[0068] According to embodiments of this disclosure, the characters corresponding to each of the multiple tree nodes in the abstract syntax tree are determined, and the character types of the multiple characters are determined. Based on the character types of the multiple characters and the syntax rules, the character semantics of the multiple characters can be determined.

[0069] According to embodiments of this disclosure, the grammatical structure of the command to be detected is determined based on an abstract syntax tree, and the semantics of the multiple characters are concatenated according to the grammatical structure based on the grammatical structure to determine the command semantics.

[0070] According to embodiments of this disclosure, based on the character semantics of the characters corresponding to the tree nodes in the abstract syntax tree, and the grammatical structure determined by the abstract syntax tree, the command semantics are accurately concatenated and determined, thereby enabling the command semantics to accurately reflect the intent of the command to be detected and improving the accuracy of risk monitoring of the command to be detected based on the command semantics.

[0071] Figure 3 A schematic diagram of a syntax tree of a command to be detected, established according to an embodiment of the present disclosure, is shown.

[0072] like Figure 3 As shown, the command to be tested is "app install --source / path / to / source --verbose update --version 1.2.3 remove --all". This command is tokenized, yielding multiple fields: app, install, --source / path / to / source, --verbose, update, --version1.2.3, remove, and --all. Based on the syntax rules of the command, these fields are analyzed to determine their priorities. App has the highest priority, followed by install, update, and remove (commands for app), --source and --verbose (options for install), --version (options for update), and --all (options for remove), all having the third highest priority. / path / to / source is a parameter for --source, and 1.2.3 is a parameter for --version, with the lowest priority. Based on the positional relationships of install, update, and remove within the command, the corresponding tree nodes can be located within the abstract syntax tree (Abstract Syntax Tree), thus obtaining the Abstract Syntax Tree.

[0073] Based on the abstract syntax tree, it can be determined that the command to be detected is used to install an app. The download location or local path of the required software package is " / path / to / source", and verbose output mode is enabled. The app is then updated to version 1.2.3. Finally, the app is deleted, along with all related items and data. This command may be used to check whether an app can be installed, run, and updated normally, and then delete the app after testing. Therefore, the command semantics of this command include: install app, update app, delete app.

[0074] According to embodiments of this disclosure, determining the file content of a file to be detected based on its filename and file path includes: determining the filename and file path of the file to be detected; concatenating the filename and file path to obtain a file address parameter; obtaining the file to be detected based on the file address parameter; and reading the file to be detected, parsing its content, and determining multiple commands to be detected.

[0075] According to embodiments of this disclosure, the filename and file path of the file to be detected are determined, and the filename is concatenated to the file path to obtain the file address parameter. Based on the file address parameter, after determining the file to be detected from the system, file extraction is performed on the file to be detected to obtain the file to be detected.

[0076] According to embodiments of this disclosure, a file to be detected is read to obtain its content, and the content is parsed to obtain multiple commands to be detected. The parsing method may include word segmentation, line splitting, etc. For example, if the multiple commands to be detected are stored line by line in the file content, the file content is split into multiple lines to obtain line content corresponding to each line, and each line content is then identified as a command to be detected.

[0077] According to embodiments of this disclosure, the file to be detected is identified, read, and analyzed based on its filename and file path, enabling accurate location and reading of the file to be detected.

[0078] According to embodiments of this disclosure, matching is performed in a risk command database based on command semantics to obtain matching results, including: determining the natural language descriptions of multiple risk commands in the risk command database; using a natural language processing method to determine one or more synonyms of the command semantics, wherein the one or more synonyms have the same meaning as the command semantics but are expressed differently; and matching the one or more synonyms with the natural language descriptions of the multiple risk commands to determine matching results.

[0079] According to embodiments of this disclosure, a risk command library is read to determine natural language descriptions of multiple risk commands stored in the risk command library.

[0080] According to embodiments of this disclosure, a natural language processing method is used to determine the command word vector of the command semantics, calculate the similarity between the command word vector and the word vectors of other words in the vocabulary, determine the several word vectors with the highest similarity, determine the target words corresponding to one or more word vectors, and determine one or more target words as the synonym semantics of the command semantics.

[0081] According to embodiments of this disclosure, one or more synonymous semantics and command semantics are matched with the natural language descriptions of multiple risk commands in a risk command library to determine the matching result. The matching process can also be completed using word vectors. For example, the word vectors of the natural language descriptions of multiple risk commands are determined, and the similarity of the obtained word vectors with the word vectors of one or more target words and the command word vectors of the command semantics is calculated respectively. If there is a word vector pair with a similarity higher than the similarity threshold among the obtained multiple similarities, the natural language description of the corresponding risk command is determined, and the matching result indicates that the matching is successful.

[0082] According to embodiments of this disclosure, a natural language processing method is used to perform synonym expansion on the command semantics, resulting in multiple synonymous semantics. The command semantics and the multiple synonymous semantics are then matched against the natural language descriptions of multiple risk commands in a risk command database to determine the matching result. Synonym expansion avoids matching failures caused by semantically identical but different descriptions between the command semantics and the natural language descriptions of risk commands, thus improving matching accuracy and enhancing the detection precision of alarm commands, thereby improving system security.

[0083] According to embodiments of this disclosure, a file detection result for issuing an alarm is generated based on the risk category of a risk command that successfully matches an alarm command and the location of the alarm command in the file to be detected. This includes: determining the risk category of a risk command that successfully matches an alarm command based on a risk command library; determining the location of the alarm command in the file to be detected based on the file content; determining the alarm content for the alarm command based on the risk category and location; and generating the file detection result based on the alarm content.

[0084] According to embodiments of this disclosure, based on the natural language description of the risk command corresponding to the successfully matched word vector pair, and based on a risk command library, the risk category of the risk command is determined. The risk category may include unauthorized access, privilege escalation, script injection, file deletion, file movement, etc. Based on the file content, the location of the alarm command within the file content is determined, such as the line number.

[0085] According to embodiments of this disclosure, the alarm content for the alarm command is determined based on the risk category and location, for example, "A deletion command exists on line 28 of file A".

[0086] According to embodiments of this disclosure, a file detection result is generated based on the alarm content of each of the alarm commands present in the file to be detected. The file detection result indicates that the file has a risk and displays the alarm content of each of the alarm commands.

[0087] According to embodiments of this disclosure, by generating alarm content and file detection results based on risk category and alarm command location, it is possible to quickly locate alarm commands in the file to be detected and preliminarily determine the risk category based on the file detection results, thereby improving the efficiency and accuracy of processing risk commands.

[0088] According to embodiments of this disclosure, the file detection method further includes: generating a file detection result to indicate that the file to be detected has passed the detection when no alarm command is present in the file to be detected; and generating and storing a result file based on the file detection result used to issue an alarm or the file detection result used to indicate that the file to be detected has passed the detection.

[0089] According to embodiments of this disclosure, when the file to be tested does not include alarm commands, a file detection result is generated to indicate that the file to be tested has passed the test, and the file to be tested can be executed normally.

[0090] According to embodiments of this disclosure, a result file is generated based on the file detection results used for issuing alarms or the file detection results used to characterize whether the file to be detected has passed the detection. The result file is then stored in the system so that the system administrator can query the result file and review and modify the alarm commands in the file to be detected.

[0091] According to embodiments of this disclosure, a result file is generated based on the file detection results and persistently stored on the system. This allows system administrators to review and modify alarm commands in the file to be detected through the result file, thereby protecting system security and improving the efficiency of alarm command processing.

[0092] Based on the above document detection method, this disclosure also provides a document detection device. The following will be combined with... Figure 4 The device is described in detail.

[0093] Figure 4 A schematic block diagram of a document detection apparatus according to an embodiment of the present disclosure is shown.

[0094] like Figure 4 As shown, the document detection device 400 of this embodiment includes a content determination module 410, a semantic determination module 420, a command matching module 430, a command determination module 440, and a result generation module 450.

[0095] The content determination module 410 is used to determine the file content of the file to be detected based on the filename and file path of the file to be detected, wherein the file content includes multiple commands to be detected. In one embodiment, the content determination module 410 can be used to perform the operation S210 described above, which will not be repeated here.

[0096] The semantic determination module 420 is used to perform syntactic analysis on each command to be detected and determine the command semantics of the command to be detected. In one embodiment, the semantic determination module 420 can be used to perform the operation S220 described above, which will not be repeated here.

[0097] The command matching module 430 is used to perform matching in the risk command library based on command semantics to obtain matching results. The risk command library includes natural language descriptions of multiple risk commands. In one embodiment, the command matching module 430 can be used to perform the operation S230 described above, which will not be repeated here.

[0098] The command determination module 440 is used to determine the command to be detected as an alarm command when the matching result indicates that the command to be detected successfully matches the risk command. In one embodiment, the command determination module 440 can be used to perform the operation S240 described above, which will not be repeated here.

[0099] The result generation module 450 is used to generate a file detection result for issuing an alarm when an alarm command exists in the file to be detected, based on the risk category of the risk command that successfully matches the alarm command and the position of the alarm command in the file to be detected. In one embodiment, the result generation module 450 can be used to perform the operation S250 described above, which will not be repeated here.

[0100] According to embodiments of this disclosure, the semantic determination module 420 includes a lexical analysis submodule, a hierarchy determination submodule, a syntax tree construction submodule, and a semantic determination submodule.

[0101] The lexical analysis submodule is used to perform lexical analysis on the command to be detected, and to determine the character type of each character in the command.

[0102] The hierarchy determination submodule is used to determine the character hierarchy of each character in the syntax rules based on the character type of each character and the syntax rules of the command to be detected.

[0103] The syntax tree construction submodule is used to build an abstract syntax tree corresponding to the command to be detected based on the character level.

[0104] The semantic determination submodule is used to determine the command semantics of the command to be detected based on the abstract syntax tree.

[0105] According to embodiments of this disclosure, the semantic determination submodule includes a character type determination unit, a character semantic determination unit, and a command semantic determination unit.

[0106] The character type determination unit is used to determine the characters corresponding to multiple tree nodes in the abstract syntax tree and to determine the character type of the characters.

[0107] The character semantic determination unit is used to determine the character semantics of a character based on its type and syntax rules.

[0108] The command semantics determination unit is used to determine the command semantics based on the character semantics and abstract syntax tree corresponding to the characters of multiple tree nodes.

[0109] According to embodiments of this disclosure, the content determination module 410 includes a file determination submodule, a parameter determination submodule, a file acquisition submodule, and a file parsing submodule.

[0110] The file determination submodule is used to determine the filename and file path of the file to be detected.

[0111] The parameter determination submodule is used to concatenate the file name and file path to obtain the file address parameter.

[0112] The file acquisition submodule is used to obtain the file to be detected based on the file address parameter.

[0113] The file parsing submodule is used to read the file to be tested, parse the file content, and determine multiple commands to be tested.

[0114] According to embodiments of this disclosure, the command matching module 430 includes a description determination submodule, a synonym substitution submodule, and a language matching submodule.

[0115] The description determination submodule is used to determine the natural language descriptions of multiple risk commands in the risk command library.

[0116] The synonym substitution submodule is used to determine one or more synonyms of the command semantics using natural language processing methods. These one or more synonyms have the same meaning as the command semantics but are expressed differently.

[0117] The language matching submodule is used to match one or more synonymous semantics with the natural language descriptions of multiple risk commands to determine the matching results.

[0118] According to embodiments of this disclosure, the result generation module 450 includes a category determination submodule, a location determination submodule, a command determination submodule, and a result generation submodule.

[0119] The category determination submodule is used to determine the risk category of risk commands that successfully match alarm commands based on the risk command library.

[0120] The location determination submodule is used to determine the location of alarm commands in the file to be detected based on the file content.

[0121] The command determination submodule is used to determine the alarm content for alarm commands based on risk category and location.

[0122] The results generation submodule is used to generate file detection results based on alarm content.

[0123] According to embodiments of this disclosure, the document detection device 400 further includes a result generation module and a document storage module.

[0124] The result generation module is used to generate file detection results indicating that the file under test has passed the test when no alarm command is present in the file under test.

[0125] The file storage module is used to generate and store result files based on file detection results used for alarms or to characterize whether a file under test has passed the detection.

[0126] According to embodiments of this disclosure, any plurality of modules among the content determination module 410, semantic determination module 420, command matching module 430, command determination module 440, and result generation module 450 may be combined into one module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the content determination module 410, semantic determination module 420, command matching module 430, command determination module 440, and result generation module 450 may be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the content determination module 410, semantic determination module 420, command matching module 430, command determination module 440, and result generation module 450 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0127] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a document detection method according to an embodiment of the present disclosure.

[0128] like Figure 5As shown, an electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0129] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 502 and / or RAM 503. It should be noted that the programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0130] According to embodiments of this disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0131] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0132] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0133] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the file detection method provided in the embodiments of this disclosure.

[0134] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0135] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0136] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0137] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0139] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0140] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A document detection method, characterized in that, The method includes: Based on the filename and file path of the file to be detected, the file content of the file to be detected is determined, wherein the file content includes multiple commands to be detected; For each of the commands to be detected, Perform syntactic analysis to determine the command semantics of the command to be detected; Based on the command semantics, a match is performed in the risk command library to obtain the matching result, wherein the risk command library includes natural language descriptions of multiple risk commands; If the matching result indicates that the command to be detected successfully matches the risk command, the command to be detected is identified as an alarm command; and If the alarm command exists in the file to be detected, a file detection result for issuing an alarm is generated based on the risk category of the risk command that successfully matches the alarm command and the position of the alarm command in the file to be detected; The step of matching based on the command semantics in the risk command database to obtain the matching result includes: Determine the natural language descriptions of the plurality of risk commands in the risk command library; Using natural language processing methods, one or more synonymous semantics of the command semantics are determined, wherein the one or more synonymous semantics have the same meaning as the command semantics but are expressed differently; and The matching result is determined by matching the one or more synonymous semantics with the natural language descriptions of the multiple risk commands.

2. The method according to claim 1, characterized in that, The step of performing syntactic analysis on each of the commands to be detected to determine the command semantics includes: Lexical analysis is performed on the command to be detected to determine the character type of each character in the command to be detected; Based on the character type of each of the multiple characters and the syntax rules of the command to be detected, the character level of each of the characters in the syntax rules is determined; Based on the character hierarchy, an abstract syntax tree corresponding to the command to be detected is established; and Based on the abstract syntax tree, the command semantics of the command to be detected are determined.

3. The method according to claim 2, characterized in that, Determining the command semantics of the command to be detected based on the abstract syntax tree includes: Determine the characters corresponding to multiple tree nodes in the abstract syntax tree, and determine the character type of the characters; Based on the character type and the syntax rules, determine the character semantics; and The command semantics are determined based on the character semantics of the characters corresponding to the multiple tree nodes and the abstract syntax tree.

4. The method according to claim 1, characterized in that, The process of determining the file content of the file to be detected based on its filename and file path includes: Determine the filename and file path of the file to be detected; The file address parameter is obtained by concatenating the file name and the file path; Based on the file address parameter, obtain the file to be detected; and Read the file to be detected, parse the file content, and determine the multiple commands to be detected.

5. The method according to claim 1, characterized in that, The process of generating file detection results for issuing alerts based on the risk category of the risk command that successfully matches the alert command and the position of the alert command in the file to be detected includes: Based on the risk command library, determine the risk category of the risk command that successfully matches the alarm command; Based on the file content, determine the location of the alarm command in the file to be detected; Based on the risk category and the location, determine the alarm content for the alarm command; and Based on the alarm content, the file detection result is generated.

6. The method according to claim 1, characterized in that, The method further includes: If the alarm command is not present in the file to be detected, a file detection result is generated to indicate that the file to be detected has passed the detection; and Based on the file detection results used for issuing alarms or the file detection results used to characterize the file to be detected as having passed the detection, a result file is generated and stored.

7. A document detection device, characterized in that, The device includes: The content determination module is used to determine the file content of the file to be detected based on the file name and file path of the file to be detected, wherein the file content includes multiple commands to be detected; The semantic determination module is used for each of the commands to be detected. Perform syntactic analysis to determine the command semantics of the command to be detected; The command matching module is used to perform matching in the risk command library based on the command semantics to obtain matching results, wherein the risk command library includes natural language descriptions of multiple risk commands; The command determination module is configured to determine the command to be detected as an alarm command when the matching result indicates that the command to be detected successfully matches the risk command; and The result generation module is used to generate a file detection result for issuing an alarm, based on the risk category of the risk command that successfully matches the alarm command and the position of the alarm command in the file to be detected, when the alarm command exists in the file to be detected. The command matching module includes: The description determination submodule is used to determine the natural language descriptions of the plurality of risk commands in the risk command library; The synonym substitution submodule is used to determine one or more synonyms of the command semantics using natural language processing methods, wherein the one or more synonyms have the same meaning as the command semantics but are expressed differently; and The language matching submodule is used to match the one or more synonymous semantics with the natural language descriptions of the multiple risk commands to determine the matching result.

8. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 6.

Images