Information security processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an information security processing method and device, electronic equipment and a storage medium. The information security processing method comprises the following steps: acquiring running behavior characteristics of a to-be-detected program and running behavior characteristics of multiple types of pre-stored malicious programs; for each type of malicious program, calculating the similarity between the operation behavior characteristics of the to-be-detected program and the operation behavior characteristics of the type of malicious program, and taking the similarity as the similarity corresponding to the type of malicious program; based on the similarities corresponding to the multiple types of malicious programs, similarity influence factors corresponding to the multiple types of malicious programs are calculated; calculating a malicious index of the to-be-detected program based on the similarities corresponding to the multiple types of malicious programs and the similarity influence factors corresponding to the multiple types of malicious programs; and executing information security processing operation corresponding to the malicious index on the to-be-detected program. In the embodiment of the invention, the accuracy of executing the information security processing operation according to the malicious index is higher.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to an information security processing method, device, electronic device and storage medium. Background Art

[0002] With the rapid popularization of the Internet, users can interact with various information through the Internet, which provides great convenience for users.

[0003] However, these information and data may be insecure in the network. For example, some malicious programs will modify the registry after running, copy themselves to the system directory, steal information, remotely inject, etc. These malicious programs will seriously endanger the security of the system. Therefore, how to identify malicious programs and perform corresponding information security processing on them is a technical problem that needs to be solved urgently. Summary of the invention

[0004] In view of the above problems, the embodiments of the present application propose an information security processing method, device, electronic device and storage medium, which can perform information security processing operations on the program to be detected according to the malicious index of the program to be detected.

[0005] According to one aspect of an embodiment of the present application, there is provided an information security processing method, the method comprising:

[0006] Obtaining the running behavior characteristics of the program to be detected and the running behavior characteristics of multiple types of malicious programs stored in advance;

[0007] For each type of malicious program, calculating the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program, as the similarity corresponding to the type of malicious program;

[0008] Based on the similarities respectively corresponding to the multiple types of malicious programs, calculating the similarity impact factors respectively corresponding to the multiple types of malicious programs;

[0009] Calculating the maliciousness index of the program to be detected based on the similarities respectively corresponding to the multiple types of malicious programs and the similarity impact factors respectively corresponding to the multiple types of malicious programs;

[0010] An information security processing operation corresponding to the malicious index is performed on the program to be detected.

[0011] Optionally, the calculating the similarity influence factors corresponding to the multiple types of malicious programs respectively based on the similarities corresponding to the multiple types of malicious programs includes: taking the similarities corresponding to the multiple types of malicious programs respectively as input of a pre-trained influence factor calculation model, and obtaining the similarity influence factors corresponding to the multiple types of malicious programs respectively output by the influence factor calculation model.

[0012] Optionally, the impact factor calculation model is trained in the following manner:

[0013] Acquire sample data, the sample data including: sample similarities corresponding to the multiple types of malicious programs, and sample similarity influencing factors corresponding to the multiple types of malicious programs;

[0014] The sample similarities corresponding to the multiple types of malicious programs are used as the input of the influence factor calculation model to be trained, and the sample similarity influence factors corresponding to the multiple types of malicious programs are used as the output target of the influence factor calculation model to be trained. The influence factor calculation model to be trained is trained, and the influence factor calculation model is obtained after the training is completed.

[0015] Optionally, the calculating the maliciousness index of the program to be detected based on the similarities respectively corresponding to the multiple types of malicious programs and the similarity impact factors respectively corresponding to the multiple types of malicious programs includes:

[0016] For each type of malicious program, multiplying the similarity corresponding to the type of malicious program by the similarity influence factor corresponding to the type of malicious program as the product corresponding to the type of malicious program;

[0017] Calculate a first sum of the products corresponding to the multiple types of malicious programs and a second sum of the similarity influence factors corresponding to the multiple types of malicious programs, and use the ratio of the first sum to the second sum as the malicious index of the program to be detected.

[0018] Optionally, after calculating the similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs, the method further includes:

[0019] For each type of malicious program, comparing the similarity impact factor corresponding to the type of malicious program with a preset impact factor range corresponding to the type of malicious program;

[0020] When the similarity impact factor corresponding to the type of malicious program is less than the lower limit of the preset impact factor range corresponding to the type of malicious program, adjusting the similarity impact factor corresponding to the type of malicious program to the lower limit of the preset impact factor range corresponding to the type of malicious program;

[0021] When the similarity impact factor corresponding to the type of malicious program is greater than an upper limit of a preset impact factor range corresponding to the type of malicious program, the similarity impact factor corresponding to the type of malicious program is adjusted to the upper limit of the preset impact factor range corresponding to the type of malicious program.

[0022] Optionally, the calculating the similarity influence factors corresponding to the multiple types of malicious programs respectively based on the similarities corresponding to the multiple types of malicious programs includes: comparing the similarities corresponding to the multiple types of malicious programs with a first preset threshold value respectively; and calculating the similarity influence factors corresponding to the multiple types of malicious programs respectively based on the similarities corresponding to the multiple types of malicious programs when at least one of the similarities corresponding to the multiple types of malicious programs is greater than the first preset threshold value.

[0023] Optionally, the performing of an information security processing operation corresponding to the malicious index on the program to be detected includes:

[0024] When the maliciousness index is less than or equal to a second preset threshold, allowing the program to be detected to continue running;

[0025] When the maliciousness index is greater than the second preset threshold and less than or equal to the third preset threshold, displaying prompt information for prompting the user to choose whether to continue running the program to be detected;

[0026] When the maliciousness index is greater than the third preset threshold, the program to be detected is prohibited from continuing to run, and the file of the program to be detected is deleted.

[0027] Optionally, the obtaining of the running behavior characteristics of the program to be detected includes: placing the program to be detected in a virtual machine for execution, and obtaining the running behavior characteristics of the program to be detected.

[0028] According to another aspect of an embodiment of the present application, there is provided an information security processing device, the device comprising:

[0029] An acquisition module, used to acquire the running behavior characteristics of the program to be detected, and the running behavior characteristics of multiple types of malicious programs stored in advance;

[0030] A first calculation module, for calculating, for each type of malicious program, a similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program, as a similarity corresponding to the type of malicious program;

[0031] A second calculation module, configured to calculate similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs;

[0032] A third calculation module, configured to calculate a maliciousness index of the program to be detected based on the similarities respectively corresponding to the multiple types of malicious programs and the similarity impact factors respectively corresponding to the multiple types of malicious programs;

[0033] A processing module is used to perform information security processing operations corresponding to the malicious index on the program to be detected.

[0034] Optionally, the second calculation module is specifically used to use the similarities corresponding to the multiple types of malicious programs as inputs of a pre-trained influence factor calculation model to obtain similarity influence factors corresponding to the multiple types of malicious programs output by the influence factor calculation model.

[0035] Optionally, the impact factor calculation model is trained in the following manner:

[0036] Acquire sample data, the sample data including: sample similarities corresponding to the multiple types of malicious programs, and sample similarity influencing factors corresponding to the multiple types of malicious programs;

[0037] The sample similarities corresponding to the multiple types of malicious programs are used as the input of the influence factor calculation model to be trained, and the sample similarity influence factors corresponding to the multiple types of malicious programs are used as the output target of the influence factor calculation model to be trained. The influence factor calculation model to be trained is trained, and the influence factor calculation model is obtained after the training is completed.

[0038] Optionally, the third calculation module is specifically used to, for each type of malicious program, take the product of the similarity corresponding to the type of malicious program and the similarity influence factor corresponding to the type of malicious program as the product corresponding to the type of malicious program; calculate a first sum of the products corresponding to the multiple types of malicious programs, and a second sum of the similarity influence factors corresponding to the multiple types of malicious programs, and take the ratio of the first sum to the second sum as the malicious index of the program to be detected.

[0039] Optionally, the device further comprises:

[0040] A first comparison module is configured to compare, for each type of malicious program, the similarity impact factor corresponding to the type of malicious program with a preset impact factor range corresponding to the type of malicious program after the second calculation module calculates the similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs;

[0041] A first adjustment module, configured to adjust the similarity impact factor corresponding to the type of malicious program to the lower limit of the preset impact factor range corresponding to the type of malicious program when the similarity impact factor corresponding to the type of malicious program is less than the lower limit of the preset impact factor range corresponding to the type of malicious program;

[0042] The second adjustment module is used to adjust the similarity impact factor corresponding to the type of malicious program to the upper limit of the preset impact factor range corresponding to the type of malicious program when the similarity impact factor corresponding to the type of malicious program is greater than the upper limit of the preset impact factor range corresponding to the type of malicious program.

[0043] Optionally, the second calculation module is specifically used to compare the similarities corresponding to the multiple types of malicious programs with a first preset threshold value respectively; when at least one of the similarities corresponding to the multiple types of malicious programs is greater than the first preset threshold value, based on the similarities corresponding to the multiple types of malicious programs respectively, calculate the similarity influence factors corresponding to the multiple types of malicious programs respectively.

[0044] Optionally, the processing module is specifically used to allow the program to be detected to continue running when the malicious index is less than or equal to a second preset threshold; when the malicious index is greater than the second preset threshold and less than or equal to a third preset threshold, display a prompt message for prompting the user to choose whether to continue running the program to be detected; when the malicious index is greater than the third preset threshold, prohibit the program to be detected from continuing to run, and delete the file of the program to be detected.

[0045] Optionally, the acquisition module is specifically used to place the program to be detected into a virtual machine for execution, and obtain the running behavior characteristics of the program to be detected.

[0046] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium; when the computer program is executed by the processor, the processor executes the information security processing method as described in any one of the above items.

[0047] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the information security processing method as described in any one of the above items.

[0048] In an embodiment of the present application, the running behavior characteristics of the program to be detected and the running behavior characteristics of multiple types of malicious programs stored in advance are obtained; for each type of malicious program, the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program is calculated as the similarity corresponding to the type of malicious program; based on the similarities corresponding to the multiple types of malicious programs, the similarity influencing factors corresponding to the multiple types of malicious programs are calculated; based on the similarities corresponding to the multiple types of malicious programs and the similarity influencing factors corresponding to the multiple types of malicious programs, the malicious index of the program to be detected is calculated; and an information security processing operation corresponding to the malicious index is performed on the program to be detected.

[0049] It can be seen that in the embodiment of the present application, not only the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of each type of malicious program is calculated, but also the similarity influence factors corresponding to each type of malicious program are further calculated, and then the malicious index of the program to be detected is comprehensively calculated based on the two factors of similarity and similarity influence factor. Compared with a single similarity, the malicious index can more accurately indicate the maliciousness of the program to be detected, so that the accuracy of performing information security processing operations according to the malicious index is higher, which can prevent the system from suffering service interruptions caused by malicious attacks or internal errors, ensure the continuous and stable operation of the business, and reduce the economic losses caused by downtime.

[0050] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solution of the embodiment of the present application, the drawings required for use in the description of the embodiment of the present application will be briefly introduced below. Obviously, the drawings described below are only some drawings of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 It is a flowchart of the steps of an information security processing method according to an embodiment of the present application;

[0053] Figure 2is a structural block diagram of an information security processing device according to an embodiment of the present application;

[0054] Figure 3 is a structural block diagram of an electronic device according to an embodiment of the present application;

[0055] Figure 4 It is a structural block diagram of a computer-readable storage medium in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0057] Reference Figure 1 , showing a step flow chart of an information security processing method according to an embodiment of the present application.

[0058] like Figure 1 As shown, the information security processing method may include the following steps:

[0059] Step 101, obtaining the running behavior characteristics of the program to be detected and the running behavior characteristics of multiple types of malicious programs stored in advance.

[0060] Malicious programs are software or code that is intentionally designed to damage, disrupt, or harm a computer system.

[0061] In the embodiment of the present application, a large number of different types of malicious programs need to be analyzed in advance, so as to obtain the running behavior characteristics of multiple types of malicious programs.

[0062] Exemplarily, first, a large number of related files of different types of malicious programs may be collected, and then, for each type of malicious program, the related files of the type of malicious program are run in a virtual machine, thereby obtaining the running behavior characteristics of the type of malicious program during runtime.

[0063] A virtual machine is a computer system that simulates complete hardware system functions through software and runs in a completely isolated environment. Virtual machine technology allows users to simulate one or more virtual computers on a physical computer. These virtual machines work exactly like real computers, including installing operating systems, installing applications, accessing network resources, etc.

[0064] Virtual machines provide a relatively safe and closed environment, where the behavior of malicious programs can be monitored and analyzed without affecting the physical machine or other systems. Even if a malicious program attempts to damage or infect a virtual machine, the user can simply reinstall the virtual machine or roll it back to a previous state to restore the cleanliness of the virtual machine. When running a malicious program in a virtual machine, its behavioral characteristics can be observed, such as file operations, network activities, registry modifications, etc. Through these behavioral characteristics, analysts can determine the nature, purpose, and possible harm of the malicious program.

[0065] In the embodiment of the present application, after the running behavior characteristics of the multiple types of malicious programs are obtained, the running behavior characteristics of the multiple types of malicious programs are stored for subsequent use in matching with the program to be detected.

[0066] In implementation, the running behavior characteristics of the multiple types of malicious programs may be stored in any applicable type of database.

[0067] Exemplarily, the storage methods of the running behavior characteristics of the multiple types of malicious programs may include, but are not limited to: table storage method, index storage method, KV (Key-Value) storage method, and the like.

[0068] If the running behavior features of the multiple types of malicious programs are stored in a table storage manner, the number of rows and columns of the running behavior features of each type of malicious program is recorded. Therefore, when querying, the running behavior features of the type of malicious program are queried according to the number of rows and columns of the running behavior features of the type of malicious program.

[0069] If the operation behavior characteristics of the plurality of types of malicious programs are stored in an index storage manner, an index for storing the operation behavior characteristics of each type of malicious program is established. Therefore, when querying, the operation behavior characteristics of the type of malicious program are queried according to the index for storing the operation behavior characteristics of the type of malicious program.

[0070] If the KV storage method is used to store the running behavior characteristics of the multiple types of malicious programs, for each type of malicious program, the identifier (such as number, name, etc.) of the type of malicious program is used as the key, and the running behavior characteristics of the type of malicious program is used as the value. Therefore, when querying, the running behavior characteristics of the type of malicious program are queried according to the identifier of the type of malicious program.

[0071] Exemplarily, the multiple types of malicious programs may include, but are not limited to: malicious registry modification programs, malicious copy to system directory programs, malicious information stealing programs, malicious remote injection programs, and the like.

[0072] Exemplarily, the running behavior characteristics of a malicious program may include, but are not limited to: modifying the registry, modifying the system directory, modifying the system files, acquiring system resources, remote injection, modifying system processes and threads, and the like.

[0073] In the embodiment of the present application, when it is necessary to process the program to be detected, the running behavior characteristics of the program to be detected can be obtained.

[0074] Exemplarily, in order to ensure the security of the system, the program to be detected may be placed in a virtual machine for execution, thereby obtaining the running behavior characteristics of the program to be detected.

[0075] Exemplarily, the running behavior characteristics of the program to be detected may include but are not limited to: modifying the registry, modifying the system directory, modifying the system files, obtaining system resources, remote injection, modifying system processes and threads, establishing network connections, resource occupation, etc.

[0076] Step 102: for each type of malicious program, calculate the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program as the similarity corresponding to the type of malicious program.

[0077] In an embodiment of the present application, after obtaining the running behavior characteristics of the program to be detected and the running behavior characteristics of multiple types of malicious programs stored in advance, for each type of malicious program, the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program is calculated, and the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program is used as the similarity corresponding to the type of malicious program, thereby obtaining the similarities corresponding to the multiple types of malicious programs respectively.

[0078] Exemplarily, for any type of malicious program, the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the malicious program of the type can be measured by calculating the cosine similarity, Euclidean distance, Manhattan distance, Chebyshev distance, Hamming distance, etc. between the running behavior characteristics of the program to be detected and the running behavior characteristics of the malicious program of the type. For the specific calculation process, those skilled in the art can process it according to actual experience, and this embodiment will not be discussed in detail here.

[0079] Exemplarily, for any type of malicious program, the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program can be calculated by a machine learning model capable of calculating similarity. In this case, in order to improve the accuracy of the similarity calculation, the similarity calculation model used to calculate the similarity between the running behavior characteristics can be trained, and then the trained similarity calculation model can be used for calculation.

[0080] Exemplarily, the process of training a similarity calculation model for calculating similarities between operating behavior features may include:

[0081] Acquire a training sample; the training sample includes an operation behavior feature of a first sample program, an operation behavior feature of a second sample program, and an annotation similarity between the operation behavior feature of the first sample program and the operation behavior feature of the second sample program;

[0082] The running behavior characteristics of the first sample program and the running behavior characteristics of the second sample program are used as inputs of the similarity calculation model to be trained, and the labeled similarity between the running behavior characteristics of the first sample program and the running behavior characteristics of the second sample program is used as the output target of the similarity calculation model to be trained. The similarity calculation model to be trained is trained to obtain a similarity calculation model after the training is completed.

[0083] Specifically, the running behavior characteristics of the first sample program and the running behavior characteristics of the second sample program are used as inputs of the similarity calculation model to be trained, and the predicted similarity between the running behavior characteristics of the first sample program and the running behavior characteristics of the second sample program output by the similarity calculation model to be trained is obtained. Based on the predicted similarity between the running behavior characteristics of the first sample program and the running behavior characteristics of the second sample program, and the labeled similarity between the running behavior characteristics of the first sample program and the running behavior characteristics of the second sample program, the loss function of the similarity calculation model to be trained is calculated. When the loss function of the similarity calculation model to be trained meets the first preset condition, it is determined that the training is completed and the similarity calculation model is obtained. When the loss function of the similarity calculation model to be trained does not meet the first preset condition, it is determined that the training is not completed. In this case, the parameters corresponding to the similarity calculation model to be trained can be updated to continue training.

[0084] Exemplarily, the similarity calculation model to be trained can be constructed using a SVM (Support Vector Machine) model, a DNN (Deep Neural Networks) model, or the like.

[0085] Exemplarily, the loss function of the similarity calculation model to be trained may adopt an absolute value loss function, a logarithmic loss function, a square loss function, an exponential loss function, a cross entropy loss function, etc. The first preset condition may be set to that the loss function of the similarity calculation model to be trained is less than a first loss threshold, etc. The specific value of the first loss threshold is not limited in this embodiment.

[0086] After the similarity calculation model is trained, the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program can be used as inputs of the similarity calculation model to obtain the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program output by the similarity calculation model.

[0087] Step 103: Calculate similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs.

[0088] In the embodiment of the present application, after calculating the similarities corresponding to the multiple types of malicious programs, similarity influence factors corresponding to the multiple types of malicious programs are calculated based on the similarities corresponding to the multiple types of malicious programs. For any type of malicious program, the similarity influence factor corresponding to the type of malicious program can be a numerical value, and the similarity influence factor can characterize the influence of the similarity corresponding to the type of malicious program on the maliciousness of the program. The higher the similarity influence factor corresponding to the type of malicious program, the greater the influence of the similarity corresponding to the type of malicious program on the maliciousness of the program.

[0089] Exemplarily, an influence factor calculation model for calculating similarity influence factors respectively corresponding to the multiple types of malicious programs may be pre-trained.

[0090] Exemplarily, the impact factor calculation model is trained in the following manner:

[0091] Acquire sample data, the sample data including: sample similarities corresponding to the multiple types of malicious programs, and sample similarity influencing factors corresponding to the multiple types of malicious programs;

[0092] The sample similarities corresponding to the multiple types of malicious programs are used as the input of the influence factor calculation model to be trained, and the sample similarity influence factors corresponding to the multiple types of malicious programs are used as the output target of the influence factor calculation model to be trained. The influence factor calculation model to be trained is trained, and the influence factor calculation model is obtained after the training is completed.

[0093] Specifically, the sample similarities corresponding to the multiple types of malicious programs are used as inputs of the impact factor calculation model to be trained, and the predicted similarity impact factors corresponding to the multiple types of malicious programs are obtained as outputs of the impact factor calculation model to be trained; the loss function of the impact factor calculation model to be trained is calculated based on the sample similarity impact factors corresponding to the multiple types of malicious programs and the predicted similarity impact factors corresponding to the multiple types of malicious programs; when the loss function of the impact factor calculation model to be trained meets the second preset condition, it is determined that the training is completed and the impact factor calculation model is obtained. When the loss function of the impact factor calculation model to be trained does not meet the second preset condition, it is determined that the training is not completed. In this case, the parameters corresponding to the impact factor calculation model to be trained can be updated to continue training.

[0094] The sample similarities corresponding to the multiple types of malicious programs are all input into the influence factor calculation model to be trained at one time, and the influence factor calculation model to be trained outputs all the predicted similarity influence factors corresponding to the multiple types of malicious programs at one time, which is a multi-input and multi-output form.

[0095] Exemplarily, the above-mentioned influencing factor calculation model to be trained can be constructed using an MLR (Multiple Linear Regression) model, a multivariate regression analysis model, an LR (Logistic Regression) model, or the like.

[0096] Exemplarily, the loss function of the influence factor calculation model to be trained may adopt an absolute value loss function, a logarithmic loss function, a square loss function, an exponential loss function, a cross entropy loss function, etc. The second preset condition may be set as the loss function of the influence factor calculation model to be trained is less than a second loss threshold, etc. The specific value of the second loss preset threshold is not limited in this embodiment.

[0097] Accordingly, based on the similarities corresponding to the multiple types of malicious programs, the process of calculating the similarity influence factors corresponding to the multiple types of malicious programs may include: using the similarities corresponding to the multiple types of malicious programs as inputs to a pre-trained influence factor calculation model, and obtaining the similarity influence factors corresponding to the multiple types of malicious programs output by the influence factor calculation model. The similarities corresponding to the multiple types of malicious programs are all input into the influence factor calculation model at one time, and the influence factor calculation model outputs the similarity influence factors corresponding to the multiple types of malicious programs at one time.

[0098] In an optional implementation, in order to solve the problem that the impact factor calculation model causes large calculation errors due to certain reasons, a reasonable preset impact factor range corresponding to each type of malicious program can be set for the type of malicious program based on actual experience and needs.

[0099] Accordingly, after calculating the similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs, the method further includes:

[0100] For each type of malicious program, comparing the similarity impact factor corresponding to the type of malicious program with a preset impact factor range corresponding to the type of malicious program;

[0101] When the similarity impact factor corresponding to the type of malicious program is less than the lower limit of the preset impact factor range corresponding to the type of malicious program, adjusting the similarity impact factor corresponding to the type of malicious program to the lower limit of the preset impact factor range corresponding to the type of malicious program;

[0102] When the similarity impact factor corresponding to the type of malicious program is greater than an upper limit of a preset impact factor range corresponding to the type of malicious program, the similarity impact factor corresponding to the type of malicious program is adjusted to the upper limit of the preset impact factor range corresponding to the type of malicious program.

[0103] The specific values ​​of the preset impact factor ranges corresponding to each type of malicious program can be set according to actual experience, and this embodiment does not impose any restrictions on this. For example, the similarity impact factor corresponding to the malicious registry modification program is expressed as Az, the similarity impact factor corresponding to the malicious copy to the system directory program is expressed as Ax, the similarity impact factor corresponding to the malicious information theft program is expressed as Ac, and the similarity impact factor corresponding to the malicious remote injection program is expressed as Av. The impact factor range corresponding to the malicious registry modification program can be set to 0.37≤Az≤0.57, the impact factor range corresponding to the malicious copy to the system directory program is 0.24≤Ax≤0.86, the impact factor range corresponding to the malicious information theft program is 0.67≤Ac≤0.88, the impact factor range corresponding to the malicious remote injection program is 0.29≤Av≤0.47, and so on.

[0104] In an optional implementation, after calculating the similarities corresponding to the multiple types of malicious programs, the similarities corresponding to the multiple types of malicious programs can be compared with a first preset threshold; when at least one of the similarities corresponding to the multiple types of malicious programs is greater than the first preset threshold, the step of calculating the similarity influence factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs is performed; when the similarities corresponding to the multiple types of malicious programs are all less than or equal to the first preset threshold, it can be considered that the program to be detected is not a malicious program, and therefore the step of calculating the similarity influence factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs and subsequent steps can be discontinued. In this way, unnecessary calculation and analysis operations can be reduced and resources can be saved.

[0105] The specific value of the first preset threshold can be set according to actual experience and needs, and this embodiment does not limit this.

[0106] Step 104: Calculate the maliciousness index of the program to be detected based on the similarities corresponding to the multiple types of malicious programs and the similarity impact factors corresponding to the multiple types of malicious programs.

[0107] After calculation in the above steps, the similarities corresponding to the multiple types of malicious programs and the similarity influence factors corresponding to the multiple types of malicious programs are obtained, and then the malicious index of the program to be detected is calculated based on the similarities corresponding to the multiple types of malicious programs and the similarity influence factors corresponding to the multiple types of malicious programs.

[0108] Exemplarily, the process of calculating the malicious index of the program to be detected based on the similarities corresponding to the multiple types of malicious programs and the similarity influence factors corresponding to the multiple types of malicious programs may include: for each type of malicious program, taking the product of the similarity corresponding to the type of malicious program and the similarity influence factor corresponding to the type of malicious program as the product corresponding to the type of malicious program; calculating a first sum of the products corresponding to the multiple types of malicious programs and a second sum of the similarity influence factors corresponding to the multiple types of malicious programs, and taking the ratio of the first sum to the second sum as the malicious index of the program to be detected.

[0109] The following examples illustrate this.

[0110] For example, the multiple types of malicious programs include the following four types of malicious programs: malicious registry modification programs, malicious copy to system directory programs, malicious information stealing programs, and malicious remote injection programs.

[0111] For each type of malicious program, the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program is calculated, so as to obtain the similarity Z corresponding to the malicious registry modification program, the similarity X corresponding to the malicious copy to the system directory program, the similarity C corresponding to the malicious information stealing program, and the similarity V corresponding to the malicious remote injection program.

[0112] Based on the similarity Z corresponding to the malicious registry modification program, the similarity X corresponding to the malicious copy to the system directory program, the similarity C corresponding to the malicious information stealing program, and the similarity V corresponding to the malicious remote injection program, the similarity influence factor Az corresponding to the malicious registry modification program, the similarity influence factor Ax corresponding to the malicious copy to the system directory program, the similarity influence factor Ac corresponding to the malicious information stealing program, and the similarity influence factor Av corresponding to the malicious remote injection program are calculated.

[0113] According to the similarity Z corresponding to the malicious registry modification program, the similarity X corresponding to the malicious copy to the system directory program, the similarity C corresponding to the malicious information stealing program, and the similarity V corresponding to the malicious remote injection program, the similarity influence factor Az corresponding to the malicious registry modification program, the similarity influence factor Ax corresponding to the malicious copy to the system directory program, the similarity influence factor Ac corresponding to the malicious information stealing program, and the similarity influence factor Av corresponding to the malicious remote injection program are dimensionlessly processed and associated to form the malicious index PW of the program to be detected, and the calculation formula is:

[0114]

[0115] Step 105: Execute an information security processing operation corresponding to the malicious index on the program to be detected.

[0116] The maliciousness index of the program to be detected can represent the maliciousness degree of the program to be detected. Therefore, based on the maliciousness index of the program to be detected, an information security processing operation corresponding to the maliciousness index can be performed on the program to be detected.

[0117] Exemplarily, the process of performing the information security processing operation corresponding to the malicious index on the program to be detected may include:

[0118] When the maliciousness index is less than or equal to a second preset threshold, allowing the program to be detected to continue running;

[0119] When the maliciousness index is greater than the second preset threshold and less than or equal to the third preset threshold, displaying prompt information for prompting the user to choose whether to continue running the program to be detected;

[0120] When the maliciousness index is greater than the third preset threshold, the program to be detected is prohibited from continuing to run, and the file of the program to be detected is deleted.

[0121] The second preset threshold is smaller than the third preset threshold. The specific values ​​of the second preset threshold and the third preset threshold can be set according to actual experience and needs, and this embodiment does not limit this.

[0122] By presetting the second preset threshold and the third preset threshold, when the malicious index PW of the program to be detected is within the second preset threshold, the program to be detected is saved and continues to run; when the malicious index PW of the program to be detected is within the third preset threshold, the program to be detected is saved but the user needs to manually confirm the running of the program to be detected; when the malicious index PW of the program to be detected exceeds the third preset threshold, all related files of the program to be detected are immediately deleted.

[0123] In the embodiment of the present application, not only the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of each type of malicious program is calculated, but also the similarity influencing factors corresponding to each type of malicious program are further calculated, and then the malicious index of the program to be detected is comprehensively calculated based on the two factors of similarity and similarity influencing factor. Therefore, compared with a single similarity, the malicious index can more accurately indicate the maliciousness of the program to be detected, so that the accuracy of performing information security processing operations according to the malicious index is higher, which can prevent the system from suffering service interruptions caused by malicious attacks or internal errors, ensure the continuous and stable operation of the business, and reduce the economic losses caused by downtime.

[0124] Reference Figure 2 , shows a structural block diagram of an information security processing device in an embodiment of the present application.

[0125] like Figure 2 As shown, the information security processing device may include the following modules:

[0126] The acquisition module 201 is used to acquire the running behavior characteristics of the program to be detected and the running behavior characteristics of multiple types of malicious programs stored in advance;

[0127] A first calculation module 202, for calculating, for each type of malicious program, a similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program, as a similarity corresponding to the type of malicious program;

[0128] A second calculation module 203, configured to calculate similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs;

[0129] A third calculation module 204, configured to calculate a maliciousness index of the program to be detected based on the similarities corresponding to the multiple types of malicious programs and the similarity impact factors corresponding to the multiple types of malicious programs;

[0130] The processing module 205 is used to perform an information security processing operation corresponding to the malicious index on the program to be detected.

[0131] Optionally, the second calculation module 203 is specifically configured to use the similarities corresponding to the multiple types of malicious programs as inputs to a pre-trained impact factor calculation model to obtain similarity impact factors corresponding to the multiple types of malicious programs output by the impact factor calculation model.

[0132] Optionally, the impact factor calculation model is trained in the following manner:

[0133] Acquire sample data, the sample data including: sample similarities corresponding to the multiple types of malicious programs, and sample similarity influencing factors corresponding to the multiple types of malicious programs;

[0134] The sample similarities corresponding to the multiple types of malicious programs are used as the input of the influence factor calculation model to be trained, and the sample similarity influence factors corresponding to the multiple types of malicious programs are used as the output target of the influence factor calculation model to be trained. The influence factor calculation model to be trained is trained, and the influence factor calculation model is obtained after the training is completed.

[0135] Optionally, the third calculation module 204 is specifically used to, for each type of malicious program, take the product of the similarity corresponding to the type of malicious program and the similarity influence factor corresponding to the type of malicious program as the product corresponding to the type of malicious program; calculate a first sum of the products corresponding to the multiple types of malicious programs, and a second sum of the similarity influence factors corresponding to the multiple types of malicious programs, and take the ratio of the first sum to the second sum as the malicious index of the program to be detected.

[0136] Optionally, the device further comprises:

[0137] A first comparison module, configured to compare, for each type of malicious program, the similarity impact factor corresponding to the type of malicious program with a preset impact factor range corresponding to the type of malicious program after the second calculation module 203 calculates the similarity impact factors corresponding to the types of malicious programs based on the similarities corresponding to the types of malicious programs;

[0138] A first adjustment module, configured to adjust the similarity impact factor corresponding to the type of malicious program to the lower limit of the preset impact factor range corresponding to the type of malicious program when the similarity impact factor corresponding to the type of malicious program is less than the lower limit of the preset impact factor range corresponding to the type of malicious program;

[0139] The second adjustment module is used to adjust the similarity impact factor corresponding to the type of malicious program to the upper limit of the preset impact factor range corresponding to the type of malicious program when the similarity impact factor corresponding to the type of malicious program is greater than the upper limit of the preset impact factor range corresponding to the type of malicious program.

[0140] Optionally, the second calculation module 203 is specifically used to compare the similarities corresponding to the multiple types of malicious programs with a first preset threshold value respectively; when at least one of the similarities corresponding to the multiple types of malicious programs is greater than the first preset threshold value, based on the similarities corresponding to the multiple types of malicious programs respectively, calculate the similarity influence factors corresponding to the multiple types of malicious programs respectively.

[0141] Optionally, the processing module 205 is specifically used to allow the program to be detected to continue running when the malicious index is less than or equal to a second preset threshold; when the malicious index is greater than the second preset threshold and less than or equal to a third preset threshold, display a prompt message for prompting the user to choose whether to continue running the program to be detected; when the malicious index is greater than the third preset threshold, prohibit the program to be detected from continuing to run, and delete the file of the program to be detected.

[0142] Optionally, the acquisition module 201 is specifically configured to place the program to be detected into a virtual machine for execution, and acquire the running behavior characteristics of the program to be detected.

[0143] In the embodiment of the present application, not only the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of each type of malicious program is calculated, but also the similarity influencing factors corresponding to each type of malicious program are further calculated, and then the malicious index of the program to be detected is comprehensively calculated based on the two factors of similarity and similarity influencing factor. Therefore, compared with a single similarity, the malicious index can more accurately indicate the maliciousness of the program to be detected, so that the accuracy of performing information security processing operations according to the malicious index is higher, which can prevent the system from suffering service interruptions caused by malicious attacks or internal errors, ensure the continuous and stable operation of the business, and reduce the economic losses caused by downtime.

[0144] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0145] In an embodiment of the present application, an electronic device is also provided. The electronic device may include a processor and a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium; when the computer program is executed by the processor, the processor executes the information security processing method of any of the above embodiments.

[0146] Reference Figure 3 , shows a structural block diagram of an electronic device according to an embodiment of the present application. Figure 3 As shown, the electronic device 30 includes a processor 301 and a computer-readable storage medium 302 , on which a computer program 3021 is stored.

[0147] The processor 301 is used to execute the computer program 3021 stored on the computer-readable storage medium 302. When executing the computer program 3021, the processor 301 implements the information security processing method of any of the above-mentioned embodiments and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0148] The processor 301 mentioned above may include but is not limited to: a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0149] The computer-readable storage medium 302 mentioned above may include but is not limited to: Read Only Memory (ROM), Random Access Memory (RAM), Compact Disc Read Only Memory (CD-ROM), Electronic Erasable Programmable Read Only Memory (EEPROM), hard disk, floppy disk, flash memory, etc.

[0150] In an embodiment of the present application, a computer-readable storage medium is also provided, on which a computer program is stored. The computer program can be executed by a processor of an electronic device. When the computer program is executed by the processor, the processor executes the information security processing method described in any of the above embodiments.

[0151] Reference Figure 4 , shows a block diagram of a computer-readable storage medium according to an embodiment of the present application. Figure 4 As shown, a computer program 401 is stored on a computer-readable storage medium 40. When the computer program 401 is executed by a processor, the processor executes the information security processing method described in any of the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0152] The various embodiments in this specification are interrelated, and each embodiment is described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0153] It should be noted that all actions to obtain signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the location and with the authorization given by the owner of the corresponding device.

[0154] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0155] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0156] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0157] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0158] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0159] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0160] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0162] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. In summary, the content of this specification should not be understood as limiting the present application.

Claims

1. An information security processing method, characterized in that: The method comprises: Obtaining the running behavior characteristics of the program to be detected and the running behavior characteristics of multiple types of malicious programs stored in advance; For each type of malicious program, calculating the similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program, as the similarity corresponding to the type of malicious program; Based on the similarities respectively corresponding to the multiple types of malicious programs, calculating the similarity impact factors respectively corresponding to the multiple types of malicious programs; Calculating the maliciousness index of the program to be detected based on the similarities respectively corresponding to the multiple types of malicious programs and the similarity impact factors respectively corresponding to the multiple types of malicious programs; An information security processing operation corresponding to the malicious index is performed on the program to be detected.

2. The method according to claim 1, characterized in that The calculating the similarity impact factors corresponding to the multiple types of malicious programs respectively based on the similarities corresponding to the multiple types of malicious programs respectively includes: The similarities respectively corresponding to the multiple types of malicious programs are used as inputs of a pre-trained influence factor calculation model to obtain similarity influence factors respectively corresponding to the multiple types of malicious programs output by the influence factor calculation model.

3. The method according to claim 2, characterized in that The impact factor calculation model is trained in the following way: Acquire sample data, the sample data including: sample similarities corresponding to the multiple types of malicious programs, and sample similarity influencing factors corresponding to the multiple types of malicious programs; The sample similarities corresponding to the multiple types of malicious programs are used as the input of the influence factor calculation model to be trained, and the sample similarity influence factors corresponding to the multiple types of malicious programs are used as the output target of the influence factor calculation model to be trained. The influence factor calculation model to be trained is trained, and the influence factor calculation model is obtained after the training is completed.

4. The method according to claim 1, characterized in that: The calculating the maliciousness index of the program to be detected based on the similarities respectively corresponding to the multiple types of malicious programs and the similarity influence factors respectively corresponding to the multiple types of malicious programs includes: For each type of malicious program, multiplying the similarity corresponding to the type of malicious program by the similarity influence factor corresponding to the type of malicious program as the product corresponding to the type of malicious program; Calculate a first sum of the products corresponding to the multiple types of malicious programs and a second sum of the similarity influence factors corresponding to the multiple types of malicious programs, and use the ratio of the first sum to the second sum as the malicious index of the program to be detected.

5. The method according to claim 1, characterized in that: After calculating the similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs, the method further includes: For each type of malicious program, comparing the similarity impact factor corresponding to the type of malicious program with a preset impact factor range corresponding to the type of malicious program; When the similarity impact factor corresponding to the type of malicious program is less than the lower limit of the preset impact factor range corresponding to the type of malicious program, adjusting the similarity impact factor corresponding to the type of malicious program to the lower limit of the preset impact factor range corresponding to the type of malicious program; When the similarity impact factor corresponding to the type of malicious program is greater than an upper limit of a preset impact factor range corresponding to the type of malicious program, the similarity impact factor corresponding to the type of malicious program is adjusted to the upper limit of the preset impact factor range corresponding to the type of malicious program.

6. The method according to claim 1, characterized in that The calculating the similarity impact factors corresponding to the multiple types of malicious programs respectively based on the similarities corresponding to the multiple types of malicious programs respectively includes: Comparing the similarities corresponding to the multiple types of malicious programs with a first preset threshold respectively; When at least one of the similarities respectively corresponding to the multiple types of malicious programs is greater than the first preset threshold, similarity influence factors respectively corresponding to the multiple types of malicious programs are calculated based on the similarities respectively corresponding to the multiple types of malicious programs.

7. The method according to claim 1, characterized in that The performing of the information security processing operation corresponding to the malicious index on the program to be detected includes: When the maliciousness index is less than or equal to a second preset threshold, allowing the program to be detected to continue running; When the maliciousness index is greater than the second preset threshold and less than or equal to the third preset threshold, displaying prompt information for prompting the user to choose whether to continue running the program to be detected; When the maliciousness index is greater than the third preset threshold, the program to be detected is prohibited from continuing to run, and the file of the program to be detected is deleted.

8. The method according to claim 1, characterized in that: The step of obtaining the running behavior characteristics of the program to be detected includes: The program to be detected is placed in a virtual machine for execution, and the running behavior characteristics of the program to be detected are obtained.

9. An information security processing device, characterized in that: The device comprises: An acquisition module, used to acquire the running behavior characteristics of the program to be detected, and the running behavior characteristics of multiple types of malicious programs stored in advance; A first calculation module, for calculating, for each type of malicious program, a similarity between the running behavior characteristics of the program to be detected and the running behavior characteristics of the type of malicious program, as a similarity corresponding to the type of malicious program; A second calculation module, configured to calculate similarity impact factors corresponding to the multiple types of malicious programs based on the similarities corresponding to the multiple types of malicious programs; A third calculation module, configured to calculate a maliciousness index of the program to be detected based on the similarities respectively corresponding to the multiple types of malicious programs and the similarity impact factors respectively corresponding to the multiple types of malicious programs; A processing module is used to perform an information security processing operation corresponding to the malicious index on the program to be detected.

10. An electronic device, characterized in that: The electronic device comprises a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program; When the computer program is executed by the processor, the processor is caused to execute the information security processing method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the information security processing method according to any one of claims 1 to 8.

Images